Edit tour

Windows Analysis Report
https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL

Overview

General Information

Sample URL:	https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL
Analysis ID:	824068
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Phishing site detected (based on image similarity)

Invalid 'forgot password' link found

HTML body contains low number of good links

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5100 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 3384 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1776,i,11119819390176411005,8890703824281984135,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 4640 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_348	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
28049.10.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 Mar 2023 12:50:46 GMTContent-Type: text/plain; charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 7a5baf6d8e239a17-FRACache-Control: public, max-age=31536000Expires: Sat, 09 Mar 2024 12:50:46 GMTVary: Accept-EncodingVia: 1.1 googleCF-Cache-Status: HITX-Content-Type-Options: nosniffServer: cloudflare

Source: chromecache_265.1.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_305.1.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_259.1.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_279.1.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml
Source: chromecache_265.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_348.1.dr	String found in binary or memory: https://1ol.za.com/busy.php
Source: chromecache_348.1.dr	String found in binary or memory: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.
Source: chromecache_285.1.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.5.0.min.js
Source: chromecache_348.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: chromecache_311.1.dr	String found in binary or memory: https://aka.ms/MathAssistantSupport?client_id=onenote_wac&platform_id=web&correlation_id=
Source: chromecache_348.1.dr	String found in binary or memory: https://app.forexliteoptions.com/core/database/xero/css/hover.css
Source: chromecache_269.1.dr	String found in binary or memory: https://apps.apple.com/in/app/microsoft-onenote/id410395246
Source: chromecache_285.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161630740453_Scripts/BrowserUls.js
Source: chromecache_285.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161630740453_Scripts/CommonDiagnostics.js
Source: chromecache_285.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161630740453_Scripts/ExternalResources/js-cookie.js
Source: chromecache_285.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161630740453_Scripts/Instrumentation.js
Source: chromecache_285.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161630740453_Scripts/LearningTools/LearningTools.js
Source: chromecache_285.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161630740453_Scripts/aria-web-telemetry-2.9.0.min.js
Source: chromecache_285.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161630740453_Scripts/pickadate.min.js
Source: chromecache_353.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details16x16.png
Source: chromecache_353.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details32x32.png
Source: chromecache_353.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details48x48.png
Source: chromecache_353.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details80x80.png
Source: chromecache_348.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: chromecache_348.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: chromecache_348.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: chromecache_348.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: chromecache_279.1.dr	String found in binary or memory: https://contentstorage.osi.office.net/images/2f4febe2cca96f7f.gif
Source: chromecache_279.1.dr	String found in binary or memory: https://contentstorage.osi.office.net/images/eb14b3fe6a1e1671.png
Source: chromecache_269.1.dr	String found in binary or memory: https://edog.onenote.com
Source: chromecache_348.1.dr, chromecache_244.1.dr, chromecache_322.1.dr, chromecache_314.1.dr, chromecache_339.1.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_348.1.dr, chromecache_244.1.dr, chromecache_322.1.dr, chromecache_314.1.dr, chromecache_339.1.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_348.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: chromecache_333.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/yellowtail/v18/OZpGg_pnoDtINPfRIlLohlvHwQ.woff2)
Source: chromecache_311.1.dr	String found in binary or memory: https://forms.office.com
Source: chromecache_311.1.dr	String found in binary or memory: https://forms.office.com/Pages/OneNoteMathAddinFunctionPage.aspx
Source: chromecache_311.1.dr	String found in binary or memory: https://forms.officeppe.com
Source: chromecache_273.1.dr, chromecache_263.1.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_247.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_338.1.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_273.1.dr, chromecache_247.1.dr, chromecache_263.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_247.1.dr, chromecache_263.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_269.1.dr	String found in binary or memory: https://hedwigtestserver.blob.core.windows.net/builds/
Source: chromecache_348.1.dr	String found in binary or memory: https://i.gyazo.com/214d89a26f0ac918a09f216a1b0f97b4.png);
Source: chromecache_311.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore/flyoutdetails/
Source: chromecache_301.1.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: chromecache_348.1.dr	String found in binary or memory: https://kit-free.fontawesome.com/releases/latest/css/free-v4-shims.min.css
Source: chromecache_348.1.dr	String found in binary or memory: https://kit-free.fontawesome.com/releases/latest/css/free.min.css
Source: chromecache_301.1.dr	String found in binary or memory: https://kit.fontawesome.com
Source: chromecache_348.1.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: chromecache_348.1.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90b
Source: chromecache_348.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: chromecache_348.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: chromecache_311.1.dr	String found in binary or memory: https://office.visualstudio.com/DefaultCollection/OC/_wiki/wikis/OC.wiki/22688/Using-Dictation-on-yo
Source: chromecache_348.1.dr	String found in binary or memory: https://outlook.office365.com/Encryption/ErrorPage.aspx?src=3&code=11&be=SN6PR04MB4014&fe=JNAP275CA0
Source: chromecache_355.1.dr, chromecache_296.1.dr, chromecache_332.1.dr	String found in binary or memory: https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE
Source: chromecache_249.1.dr, chromecache_292.1.dr	String found in binary or memory: https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
Source: chromecache_292.1.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_269.1.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net/1js/build/17953293/wdjs/OneNoteDS.box4.dll1.js.map
Source: chromecache_311.1.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net/1js/build/17953293/wdjs/OneNoteDS.box4.dll2.js.map
Source: chromecache_279.1.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net/1js/build/17953293/wdjs/OneNoteDS.js.map
Source: chromecache_348.1.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: chromecache_311.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/suggestions
Source: chromecache_279.1.dr	String found in binary or memory: https://support.office.com/article/7afcb4f3-4aa2-443a-9b08-125a5d692576
Source: chromecache_269.1.dr	String found in binary or memory: https://support.office.com/article/ec43ed03-eb3c-4a10-8d9d-e9e5433c9ed2
Source: chromecache_269.1.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/
Source: chromecache_269.1.dr	String found in binary or memory: https://uci.edog.cdn.office.net/mirrored/smartlookup/
Source: chromecache_269.1.dr	String found in binary or memory: https://uciserviceintcdnwus.blob.core.windows.net/mirrored/smartlookup/
Source: chromecache_253.1.dr	String found in binary or memory: https://ukc-onenote.officeapps.live.com/o/remoteuls.ashx
Source: chromecache_348.1.dr	String found in binary or memory: https://www.google.com/s2/favicons?domain=
Source: chromecache_269.1.dr	String found in binary or memory: https://www.onenote.com
Source: chromecache_311.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/mathassistant
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=af-ZA&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=am-ET&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ar-SA&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=as-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=az-Latn-AZ&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=be-BY&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bg-BG&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bn-BD&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bn-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bs-Latn-BA&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ca-ES&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ca-ES-valencia&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=cs-CZ&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=cy-GB&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=da-DK&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=de-DE&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=el-GR&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=en-US&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=es-ES&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=et-EE&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=eu-ES&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fa-IR&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fi-FI&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fil-PH&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fr-FR&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ga-IE&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=gd-GB&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=gl-ES&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=gu-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ha-Latn-NG&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=he-IL&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hi-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hr-HR&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hu-HU&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hy-AM&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=id-ID&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ig-NG&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=is-IS&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=it-IT&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ja-JP&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ka-GE&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=kk-KZ&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=km-KH&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=kn-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ko-KR&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=kok-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ku-Arab-IQ&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ky-KG&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=lb-LU&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=lt-LT&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=lv-LV&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mi-NZ&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mk-MK&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ml-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mn-MN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mr-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ms-MY&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mt-MT&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nb-NO&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ne-NP&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nl-NL&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nn-NO&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nso-ZA&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=or-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pa-Arab-PK&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pa-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pl-PL&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=prs-AF&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pt-BR&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pt-PT&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=quz-PE&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ro-RO&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ru-RU&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=rw-RW&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sd-Arab-PK&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=si-LK&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sk-SK&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sl-SI&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sq-AL&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sr-Cyrl-BA&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sr-Cyrl-RS&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sr-Latn-RS&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sv-SE&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sw-KE&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ta-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=te-IN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tg-Cyrl-TJ&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=th-TH&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ti-ET&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tk-TM&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tn-ZA&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tr-TR&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tt-RU&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ug-CN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=uk-UA&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ur-PK&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=uz-Latn-UZ&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=vi-VN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=wo-SN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=xh-ZA&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=yo-NG&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=zh-CN&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=zh-TW&temporaryLocalization=true
Source: chromecache_353.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=zu-ZA&temporaryLocalization=true

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg

Source: classification engine

Classification label: mal60.phis.win@29/115@30/17

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1776,i,11119819390176411005,8890703824281984135,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1776,i,11119819390176411005,8890703824281984135,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: chromecache_279.1.dr

Binary or memory string: 339,50,"AudioPlayback error: unplayable audio type ({0})",J)}return B}catch(B){}}return!1}static XQe(x){const B=x.lastIndexOf(".");if(0>B)return{returnValue:!1,extension:""};x=x.substring(B,x.length);return{returnValue:z.Soh(x),extension:x}}static x8g(){if(!z.vNb){z.vNb=new n.a(t.a.Ae());const x=".3gp .aa .aac .aax .act .aiff .amr .ape .au .awb .dct .dss .dvf .flac .gsm .iklax .ivs .m4a .m4b .m4p .mmf .mp3 .mpc .msv .ogg .oga .mogg .opus .ra .rm .raw .sln .tta .vox .wav .webm .wma .wv".split(" ");

Source: Yara match	File source: 28049.10.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_348, type: DROPPED

Source: https://ipfs.io	Matcher: Found strong image similarity, brand: Microsoft cache file: chromecache_326.1.dr			Jump to dropped file
Source: https://ipfs.io/ipfs/bafkreihn76ndhoguhulgjz52d6xmb6vsnf5ib5aqbvhxh5m75izdxy7sny	Matcher: Found strong image similarity, brand: Microsoft image: 28049.img.0.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD

Source:	Binary string: b(0);var e=b(70);class f{constructor(){this.AngleMeasurement=this.Field=0}static construct(n,t){const D=new f;D.Field=n;D.AngleMeasurement=t;return D}}Object(K.a)(f,"MathSolverSettings",null,[]);b.d(Q,"a",function(){return l});class l{}l.executionContext=null;l.YI=new e.a;l.PAb=null;l.C1c=null;l.$6b=null;l.hec=null;l.Mta=!1;l.rhc=!1;l.Utf=null;l.Ttf=null;l.Z6a=null;l.wjc=null;l.pge=!1;l.Hye=0;l.K2b=!1;l.Hyb=null;l.OUb=!1;l.RBd=null;l.Tya=null;l.APe=null;l.BPe=null;l.Slc=!1;l.Vtf=null;l.PDb=null;l.vya= source: chromecache_311.1.dr
Source:	Binary string: this.qa);r&&(this.Pdb=cp.a(r,this.htmlElement,this.Pdb));if(Ic.App.Ax&&(r=Sys.UI.DomElement.containsCssClass(this.htmlElement,"Selected"),1===Tb.ImageReader.qua(this.qa))){var M=Tb.ImageReader.TCe(this.qa);M=document.getElementById("overlay-"+M);r?(Sys.UI.DomElement.removeCssClass(this.htmlElement,"Selected"),Sys.UI.DomElement.removeCssClass(this.htmlElement,"OnlyImageSelected"),Sys.UI.DomElement.removeCssClass(this.htmlElement,"OnlyImageSelectedMove"),M&&(M.style.background="rgba(0,0,0,0.6)")):M&& source: chromecache_279.1.dr
Source:	Binary string: H.appendChild(this.pza)}dispose(){this.JJ&&(this.Uh.kb(e.a.click,this.GW,this.JJ),this.JJ=null);this.T8&&(this.xc.kb(e.a.xd,this.fX,this.T8),this.T8=null);this.u3a=this.GW=this.pdb=this.ig=this.pza=this.fX=this.xc=this.Uh=null;super.dispose()}wi(){this.fni();A.FolderReader.instance.z3a(this.qa,null,null,null,!0);return!0}Lo(H){H.Fa.keyCode!==l.a.Hl&&H.Fa.keyCode!==l.a.kP\|\|this.wi(null);return!0}cSc(){return!1}fni(){const H="url("+n.a.SH("progress16.gif")+")";Sys.UI.DomElement.addCssClass(this.pza, source: chromecache_279.1.dr
Source:	Binary string: this.UYf=!!t.AFrameworkApplication.J&&t.AFrameworkApplication.J.Z("TellMeFileSuggestionIsEnabled");this.AMf=!!t.AFrameworkApplication.ha&&t.AFrameworkApplication.ha.Ia.pDb;this.XYf=!!t.AFrameworkApplication.J&&t.AFrameworkApplication.J.Z("TellMeSeeMoreButtonIsEnabledInZeroTerm");this.uXf=!!t.AFrameworkApplication.J&&t.AFrameworkApplication.J.Z("HelpShowsTopSearchResult");this.LTf=this.rDb\|\|this.qDb;this.JTf=!!t.AFrameworkApplication.J&&t.AFrameworkApplication.J.Z("OnlineCommandSuggestionsIsEnabled"); source: chromecache_311.1.dr
Source:	Binary string: b(667),wa=b(666),Fa=b(144);b.d(Q,"a",function(){return ha});class ha extends O.a{constructor(da,aa,ka,la){super(da,aa,ka);this.HX=this.Pdb=!1;this.mFc=this.oIc=this.Kl=this.W8=this.HIc=null;this.whb="InkResizeHandleNW InkResizeHandleN InkResizeHandleNE InkResizeHandleE InkResizeHandleSE InkResizeHandleS InkResizeHandleSW InkResizeHandleW".split(" ");this.GRa="nw-resize n-resize ne-resize e-resize se-resize s-resize sw-resize w-resize".split(" ");this.Kp=Array(8);this.lva=ha.g$c()?5:0;this.gF=la;this.fa= source: chromecache_279.1.dr
Source:	Binary string: if(2!==E)return 2;if(!ta.App.ga.Zq)return 16;this.Xxa();return 32}wai(d,k,E){if(1===E)return 32;if(2!==E)return 2;this.aif();this.Mud();this.uNb.QL();this.nLc.QL();return 32}Aai(d,k,E){if(1===E)return 32;if(2!==E)return 2;this.$ud();return 32}Y8f(d,k,E){if(1===E)return 32;if(2!==E)return 2;this.gY.QL();this.uNb.QL();this.nLc.QL();this.Z8f(Jb.a.RBd,Jb.a.Vtf);return 32}$8f(d,k,E){if(1===E)return 32;if(2!==E)return 2;this.Bpi(Jb.a.PDb,Jb.a.gzb);this.a9f();return 32}c9f(d,k,E){if(1===E)return 32;if(2!== source: chromecache_311.1.dr
Source:	Binary string: B.AFrameworkApplication.ha.Ia.pDb;Ma.IsSerpletEnabled=x.a.H5();Ma.FirstOnClickTimeInMS=Math.round(window.performance.now());Ma.IsHeaderHidden=B.AFrameworkApplication.hideHeader\|\|B.AFrameworkApplication.Ix;Ma.IsSearchInHeaderHidden=B.AFrameworkApplication.k6b;void 0!==window.performance.timing&&null!==window.performance.timing&&(Ma.TimeSinceFetchStart=Math.round(Date.now()-window.performance.timing.fetchStart));Ma.IsFindWithMatchesEnabled=this.Va.fwe;Ma.HelpShowsTopSearchResult=this.Va.rDb;Ma.HelpShowsNumberOfMatches= source: chromecache_311.1.dr
Source:	Binary string: !1}getBounds(){const da=Sys.UI.DomElement.getBounds(this.fa);if(!this.Kl)return da;da.x+=this.Kl.x;da.y+=this.Kl.y;da.width=this.Kl.width;da.height=this.Kl.height;return da}NPi(){return this.j8d\|\|S.App.instance.Zy\|\|0!==S.App.fg&&1!==S.App.fg}lJi(){this.Lr&&this.Lr.DR(this.htmlElement);const da=Object(L.a)(23,this.qa);da&&(this.Pdb=I.a(da,this.htmlElement,this.Pdb))}SPa(da){var aa=this.source,ka=pa.a.iJa(aa);aa=ha.rvd(this.Yb.ownerDocument,aa,ka,null,this.Kl,null,null,da);for(ka=0;ka<aa.length;++ka){this.kh(aa[ka]); source: chromecache_279.1.dr
Source:	Binary string: {};this.pDb()&&(A.Loki=this.cZg(),A.Substrate=this.i5g());return A}lxb(A){n.a.oma(Object.assign(new D.a,{name:"Events",dataFields:[Object.assign(new m.a,{name:"Event",string:"StringsLoaded"}),Object.assign(new m.a,{name:"Status",bool:A})],durationMs:Math.round(window.performance.now())}),"TellMeWAC.")}yyh(){return l.AFrameworkApplication.J.Z("DynamicBundlesIsEnabled")?appResourceLoader.loadChunk("tellme-strings").catch(()=>{this.lxb(!1);return!1}).then(()=>{this.lxb(!0);return!0}):new Promise((A, source: chromecache_269.1.dr
Source:	Binary string: this.Ic.rAh()}DIg(){let d="<p><b>"+Jb.a.PDb[Jb.a.vya]+"</b></p><br/>";for(const k of Jb.a.l8a){let E="<p>";for(const X of k.Text)E=X.startsWith("<math")?E+("\x3c!-- [if mathML]>"+X+"<![endif] --\x3e"):E+("<span>"+X+"</span>");E+="<br/>";for(const X of k.MathML)E+="\x3c!-- [if mathML]>"+X+"<![endif] --\x3e<br/>";d+=E+"</p>"}return d}CIg(){const d={};Jb.a.YI&&0<Jb.a.YI.count&&(d.inputExpression=Jb.a.YI.K(0),d.actionName=Jb.a.wjc);return D.c(d)}isStudent(){return t.AFrameworkApplication.J.Z("OneNoteMathEducationSwitchEnabled")&& source: chromecache_311.1.dr
Source:	Binary string: this.y2f(this.GW);this.qVb(this.GW)}n9d(){this.u3a=this.Yb.createElement("li");this.Po(this.u3a);this.u3a.setAttribute(f.a.ld,f.a.qlb)}hVb(H){this.GW=this.Yb.createElement("div");this.GW.className="NavSectionGroup";H.appendChild(this.GW)}y2f(H){this.pdb=this.Yb.createElement("div");this.pdb.className="SectionGroupImage";this.ig=u.createClusteredImage(16,16,"SectionGroup_16x16x32",null,!0,Box4Intl.Box4Strings.l_SectionGroupAltText);this.pdb.appendChild(this.ig);H.appendChild(this.pdb)}qVb(H){this.pza= source: chromecache_279.1.dr
Source:	Binary string: K=b(0);var e=b(15),f=b(61),l=b(87),n=b(93),t=b(371),D=b(116),m=b(41);Q=b(506);var u=b(85),A=b(68);class F extends Q.a{constructor(H,z,x,B){super(H,z);this.T8=this.JJ=this.fX=this.pdb=this.ig=this.pza=this.GW=this.u3a=null;this.Uh=x;this.xc=B}get Bmf(){return"SectionGroupTitle"}initialize(){this.lQe();this.Rob();this.JJ=Object(m.a)(this,this.wi,"onClick");this.Uh.Aa(e.a.click,this.GW,this.JJ);this.T8=Object(m.a)(this,this.Lo,"onKeyUp");this.xc.Aa(e.a.xd,this.fX,this.T8)}lQe(){this.n9d();this.hVb(this.u3a); source: chromecache_279.1.dr
Source:	Binary string: 2))}IPh(d){this.Rc.T0(d.ErrorMessage&&""!==d.ErrorMessage?d.ErrorMessage:OneNoteIntl.OneNoteStrings.L_MathSolverError,"Math solver execute failed!");this.Ic.oAh()}NPh(d){d=d.TemplateNames;Jb.a.PDb=d;Jb.a.gzb=Object(z.a)(this,this.gzb,"onTemplateClick");d&&0<d.length?(t.AFrameworkApplication.ma.processAction(Pa.a.y2e,2),this.Ic.nCh(),-1!==Jb.a.IA&&Jb.a.jq.count>Jb.a.IA&&(this.cHe(Jb.a.jq.K(Jb.a.IA).Xx),Jb.a.IA=-1)):f.ULS.sendTraceTag(23418905,339,10,"Math solver get templates failed!")}MPh(){f.ULS.sendTraceTag(23418906, source: chromecache_311.1.dr
Source:	Binary string: R.a.construct(1,ma.K(ua),null),va.push(this.Rc.Ak(Na));ka.Task.WAA.apply(null,va).continueWith(()=>{new u.a;let xa=new u.a;new u.a;let Ta=new u.a;({W_c:xa,xhd:Ta}=this.Rc.Mrd(va));const Aa=new J.GraphTransaction(15);Aa.Ta(x.App.ga.pa.Bi.Wb);this.Hz=null;const Ba=new ca.GraphIterator;Ba.set(x.App.ga.pa.Bi.Wb);const ya=this.Vsa(Ba,!1,null,!1,this.KJb),Ra=new W.a(ya.xa.K(0),n.a.create()),rb=new I.a;ya.pf(F.a.bold,!0);this.rX.replaceTextRange(S.a.ee(ya,0),ja.a.PDb[ja.a.vya]);let Ha;Ha=S.a.ee(ya,ya.characterData.length); source: chromecache_311.1.dr
Source:	Binary string: {window.setTimeout(()=>{A(window.TellMeSubstrateTokenOverride)},750)});this.vFd();return this.bra?this.bra.getToken("Search",l.AFrameworkApplication.svf,!0):null}R5g(){this.vFd();return this.bra?this.bra.getToken("Search",this.O5g(),this.v4d):null}O5g(){return l.AFrameworkApplication.J.Da("TellMeServiceAuthEndpointForSearch")}cZg(){return Object(f.a)(this,this.bZg,"getLokiTokenPromise")}i5g(){return Object(f.a)(this,this.qHe,"getSubstrateTokenPromise")}pDb(){return!!l.AFrameworkApplication.ha&&l.AFrameworkApplication.ha.Ia.pDb}h6g(){const A= source: chromecache_269.1.dr
Source:	Binary string: X[0]){k=document.createElement("b");k.innerText=Jb.a.PDb[Jb.a.vya];this.Mh.appendChild(k);this.Mh.appendChild(document.createElement("br"));this.Mh.appendChild(document.createElement("br"));X=X[0].cloneNode(!0);for(k=!1;2<X.children.length;)X.removeChild(X.lastChild),k=!0;this.Mh.appendChild(X);k&&(X=document.createElement("div"),X.innerText=OneNoteIntl.OneNoteStrings.L_MathMoreSteps,Sys.UI.DomElement.addCssClass(X,"MathSolverMoreSteps"),this.Mh.appendChild(X));this.Mh.style.textAlign="left"}else X= source: chromecache_311.1.dr
Source:	Binary string: Fl=b(364);class cj{create(r,M){if(r.Jx){const ba=Object(J.a)(Jn.a,r);return ba&&ba.Wb===M?new Fl.a(r,M):null}return r.Evb?(r=Object(J.a)(66,M),r=Ic.App.ga.pa.nf.eZb(r),Object(J.a)(132,r)):null}}Object(n.a)(cj,"GraphSpaceViewElementFactory",null,[85]);var cm=b(647),bp=b(415),cp=b(601),mc=b(648);class tf extends Wc.a{constructor(r,M,ba,sa,Ja,cb){super(r,M,sa);this.Pdb=!1;this.hr=null;this.$V=ba;this.kF=this.SCe();this.MX=Ja;this.ZDa=cb;this.via()}OG(){this.Lr.Q3a(this.htmlElement);var r=Object(J.a)(23, source: chromecache_279.1.dr

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL HTTP/1.1Host: gtekcontrol-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc=%7Bfb7bcc10-ad49-4e02-be4a-9c3e0df6517c%7D&action=default&slrid=ebdb9da0-a036-6000-4d52-206500d6a486&originalPath=aHR0cHM6Ly9ndGVrY29udHJvbC1teS5zaGFyZXBvaW50LmNvbS86bzovZy9wZXJzb25hbC9reWxlc3Rld2FyZF9ndGVrX2NvX3VrL0VoRE1lX3RKclFKT3ZrcWNQZzMyVVh3QnkzdlBoSzdlTWktcFZpOXgzSFlVNXc_cnRpbWU9b2pCUjZXVWgyMGc&cid=8ee8aab8-024d-41e4-a77e-afc9294657c5 HTTP/1.1Host: gtekcontrol-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEyLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2RiZWQ1ZDM0NzFlNDJmY2IyMDhlOTY0YTBmNGI3YWI4ZTFhZmQ0NjI1ZjQ5NjFmMGVkYTcxNGI2NDU5ZTU0MzEsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZGJlZDVkMzQ3MWU0MmZjYjIwOGU5NjRhMGY0YjdhYjhlMWFmZDQ2MjVmNDk2MWYwZWRhNzE0YjY0NTllNTQzMSwxMzMyMjkyNjQ3OTAwMDAwMDAsMCwxMzMyMzAxMjU3OTI3MjY1NzEsMC4wLjAuMCwyNTgsYWM0ODIxZjctNmYzNC00YzU0LWI0OGQtYTdjZjdlYWJiMmY5LCwsZWJkYjlkYTAtYTAzNi02MDAwLTRkNTItMjA2NTAwZDZhNDg2LGViZGI5ZGEwLWEwMzYtNjAwMC00ZDUyLTIwNjUwMGQ2YTQ4NiwvUGNrL1p6dHpFaWwxT1ZVQ3RnRURnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCxpeXdySEVvVFRYWDdSU2oyTDlYc0FhVlJ1a1hsckFMT1NtTzZzTGl5NS9QQUNnVEtiYkF5R25tVWxGM2M3ZFZ6RER4WTRPMFFFRU5BQzdTT2xVeWZFYTRlWUkyTEZZVzBjMk5Pd0Q5TGNkR2ZhNUNIdFF1ZENaMmc2aFRJVWVJQ01wYjJkV1ZIMTlQblVmWFhUUUNsOENSTlpXS01ZVVZuMktQUlBSN3BZakNGaEIvZXpvMVBBNW1MQTA3dzRyVXA2NFZLUmRHVXhueWNwdXJMcU9qK2xtYUpuZks1OEZwbHJ4QWNiWUs2NHY5WWtwQTNxUThHdnlwQzVlSEU2S2E3cDN3VTFDZWl5cFZTNUVEZ3Q1RHdEbE42bko1Y0todTFQemIvR2lIVW1LMWFUZ3BWT21ESHJUU04xc1VqWUp5aVRxcmF5UGJsdmNyODh3ZXZkaEZ5RGc9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /me?partner=OneNoteOnline&version=10.22274.1&market=EN-US&wrapperId=suiteshell HTTP/1.1Host: amcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://ukc-onenote.officeapps.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ukc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mydata/myprofile/expressionprofile/profilephoto:UserTileStatic,UserTileSmall/MeControlMediumUserTile?ck=1&ex=24&fofoff=1&sc=1678484994920 HTTP/1.1Host: storage.live.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ukc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.2.6.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://ukc-onenote.officeapps.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ukc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc={fb7bcc10-ad49-4e02-be4a-9c3e0df6517c}&action=view&wd=target%28G-TEK%20CONTROL%20SYSTEMS%20LTD.one%7C7b9e9545-c693-43af-b301-b6f7465205f4%2FG-TEK%20CONTROL%20SYSTEMS%20LTD%7Cce29b029-a4a8-4d85-a67b-b31873044275%2F%29&wdorigin=NavigationUrl HTTP/1.1Host: gtekcontrol-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://gtekcontrol-my.sharepoint.com/personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc={fb7bcc10-ad49-4e02-be4a-9c3e0df6517c}&action=view&wd=target%28G-TEK%20CONTROL%20SYSTEMS%20LTD.one%7C7b9e9545-c693-43af-b301-b6f7465205f4%2FG-TEK%20CONTROL%20SYSTEMS%20LTD%7Cce29b029-a4a8-4d85-a67b-b31873044275%2F%29&wdorigin=NavigationUrlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEyLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2RiZWQ1ZDM0NzFlNDJmY2IyMDhlOTY0YTBmNGI3YWI4ZTFhZmQ0NjI1ZjQ5NjFmMGVkYTcxNGI2NDU5ZTU0MzEsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZGJlZDVkMzQ3MWU0MmZjYjIwOGU5NjRhMGY0YjdhYjhlMWFmZDQ2MjVmNDk2MWYwZWRhNzE0YjY0NTllNTQzMSwxMzMyMjkyNjQ3OTAwMDAwMDAsMCwxMzMyMzAxMjU3OTI3MjY1NzEsMC4wLjAuMCwyNTgsYWM0ODIxZjctNmYzNC00YzU0LWI0OGQtYTdjZjdlYWJiMmY5LCwsZWJkYjlkYTAtYTAzNi02MDAwLTRkNTItMjA2NTAwZDZhNDg2LGViZGI5ZGEwLWEwMzYtNjAwMC00ZDUyLTIwNjUwMGQ2YTQ4NiwvUGNrL1p6dHpFaWwxT1ZVQ3RnRURnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCxpeXdySEVvVFRYWDdSU2oyTDlYc0FhVlJ1a1hsckFMT1NtTzZzTGl5NS9QQUNnVEtiYkF5R25tVWxGM2M3ZFZ6RER4WTRPMFFFRU5BQzdTT2xVeWZFYTRlWUkyTEZZVzBjMk5Pd0Q5TGNkR2ZhNUNIdFF1ZENaMmc2aFRJVWVJQ01wYjJkV1ZIMTlQblVmWFhUUUNsOENSTlpXS01ZVVZuMktQUlBSN3BZakNGaEIvZXpvMVBBNW1MQTA3dzRyVXA2NFZLUmRHVXhueWNwdXJMcU9qK2xtYUpuZks1OEZwbHJ4QWNiWUs2NHY5WWtwQTNxUThHdnlwQzVlSEU2S2E3cDN3VTFDZWl5cFZTNUVEZ3Q1RHdEbE42bko1Y0todTFQemIvR2lIVW1LMWFUZ3BWT21ESHJUU04xc1VqWUp5aVRxcmF5UGJsdmNyODh3ZXZkaEZ5RGc9PTwvU1A+; OneNoteWacDataCenter=GUK3; WacDataCenter=GUK3; MSFPC=GUID=c2bd83e1dd9d41ca8d561e5f3863b545&HASH=c2bd&LV=202303&V=4&LU=1678452587593
Source: global traffic	HTTP traffic detected: GET /mydata/myprofile/expressionprofile/profilephoto:UserTileStatic,UserTileSmall/MeControlMediumUserTile?ck=1&ex=24&fofoff=1&sc=1678485014600 HTTP/1.1Host: storage.live.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ukc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mt809v HTTP/1.1Host: snip.lyConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ipfs/bafkreihn76ndhoguhulgjz52d6xmb6vsnf5ib5aqbvhxh5m75izdxy7sny HTTP/1.1Host: ipfs.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://ipfs.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://ipfs.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://ipfs.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ipfs.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ipfs.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://ipfs.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ipfs.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ipfs.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /214d89a26f0ac918a09f216a1b0f97b4.png HTTP/1.1Host: i.gyazo.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ipfs.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ipfs.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ipfs.io/ipfs/bafkreihn76ndhoguhulgjz52d6xmb6vsnf5ib5aqbvhxh5m75izdxy7snyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_290.1.dr, chromecache_287.1.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_290.1.dr, chromecache_287.1.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL	0%	Virustotal		Browse
https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://forms.officeppe.com	0%	URL Reputation	safe
https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE	0%	URL Reputation	safe
http://hammerjs.github.io/	0%	URL Reputation	safe
https://gtekcontrol-my.sharepoint.com/personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc=%7Bfb7bcc10-ad49-4e02-be4a-9c3e0df6517c%7D&action=default&slrid=ebdb9da0-a036-6000-4d52-206500d6a486&originalPath=aHR0cHM6Ly9ndGVrY29udHJvbC1teS5zaGFyZXBvaW50LmNvbS86bzovZy9wZXJzb25hbC9reWxlc3Rld2FyZF9ndGVrX2NvX3VrL0VoRE1lX3RKclFKT3ZrcWNQZzMyVVh3QnkzdlBoSzdlTWktcFZpOXgzSFlVNXc_cnRpbWU9b2pCUjZXVWgyMGc&cid=8ee8aab8-024d-41e4-a77e-afc9294657c5	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE	0%	Avira URL Cloud	safe
https://app.forexliteoptions.com/core/database/xero/css/hover.css	100%	Avira URL Cloud	phishing
https://res-dev.cdn.officeppe.net/1js/build/17953293/wdjs/OneNoteDS.js.map	0%	Avira URL Cloud	safe
https://res-dev.cdn.officeppe.net/1js/build/17953293/wdjs/OneNoteDS.box4.dll1.js.map	0%	Avira URL Cloud	safe
https://res-dev.cdn.officeppe.net/1js/build/17953293/wdjs/OneNoteDS.box4.dll2.js.map	0%	Avira URL Cloud	safe
https://1ol.za.com/busy.php	0%	Avira URL Cloud	safe
https://amcdn.msftauth.net/me?partner=OneNoteOnline&version=10.22274.1&market=EN-US&wrapperId=suiteshell	0%	Avira URL Cloud	safe
https://getbootstrap.com)	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
stackpath.bootstrapcdn.com	104.18.11.207	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
accounts.google.com	142.250.203.109	true	false	high
snip.ly	104.26.7.32	true	false	high
i.gyazo.com	104.18.9.178	true	false	high
dual-spo-0003.spo-msedge.net	13.107.136.8	true	false	unknown
maxcdn.bootstrapcdn.com	104.18.11.207	true	false	high
part-0032.t-0009.t-s1-msedge.net	13.107.228.43	true	false	unknown
i-am3p-cor003.api.p001.1drv.com	40.90.142.224	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
www.google.com	142.250.203.100	true	false	high
part-0032.t-0009.fdv2-t-msedge.net	13.107.237.60	true	false	unknown
cs1227.wpc.alphacdn.net	192.229.221.185	true	false	unknown
clients.l.google.com	142.250.203.110	true	false	high
ipfs.io	209.94.90.1	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
ka-f.fontawesome.com	unknown	unknown	false	high
augloop.office.com	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high
onenoteonline.nel.measure.office.net	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
amcdn.msftauth.net	unknown	unknown	false	unknown
www.onenote.com	unknown	unknown	false	high
gtekcontrol-my.sharepoint.com	unknown	unknown	false	unknown
messaging.engagement.office.com	unknown	unknown	false	high
onenoteonlinesync.onenote.com	unknown	unknown	false	high
kit.fontawesome.com	unknown	unknown	false	high
storage.live.com	unknown	unknown	false	high
app.forexliteoptions.com	unknown	unknown	false	unknown
kit-free.fontawesome.com	unknown	unknown	false	high
spoprod-a.akamaihd.net	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.2.6.gbl.min.js	false		high
https://gtekcontrol-my.sharepoint.com/personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc=%7Bfb7bcc10-ad49-4e02-be4a-9c3e0df6517c%7D&action=default&slrid=ebdb9da0-a036-6000-4d52-206500d6a486&originalPath=aHR0cHM6Ly9ndGVrY29udHJvbC1teS5zaGFyZXBvaW50LmNvbS86bzovZy9wZXJzb25hbC9reWxlc3Rld2FyZF9ndGVrX2NvX3VrL0VoRE1lX3RKclFKT3ZrcWNQZzMyVVh3QnkzdlBoSzdlTWktcFZpOXgzSFlVNXc_cnRpbWU9b2pCUjZXVWgyMGc&cid=8ee8aab8-024d-41e4-a77e-afc9294657c5	false	Avira URL Cloud: safe	unknown
https://snip.ly/mt809v	false		high
https://gtekcontrol-my.sharepoint.com/:o:/r/personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc=%7Bfb7bcc10-ad49-4e02-be4a-9c3e0df6517c%7D&action=view&wd=target(G-TEK%20CONTROL%20SYSTEMS%20LTD.one%7C7b9e9545-c693-43af-b301-b6f7465205f4%2FG-TEK%20CONTROL%20SYSTEMS%20LTD%7Cce29b029-a4a8-4d85-a67b-b31873044275%2F)&wdorigin=NavigationUrl	false		unknown
https://ipfs.io/favicon.ico	false		high
https://ipfs.io/ipfs/bafkreihn76ndhoguhulgjz52d6xmb6vsnf5ib5aqbvhxh5m75izdxy7sny	false		high
https://gtekcontrol-my.sharepoint.com/personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc={fb7bcc10-ad49-4e02-be4a-9c3e0df6517c}&action=view&wd=target%28G-TEK%20CONTROL%20SYSTEMS%20LTD.one%7C7b9e9545-c693-43af-b301-b6f7465205f4%2FG-TEK%20CONTROL%20SYSTEMS%20LTD%7Cce29b029-a4a8-4d85-a67b-b31873044275%2F%29&wdorigin=NavigationUrl	false		unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?rtime=ojBR6WUh20g	false		unknown
https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL	false		unknown
https://i.gyazo.com/214d89a26f0ac918a09f216a1b0f97b4.png	false		high
https://ipfs.io/ipfs/bafkreihn76ndhoguhulgjz52d6xmb6vsnf5ib5aqbvhxh5m75izdxy7sny	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://amcdn.msftauth.net/me?partner=OneNoteOnline&version=10.22274.1&market=EN-US&wrapperId=suiteshell	false	Avira URL Cloud: safe	unknown
https://gtekcontrol-my.sharepoint.com/personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc={fb7bcc10-ad49-4e02-be4a-9c3e0df6517c}&action=view&wd=target%28G-TEK%20CONTROL%20SYSTEMS%20LTD.one%7C7b9e9545-c693-43af-b301-b6f7465205f4%2FG-TEK%20CONTROL%20SYSTEMS%20LTD%7Cce29b029-a4a8-4d85-a67b-b31873044275%2F%29&wdorigin=NavigationUrl	false		unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://a.nel.cloudflare.com/report/v3?s=YbNrUc9AdbUPNcX5uqAqUimWbCFyollvLo5ZlqUorzAAxfhKCzzeR9WYc6HmldHhh0AsxboUQHxV24TuoZAFp6AxKNvRMtvzcPMpFMEXy4l9rYU4gBVKKYo9ECmkRp5moqDaORdj	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://res-dev.cdn.officeppe.net/1js/build/17953293/wdjs/OneNoteDS.box4.dll2.js.map	chromecache_311.1.dr	false	Avira URL Cloud: safe	unknown
https://res-dev.cdn.officeppe.net/1js/build/17953293/wdjs/OneNoteDS.box4.dll1.js.map	chromecache_269.1.dr	false	Avira URL Cloud: safe	unknown
https://res-dev.cdn.officeppe.net/1js/build/17953293/wdjs/OneNoteDS.js.map	chromecache_279.1.dr	false	Avira URL Cloud: safe	unknown
https://ka-f.fontawesome.com	chromecache_301.1.dr	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	chromecache_348.1.dr	false		high
https://fontawesome.com/license/free	chromecache_348.1.dr, chromecache_244.1.dr, chromecache_322.1.dr, chromecache_314.1.dr, chromecache_339.1.dr	false		high
https://aka.ms/MathAssistantSupport?client_id=onenote_wac&platform_id=web&correlation_id=	chromecache_311.1.dr	false		high
https://reactjs.org/link/react-polyfills	chromecache_292.1.dr	false		high
https://fontawesome.com	chromecache_348.1.dr, chromecache_244.1.dr, chromecache_322.1.dr, chromecache_314.1.dr, chromecache_339.1.dr	false		high
http://www.opensource.org/licenses/mit-license.php	chromecache_265.1.dr	false		high
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE	chromecache_249.1.dr, chromecache_292.1.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_247.1.dr, chromecache_263.1.dr	false		high
https://app.forexliteoptions.com/core/database/xero/css/hover.css	chromecache_348.1.dr	false	Avira URL Cloud: phishing	unknown
http://opensource.org/licenses/MIT).	chromecache_259.1.dr	false		high
https://kit.fontawesome.com/585b051251.js	chromecache_348.1.dr	false		high
https://www.onenote.com/officeaddins/mathassistant	chromecache_311.1.dr	false		high
https://1ol.za.com/busy.php	chromecache_348.1.dr	false	Avira URL Cloud: safe	unknown
https://forms.officeppe.com	chromecache_311.1.dr	false	URL Reputation: safe	unknown
https://www.onenote.com/officeaddins/meetings	chromecache_353.1.dr	false		high
https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE	chromecache_355.1.dr, chromecache_296.1.dr, chromecache_332.1.dr	false	URL Reputation: safe	unknown
https://code.jquery.com/jquery-3.1.1.min.js	chromecache_348.1.dr	false		high
https://forms.office.com	chromecache_311.1.dr	false		high
http://hammerjs.github.io/	chromecache_305.1.dr	false	URL Reputation: safe	unknown
https://substrate.office.com/search/api/v1/suggestions	chromecache_311.1.dr	false		high
https://forms.office.com/Pages/OneNoteMathAddinFunctionPage.aspx	chromecache_311.1.dr	false		high
https://getbootstrap.com/)	chromecache_247.1.dr	false		high
https://www.google.com/s2/favicons?domain=	chromecache_348.1.dr	false		high
http://fb.me/use-check-prop-types	chromecache_265.1.dr	false		high
https://edog.onenote.com	chromecache_269.1.dr	false		high
https://code.jquery.com/jquery-3.3.1.js	chromecache_348.1.dr	false		high
https://www.onenote.com	chromecache_269.1.dr	false		high
https://kit-free.fontawesome.com/releases/latest/css/free-v4-shims.min.css	chromecache_348.1.dr	false		high
https://kit.fontawesome.com	chromecache_301.1.dr	false		high
https://i.gyazo.com/214d89a26f0ac918a09f216a1b0f97b4.png);	chromecache_348.1.dr	false		high
https://outlook.office365.com/Encryption/ErrorPage.aspx?src=3&code=11&be=SN6PR04MB4014&fe=JNAP275CA0	chromecache_348.1.dr	false		high
https://getbootstrap.com)	chromecache_273.1.dr, chromecache_263.1.dr	false	Avira URL Cloud: safe	low
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.5.0.min.js	chromecache_285.1.dr	false		high
https://office.visualstudio.com/DefaultCollection/OC/_wiki/wikis/OC.wiki/22688/Using-Dictation-on-yo	chromecache_311.1.dr	false		high
https://kit-free.fontawesome.com/releases/latest/css/free.min.css	chromecache_348.1.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_273.1.dr, chromecache_247.1.dr, chromecache_263.1.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_338.1.dr	false		high
https://support.office.com/article/7afcb4f3-4aa2-443a-9b08-125a5d692576	chromecache_279.1.dr	false		high
https://support.office.com/article/ec43ed03-eb3c-4a10-8d9d-e9e5433c9ed2	chromecache_269.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.7.32	snip.ly	United States	13335	CLOUDFLARENETUS	false
13.107.136.8	dual-spo-0003.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
13.107.228.43	part-0032.t-0009.t-s1-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
40.90.142.224	i-am3p-cor003.api.p001.1drv.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
209.94.90.1	ipfs.io	United States	40680	PROTOCOLUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.203.100	www.google.com	United States	15169	GOOGLEUS	false
104.18.9.178	i.gyazo.com	United States	13335	CLOUDFLARENETUS	false
104.18.11.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.229.221.185	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
13.107.237.60	part-0032.t-0009.fdv2-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	824068
Start date and time:	2023-03-10 13:48:36 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@29/115@30/17
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://snip.ly/mt809v

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32012)
Category:	downloaded
Size (bytes):	69597
Entropy (8bit):	5.369216080582935
Encrypted:	false
SSDEEP:	1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT
MD5:	5F48FC77CAC90C4778FA24EC9C57F37D
SHA1:	9E89D1515BC4C371B86F4CB1002FD8E377C1829F
SHA-256:	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
SHA-512:	CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-3.2.1.slim.min.js
Preview:	/! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2023 13:49:37.834276915 CET	59324	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:37.836524963 CET	59014	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:37.840086937 CET	61626	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:37.855504036 CET	53	59014	8.8.8.8	192.168.2.3
Mar 10, 2023 13:49:37.867388010 CET	53	61626	8.8.8.8	192.168.2.3
Mar 10, 2023 13:49:39.107455015 CET	49977	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:39.134871006 CET	53	49977	8.8.8.8	192.168.2.3
Mar 10, 2023 13:49:41.015567064 CET	53975	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:46.125009060 CET	56042	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:54.276520967 CET	65017	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:54.353101015 CET	53466	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:55.588624001 CET	53623	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:55.611789942 CET	61416	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:55.750617981 CET	65196	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:55.807723999 CET	58708	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:49:56.101847887 CET	63562	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:20.689932108 CET	64967	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:35.482182026 CET	51105	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:35.502935886 CET	53	51105	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:36.547141075 CET	55244	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:36.563806057 CET	53	55244	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:38.403328896 CET	60816	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:38.411694050 CET	62424	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:38.432836056 CET	53	62424	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:38.457648993 CET	55390	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:38.459595919 CET	58912	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:38.512676001 CET	50622	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:38.832976103 CET	64376	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:38.853152037 CET	52110	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:38.868386984 CET	63687	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:38.875684023 CET	53	52110	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:38.888755083 CET	53	63687	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:39.163342953 CET	52741	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:39.182385921 CET	53	52741	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:39.589348078 CET	50622	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:40.605071068 CET	50622	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:42.613835096 CET	53	50622	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:42.768255949 CET	53	50622	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:44.581249952 CET	50622	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:44.643855095 CET	53	50622	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:45.820452929 CET	61359	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:45.840977907 CET	53	61359	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:45.894964933 CET	58480	53	192.168.2.3	8.8.8.8
Mar 10, 2023 13:50:45.912282944 CET	53	58480	8.8.8.8	192.168.2.3
Mar 10, 2023 13:50:47.604568005 CET	53	50622	8.8.8.8	192.168.2.3

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 10, 2023 13:50:44.644022942 CET	192.168.2.3	8.8.8.8	cffb	(Port unreachable)	Destination Unreachable
Mar 10, 2023 13:50:47.604650021 CET	192.168.2.3	8.8.8.8	cffb	(Port unreachable)	Destination Unreachable

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:49:39 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg
2023-03-10 12:49:39 UTC	0	OUT	Data Raw: 20 Data Ascii:
2023-03-10 12:49:39 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Mar 2023 12:49:39 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Content-Security-Policy: script-src 'report-sample' 'nonce-WOQI-AQk9xE57mLxXoZDGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-03-10 12:49:39 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-03-10 12:49:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:49:39 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:49:39 UTC	2	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-jrlB1tdjQFmetb_DzylCOw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Mar 2023 12:49:39 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5912 X-Daystart: 17379 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-03-10 12:49:39 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 39 31 32 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 37 33 37 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5912" elapsed_seconds="17379"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-03-10 12:49:39 UTC	3	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-03-10 12:49:39 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:50:37 UTC	289	OUT	GET /ipfs/bafkreihn76ndhoguhulgjz52d6xmb6vsnf5ib5aqbvhxh5m75izdxy7sny HTTP/1.1 Host: ipfs.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:50:37 UTC	290	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 10 Mar 2023 12:50:37 GMT Content-Type: text/html Content-Length: 100567 Connection: close Vary: Accept-Encoding Access-Control-Allow-Methods: GET Cache-Control: public, max-age=29030400, immutable Etag: "bafkreihn76ndhoguhulgjz52d6xmb6vsnf5ib5aqbvhxh5m75izdxy7sny" X-Ipfs-Gateway-Host: ipfs-bank15-fr2 X-Ipfs-Path: /ipfs/bafkreihn76ndhoguhulgjz52d6xmb6vsnf5ib5aqbvhxh5m75izdxy7sny X-Ipfs-Roots: bafkreihn76ndhoguhulgjz52d6xmb6vsnf5ib5aqbvhxh5m75izdxy7sny X-IPFS-POP: ipfs-bank15-fr2 Timing-Allow-Origin: * X-Ipfs-DataSize: 100567 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output Access-Control-Expose-Headers: Content-Range, X-Chunked-Output, X-Stream-Output X-IPFS-LB-POP: gateway-bank3-fr2 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Proxy-Cache: HIT Accept-Ranges: bytes
2023-03-10 12:50:37 UTC	291	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 4f 66 66 69 63 65 33 36 35 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 32 2e 32 2e 34 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 6a 71 75 65 72 79 2e 63 6f 6d 2f 6a 71 75 65 72 79 2d 33 2e 31 2e 31 2e 6d 69 6e 2e 6a 73 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 6a 71 75 65 72 79 2e 63 6f 6d 2f 6a 71 75 65 72 79 2d 33 2e 33 2e 31 Data Ascii: <html lang="en"><head><title>Office365</title><script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script><script src="https://code.jquery.com/jquery-3.1.1.min.js"> <script src="https://code.jquery.com/jquery-3.3.1
2023-03-10 12:50:37 UTC	306	IN	Data Raw: 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 63 35 22 7d 2e 66 61 2e 66 61 2d 66 69 6c 65 2d 70 68 6f 74 6f 2d 6f 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 46 72 65 65 22 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 66 61 2e 66 61 2d 66 69 6c 65 2d 70 68 6f 74 6f 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 63 35 22 7d 2e 66 61 2e 66 61 2d 66 69 6c 65 2d 70 69 63 74 75 72 65 2d 6f 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 46 72 65 65 22 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 66 61 2e 66 61 2d 66 69 6c 65 2d 70 69 63 74 75 72 65 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 63 35 22 7d 2e 66 Data Ascii: before{content:"\f1c5"}.fa.fa-file-photo-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-file-photo-o:before{content:"\f1c5"}.fa.fa-file-picture-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-file-picture-o:before{content:"\f1c5"}.f
2023-03-10 12:50:37 UTC	322	IN	Data Raw: 6e 74 65 6e 74 3a 22 5c 66 31 37 62 22 7d 2e 66 61 2d 61 6e 67 65 6c 6c 69 73 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 30 39 22 7d 2e 66 61 2d 61 6e 67 6c 65 2d 64 6f 75 62 6c 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 30 33 22 7d 2e 66 61 2d 61 6e 67 6c 65 2d 64 6f 75 62 6c 65 2d 6c 65 66 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 30 30 22 7d 2e 66 61 2d 61 6e 67 6c 65 2d 64 6f 75 62 6c 65 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 30 31 22 7d 2e 66 61 2d 61 6e 67 6c 65 2d 64 6f 75 62 6c 65 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 30 32 22 7d 2e 66 61 2d 61 6e 67 6c 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e Data Ascii: ntent:"\f17b"}.fa-angellist:before{content:"\f209"}.fa-angle-double-down:before{content:"\f103"}.fa-angle-double-left:before{content:"\f100"}.fa-angle-double-right:before{content:"\f101"}.fa-angle-double-up:before{content:"\f102"}.fa-angle-down:before{con
2023-03-10 12:50:37 UTC	338	IN	Data Raw: 6f 6e 74 65 6e 74 3a 22 5c 66 30 66 62 22 7d 2e 66 61 2d 66 69 67 6d 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 37 39 39 22 7d 2e 66 61 2d 66 69 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 35 62 22 7d 2e 66 61 2d 66 69 6c 65 2d 61 6c 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 35 63 22 7d 2e 66 61 2d 66 69 6c 65 2d 61 72 63 68 69 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 63 36 22 7d 2e 66 61 2d 66 69 6c 65 2d 61 75 64 69 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 63 37 22 7d 2e 66 61 2d 66 69 6c 65 2d 63 6f 64 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 63 39 22 7d 2e 66 61 2d 66 69 6c 65 2d 63 6f 6e 74 72 61 63 74 3a 62 65 66 6f 72 65 Data Ascii: ontent:"\f0fb"}.fa-figma:before{content:"\f799"}.fa-file:before{content:"\f15b"}.fa-file-alt:before{content:"\f15c"}.fa-file-archive:before{content:"\f1c6"}.fa-file-audio:before{content:"\f1c7"}.fa-file-code:before{content:"\f1c9"}.fa-file-contract:before
2023-03-10 12:50:37 UTC	354	IN	Data Raw: 66 30 33 62 22 7d 2e 66 61 2d 70 61 67 65 34 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 64 37 22 7d 2e 66 61 2d 70 61 67 65 6c 69 6e 65 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 38 63 22 7d 2e 66 61 2d 70 61 67 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 38 31 35 22 7d 2e 66 61 2d 70 61 69 6e 74 2d 62 72 75 73 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 66 63 22 7d 2e 66 61 2d 70 61 69 6e 74 2d 72 6f 6c 6c 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 61 61 22 7d 2e 66 61 2d 70 61 6c 65 74 74 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 35 33 66 22 7d 2e 66 61 2d 70 61 6c 66 65 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 64 38 Data Ascii: f03b"}.fa-page4:before{content:"\f3d7"}.fa-pagelines:before{content:"\f18c"}.fa-pager:before{content:"\f815"}.fa-paint-brush:before{content:"\f1fc"}.fa-paint-roller:before{content:"\f5aa"}.fa-palette:before{content:"\f53f"}.fa-palfed:before{content:"\f3d8
2023-03-10 12:50:37 UTC	370	IN	Data Raw: 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 30 36 22 7d 2e 66 61 2d 75 73 65 72 2d 61 6c 74 2d 73 6c 61 73 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 66 61 22 7d 2e 66 61 2d 75 73 65 72 2d 61 73 74 72 6f 6e 61 75 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 66 62 22 7d 2e 66 61 2d 75 73 65 72 2d 63 68 65 63 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 66 63 22 7d 2e 66 61 2d 75 73 65 72 2d 63 69 72 63 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 62 64 22 7d 2e 66 61 2d 75 73 65 72 2d 63 6c 6f 63 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 66 64 22 7d 2e 66 61 2d 75 73 65 72 2d 63 6f 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 66 65 22 7d 2e 66 61 Data Ascii: {content:"\f406"}.fa-user-alt-slash:before{content:"\f4fa"}.fa-user-astronaut:before{content:"\f4fb"}.fa-user-check:before{content:"\f4fc"}.fa-user-circle:before{content:"\f2bd"}.fa-user-clock:before{content:"\f4fd"}.fa-user-cog:before{content:"\f4fe"}.fa
2023-03-10 12:50:37 UTC	386	IN	Data Raw: 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 72 65 73 70 6f 6e 73 65 5b 27 72 65 64 69 72 65 63 74 5f 6c 69 6e 6b 27 5d 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 2f 2f 6f 75 74 6c 6f 6f 6b 2e 6f 66 66 69 63 65 33 36 35 2e 63 6f 6d 2f 45 6e 63 72 79 70 74 69 6f 6e 2f 45 72 72 6f 72 50 61 67 65 2e 61 73 70 78 3f 73 72 63 3d 33 26 63 6f 64 65 3d 31 31 26 62 65 3d 53 4e 36 50 52 30 34 4d 42 34 30 31 34 26 66 65 3d 4a 4e 41 50 32 37 35 43 41 30 30 34 30 2e 5a 41 46 50 32 37 35 2e 50 52 4f 44 2e 4f 55 54 4c 4f 4f 67 4b 2e 43 4f 4d 26 6c 6f 63 3d 65 6e 2d 55 53 26 69 74 65 6d 49 44 3d 45 34 45 5f 4d 5f 65 39 64 66 31 35 Data Ascii: ndow.location.replace(response['redirect_link']); window.location.replace("https://outlook.office365.com/Encryption/ErrorPage.aspx?src=3&code=11&be=SN6PR04MB4014&fe=JNAP275CA0040.ZAFP275.PROD.OUTLOOgK.COM&loc=en-US&itemID=E4E_M_e9df15

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Chrome Cache Entry: 252

Chrome Cache Entry: 253

Chrome Cache Entry: 254

Chrome Cache Entry: 255

Chrome Cache Entry: 256

Chrome Cache Entry: 257

Chrome Cache Entry: 258

Chrome Cache Entry: 259

Chrome Cache Entry: 260

Chrome Cache Entry: 261

Chrome Cache Entry: 262

Chrome Cache Entry: 263

Chrome Cache Entry: 264

Chrome Cache Entry: 265

Chrome Cache Entry: 266

Chrome Cache Entry: 267

Windows Analysis Report
https://gtekcontrol-my.sharepoint.com/:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:50:39 UTC	533	OUT	GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" Origin: https://ipfs.io sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ipfs.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:50:39 UTC	634	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 12:50:39 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fa9-4af4" Last-Modified: Mon, 04 May 2020 16:15:37 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1876039 Expires: Wed, 28 Feb 2024 12:50:39 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YbNrUc9AdbUPNcX5uqAqUimWbCFyollvLo5ZlqUorzAAxfhKCzzeR9WYc6HmldHhh0AsxboUQHxV24TuoZAFp6AxKNvRMtvzcPMpFMEXy4l9rYU4gBVKKYo9ECmkRp5moqDaORdj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 7a5baf42395a92ad-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 12:50:39 UTC	635	IN	Data Raw: 34 61 66 34 0d 0a 2f 2a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 46 65 64 65 72 69 63 6f 20 5a 69 76 6f 6c 6f 20 32 30 31 37 0a 20 44 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 28 6c 69 63 65 6e 73 65 20 74 65 72 6d 73 20 61 72 65 20 61 74 20 68 74 74 70 3a 2f 2f 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 4d 49 54 29 2e 0a 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 27 6f 62 6a 65 63 74 27 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 27 75 6e 64 65 66 69 6e 65 64 27 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 27 66 75 6e 63 74 69 6f 6e 27 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 Data Ascii: 4af4/* Copyright (C) Federico Zivolo 2017 Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT). */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&
2023-03-10 12:50:39 UTC	635	IN	Data Raw: 69 6f 6e 20 74 28 65 2c 74 29 7b 69 66 28 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 5b 5d 3b 76 61 72 20 6f 3d 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 74 3f 6f 5b 74 5d 3a 6f 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 27 48 54 4d 4c 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 3f 65 3a 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 65 2e 68 6f 73 74 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 73 77 69 74 63 68 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7b 63 61 73 65 27 48 54 4d 4c 27 3a 63 61 73 65 27 42 4f 44 59 27 3a 72 65 74 75 72 6e 20 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 62 6f Data Ascii: ion t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.bo
2023-03-10 12:50:39 UTC	636	IN	Data Raw: 5d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 2c 74 29 7b 76 61 72 20 6f 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 61 28 74 2c 27 74 6f 70 27 29 2c 6e 3d 61 28 74 2c 27 6c 65 66 74 27 29 2c 72 3d 6f 3f 2d 31 3a 31 3b 72 65 74 75 72 6e 20 65 2e 74 6f 70 2b 3d 69 2a 72 2c 65 2e 62 6f 74 74 6f 6d 2b 3d 69 2a 72 2c 65 2e 6c 65 66 74 2b 3d 6e 2a 72 2c 65 2e 72 69 67 68 74 2b 3d 6e 2a 72 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 29 7b 76 61 72 20 6f 3d 27 78 27 3d 3d 3d 74 3f 27 4c 65 66 74 27 3a 27 54 6f 70 27 2c 69 3d 27 4c 65 66 74 27 3d 3d 6f 3f 27 52 69 67 68 74 27 3a 27 42 6f 74 74 6f 6d 27 3b 72 65 74 75 72 6e 20 70 Data Ascii: ]}function l(e,t){var o=2<arguments.length&&void 0!==arguments[2]&&arguments[2],i=a(t,'top'),n=a(t,'left'),r=o?-1:1;return e.top+=ir,e.bottom+=ir,e.left+=nr,e.right+=nr,e}function f(e,t){var o='x'===t?'Left':'Top',i='Left'==o?'Right':'Bottom';return p
2023-03-10 12:50:39 UTC	638	IN	Data Raw: 57 69 64 74 68 2c 31 30 29 2c 68 3d 63 28 7b 74 6f 70 3a 70 2e 74 6f 70 2d 73 2e 74 6f 70 2d 66 2c 6c 65 66 74 3a 70 2e 6c 65 66 74 2d 73 2e 6c 65 66 74 2d 6d 2c 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 29 3b 69 66 28 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 30 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 30 2c 21 69 26 26 72 29 7b 76 61 72 20 75 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 54 6f 70 2c 31 30 29 2c 62 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 4c 65 66 74 2c 31 30 29 3b 68 2e 74 6f 70 2d 3d 66 2d 75 2c 68 2e 62 6f 74 74 6f 6d 2d 3d 66 2d 75 2c 68 2e 6c 65 66 74 2d 3d 6d 2d 62 2c 68 2e 72 69 67 68 74 2d 3d 6d 2d 62 2c 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 75 2c 68 2e 6d Data Ascii: Width,10),h=c({top:p.top-s.top-f,left:p.left-s.left-m,width:p.width,height:p.height});if(h.marginTop=0,h.marginLeft=0,!i&&r){var u=parseFloat(a.marginTop,10),b=parseFloat(a.marginLeft,10);h.top-=f-u,h.bottom-=f-u,h.left-=m-b,h.right-=m-b,h.marginTop=u,h.m
2023-03-10 12:50:39 UTC	639	IN	Data Raw: 72 69 67 68 74 2d 74 2e 72 69 67 68 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 2c 62 6f 74 74 6f 6d 3a 7b 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 62 6f 74 74 6f 6d 2d 74 2e 62 6f 74 74 6f 6d 7d 2c 6c 65 66 74 3a 7b 77 69 64 74 68 3a 74 2e 6c 65 66 74 2d 70 2e 6c 65 66 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 7d 2c 64 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 73 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 73 65 28 7b 6b 65 79 3a 65 7d 2c 73 5b 65 5d 2c 7b 61 72 65 61 3a 45 28 73 5b 65 5d 29 7d 29 7d 29 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 61 72 65 61 2d 65 2e 61 72 65 61 7d 29 2c 61 3d 64 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 Data Ascii: right-t.right,height:p.height},bottom:{width:p.width,height:p.bottom-t.bottom},left:{width:t.left-p.left,height:p.height}},d=Object.keys(s).map(function(e){return se({key:e},s[e],{area:E(s[e])})}).sort(function(e,t){return t.area-e.area}),a=d.filter(funct
2023-03-10 12:50:39 UTC	640	IN	Data Raw: 75 6e 63 74 69 6f 6e 27 5d 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 6d 6f 64 69 66 69 65 72 2e 66 75 6e 63 74 69 6f 6e 60 20 69 73 20 64 65 70 72 65 63 61 74 65 64 2c 20 75 73 65 20 60 6d 6f 64 69 66 69 65 72 2e 66 6e 60 21 27 29 3b 76 61 72 20 69 3d 74 5b 27 66 75 6e 63 74 69 6f 6e 27 5d 7c 7c 74 2e 66 6e 3b 74 2e 65 6e 61 62 6c 65 64 26 26 65 28 69 29 26 26 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 29 2c 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 29 2c 6f 3d 69 28 6f 2c 74 29 29 7d 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 29 7b 69 66 28 21 74 68 69 73 2e 73 74 61 74 65 2e 69 73 44 65 73 74 72 6f Data Ascii: unction']&&console.warn('`modifier.function` is deprecated, use `modifier.fn`!');var i=t['function']\|\|t.fn;t.enabled&&e(i)&&(o.offsets.popper=c(o.offsets.popper),o.offsets.reference=c(o.offsets.reference),o=i(o,t))}),o}function N(){if(!this.state.isDestro
2023-03-10 12:50:39 UTC	642	IN	Data Raw: 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 72 65 6d 6f 76 65 4f 6e 44 65 73 74 72 6f 79 26 26 74 68 69 73 2e 70 6f 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 2e 70 6f 70 70 65 72 29 2c 74 68 69 73 7d 66 75 6e 63 74 69 6f 6e 20 42 28 65 29 7b 76 61 72 20 74 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3b 72 65 74 75 72 6e 20 74 3f 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 66 75 6e 63 74 69 6f 6e 20 48 28 65 2c 74 2c 6f 2c 69 29 7b 76 61 72 20 72 3d 27 42 4f 44 59 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 2c 70 3d 72 3f 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 65 3b 70 2e 61 64 64 45 76 65 6e 74 4c Data Ascii: entListeners(),this.options.removeOnDestroy&&this.popper.parentNode.removeChild(this.popper),this}function B(e){var t=e.ownerDocument;return t?t.defaultView:window}function H(e,t,o,i){var r='BODY'===e.nodeName,p=r?e.ownerDocument.defaultView:e;p.addEventL
2023-03-10 12:50:39 UTC	643	IN	Data Raw: 7b 76 61 72 20 6f 3d 65 2e 6e 61 6d 65 3b 72 65 74 75 72 6e 20 6f 3d 3d 3d 74 7d 29 2c 6e 3d 21 21 69 26 26 65 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 6e 61 6d 65 3d 3d 3d 6f 26 26 65 2e 65 6e 61 62 6c 65 64 26 26 65 2e 6f 72 64 65 72 3c 69 2e 6f 72 64 65 72 7d 29 3b 69 66 28 21 6e 29 7b 76 61 72 20 72 3d 27 60 27 2b 74 2b 27 60 27 3b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 27 2b 6f 2b 27 60 27 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 73 20 72 65 71 75 69 72 65 64 20 62 79 20 27 2b 72 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 6e 20 6f 72 64 65 72 20 74 6f 20 77 6f 72 6b 2c 20 62 65 20 73 75 72 65 20 74 6f 20 69 6e 63 6c 75 64 65 20 69 74 20 62 65 66 6f 72 65 20 27 2b 72 2b 27 21 27 29 7d 72 65 74 75 72 6e 20 6e 7d Data Ascii: {var o=e.name;return o===t}),n=!!i&&e.some(function(e){return e.name===o&&e.enabled&&e.order<i.order});if(!n){var r='`'+t+'`';console.warn('`'+o+'`'+' modifier is required by '+r+' modifier in order to work, be sure to include it before '+r+'!')}return n}
2023-03-10 12:50:39 UTC	644	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 27 27 3d 3d 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 26 26 2d 31 21 3d 3d 5b 27 2b 27 2c 27 2d 27 5d 2e 69 6e 64 65 78 4f 66 28 74 29 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 3d 74 2c 70 3d 21 30 2c 65 29 3a 70 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 2b 3d 74 2c 70 3d 21 31 2c 65 29 3a 65 2e 63 6f 6e 63 61 74 28 74 29 7d 2c 5b 5d 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 56 28 65 2c 6e 2c 74 2c 6f 29 7d 29 7d 29 2c 61 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 69 29 7b 55 28 6f 29 26 26 28 6e 5b 74 5d 2b 3d 6f 2a 28 27 2d 27 3d 3d 3d 65 5b 69 2d 31 5d 3f 2d 31 3a 31 Data Ascii: function(e,t){return''===e[e.length-1]&&-1!==['+','-'].indexOf(t)?(e[e.length-1]=t,p=!0,e):p?(e[e.length-1]+=t,p=!1,e):e.concat(t)},[]).map(function(e){return V(e,n,t,o)})}),a.forEach(function(e,t){e.forEach(function(o,i){U(o)&&(n[t]+=o*('-'===e[i-1]?-1:1
2023-03-10 12:50:39 UTC	646	IN	Data Raw: 6e 63 74 69 6f 6e 28 74 2c 6f 2c 69 29 7b 72 65 74 75 72 6e 20 6f 26 26 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6f 29 2c 69 26 26 65 28 74 2c 69 29 2c 74 7d 7d 28 29 2c 70 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6f 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 6f 2c 65 7d 2c 73 65 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 69 Data Ascii: nction(t,o,i){return o&&e(t.prototype,o),i&&e(t,i),t}}(),pe=function(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e},se=Object.assign\|\|function(e){for(var t,o=1;o<arguments.length;o++)for(var i
2023-03-10 12:50:39 UTC	647	IN	Data Raw: 2e 6f 6e 4c 6f 61 64 29 26 26 74 2e 6f 6e 4c 6f 61 64 28 6e 2e 72 65 66 65 72 65 6e 63 65 2c 6e 2e 70 6f 70 70 65 72 2c 6e 2e 6f 70 74 69 6f 6e 73 2c 74 2c 6e 2e 73 74 61 74 65 29 7d 29 2c 74 68 69 73 2e 75 70 64 61 74 65 28 29 3b 76 61 72 20 70 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 76 65 6e 74 73 45 6e 61 62 6c 65 64 3b 70 26 26 74 68 69 73 2e 65 6e 61 62 6c 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 2c 74 68 69 73 2e 73 74 61 74 65 2e 65 76 65 6e 74 73 45 6e 61 62 6c 65 64 3d 70 7d 72 65 74 75 72 6e 20 72 65 28 74 2c 5b 7b 6b 65 79 3a 27 75 70 64 61 74 65 27 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4e 2e 63 61 6c 6c 28 74 68 69 73 29 7d 7d 2c 7b 6b 65 79 3a 27 64 65 73 74 72 6f 79 27 2c 76 61 6c 75 65 3a Data Ascii: .onLoad)&&t.onLoad(n.reference,n.popper,n.options,t,n.state)}),this.update();var p=this.options.eventsEnabled;p&&this.enableEventListeners(),this.state.eventsEnabled=p}return re(t,[{key:'update',value:function(){return N.call(this)}},{key:'destroy',value:
2023-03-10 12:50:39 UTC	648	IN	Data Raw: 65 29 7b 76 61 72 20 6f 3d 27 72 69 67 68 74 27 3d 3d 3d 65 3f 27 6c 65 66 74 27 3a 27 74 6f 70 27 2c 6e 3d 70 5b 6f 5d 3b 72 65 74 75 72 6e 20 70 5b 65 5d 3e 69 5b 65 5d 26 26 21 74 2e 65 73 63 61 70 65 57 69 74 68 52 65 66 65 72 65 6e 63 65 26 26 28 6e 3d 5f 28 70 5b 6f 5d 2c 69 5b 65 5d 2d 28 27 72 69 67 68 74 27 3d 3d 3d 65 3f 70 2e 77 69 64 74 68 3a 70 2e 68 65 69 67 68 74 29 29 29 2c 70 65 28 7b 7d 2c 6f 2c 6e 29 7d 7d 3b 72 65 74 75 72 6e 20 6e 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 2d 31 3d 3d 3d 5b 27 6c 65 66 74 27 2c 27 74 6f 70 27 5d 2e 69 6e 64 65 78 4f 66 28 65 29 3f 27 73 65 63 6f 6e 64 61 72 79 27 3a 27 70 72 69 6d 61 72 79 27 3b 70 3d 73 65 28 7b 7d 2c 70 2c 73 5b 74 5d 28 65 29 29 7d 29 2c 65 2e Data Ascii: e){var o='right'===e?'left':'top',n=p[o];return p[e]>i[e]&&!t.escapeWithReference&&(n=_(p[o],i[e]-('right'===e?p.width:p.height))),pe({},o,n)}};return n.forEach(function(e){var t=-1===['left','top'].indexOf(e)?'secondary':'primary';p=se({},p,s[t](e))}),e.
2023-03-10 12:50:39 UTC	650	IN	Data Raw: 32 2d 75 2f 32 2c 77 3d 74 28 65 2e 69 6e 73 74 61 6e 63 65 2e 70 6f 70 70 65 72 29 2c 79 3d 70 61 72 73 65 46 6c 6f 61 74 28 77 5b 27 6d 61 72 67 69 6e 27 2b 66 5d 2c 31 30 29 2c 45 3d 70 61 72 73 65 46 6c 6f 61 74 28 77 5b 27 62 6f 72 64 65 72 27 2b 66 2b 27 57 69 64 74 68 27 5d 2c 31 30 29 2c 76 3d 62 2d 65 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 5b 6d 5d 2d 79 2d 45 3b 72 65 74 75 72 6e 20 76 3d 4a 28 5f 28 73 5b 6c 5d 2d 75 2c 76 29 2c 30 29 2c 65 2e 61 72 72 6f 77 45 6c 65 6d 65 6e 74 3d 6e 2c 65 2e 6f 66 66 73 65 74 73 2e 61 72 72 6f 77 3d 28 69 3d 7b 7d 2c 70 65 28 69 2c 6d 2c 4d 61 74 68 2e 72 6f 75 6e 64 28 76 29 29 2c 70 65 28 69 2c 68 2c 27 27 29 2c 69 29 2c 65 7d 2c 65 6c 65 6d 65 6e 74 3a 27 5b 78 2d 61 72 72 6f 77 5d 27 7d 2c 66 6c 69 Data Ascii: 2-u/2,w=t(e.instance.popper),y=parseFloat(w['margin'+f],10),E=parseFloat(w['border'+f+'Width'],10),v=b-e.offsets.popper[m]-y-E;return v=J(_(s[l]-u,v),0),e.arrowElement=n,e.offsets.arrow=(i={},pe(i,m,Math.round(v)),pe(i,h,''),i),e},element:'[x-arrow]'},fli
2023-03-10 12:50:39 UTC	651	IN	Data Raw: 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 2c 53 28 65 2e 69 6e 73 74 61 6e 63 65 2e 70 6f 70 70 65 72 2c 65 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 2c 65 2e 70 6c 61 63 65 6d 65 6e 74 29 29 2c 65 3d 43 28 65 2e 69 6e 73 74 61 6e 63 65 2e 6d 6f 64 69 66 69 65 72 73 2c 65 2c 27 66 6c 69 70 27 29 29 7d 29 2c 65 7d 2c 62 65 68 61 76 69 6f 72 3a 27 66 6c 69 70 27 2c 70 61 64 64 69 6e 67 3a 35 2c 62 6f 75 6e 64 61 72 69 65 73 45 6c 65 6d 65 6e 74 3a 27 76 69 65 77 70 6f 72 74 27 7d 2c 69 6e 6e 65 72 3a 7b 6f 72 64 65 72 3a 37 30 30 2c 65 6e 61 62 6c 65 64 3a 21 31 2c 66 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 70 6c 61 63 65 6d 65 6e 74 2c 6f 3d 74 2e 73 70 6c 69 74 28 27 2d 27 29 5b 30 5d 2c 69 3d 65 2e 6f 66 66 73 65 Data Ascii: .offsets.popper,S(e.instance.popper,e.offsets.reference,e.placement)),e=C(e.instance.modifiers,e,'flip'))}),e},behavior:'flip',padding:5,boundariesElement:'viewport'},inner:{order:700,enabled:!1,fn:function(e){var t=e.placement,o=t.split('-')[0],i=e.offse
2023-03-10 12:50:39 UTC	652	IN	Data Raw: 58 28 6e 2e 72 69 67 68 74 29 7d 2c 63 3d 27 62 6f 74 74 6f 6d 27 3d 3d 3d 6f 3f 27 74 6f 70 27 3a 27 62 6f 74 74 6f 6d 27 2c 75 3d 27 72 69 67 68 74 27 3d 3d 3d 69 3f 27 6c 65 66 74 27 3a 27 72 69 67 68 74 27 2c 62 3d 57 28 27 74 72 61 6e 73 66 6f 72 6d 27 29 3b 69 66 28 64 3d 27 62 6f 74 74 6f 6d 27 3d 3d 63 3f 2d 66 2e 68 65 69 67 68 74 2b 68 2e 62 6f 74 74 6f 6d 3a 68 2e 74 6f 70 2c 73 3d 27 72 69 67 68 74 27 3d 3d 75 3f 2d 66 2e 77 69 64 74 68 2b 68 2e 72 69 67 68 74 3a 68 2e 6c 65 66 74 2c 61 26 26 62 29 6d 5b 62 5d 3d 27 74 72 61 6e 73 6c 61 74 65 33 64 28 27 2b 73 2b 27 70 78 2c 20 27 2b 64 2b 27 70 78 2c 20 30 29 27 2c 6d 5b 63 5d 3d 30 2c 6d 5b 75 5d 3d 30 2c 6d 2e 77 69 6c 6c 43 68 61 6e 67 65 3d 27 74 72 61 6e 73 66 6f 72 6d 27 3b 65 6c 73 65 Data Ascii: X(n.right)},c='bottom'===o?'top':'bottom',u='right'===i?'left':'right',b=W('transform');if(d='bottom'==c?-f.height+h.bottom:h.top,s='right'==u?-f.width+h.right:h.left,a&&b)m[b]='translate3d('+s+'px, '+d+'px, 0)',m[c]=0,m[u]=0,m.willChange='transform';else
2023-03-10 12:50:39 UTC	653	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:50:39 UTC	633	OUT	GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ipfs.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:50:39 UTC	653	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 15247411 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Fri, 10 Mar 2023 12:50:39 GMT Etag: 0x8D79ED29CF0C29A Last-Modified: Wed, 22 Jan 2020 00:32:50 GMT Server: ECAcc (frc/4CFA) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 7e9702ad-301e-0071-45a2-c81d53000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2023-03-10 12:50:39 UTC	654	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:50:46 UTC	662	OUT	GET /214d89a26f0ac918a09f216a1b0f97b4.png HTTP/1.1 Host: i.gyazo.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ipfs.io/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:50:46 UTC	664	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Mar 2023 12:50:46 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 7a5baf6d8e239a17-FRA Cache-Control: public, max-age=31536000 Expires: Sat, 09 Mar 2024 12:50:46 GMT Vary: Accept-Encoding Via: 1.1 google CF-Cache-Status: HIT X-Content-Type-Options: nosniff Server: cloudflare
2023-03-10 12:50:46 UTC	664	IN	Data Raw: 31 39 0d 0a 47 79 61 7a 6f 20 69 6d 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 0a 0d 0a Data Ascii: 19Gyazo image is not found
2023-03-10 12:50:46 UTC	664	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:50:46 UTC	663	OUT	OPTIONS /report/v3?s=YbNrUc9AdbUPNcX5uqAqUimWbCFyollvLo5ZlqUorzAAxfhKCzzeR9WYc6HmldHhh0AsxboUQHxV24TuoZAFp6AxKNvRMtvzcPMpFMEXy4l9rYU4gBVKKYo9ECmkRp5moqDaORdj HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://cdnjs.cloudflare.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:50:46 UTC	663	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Fri, 10 Mar 2023 12:50:45 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:50:46 UTC	664	OUT	POST /report/v3?s=YbNrUc9AdbUPNcX5uqAqUimWbCFyollvLo5ZlqUorzAAxfhKCzzeR9WYc6HmldHhh0AsxboUQHxV24TuoZAFp6AxKNvRMtvzcPMpFMEXy4l9rYU4gBVKKYo9ECmkRp5moqDaORdj HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 445 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:50:46 UTC	665	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 36 37 38 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 35 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 69 70 66 73 2e 69 6f 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 31 37 2e 32 34 2e 31 34 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 6f 6b 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 Data Ascii: [{"age":6782,"body":{"elapsed_time":259,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://ipfs.io/","sampling_fraction":0.01,"server_ip":"104.17.24.14","status_code":200,"type":"ok"},"type":"network-error","url":"https://cdnjs
2023-03-10 12:50:46 UTC	666	IN	HTTP/1.1 200 OK content-length: 0 date: Fri, 10 Mar 2023 12:50:46 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:49:39 UTC	1	OUT	GET /:o:/g/personal/kylesteward_gtek_co_uk/EhDMe_tJrQJOvkqcPg32UXwBy3vPhK7eMi-pVi9x3HYU5w?e=WkWbuL HTTP/1.1 Host: gtekcontrol-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:49:39 UTC	5	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 576 Content-Type: text/html; charset=utf-8 Location: https://gtekcontrol-my.sharepoint.com/personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc=%7Bfb7bcc10-ad49-4e02-be4a-9c3e0df6517c%7D&action=default&slrid=ebdb9da0-a036-6000-4d52-206500d6a486&originalPath=aHR0cHM6Ly9ndGVrY29udHJvbC1teS5zaGFyZXBvaW50LmNvbS86bzovZy9wZXJzb25hbC9reWxlc3Rld2FyZF9ndGVrX2NvX3VrL0VoRE1lX3RKclFKT3ZrcWNQZzMyVVh3QnkzdlBoSzdlTWktcFZpOXgzSFlVNXc_cnRpbWU9b2pCUjZXVWgyMGc&cid=8ee8aab8-024d-41e4-a77e-afc9294657c5 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEyLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2RiZWQ1ZDM0NzFlNDJmY2IyMDhlOTY0YTBmNGI3YWI4ZTFhZmQ0NjI1ZjQ5NjFmMGVkYTcxNGI2NDU5ZTU0MzEsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZGJlZDVkMzQ3MWU0MmZjYjIwOGU5NjRhMGY0YjdhYjhlMWFmZDQ2MjVmNDk2MWYwZWRhNzE0YjY0NTllNTQzMSwxMzMyMjkyNjQ3OTAwMDAwMDAsMCwxMzMyMzAxMjU3OTI3MjY1NzEsMC4wLjAuMCwyNTgsYWM0ODIxZjctNmYzNC00YzU0LWI0OGQtYTdjZjdlYWJiMmY5LCwsZWJkYjlkYTAtYTAzNi02MDAwLTRkNTItMjA2NTAwZDZhNDg2LGViZGI5ZGEwLWEwMzYtNjAwMC00ZDUyLTIwNjUwMGQ2YTQ4NiwvUGNrL1p6dHpFaWwxT1ZVQ3RnRURnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCxpeXdySEVvVFRYWDdSU2oyTDlYc0FhVlJ1a1hsckFMT1NtTzZzTGl5NS9QQUNnVEtiYkF5R25tVWxGM2M3ZFZ6RER4WTRPMFFFRU5BQzdTT2xVeWZFYTRlWUkyTEZZVzBjMk5Pd0Q5TGNkR2ZhNUNIdFF1ZENaMmc2aFRJVWVJQ01wYjJkV1ZIMTlQblVmWFhUUUNsOENSTlpXS01ZVVZuMktQUlBSN3BZakNGaEIvZXpvMVBBNW1MQTA3dzRyVXA2NFZLUmRHVXhueWNwdXJMcU9qK2xtYUpuZks1OEZwbHJ4QWNiWUs2NHY5WWtwQTNxUThHdnlwQzVlSEU2S2E3cDN3VTFDZWl5cFZTNUVEZ3Q1RHdEbE42bko1Y0todTFQemIvR2lIVW1LMWFUZ3BWT21ESHJUU04xc1VqWUp5aVRxcmF5UGJsdmNyODh3ZXZkaEZ5RGc9PTwvU1A+; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,47361,0,27376 X-SharePointHealthScore: 2 X-MS-SPO-CookieValidator: iywrHEoTTXX7RSj2L9XsAaVRukXlrALOSmO6sLiy5/PACgTKbbAyGnmUlF3c7dVzDDxY4O0QEENAC7SOlUyfEa4eYI2LFYW0c2NOwD9LcdGfa5CHtQudCZ2g6hTIUeICMpb2dWVH19PnUfXXTQCl8CRNZWKMYUVn2KPRPR7pYjCFhB/ezo1PA5mLA07w4rUp64VKRdGUxnycpurLqOj+lmaJnfK58FplrxAcbYK64v9YkpA3qQ8GvypC5eHE6Ka7p3wU1CeiypVS5EDgt5DwDlN6nJ5cKhu1Pzb/GiHUmK1aTgpVOmDHrTSN1sUjYJyiTqrayPblvcr88wevdhFyDg== X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: ebdb9da0-a036-6000-4d52-206500d6a486 request-id: ebdb9da0-a036-6000-4d52-206500d6a486 MS-CV: oJ3b6zagAGBNUiBlANakhg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=ac4821f7-6f34-4c54-b48d-a7cf7eabb2f9&destinationEndpoint=Edge-Prod-BER30&frontEnd=AFD"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .powerapps.com .yammer.com .officeapps.live.com .office.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 117 SPIisLatency: 3 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.23422 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4BE8F3AEAB1D4C5AA787BFD72A89D79A Ref B: BER30EDGE0517 Ref C: 2023-03-10T12:49:39Z Date: Fri, 10 Mar 2023 12:49:38 GMT Connection: close
2023-03-10 12:49:39 UTC	8	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 74 65 6b 63 6f 6e 74 72 6f 6c 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 6b 79 6c 65 73 74 65 77 61 72 64 5f 67 74 65 6b 5f 63 6f 5f 75 6b 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 44 6f 63 2e 61 73 70 78 3f 73 6f 75 72 63 65 64 6f 63 3d 25 37 42 66 62 37 62 63 63 31 30 2d 61 64 34 39 2d 34 65 30 32 2d 62 65 34 61 2d 39 63 33 65 30 64 66 36 35 31 37 63 25 37 44 26 61 6d 70 3b 61 63 74 69 6f 6e 3d 64 65 66 61 75 6c 74 26 61 6d 70 3b 73 6c 72 69 64 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://gtekcontrol-my.sharepoint.com/personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc=%7Bfb7bcc10-ad49-4e02-be4a-9c3e0df6517c%7D&action=default&slrid

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:49:39 UTC	9	OUT	GET /personal/kylesteward_gtek_co_uk/_layouts/15/Doc.aspx?sourcedoc=%7Bfb7bcc10-ad49-4e02-be4a-9c3e0df6517c%7D&action=default&slrid=ebdb9da0-a036-6000-4d52-206500d6a486&originalPath=aHR0cHM6Ly9ndGVrY29udHJvbC1teS5zaGFyZXBvaW50LmNvbS86bzovZy9wZXJzb25hbC9reWxlc3Rld2FyZF9ndGVrX2NvX3VrL0VoRE1lX3RKclFKT3ZrcWNQZzMyVVh3QnkzdlBoSzdlTWktcFZpOXgzSFlVNXc_cnRpbWU9b2pCUjZXVWgyMGc&cid=8ee8aab8-024d-41e4-a77e-afc9294657c5 HTTP/1.1 Host: gtekcontrol-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEyLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2RiZWQ1ZDM0NzFlNDJmY2IyMDhlOTY0YTBmNGI3YWI4ZTFhZmQ0NjI1ZjQ5NjFmMGVkYTcxNGI2NDU5ZTU0MzEsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZGJlZDVkMzQ3MWU0MmZjYjIwOGU5NjRhMGY0YjdhYjhlMWFmZDQ2MjVmNDk2MWYwZWRhNzE0YjY0NTllNTQzMSwxMzMyMjkyNjQ3OTAwMDAwMDAsMCwxMzMyMzAxMjU3OTI3MjY1NzEsMC4wLjAuMCwyNTgsYWM0ODIxZjctNmYzNC00YzU0LWI0OGQtYTdjZjdlYWJiMmY5LCwsZWJkYjlkYTAtYTAzNi02MDAwLTRkNTItMjA2NTAwZDZhNDg2LGViZGI5ZGEwLWEwMzYtNjAwMC00ZDUyLTIwNjUwMGQ2YTQ4NiwvUGNrL1p6dHpFaWwxT1ZVQ3RnRURnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCxpeXdySEVvVFRYWDdSU2oyTDlYc0FhVlJ1a1hsckFMT1NtTzZzTGl5NS9QQUNnVEtiYkF5R25tVWxGM2M3ZFZ6RER4WTRPMFFFRU5BQzdTT2xVeWZFYTRlWUkyTEZZVzBjMk5Pd0Q5TGNkR2ZhNUNIdFF1ZENaMmc2aFRJVWVJQ01wYjJkV1ZIMTlQblVmWFhUUUNsOENSTlpXS01ZVVZuMktQUlBSN3BZakNGaEIvZXpvMVBBNW1MQTA3dzRyVXA2NFZLUmRHVXhueWNwdXJMcU9qK2xtYUpuZks1OEZwbHJ4QWNiWUs2NHY5WWtwQTNxUThHdnlwQzVlSEU2S2E3cDN3VTFDZWl5cFZTNUVEZ3Q1RHdEbE42bko1Y0todTFQemIvR2lIVW1LMWFUZ3BWT21ESHJUU04xc1VqWUp5aVRxcmF5UGJsdmNyODh3ZXZkaEZ5RGc9PTwvU1A+
2023-03-10 12:49:39 UTC	11	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 74401 Content-Type: text/html; charset=utf-8 Expires: -1 P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEyLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2RiZWQ1ZDM0NzFlNDJmY2IyMDhlOTY0YTBmNGI3YWI4ZTFhZmQ0NjI1ZjQ5NjFmMGVkYTcxNGI2NDU5ZTU0MzEsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZGJlZDVkMzQ3MWU0MmZjYjIwOGU5NjRhMGY0YjdhYjhlMWFmZDQ2MjVmNDk2MWYwZWRhNzE0YjY0NTllNTQzMSwxMzMyMjkyNjQ3OTAwMDAwMDAsMCwxMzMyMzAxMjU3OTI3MjY1NzEsMC4wLjAuMCwyNTgsYWM0ODIxZjctNmYzNC00YzU0LWI0OGQtYTdjZjdlYWJiMmY5LCwsZWJkYjlkYTAtYTAzNi02MDAwLTRkNTItMjA2NTAwZDZhNDg2LGViZGI5ZGEwLWEwMzYtNjAwMC00ZDUyLTIwNjUwMGQ2YTQ4NiwvUGNrL1p6dHpFaWwxT1ZVQ3RnRURnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCxpeXdySEVvVFRYWDdSU2oyTDlYc0FhVlJ1a1hsckFMT1NtTzZzTGl5NS9QQUNnVEtiYkF5R25tVWxGM2M3ZFZ6RER4WTRPMFFFRU5BQzdTT2xVeWZFYTRlWUkyTEZZVzBjMk5Pd0Q5TGNkR2ZhNUNIdFF1ZENaMmc2aFRJVWVJQ01wYjJkV1ZIMTlQblVmWFhUUUNsOENSTlpXS01ZVVZuMktQUlBSN3BZakNGaEIvZXpvMVBBNW1MQTA3dzRyVXA2NFZLUmRHVXhueWNwdXJMcU9qK2xtYUpuZks1OEZwbHJ4QWNiWUs2NHY5WWtwQTNxUThHdnlwQzVlSEU2S2E3cDN3VTFDZWl5cFZTNUVEZ3Q1RHdEbE42bko1Y0todTFQemIvR2lIVW1LMWFUZ3BWT21ESHJUU04xc1VqWUp5aVRxcmF5UGJsdmNyODh3ZXZkaEZ5RGc9PTwvU1A+; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,2102272,0,68,2827451,0,1778925 X-SharePointHealthScore: 3 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: ebdb9da0-3046-6000-4d52-227c923dd465 request-id: ebdb9da0-3046-6000-4d52-227c923dd465 MS-CV: oJ3b60YwAGBNUiJ8kj3UZQ.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=ac4821f7-6f34-4c54-b48d-a7cf7eabb2f9&destinationEndpoint=Edge-Prod-AMS04r5c&frontEnd=AFD"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .powerapps.com .yammer.com .officeapps.live.com .office.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 84 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.23422 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 707A4B10D43F494A935F7D9CAC4F7C22 Ref B: AMS04EDGE2217 Ref C: 2023-03-10T12:49:39Z Date: Fri, 10 Mar 2023 12:49:39 GMT Connection: close
2023-03-10 12:49:39 UTC	14	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 21 2d 2d 20 64 6f 63 2f 64 6f 63 32 20 6d 65 72 67 65 20 66 6c 69 67 68 74 20 2d 2d 3e 0d 0a 20 0d 0a 0d 0a 20 20 20 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d Data Ascii: <!DOCTYPE html><html lang="en-us" dir="ltr">... doc/doc2 merge flight --> <head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum
2023-03-10 12:49:39 UTC	16	IN	Data Raw: 6a 51 31 4f 57 55 31 4e 44 4d 78 49 69 77 69 62 6d 6c 70 49 6a 6f 69 62 57 6c 6a 63 6d 39 7a 62 32 5a 30 4c 6e 4e 6f 59 58 4a 6c 63 47 39 70 62 6e 51 69 4c 43 4a 70 63 33 56 7a 5a 58 49 69 4f 69 4a 30 63 6e 56 6c 49 69 77 69 59 32 46 6a 61 47 56 72 5a 58 6b 69 4f 69 49 77 61 43 35 6d 66 47 31 6c 62 57 4a 6c 63 6e 4e 6f 61 58 42 38 64 58 4a 75 4a 54 4e 68 63 33 42 76 4a 54 4e 68 59 57 35 76 62 69 4e 6b 59 6d 56 6b 4e 57 51 7a 4e 44 63 78 5a 54 51 79 5a 6d 4e 69 4d 6a 41 34 5a 54 6b 32 4e 47 45 77 5a 6a 52 69 4e 32 46 69 4f 47 55 78 59 57 5a 6b 4e 44 59 79 4e 57 59 30 4f 54 59 78 5a 6a 42 6c 5a 47 45 33 4d 54 52 69 4e 6a 51 31 4f 57 55 31 4e 44 4d 78 49 69 77 69 63 32 68 68 63 6d 6c 75 5a 32 6c 6b 49 6a 6f 69 4c 31 42 6a 61 79 39 61 65 6e 52 36 52 57 6c 73 Data Ascii: jQ1OWU1NDMxIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJpc3VzZXIiOiJ0cnVlIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNkYmVkNWQzNDcxZTQyZmNiMjA4ZTk2NGEwZjRiN2FiOGUxYWZkNDYyNWY0OTYxZjBlZGE3MTRiNjQ1OWU1NDMxIiwic2hhcmluZ2lkIjoiL1Bjay9aenR6RWls
2023-03-10 12:49:39 UTC	24	IN	Data Raw: 37 42 30 33 35 2d 42 34 34 33 2d 34 39 31 39 2d 38 42 46 38 2d 42 33 45 34 44 31 43 33 34 44 41 30 22 3a 74 72 75 65 2c 22 46 44 41 45 39 45 39 34 2d 38 41 38 38 2d 34 38 36 30 2d 38 38 30 42 2d 46 41 33 30 34 39 35 34 43 32 41 37 22 3a 74 72 75 65 2c 22 31 30 33 41 37 44 33 45 2d 39 32 39 42 2d 34 41 36 35 2d 41 32 45 46 2d 41 46 41 41 41 38 41 30 43 30 44 35 22 3a 74 72 75 65 2c 22 37 31 35 35 33 41 45 46 2d 30 46 31 35 2d 34 41 38 31 2d 39 34 39 37 2d 36 30 43 46 41 36 43 36 33 33 38 32 22 3a 74 72 75 65 2c 22 30 39 32 46 32 41 36 36 2d 44 46 34 31 2d 34 46 33 34 2d 42 41 39 39 2d 30 33 33 42 38 41 42 37 43 36 36 38 22 3a 74 72 75 65 2c 22 38 33 43 39 38 46 32 36 2d 35 45 38 42 2d 34 34 42 41 2d 41 31 34 41 2d 36 33 41 45 41 33 43 38 41 42 44 45 22 3a Data Ascii: 7B035-B443-4919-8BF8-B3E4D1C34DA0":true,"FDAE9E94-8A88-4860-880B-FA304954C2A7":true,"103A7D3E-929B-4A65-A2EF-AFAAA8A0C0D5":true,"71553AEF-0F15-4A81-9497-60CFA6C63382":true,"092F2A66-DF41-4F34-BA99-033B8AB7C668":true,"83C98F26-5E8B-44BA-A14A-63AEA3C8ABDE":
2023-03-10 12:49:39 UTC	32	IN	Data Raw: 32 30 2d 34 46 34 46 2d 41 41 44 46 2d 44 37 42 31 41 37 46 42 31 30 31 32 22 3a 74 72 75 65 2c 22 45 45 32 42 34 35 37 32 2d 31 30 46 32 2d 34 32 33 32 2d 42 46 37 42 2d 32 31 31 44 46 43 38 46 43 33 30 45 22 3a 74 72 75 65 2c 22 44 39 39 41 39 39 34 41 2d 35 33 35 30 2d 34 44 36 42 2d 39 39 35 43 2d 36 42 35 32 46 31 43 38 45 34 35 35 22 3a 74 72 75 65 2c 22 45 43 37 42 30 35 43 33 2d 41 34 42 33 2d 34 42 45 46 2d 42 33 46 39 2d 35 42 44 43 44 46 30 46 33 46 36 42 22 3a 74 72 75 65 2c 22 46 35 31 44 38 45 37 33 2d 38 30 37 30 2d 34 32 43 34 2d 41 46 33 34 2d 46 42 31 32 33 45 36 37 44 37 44 38 22 3a 74 72 75 65 2c 22 30 42 39 46 42 45 36 37 2d 39 33 36 41 2d 34 35 31 35 2d 39 32 42 30 2d 31 39 31 33 38 37 37 42 39 42 30 41 22 3a 74 72 75 65 2c 22 33 30 Data Ascii: 20-4F4F-AADF-D7B1A7FB1012":true,"EE2B4572-10F2-4232-BF7B-211DFC8FC30E":true,"D99A994A-5350-4D6B-995C-6B52F1C8E455":true,"EC7B05C3-A4B3-4BEF-B3F9-5BDCDF0F3F6B":true,"F51D8E73-8070-42C4-AF34-FB123E67D7D8":true,"0B9FBE67-936A-4515-92B0-1913877B9B0A":true,"30
2023-03-10 12:49:39 UTC	40	IN	Data Raw: 41 37 42 43 2d 42 30 45 45 45 42 35 42 41 35 46 42 22 3a 74 72 75 65 2c 22 34 37 33 42 35 34 46 33 2d 34 41 34 34 2d 34 44 35 42 2d 38 39 45 34 2d 44 33 36 38 34 44 33 41 32 38 35 34 22 3a 74 72 75 65 2c 22 37 31 32 39 45 32 42 44 2d 31 45 32 30 2d 34 30 45 31 2d 38 34 44 31 2d 38 34 35 39 43 31 39 35 39 31 39 38 22 3a 74 72 75 65 2c 22 32 41 46 38 31 34 46 36 2d 42 38 36 32 2d 34 34 43 33 2d 42 46 42 45 2d 35 44 45 41 31 33 31 30 33 38 41 36 22 3a 74 72 75 65 2c 22 37 41 30 33 32 30 39 44 2d 45 43 37 35 2d 34 37 42 45 2d 41 33 44 36 2d 39 33 41 31 33 37 46 45 44 38 44 36 22 3a 74 72 75 65 2c 22 41 42 37 39 30 33 35 45 2d 39 34 31 44 2d 34 32 45 39 2d 38 45 41 34 2d 37 42 31 46 43 37 36 38 39 30 44 43 22 3a 74 72 75 65 2c 22 30 41 42 37 44 38 33 44 2d 45 Data Ascii: A7BC-B0EEEB5BA5FB":true,"473B54F3-4A44-4D5B-89E4-D3684D3A2854":true,"7129E2BD-1E20-40E1-84D1-8459C1959198":true,"2AF814F6-B862-44C3-BFBE-5DEA131038A6":true,"7A03209D-EC75-47BE-A3D6-93A137FED8D6":true,"AB79035E-941D-42E9-8EA4-7B1FC76890DC":true,"0AB7D83D-E
2023-03-10 12:49:39 UTC	48	IN	Data Raw: 37 37 44 33 30 30 43 31 44 22 3a 74 72 75 65 2c 22 33 30 35 30 30 34 43 42 2d 43 30 37 35 2d 34 43 32 32 2d 38 31 41 36 2d 41 45 43 41 35 45 30 37 39 38 42 46 22 3a 74 72 75 65 2c 22 39 41 43 38 39 46 33 30 2d 45 41 32 43 2d 34 30 41 43 2d 42 30 44 45 2d 45 44 44 45 30 37 34 44 32 33 39 46 22 3a 74 72 75 65 2c 22 30 44 31 30 33 43 42 31 2d 46 32 37 35 2d 34 45 37 35 2d 41 35 38 39 2d 41 42 44 46 36 33 45 30 34 43 43 42 22 3a 74 72 75 65 2c 22 32 42 35 32 41 42 42 36 2d 46 37 32 45 2d 34 44 38 36 2d 39 44 36 37 2d 46 38 35 44 46 44 32 34 39 44 34 42 22 3a 74 72 75 65 2c 22 32 44 45 46 30 32 31 33 2d 35 30 35 45 2d 34 42 42 33 2d 38 34 34 31 2d 31 39 45 33 41 45 43 30 44 33 35 32 22 3a 74 72 75 65 2c 22 45 41 30 34 37 39 38 41 2d 42 35 30 31 2d 34 37 46 39 Data Ascii: 77D300C1D":true,"305004CB-C075-4C22-81A6-AECA5E0798BF":true,"9AC89F30-EA2C-40AC-B0DE-EDDE074D239F":true,"0D103CB1-F275-4E75-A589-ABDF63E04CCB":true,"2B52ABB6-F72E-4D86-9D67-F85DFD249D4B":true,"2DEF0213-505E-4BB3-8441-19E3AEC0D352":true,"EA04798A-B501-47F9
2023-03-10 12:49:39 UTC	56	IN	Data Raw: 30 22 3a 74 72 75 65 2c 22 32 30 42 46 30 41 36 30 2d 44 45 42 33 2d 34 31 38 44 2d 41 31 37 35 2d 45 32 33 38 45 38 32 31 36 35 45 34 22 3a 74 72 75 65 2c 22 41 41 41 32 39 44 31 33 2d 45 30 46 32 2d 34 34 45 38 2d 42 41 31 34 2d 35 37 30 41 34 34 46 33 45 34 32 34 22 3a 74 72 75 65 2c 22 32 31 31 30 46 38 31 39 2d 37 46 43 41 2d 34 30 34 44 2d 38 38 43 43 2d 44 32 45 46 46 39 32 32 43 35 38 36 22 3a 74 72 75 65 2c 22 35 35 30 37 42 30 33 36 2d 45 42 35 32 2d 34 45 38 44 2d 42 31 44 43 2d 33 45 35 39 46 32 34 32 33 33 32 38 22 3a 74 72 75 65 2c 22 36 43 44 38 44 37 42 31 2d 37 41 39 33 2d 34 35 44 30 2d 41 33 34 30 2d 41 43 43 30 42 33 35 31 39 46 32 42 22 3a 74 72 75 65 2c 22 39 35 31 36 44 37 42 35 2d 31 34 46 38 2d 34 45 42 38 2d 38 45 35 33 2d 39 45 Data Ascii: 0":true,"20BF0A60-DEB3-418D-A175-E238E82165E4":true,"AAA29D13-E0F2-44E8-BA14-570A44F3E424":true,"2110F819-7FCA-404D-88CC-D2EFF922C586":true,"5507B036-EB52-4E8D-B1DC-3E59F2423328":true,"6CD8D7B1-7A93-45D0-A340-ACC0B3519F2B":true,"9516D7B5-14F8-4EB8-8E53-9E
2023-03-10 12:49:39 UTC	64	IN	Data Raw: 70 50 61 67 65 43 6f 6e 74 65 78 74 49 6e 66 6f 2e 63 6c 69 65 6e 74 53 65 72 76 65 72 54 69 6d 65 44 65 6c 74 61 3d 6e 65 77 20 44 61 74 65 28 5f 73 70 50 61 67 65 43 6f 6e 74 65 78 74 49 6e 66 6f 2e 73 65 72 76 65 72 54 69 6d 65 29 2d 6e 65 77 20 44 61 74 65 28 29 3b 69 66 28 74 79 70 65 6f 66 28 64 65 66 69 6e 65 29 3d 3d 27 66 75 6e 63 74 69 6f 6e 27 29 7b 64 65 66 69 6e 65 28 27 53 50 50 61 67 65 43 6f 6e 74 65 78 74 49 6e 66 6f 27 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 73 70 50 61 67 65 43 6f 6e 74 65 78 74 49 6e 66 6f 3b 7d 29 3b 7d 0d 0a 09 09 09 76 61 72 20 77 6f 70 69 44 69 61 67 53 65 72 76 65 72 20 3d 20 7b 22 6f 66 66 69 63 65 42 75 6e 64 6c 65 43 61 63 68 65 48 69 74 49 6e 66 6f 22 3a 6e 75 6c 6c 2c 22 6f 66 66 Data Ascii: pPageContextInfo.clientServerTimeDelta=new Date(_spPageContextInfo.serverTime)-new Date();if(typeof(define)=='function'){define('SPPageContextInfo',[],function(){return _spPageContextInfo;});}var wopiDiagServer = {"officeBundleCacheHitInfo":null,"off
2023-03-10 12:49:39 UTC	72	IN	Data Raw: 61 67 6e 6f 73 74 69 63 73 2e 62 6f 6f 74 4a 73 45 6e 64 54 69 6d 65 0d 0a 09 09 09 09 09 09 7d 2c 0d 0a 09 09 09 09 09 09 46 6e 4f 6e 49 6e 69 74 69 61 6c 69 7a 65 53 75 63 63 65 73 73 3a 20 74 68 69 73 2e 6f 6e 49 6e 69 74 53 75 63 63 65 73 73 2c 0d 0a 09 09 09 09 09 09 46 6e 4f 6e 49 6e 69 74 69 61 6c 69 7a 65 46 61 69 6c 75 72 65 3a 20 74 68 69 73 2e 6f 6e 49 6e 69 74 46 61 69 6c 2c 0d 0a 09 09 09 09 09 09 46 6e 49 73 46 65 61 74 75 72 65 45 6e 61 62 6c 65 64 3a 20 74 68 69 73 2e 69 73 46 65 61 74 75 72 65 45 6e 61 62 6c 65 64 0d 0a 09 09 09 09 09 7d 3b 0d 0a 09 09 09 09 09 69 66 20 28 77 6f 70 69 44 6f 63 43 6f 6e 74 65 78 74 2e 42 75 6e 64 6c 65 55 72 6c 20 26 26 20 77 6f 70 69 44 6f 63 43 6f 6e 74 65 78 74 2e 42 75 6e 64 6c 65 55 72 6c 2e 6c 65 6e Data Ascii: agnostics.bootJsEndTime},FnOnInitializeSuccess: this.onInitSuccess,FnOnInitializeFailure: this.onInitFail,FnIsFeatureEnabled: this.isFeatureEnabled};if (wopiDocContext.BundleUrl && wopiDocContext.BundleUrl.len
2023-03-10 12:49:39 UTC	80	IN	Data Raw: 72 65 74 75 72 6e 20 21 21 77 69 6e 64 6f 77 2e 4d 69 63 72 6f 73 6f 66 74 20 26 26 20 21 21 4d 69 63 72 6f 73 6f 66 74 2e 4f 66 66 69 63 65 3b 0d 0a 09 09 7d 0d 0a 09 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6f 6e 53 63 72 69 70 74 43 6f 6d 70 6c 65 74 65 28 72 65 74 72 79 29 20 7b 0d 0a 09 09 09 69 66 28 6a 73 41 50 49 4c 6f 61 64 65 64 28 29 29 20 7b 0d 0a 09 09 09 09 69 6e 69 74 69 61 6c 69 7a 65 57 61 63 28 29 3b 0d 0a 09 09 09 7d 20 65 6c 73 65 20 7b 0d 0a 09 09 09 09 6f 6e 4c 6f 61 64 4a 73 41 70 69 46 61 69 6c 65 64 28 72 65 74 72 79 29 0d 0a 09 09 09 7d 0d 0a 09 09 7d 3b 0d 0a 09 09 77 69 6e 64 6f 77 2e 77 6f 70 69 44 69 61 67 43 6c 69 65 6e 74 2e 62 6f 6f 74 4a 73 53 74 61 72 74 54 69 6d 65 20 3d 20 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 Data Ascii: return !!window.Microsoft && !!Microsoft.Office;} function onScriptComplete(retry) {if(jsAPILoaded()) {initializeWac();} else {onLoadJsApiFailed(retry)}};window.wopiDiagClient.bootJsStartTime = new Date().getTi

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:49:54 UTC	87	OUT	GET /me?partner=OneNoteOnline&version=10.22274.1&market=EN-US&wrapperId=suiteshell HTTP/1.1 Host: amcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" Origin: https://ukc-onenote.officeapps.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ukc-onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:49:55 UTC	87	IN	HTTP/1.1 200 OK Cache-Control: public, no-transform, max-age=43200 Content-Length: 29225 Content-Type: application/javascript Expires: Sat, 11 Mar 2023 00:49:55 GMT X-Cache: CONFIG_NOCACHE X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0cicLZAAAAAApfreDYg/6SqFi+aStydVWRlJBMjMxMDUwNDE3MDE3AGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== X-Azure-Ref: 0cicLZAAAAABbLHSwQLDdQKCbn5rjFGpGRlJBMzFFREdFMDMwOAA5ZmU2YzNmMS0xNzE4LTRhOTMtOTI1NS02M2NkM2Y4Y2E1YWI= Date: Fri, 10 Mar 2023 12:49:54 GMT Connection: close
2023-03-10 12:49:55 UTC	88	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 32 32 37 34 2e 31 22 2c 22 6d 6b 74 22 3a 22 65 6e 2d 55 53 22 2c 22 70 74 6e 22 3a 22 6f 6e 65 6e 6f 74 65 6f 6e 6c 69 6e 65 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6d 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 64 Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.22274.1","mkt":"en-US","ptn":"onenoteonline","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd
2023-03-10 12:49:55 UTC	89	IN	Data Raw: 22 67 72 61 70 68 73 63 6f 70 65 22 3a 22 75 73 65 72 2e 72 65 61 64 22 2c 22 67 72 61 70 68 63 6f 64 65 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 76 32 2e 30 2f 61 75 74 68 6f 72 69 7a 65 22 2c 22 67 72 61 70 68 72 65 64 69 72 65 63 74 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6d 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 2f 6d 65 2f 63 61 6c 6c 67 72 61 70 68 22 2c 22 67 72 61 70 68 70 68 6f 74 6f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 67 72 61 70 68 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 76 31 2e 30 2f 6d 65 2f 70 68 6f 74 6f 73 2f 39 36 78 39 36 2f 24 76 61 6c 75 65 22 7d 2c 22 61 61 64 55 72 6c 22 3a 22 68 74 74 70 Data Ascii: "graphscope":"user.read","graphcodeurl":"https://login.microsoftonline.com/common/oauth2/v2.0/authorize","graphredirecturi":"https://amcdn.msftauth.net/me/callgraph","graphphotourl":"https://graph.microsoft.com/v1.0/me/photos/96x96/$value"},"aadUrl":"http
2023-03-10 12:49:55 UTC	97	IN	Data Raw: 65 76 69 6f 75 73 41 63 74 69 6f 6e 2c 73 75 63 63 65 73 73 3a 65 2e 73 75 63 63 65 73 73 2c 64 75 72 61 74 69 6f 6e 4d 73 3a 65 2e 64 75 72 61 74 69 6f 6e 4d 73 2c 64 65 74 61 69 6c 73 3a 65 2e 64 65 74 61 69 6c 73 7d 7d 7d 76 61 72 20 68 65 3d 73 65 74 54 69 6d 65 6f 75 74 3b 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 28 65 26 26 76 6f 69 64 20 30 21 3d 3d 65 2e 6c 65 6e 67 74 68 29 7d 66 75 6e 63 74 69 6f 6e 20 43 65 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 77 65 28 65 29 7b 69 66 28 21 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 77 65 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 50 72 6f 6d 69 73 65 73 20 6d 75 73 74 20 62 65 20 63 6f 6e 73 74 72 75 63 74 65 64 20 76 69 61 20 6e Data Ascii: eviousAction,success:e.success,durationMs:e.durationMs,details:e.details}}}var he=setTimeout;function ye(e){return Boolean(e&&void 0!==e.length)}function Ce(){}function we(e){if(!(this instanceof we))throw new TypeError("Promises must be constructed via n
2023-03-10 12:49:55 UTC	103	IN	Data Raw: 28 29 7b 76 61 72 20 65 3d 73 28 29 2c 6e 3d 22 42 75 6e 64 6c 65 20 64 6f 77 6e 6c 6f 61 64 20 74 69 6d 65 64 20 6f 75 74 22 3b 7a 65 28 75 2c 65 2c 63 2c 21 30 2c 6e 29 2c 61 28 45 28 6e 2b 22 3a 20 22 2b 75 2b 22 20 28 22 2b 63 2b 22 29 22 2c 21 30 29 29 7d 2c 6d 2e 43 6f 6e 66 69 67 2e 74 69 6d 65 6f 75 74 4d 73 29 3b 66 75 6e 63 74 69 6f 6e 20 73 28 29 7b 72 65 74 75 72 6e 20 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 72 29 2c 74 26 26 28 74 2e 6f 6e 65 72 72 6f 72 3d 74 2e 6f 6e 6c 6f 61 64 3d 76 6f 69 64 20 30 2c 74 3d 76 6f 69 64 20 30 29 2c 67 28 29 2d 65 7d 74 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 73 28 29 3b 58 65 28 29 3b 76 61 72 20 6e 3d 4a 65 28 75 29 2c 72 3d 6e 26 26 6e 2e 65 78 70 6f 72 74 73 3b 69 66 Data Ascii: (){var e=s(),n="Bundle download timed out";ze(u,e,c,!0,n),a(E(n+": "+u+" ("+c+")",!0))},m.Config.timeoutMs);function s(){return clearTimeout(r),t&&(t.onerror=t.onload=void 0,t=void 0),g()-e}t.onload=function(e){var t=s();Xe();var n=Je(u),r=n&&n.exports;if
2023-03-10 12:49:55 UTC	111	IN	Data Raw: 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 6e 75 6c 6c 21 3d 65 2e 6d 65 6d 62 65 72 4e 61 6d 65 26 26 30 3c 65 2e 6d 65 6d 62 65 72 4e 61 6d 65 2e 6c 65 6e 67 74 68 7d 28 65 29 3b 63 61 73 65 22 6d 73 61 22 3a 63 61 73 65 22 6d 73 61 46 65 64 22 3a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 6e 75 6c 6c 21 3d 65 2e 6d 65 6d 62 65 72 4e 61 6d 65 26 26 30 3c 65 2e 6d 65 6d 62 65 72 4e 61 6d 65 2e 6c 65 6e 67 74 68 7d 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 6e 28 65 29 7b 69 66 28 6d 6e 28 65 29 29 73 77 69 74 63 68 28 65 2e 69 64 70 29 7b 63 61 73 65 22 61 61 64 22 3a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 7b 74 79 70 65 3a 22 61 61 64 22 2c 61 75 74 68 65 6e Data Ascii: ction(e){return e&&null!=e.memberName&&0<e.memberName.length}(e);case"msa":case"msaFed":return function(e){return e&&null!=e.memberName&&0<e.memberName.length}(e)}}function vn(e){if(mn(e))switch(e.idp){case"aad":return function(e){return{type:"aad",authen

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:49:55 UTC	116	OUT	GET /mydata/myprofile/expressionprofile/profilephoto:UserTileStatic,UserTileSmall/MeControlMediumUserTile?ck=1&ex=24&fofoff=1&sc=1678484994920 HTTP/1.1 Host: storage.live.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ukc-onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:49:55 UTC	134	IN	HTTP/1.1 302 Found Content-Length: 0 Location: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1678452595&rver=7.5.2116.0&wp=MBI_SSL&wreply=https:%2F%2Fstorage.live.com%2Fstorageservice%2Fpassport%2Fauth.aspx%3Fsru%3Dhttps:%252f%252fstorage.live.com%252fmydata%252fmyprofile%252fexpressionprofile%252fprofilephoto:UserTileStatic%252cUserTileSmall%252fMeControlMediumUserTile&lc=1033&id=63539 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" X-MSNSERVER: AM3PPFA8433C869 Strict-Transport-Security: max-age=31536000; includeSubDomains MS-CV: J6KgyauXmE2XKGBLzG6CJA.0 X-QosStats: {"ApiId":0,"ResultType":2,"SourcePropertyId":0,"TargetPropertyId":42} X-ThrowSite: 4212.9205 X-ClientErrorCode: PassportAuthFail X-ErrorCodeChain: Unauthenticated X-AsmVersion: UNKNOWN; 19.1109.227.2009 Date: Fri, 10 Mar 2023 12:49:55 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2023-03-10 12:49:55 UTC	117	OUT	GET /scripts/c/ms.shared.analytics.mectrl-3.2.6.gbl.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" Origin: https://ukc-onenote.officeapps.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ukc-onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-03-10 12:49:55 UTC	118	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000, immutable, no-transform Content-Length: 90228 Content-Type: text/javascript; charset=utf-8 Content-MD5: RlzwH95FOkmm6gksZWAC+w== Last-Modified: Thu, 18 Aug 2022 21:40:45 GMT ETag: 0x8DA81624EF9033C X-Cache: TCP_HIT x-ms-request-id: c3ef70b1-001e-0076-092e-4b9087000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 3.2.6 Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref-OriginShield: 0QO8HZAAAAACZGejDKXvQSbZStrNrXe83RlJBMjMxMDUwNDE4MDMxAGYxY2E3M2Q0LTg4ODMtNGNhZi1hYmRjLWZlMmQ1NjdhZmI5Ng== X-Azure-Ref: 0cycLZAAAAACN3w7WvL2DSYcHvPbu4WLnRlJBMzFFREdFMDkwNwBmMWNhNzNkNC04ODgzLTRjYWYtYWJkYy1mZTJkNTY3YWZiOTY= Date: Fri, 10 Mar 2023 12:49:55 GMT Connection: close
2023-03-10 12:49:55 UTC	119	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 20 53 44 4b 20 53 68 61 72 65 64 20 41 6e 61 6c 79 74 69 63 73 2c 20 33 2e 32 2e 36 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 66 3d 22 66 75 6e 63 74 69 6f 6e 22 2c 6d 3d 22 6f 62 6a 65 63 74 22 2c 5a 3d 22 75 6e 64 65 66 69 6e 65 64 22 2c 61 3d 22 70 72 6f 74 6f 74 79 70 65 22 2c 43 3d 22 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 22 2c 49 3d 4f 62 6a 65 63 74 2c 78 3d 49 5b Data Ascii: /! 1DS JS SDK Shared Analytics, 3.2.6 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e){"use strict";var f="function",m="object",Z="undefined",a="prototype",C="hasOwnProperty",I=Object,x=I[
2023-03-10 12:49:55 UTC	135	IN	Data Raw: 66 2c 77 74 2c 58 29 2c 51 28 74 29 7c 7c 28 75 3d 69 72 28 29 2c 58 28 6f 5b 6a 72 5d 29 26 26 30 3c 28 6e 3d 43 74 28 29 2b 31 65 33 2a 74 29 26 26 28 28 72 3d 6e 65 77 20 44 61 74 65 29 2e 73 65 74 54 69 6d 65 28 6e 29 2c 78 74 28 6f 2c 6a 72 2c 73 69 28 72 2c 75 3f 56 72 3a 48 72 29 7c 7c 73 69 28 72 2c 75 3f 56 72 3a 48 72 29 7c 7c 76 2c 77 74 29 29 2c 75 7c 7c 78 74 28 6f 2c 22 6d 61 78 2d 61 67 65 22 2c 76 2b 74 2c 6e 75 6c 6c 2c 58 29 29 2c 28 6e 3d 65 72 28 29 29 26 26 22 68 74 74 70 73 3a 22 3d 3d 3d 6e 2e 70 72 6f 74 6f 63 6f 6c 26 26 28 78 74 28 6f 2c 22 73 65 63 75 72 65 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 58 29 2c 28 5a 72 3d 6e 75 6c 6c 3d 3d 3d 5a 72 3f 21 28 47 28 72 3d 28 59 74 28 29 7c 7c 7b 7d 29 5b 6f 6e 5d 29 26 26 28 67 28 72 2c 22 Data Ascii: f,wt,X),Q(t)\|\|(u=ir(),X(o[jr])&&0<(n=Ct()+1e3*t)&&((r=new Date).setTime(n),xt(o,jr,si(r,u?Vr:Hr)\|\|si(r,u?Vr:Hr)\|\|v,wt)),u\|\|xt(o,"max-age",v+t,null,X)),(n=er())&&"https:"===n.protocol&&(xt(o,"secure",null,null,X),(Zr=null===Zr?!(G(r=(Yt()\|\|{})[on])&&(g(r,"
2023-03-10 12:49:55 UTC	151	IN	Data Raw: 64 7d 2c 73 65 74 53 70 61 6e 49 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6a 69 28 65 29 26 26 28 6e 2e 73 70 61 6e 49 64 3d 65 29 7d 2c 67 65 74 54 72 61 63 65 46 6c 61 67 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 5b 53 6e 5d 7d 2c 73 65 74 54 72 61 63 65 46 6c 61 67 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 5b 53 6e 5d 3d 65 7d 7d 29 2c 6b 7d 2c 70 2e 73 65 74 54 72 61 63 65 43 74 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6b 3d 65 7c 7c 6e 75 6c 6c 7d 2c 5f 74 28 70 2c 22 61 64 64 55 6e 6c 6f 61 64 43 62 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 44 7d 2c 22 61 64 64 22 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 77 6f 28 65 2c 74 2c 72 2c 69 29 7b 69 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 26 26 Data Ascii: d},setSpanId:function(e){ji(e)&&(n.spanId=e)},getTraceFlags:function(){return n[Sn]},setTraceFlags:function(e){n[Sn]=e}}),k},p.setTraceCtx=function(e){k=e\|\|null},_t(p,"addUnloadCb",function(){return D},"add")})}function wo(e,t,r,i){ie(e,function(e){if(e&&
2023-03-10 12:49:55 UTC	167	IN	Data Raw: 3d 63 2c 65 2e 65 70 6f 63 68 3d 41 72 28 21 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 2c 69 69 28 73 2c 75 29 29 3b 61 2e 69 73 45 6e 61 62 6c 65 64 28 29 7c 7c 6f 3f 28 72 3d 61 2c 69 3d 42 61 2c 72 3d 28 6f 3f 6f 2e 67 65 74 50 72 6f 70 65 72 74 79 28 69 29 7c 7c 22 22 3a 51 6f 28 72 2c 69 29 29 7c 7c 7a 69 28 29 2c 69 3d 61 2c 6e 3d 42 61 2c 74 3d 72 2c 6f 3f 6f 2e 73 65 74 50 72 6f 70 65 72 74 79 28 6e 2c 74 29 3a 69 2e 73 65 74 28 6e 2c 74 2c 33 31 35 33 36 65 33 29 2c 65 2e 69 6e 73 74 61 6c 6c 49 64 3d 72 29 3a 61 2e 70 75 72 67 65 28 42 61 29 2c 65 2e 67 65 74 53 65 71 75 65 6e 63 65 49 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 2b 2b 63 7d 7d 29 7d 76 61 72 20 56 61 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 29 7b 74 68 69 73 Data Ascii: =c,e.epoch=Ar(!1).toString(),ii(s,u));a.isEnabled()\|\|o?(r=a,i=Ba,r=(o?o.getProperty(i)\|\|"":Qo(r,i))\|\|zi(),i=a,n=Ba,t=r,o?o.setProperty(n,t):i.set(n,t,31536e3),e.installId=r):a.purge(Ba),e.getSequenceId=function(){return++c}})}var Va=function(e,n,t,r){this
2023-03-10 12:49:55 UTC	183	IN	Data Raw: 65 28 63 2c 31 29 2c 63 2d 2d 7d 63 2b 2b 7d 69 26 26 30 3c 69 2e 6c 65 6e 67 74 68 26 26 67 2e 73 69 7a 65 45 78 63 65 65 64 2e 70 75 73 68 28 6e 73 2e 63 72 65 61 74 65 28 70 2e 69 4b 65 79 28 29 2c 69 29 29 2c 6f 26 26 30 3c 6f 2e 6c 65 6e 67 74 68 26 26 67 2e 66 61 69 6c 65 64 45 76 74 73 2e 70 75 73 68 28 6e 73 2e 63 72 65 61 74 65 28 70 2e 69 4b 65 79 28 29 2c 6f 29 29 2c 72 26 26 28 67 2e 62 61 74 63 68 65 73 2e 70 75 73 68 28 70 29 2c 67 2e 70 61 79 6c 6f 61 64 42 6c 6f 62 3d 6e 2c 67 2e 6e 75 6d 45 76 65 6e 74 73 3d 74 2c 61 3d 70 2e 69 4b 65 79 28 29 2c 2d 31 3d 3d 3d 76 74 28 67 2e 61 70 69 4b 65 79 73 2c 61 29 26 26 67 2e 61 70 69 4b 65 79 73 2e 70 75 73 68 28 61 29 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 70 61 79 6c 6f Data Ascii: e(c,1),c--}c++}i&&0<i.length&&g.sizeExceed.push(ns.create(p.iKey(),i)),o&&0<o.length&&g.failedEvts.push(ns.create(p.iKey(),o)),r&&(g.batches.push(p),g.payloadBlob=n,g.numEvents=t,a=p.iKey(),-1===vt(g.apiKeys,a)&&g.apiKeys.push(a))},function(){return{paylo
2023-03-10 12:49:55 UTC	199	IN	Data Raw: 74 65 45 76 65 6e 74 4c 69 6d 69 74 29 2c 30 3c 54 2e 61 75 74 6f 46 6c 75 73 68 45 76 65 6e 74 73 4c 69 6d 69 74 26 26 28 50 3d 54 2e 61 75 74 6f 46 6c 75 73 68 45 76 65 6e 74 73 4c 69 6d 69 74 29 2c 63 74 28 54 5b 4e 73 5d 29 26 26 28 5a 3d 54 5b 4e 73 5d 29 2c 63 74 28 54 5b 4c 73 5d 29 26 26 28 59 3d 54 5b 4c 73 5d 29 2c 5f 28 29 2c 54 2e 68 74 74 70 58 48 52 4f 76 65 72 72 69 64 65 26 26 54 2e 68 74 74 70 58 48 52 4f 76 65 72 72 69 64 65 2e 73 65 6e 64 50 4f 53 54 26 26 28 4f 3d 54 2e 68 74 74 70 58 48 52 4f 76 65 72 72 69 64 65 29 2c 57 6f 28 64 2e 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 29 26 26 45 2e 61 64 64 51 75 65 72 79 53 74 72 69 6e 67 50 61 72 61 6d 65 74 65 72 28 22 61 6e 6f 6e 63 6b 6e 6d 22 2c 64 2e 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 Data Ascii: teEventLimit),0<T.autoFlushEventsLimit&&(P=T.autoFlushEventsLimit),ct(T[Ns])&&(Z=T[Ns]),ct(T[Ls])&&(Y=T[Ls]),_(),T.httpXHROverride&&T.httpXHROverride.sendPOST&&(O=T.httpXHROverride),Wo(d.anonCookieName)&&E.addQueryStringParameter("anoncknm",d.anonCookieNa