Edit tour

Windows Analysis Report
https://uqgekpc20qn1.azureedge.net/6466/

Overview

General Information

Sample URL:	https://uqgekpc20qn1.azureedge.net/6466/
Analysis ID:	1430642
Infos:

Detection

TechSupportScam

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on favicon image match)

Yara detected TechSupportScam

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Phishing site detected (based on OCR NLP Model)

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6388 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1972,i,15391958485553789851,5593228084216496742,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6592 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://uqgekpc20qn1.azureedge.net/6466/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_294	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.6.pages.csv	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security
0.0.pages.csv	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://uqgekpc20qn1.azureedge.net/6466/

SlashNext: detection malicious, Label: Scareware type: Phishing & Social Engineering

Phishing

Phishing site detected (based on favicon image match)

Source: https://uqgekpc20qn1.azureedge.net/6466/

Matcher: Template: microsoft matched with high similarity

Yara detected TechSupportScam

Source: Yara match	File source: 0.6.pages.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_294, type: DROPPED

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0&sso_reload=true	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117679298401.NDAyNmE4MzAtMzE0NC00YWI5LTlkMjgtMjY1NzYzODA0NzEyNTdkN2Q1NTktMTNjYi00YTE3LTg0YTYtOWQ5ZDhiYmFkMjY3&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJpGEZgMh4A3s7hHB1xGx7GGkhz2yircGAyHSWH-7BeYJ_GCPPV-0kxsjjzFP_IhvBFO4DV2dgYXuErCumvTJjTfSAJ9F1rgBNvwEDQatYueICNUMCoFNa6k-_IX1Frsh6GJVI-wSz5aSVshI-PTmu0Yx3md_Eul2QwvwDZWKZaVKh27m_inU2WOie4SYwrn5iDXCoI7VdAZoeV3BfOQjEzdE8eWxoJAv_OP_PmM3IAIWAPXi83o6QpGEjjweMzpIz8xnZGvaA9vj8FL7h0J0TMndGMQzr8uFtzQAGh1KXuHY-xMlOS_Ei1j5xZWbUys0AZIrUcE6zGT-UV2JgIey1um&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117679298401.NDAyNmE4MzAtMzE0NC00YWI5LTlkMjgtMjY1NzYzODA0NzEyNTdkN2Q1NTktMTNjYi00YTE3LTg0YTYtOWQ5ZDhiYmFkMjY3&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJpGEZgMh4A3s7hHB1xGx7GGkhz2yircGAyHSWH-7BeYJ_GCPPV-0kxsjjzFP_IhvBFO4DV2dgYXuErCumvTJjTfSAJ9F1rgBNvwEDQatYueICNUMCoFNa6k-_IX1Frsh6GJVI-wSz5aSVshI-PTmu0Yx3md_Eul2QwvwDZWKZaVKh27m_inU2WOie4SYwrn5iDXCoI7VdAZoeV3BfOQjEzdE8eWxoJAv_OP_PmM3IAIWAPXi83o6QpGEjjweMzpIz8xnZGvaA9vj8FL7h0J0TMndGMQzr8uFtzQAGh1KXuHY-xMlOS_Ei1j5xZWbUys0AZIrUcE6zGT-UV2JgIey1um&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0&sso_reload=true	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117679298401.NDAyNmE4MzAtMzE0NC00YWI5LTlkMjgtMjY1NzYzODA0NzEyNTdkN2Q1NTktMTNjYi00YTE3LTg0YTYtOWQ5ZDhiYmFkMjY3&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJpGEZgMh4A3s7hHB1xGx7GGkhz2yircGAyHSWH-7BeYJ_GCPPV-0kxsjjzFP_IhvBFO4DV2dgYXuErCumvTJjTfSAJ9F1rgBNvwEDQatYueICNUMCoFNa6k-_IX1Frsh6GJVI-wSz5aSVshI-PTmu0Yx3md_Eul2QwvwDZWKZaVKh27m_inU2WOie4SYwrn5iDXCoI7VdAZoeV3BfOQjEzdE8eWxoJAv_OP_PmM3IAIWAPXi83o6QpGEjjweMzpIz8xnZGvaA9vj8FL7h0J0TMndGMQzr8uFtzQAGh1KXuHY-xMlOS_Ei1j5xZWbUys0AZIrUcE6zGT-UV2JgIey1um&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: Title: Redirecting does not match URL

Source: Chrome DOM: 1.4	ML Model on OCR Text: Matched 86.4% probability on "Leave site? Microsoft Support Microsoft 365 365 All Microsoft Changes vou made may not be saved. C) Prevent this from creatng additional dialogs Cancel Wir A crincal error has (Ecurred due to the outdated version of the browser. Update your browser as as possible. The following errors are also gxyssible on outdated versions Of the browser: Microsoft x Microsoft Windows Security Center Threat Detected: xxbc Detected Address 'P: 154.16.105.36 4/24/2024, AM Location: Las Vegas, United States Irsullation & DrWers air ISP: Cogent Communications with Access has been blocked Contact Microsoft Windows Support: +1-888-531-6466 Microsoft Windows Continue Microsoft Support +1-888-531-6466 -e Microsoft Windows: Support Contact +1-888-531-6466 n you deice to me to COVID-19, via a that to browser Wcrosoft have hcreased by 624K &cause Mthis, we recormnend a "
Source: Chrome DOM: 4.7	ML Model on OCR Text: Matched 86.2% probability on "Leave site? Microsoft Support Microsoft 365 365 All Microsoft Changes vou made may not be saved. C) Prevent this from creatng additional dialogs Cancel Will A critical error has due to the version Of the browser. Update your browser as as The following errors are also possible on outdated versions of the browser: Microsoft Windows x Microsoft Windows Security Center Threat Detected: xxbc Detected Address 'P: 154.16.105.36 4/24/2024, AM Location: Las Vegas, United States Irsullation & DrWers air ISP: Cogent Communications with Access has been blocked Contact Microsoft Windows Support: +1-888-531-6466 Microsoft Windows Continue Microsoft Support +1-888-531-6466 -e Microsoft Windows: Support Contact +1-888-531-6466 o COVO-19, data theft mcidents via a fra that *tects to pur brows-8 Waosoft have mcreasS by 624%_ Because of this, we recorMnend a security that G n rerm and re pu_ The "

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0&sso_reload=true	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117679298401.NDAyNmE4MzAtMzE0NC00YWI5LTlkMjgtMjY1NzYzODA0NzEyNTdkN2Q1NTktMTNjYi00YTE3LTg0YTYtOWQ5ZDhiYmFkMjY3&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJpGEZgMh4A3s7hHB1xGx7GGkhz2yircGAyHSWH-7BeYJ_GCPPV-0kxsjjzFP_IhvBFO4DV2dgYXuErCumvTJjTfSAJ9F1rgBNvwEDQatYueICNUMCoFNa6k-_IX1Frsh6GJVI-wSz5aSVshI-PTmu0Yx3md_Eul2QwvwDZWKZaVKh27m_inU2WOie4SYwrn5iDXCoI7VdAZoeV3BfOQjEzdE8eWxoJAv_OP_PmM3IAIWAPXi83o6QpGEjjweMzpIz8xnZGvaA9vj8FL7h0J0TMndGMQzr8uFtzQAGh1KXuHY-xMlOS_Ei1j5xZWbUys0AZIrUcE6zGT-UV2JgIey1um&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/silentsigninhandler	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117679298401.NDAyNmE4MzAtMzE0NC00YWI5LTlkMjgtMjY1NzYzODA0NzEyNTdkN2Q1NTktMTNjYi00YTE3LTg0YTYtOWQ5ZDhiYmFkMjY3&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJpGEZgMh4A3s7hHB1xGx7GGkhz2yircGAyHSWH-7BeYJ_GCPPV-0kxsjjzFP_IhvBFO4DV2dgYXuErCumvTJjTfSAJ9F1rgBNvwEDQatYueICNUMCoFNa6k-_IX1Frsh6GJVI-wSz5aSVshI-PTmu0Yx3md_Eul2QwvwDZWKZaVKh27m_inU2WOie4SYwrn5iDXCoI7VdAZoeV3BfOQjEzdE8eWxoJAv_OP_PmM3IAIWAPXi83o6QpGEjjweMzpIz8xnZGvaA9vj8FL7h0J0TMndGMQzr8uFtzQAGh1KXuHY-xMlOS_Ei1j5xZWbUys0AZIrUcE6zGT-UV2JgIey1um&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117236772120.YTFhNTc4OTEtMDYxZi00NGVkLTg0NzAtMzI5M2Y5NjM0NGE2MmU4MzY2ZTMtNjk5Mi00MzFkLWJiMDEtYzllZTVmNjhmNTMx&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJrBZ3ThJ6ocAzPL0h75_dGvnuMyK8nlsKUAhXy25x1_Kh4jtAi_2BDmPmi_m6MijP17gGP0SyXerUw5gX-bYZ_1Vkk9vyRf_mdDd3AQdUmah3LLZob0GsjiOsivofQJQ_l8z6XXlHFrmzF4kcObpKmndnBSDMaJQR5-SCtt3iQBN-TYbAWXwjVzpyshYOfAJjnru5A0Xlli7l69LhJ26YIdEutmPCzzb27uv86K4fWvHhAbY0TE7DoYpJdwXi15zG9yFZKqsmPECP5n8d63FNElY1TjOL7PqALdPF1GL5TDrnI1Pu3RBAForSDZ-9bGOUdF48LQjVUFxN7wDkrHJeEB&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638495117679298401.NDAyNmE4MzAtMzE0NC00YWI5LTlkMjgtMjY1NzYzODA0NzEyNTdkN2Q1NTktMTNjYi00YTE3LTg0YTYtOWQ5ZDhiYmFkMjY3&prompt=none&nopa=2&state=CfDJ8CiTzr73KWNFsUGcHEnPeJpGEZgMh4A3s7hHB1xGx7GGkhz2yircGAyHSWH-7BeYJ_GCPPV-0kxsjjzFP_IhvBFO4DV2dgYXuErCumvTJjTfSAJ9F1rgBNvwEDQatYueICNUMCoFNa6k-_IX1Frsh6GJVI-wSz5aSVshI-PTmu0Yx3md_Eul2QwvwDZWKZaVKh27m_inU2WOie4SYwrn5iDXCoI7VdAZoeV3BfOQjEzdE8eWxoJAv_OP_PmM3IAIWAPXi83o6QpGEjjweMzpIz8xnZGvaA9vj8FL7h0J0TMndGMQzr8uFtzQAGh1KXuHY-xMlOS_Ei1j5xZWbUys0AZIrUcE6zGT-UV2JgIey1um&x-client-SKU=ID_NET6_0&x-client-ver=6.35.0.0	HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49811 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:49921 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49811 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	HTTP traffic detected: GET /6466/ HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/css/styles.css HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/css/font-awesome.min.css HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/bg1.jpg HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/bg2.jpg HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/js/jquery.min.js HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/minimize.jpg HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/kxFy-clip.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/qsbs-firewall.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?lang=en HTTP/1.1Host: ipwho.isConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://uqgekpc20qn1.azureedge.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://uqgekpc20qn1.azureedge.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/bg2.jpg HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/microsoft.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/js/bootstrap.min.js HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uqgekpc20qn1.azureedge.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/js/main.js HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/qsbs-firewall.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/minimize.jpg HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/js/scripts.js HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/s-S4-acc.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/Z5BR-network.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/uZbx-si.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uqgekpc20qn1.azureedge.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /6466/images/-EBq-current.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/images/nOxp-sett.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/images/kxFy-clip.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /?lang=en HTTP/1.1Host: ipwho.isConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/cross.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/images/re.gif HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/media/iicme4.mp3 HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Language: en-US,en;q=0.9Cookie: PHPREFS=fullRange: bytes=0-
Source: global traffic	HTTP traffic detected: GET /get/script.js?referrer=https://uqgekpc20qn1.azureedge.net/6466/ HTTP/1.1Host: userstatics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uqgekpc20qn1.azureedge.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/637211488626768?v=2.9.154&r=stable&domain=uqgekpc20qn1.azureedge.net&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uqgekpc20qn1.azureedge.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/microsoft.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/media/speech.mp3 HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Language: en-US,en;q=0.9Cookie: PHPREFS=fullRange: bytes=0-
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/fonts/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uqgekpc20qn1.azureedge.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uqgekpc20qn1.azureedge.net/6466/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/fonts/fontawesome-webfont.woff2 HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uqgekpc20qn1.azureedge.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uqgekpc20qn1.azureedge.net/6466/css/font-awesome.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/images/Z5BR-network.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/images/s-S4-acc.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/images/uZbx-si.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/images/nOxp-sett.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /6466/images/-EBq-current.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /tr/?id=637211488626768&ev=PageView&dl=https%3A%2F%2Fuqgekpc20qn1.azureedge.net&rl=&if=false&ts=1713914921306&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4124&fbp=fb.1.1713914921293.1350211828&pm=1&hrl=e32d4c&ler=empty&cdl=API_unavailable&it=1713914916953&coo=false&cs_cc=1&cas=6853986274701070%2C7741398529218150%2C7248198005229028%2C7452927741453105%2C7155926847804247%2C24327169313593447%2C24699268002997777%2C7042757742448956&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uqgekpc20qn1.azureedge.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=637211488626768&ev=PageView&dl=https%3A%2F%2Fuqgekpc20qn1.azureedge.net&rl=&if=false&ts=1713914921306&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4124&fbp=fb.1.1713914921293.1350211828&pm=1&hrl=e32d4c&ler=empty&cdl=API_unavailable&it=1713914916953&coo=false&cs_cc=1&cas=6853986274701070%2C7741398529218150%2C7248198005229028%2C7452927741453105%2C7155926847804247%2C24327169313593447%2C24699268002997777%2C7042757742448956&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger, event-source;navigation-sourceReferer: https://uqgekpc20qn1.azureedge.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/re.gif HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6466/images/cross.png HTTP/1.1Host: uqgekpc20qn1.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPREFS=full
Source: global traffic	HTTP traffic detected: GET /tr/?id=637211488626768&ev=PageView&dl=https%3A%2F%2Fuqgekpc20qn1.azureedge.net&rl=&if=false&ts=1713914921306&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4124&fbp=fb.1.1713914921293.1350211828&pm=1&hrl=e32d4c&ler=empty&cdl=API_unavailable&it=1713914916953&coo=false&cs_cc=1&cas=6853986274701070%2C7741398529218150%2C7248198005229028%2C7452927741453105%2C7155926847804247%2C24327169313593447%2C24699268002997777%2C7042757742448956&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=637211488626768&ev=PageView&dl=https%3A%2F%2Fuqgekpc20qn1.azureedge.net&rl=&if=false&ts=1713914921306&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4124&fbp=fb.1.1713914921293.1350211828&pm=1&hrl=e32d4c&ler=empty&cdl=API_unavailable&it=1713914916953&coo=false&cs_cc=1&cas=6853986274701070%2C7741398529218150%2C7248198005229028%2C7452927741453105%2C7155926847804247%2C24327169313593447%2C24699268002997777%2C7042757742448956&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=V1rVXU+dMsfa+eV&MD=SNzRoXhF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.24086.4/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.24086.4/en-US/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/FetchSessions_Core_JZTKIH_Tdx6afyJMNXnGEQ2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000/content/js/MeControl_5BiUVwve_jNbxMN6Aaj8bg2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MC1=GUID=c48a4fba52d14d73810c0ac280614a2d&HASH=c48a&LV=202404&V=4&LU=1713914926985; MS0=9f227fc0175b4a7d97731102589c73ab; MSCC=NR; ak_bmsc=2143561EB21B96E66143C28BD12659ED~000000000000000000000000000000~YAAQhcHJF0O2l+aOAQAAq+BKDRdt/Y4KkdaCuXUU0e3pOkNwmuajr5W8t/fK9eyn50C9cK7chcG9YxxJhrptE3uWoBeGnGPLVzLEg8jNIFgQ0y3BvuzAnMiQSxep2RNYwJ4Wu5DMHBkYlX6sHebJ8QfJDai9jUhzM/4H2id91r6e+1+lgXwuzIBmyJ+HuaoDR3LbB2CQpb6OtelCVF2E/cMO8y1aLiwMFGiGou0+dDOJjs6zVqrML5W4x+T8qkmnD51aGknRS3wzIqyMOzpv7t50TOFUhqx1l+FuXhwp/caiwLLcH/flL9ZxjXLIKLxxmiWPfhB5XQS+hX1DPDPbQcJ92DFf1MJC3tt10s9oOHFYSJ2jciTYgAHyzpt58Q==; bm_sv=9C69E03CD5AC5A49DC116D487DA7F1F7~YAAQhcHJF1O2l+aOAQAAL+NKDRej1LOwkhsThO+GgLBqfe3YPNGsz+1uXiwvVxmZi7TEMl2K69f4WA7wIntPgRVn1qydrJFVhfZnrhglsCx98c6XtlTYiK05WYPVoyP141hPsvQC6stU2cfGUeh2N6KG/E2NUqKKYC+D9hI++ZbCNryccXnVkyCxpMIeQGzpTqGhaREBAY7pXEGcJnujHzJ2ICb5FUqZLWRiNYss882gwhr4i6f0D8SjMolJ4M2mePSR~1
Source: global traffic	HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/FetchSessions_Core_JZTKIH_Tdx6afyJMNXnGEQ2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=V1rVXU+dMsfa+eV&MD=SNzRoXhF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.24086.4/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.24086.4/en-US/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000/content/js/MeControl_9Q-UV4NxY-KLeZzNG9Yrsw2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_238.2.dr	String found in binary or memory: "//www.linkedin.com/shareArticle?mini=true&url=" + equals www.linkedin.com (Linkedin)
Source: chromecache_238.2.dr	String found in binary or memory: url: "//www.facebook.com/share.php?u=" + h, equals www.facebook.com (Facebook)
Source: chromecache_306.2.dr	String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=null;e.exports=new h(function(d,e){try{n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}}}catch(a){return}function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL\|\|!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=func
Source: chromecache_294.2.dr	String found in binary or memory: <noscript><img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=637211488626768&ev=PageView&noscript=1"/></noscript> equals www.facebook.com (Facebook)

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713914891896&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: chromecache_279.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_279.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_273.2.dr	String found in binary or memory: http://github.com/aFarkas/lazysizes
Source: chromecache_281.2.dr, chromecache_356.2.dr, chromecache_193.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_341.2.dr	String found in binary or memory: http://github.com/requirejs/domReady
Source: chromecache_341.2.dr	String found in binary or memory: http://github.com/requirejs/requirejs/LICENSE
Source: chromecache_240.2.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_202.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_240.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Source: chromecache_366.2.dr, chromecache_384.2.dr, chromecache_330.2.dr, chromecache_349.2.dr, chromecache_197.2.dr	String found in binary or memory: https://assets.onestore.ms
Source: chromecache_240.2.dr	String found in binary or memory: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c
Source: chromecache_240.2.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: chromecache_294.2.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: chromecache_406.2.dr	String found in binary or memory: https://ezgif.com/optimize
Source: chromecache_366.2.dr, chromecache_384.2.dr, chromecache_330.2.dr, chromecache_349.2.dr, chromecache_197.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net
Source: chromecache_240.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: chromecache_294.2.dr	String found in binary or memory: https://ipwho.is/?lang=en
Source: chromecache_205.2.dr, chromecache_220.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_205.2.dr, chromecache_220.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_366.2.dr, chromecache_384.2.dr, chromecache_330.2.dr, chromecache_349.2.dr, chromecache_197.2.dr	String found in binary or memory: https://mem.gfx.ms
Source: chromecache_366.2.dr, chromecache_384.2.dr, chromecache_330.2.dr, chromecache_349.2.dr, chromecache_197.2.dr	String found in binary or memory: https://microsoftwindows.112.2o7.net
Source: chromecache_240.2.dr	String found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_240.2.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: chromecache_240.2.dr	String found in binary or memory: https://products.office.com/en-us/home
Source: chromecache_240.2.dr	String found in binary or memory: https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams
Source: chromecache_240.2.dr	String found in binary or memory: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Source: chromecache_292.2.dr	String found in binary or memory: https://ussearchprod.trafficmanager.net/services/api/v1.0/store/categories
Source: chromecache_240.2.dr	String found in binary or memory: https://www.onenote.com/
Source: chromecache_240.2.dr	String found in binary or memory: https://www.skype.com/en/
Source: chromecache_240.2.dr	String found in binary or memory: https://www.xbox.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1972,i,15391958485553789851,5593228084216496742,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://uqgekpc20qn1.azureedge.net/6466/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1972,i,15391958485553789851,5593228084216496742,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Install
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Install
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Install
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Install
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Install
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Install
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Install
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Install

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://uqgekpc20qn1.azureedge.net/6466/	0%	Avira URL Cloud	safe
https://uqgekpc20qn1.azureedge.net/6466/	100%	SlashNext	Scareware type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://ipwho.is/?lang=en	0%	URL Reputation	safe
https://assets.onestore.ms	0%	URL Reputation	safe
https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1	0%	URL Reputation	safe
https://mem.gfx.ms	0%	URL Reputation	safe
https://mem.gfx.ms/scripts/me/MeControl/10.24086.4/en-US/meCore.min.js	0%	Avira URL Cloud	safe
https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c	0%	Avira URL Cloud	safe
https://mem.gfx.ms/scripts/me/MeControl/10.24086.4/en-US/meBoot.min.js	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
star-mini.c10r.facebook.com	31.13.70.36	true	false	high
scontent.xx.fbcdn.net	31.13.70.7	true	false	high
ipwho.is	108.181.47.111	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
userstatics.com	104.21.53.38	true	false	unknown
microsoftwindows.112.2o7.net	63.140.36.51	true	false	high
part-0041.t-0009.t-msedge.net	13.107.246.69	true	false	unknown
sni1gl.wpc.alphacdn.net	152.195.19.97	true	false	unknown
www.google.com	142.250.141.103	true	false	high
cs1227.wpc.alphacdn.net	192.229.211.199	true	false	unknown
js.monitor.azure.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
logincdn.msftauth.net	unknown	unknown	false	unknown
assets.onestore.ms	unknown	unknown	false	unknown
connect.facebook.net	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high
mem.gfx.ms	unknown	unknown	false	unknown
c.s-microsoft.com	unknown	unknown	false	high
support.content.office.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
acctcdn.msftauth.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://ipwho.is/?lang=en	false	URL Reputation: safe	unknown
https://mem.gfx.ms/scripts/me/MeControl/10.24086.4/en-US/meBoot.min.js	false	Avira URL Cloud: safe	unknown
https://mem.gfx.ms/scripts/me/MeControl/10.24086.4/en-US/meCore.min.js	false	Avira URL Cloud: safe	unknown
https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1	false	URL Reputation: safe	unknown
https://connect.facebook.net/en_US/fbevents.js	false		high
https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://outlook.live.com/owa/	chromecache_240.2.dr	false		high
http://fontawesome.io	chromecache_279.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	chromecache_202.2.dr	false		high
https://microsoftwindows.112.2o7.net	chromecache_366.2.dr, chromecache_384.2.dr, chromecache_330.2.dr, chromecache_349.2.dr, chromecache_197.2.dr	false		high
http://github.com/requirejs/requirejs/LICENSE	chromecache_341.2.dr	false		high
https://www.skype.com/en/	chromecache_240.2.dr	false		high
https://products.office.com/en-us/home	chromecache_240.2.dr	false		high
https://assets.onestore.ms	chromecache_366.2.dr, chromecache_384.2.dr, chromecache_330.2.dr, chromecache_349.2.dr, chromecache_197.2.dr	false	URL Reputation: safe	unknown
https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c	chromecache_240.2.dr	false	Avira URL Cloud: safe	unknown
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js	chromecache_240.2.dr	false		high
https://login.windows-ppe.net	chromecache_205.2.dr, chromecache_220.2.dr	false		high
https://mem.gfx.ms	chromecache_366.2.dr, chromecache_384.2.dr, chromecache_330.2.dr, chromecache_349.2.dr, chromecache_197.2.dr	false	URL Reputation: safe	unknown
http://fontawesome.io/license	chromecache_279.2.dr	false		high
https://onedrive.live.com/about/en-us/	chromecache_240.2.dr	false		high
https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams	chromecache_240.2.dr	false		high
https://www.onenote.com/	chromecache_240.2.dr	false		high
http://github.com/requirejs/domReady	chromecache_341.2.dr	false		high
https://login.microsoftonline.com	chromecache_205.2.dr, chromecache_220.2.dr	false		high
https://www.xbox.com/	chromecache_240.2.dr	false		high
http://github.com/aFarkas/lazysizes	chromecache_273.2.dr	false		high
http://schema.org/Organization	chromecache_240.2.dr	false		high
http://github.com/requirejs/almond/LICENSE	chromecache_281.2.dr, chromecache_356.2.dr, chromecache_193.2.dr	false		high
https://ezgif.com/optimize	chromecache_406.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.69	part-0041.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.213.69	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.141.103	www.google.com	United States	15169	GOOGLEUS	false
142.250.141.147	unknown	United States	15169	GOOGLEUS	false
31.13.70.36	star-mini.c10r.facebook.com	Ireland	32934	FACEBOOKUS	false
108.181.47.111	ipwho.is	Canada	852	ASN852CA	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
31.13.70.7	scontent.xx.fbcdn.net	Ireland	32934	FACEBOOKUS	false
63.140.36.51	microsoftwindows.112.2o7.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
104.21.53.38	userstatics.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430642
Start date and time:	2024-04-24 01:27:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://uqgekpc20qn1.azureedge.net/6466/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@30/407@70/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.microsoft.com/ Browse: https://support.microsoft.com/en-us

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 22:28:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.982866690841369
Encrypted:	false
SSDEEP:	48:8ydiTuymHCidAKZdA19ehwiZUklqehzxy+3:8/3P2xy
MD5:	FF0FC164E5F981A35AD81A4EC19A079E
SHA1:	ADD993D2EBA6BD1D7C451F567F4697D2F90B7235
SHA-256:	A57482012D8B0C459EF749519809FF8A024578F8F79D11CBAC9454F606264CA9
SHA-512:	9B12FA3B517F29A91ACC80AD33F8B28100E36595773C13F0500DE142C06F76B9F371F9B8D443B30750FAEC959F260A86BFFDFC043D894E5BC58C6604B1016AD4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....2......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 01:28:28.666352987 CEST	53	51052	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:28.667264938 CEST	53	63832	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:29.641392946 CEST	53	53188	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:32.286628008 CEST	62827	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:32.286789894 CEST	56221	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:32.439954042 CEST	53	62827	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:32.440169096 CEST	53	56221	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:33.063325882 CEST	52492	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:33.063694000 CEST	60013	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:33.454044104 CEST	53	52492	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:33.454360008 CEST	53	60013	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:34.351952076 CEST	56169	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:34.353946924 CEST	62929	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:34.354969978 CEST	64855	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:34.355197906 CEST	51657	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:34.519736052 CEST	61159	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:34.520158052 CEST	64670	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:34.529206991 CEST	60240	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:34.529463053 CEST	52623	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:34.927357912 CEST	50671	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:34.928167105 CEST	65265	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:35.080877066 CEST	53	50671	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:35.082825899 CEST	53	65265	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:36.001308918 CEST	65467	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:36.013287067 CEST	64821	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:36.155217886 CEST	53	65467	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:36.167017937 CEST	53	64821	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:37.369343042 CEST	57394	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:37.371357918 CEST	49328	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:37.525950909 CEST	53	57394	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:37.526854038 CEST	53	49328	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:41.539782047 CEST	55422	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:41.540023088 CEST	59621	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:42.446572065 CEST	49802	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:42.446794033 CEST	53558	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:42.600215912 CEST	53	49802	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:42.600281000 CEST	53	53558	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:42.622416019 CEST	53295	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:42.622556925 CEST	54511	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:43.356097937 CEST	50599	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:43.356261015 CEST	64302	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:43.509566069 CEST	53	64302	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:43.509701014 CEST	53	50599	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:47.079233885 CEST	53	58259	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:47.977005005 CEST	53	49546	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:52.917885065 CEST	60912	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:52.918267012 CEST	49257	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:53.071461916 CEST	53	60912	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:53.071490049 CEST	53	49257	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:53.417956114 CEST	63302	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:53.418102026 CEST	56610	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:54.282771111 CEST	50740	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:54.296838999 CEST	50978	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:28:54.436369896 CEST	53	50740	1.1.1.1	192.168.2.5
Apr 24, 2024 01:28:54.449882030 CEST	53	50978	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:09.683460951 CEST	53	50094	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:14.876492977 CEST	58040	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:14.876995087 CEST	61457	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:14.879985094 CEST	63022	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:14.880276918 CEST	63373	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:17.356014013 CEST	58665	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:17.356312990 CEST	53976	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:22.910079956 CEST	63529	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:22.910458088 CEST	58242	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:22.915956974 CEST	49657	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:22.916146994 CEST	61344	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:23.069206953 CEST	62952	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:23.069745064 CEST	49587	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:25.684520960 CEST	56537	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:25.684843063 CEST	57968	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:28.228642941 CEST	49714	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:28.229000092 CEST	52103	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:28.364051104 CEST	53	59575	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:29.522631884 CEST	64633	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:29.522631884 CEST	61711	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:29.675865889 CEST	53	64633	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:29.676788092 CEST	53	61711	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:33.944046021 CEST	53	58415	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.011404991 CEST	62692	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:36.011769056 CEST	65500	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:36.151740074 CEST	53	60504	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.151842117 CEST	53	53836	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.165348053 CEST	53	62692	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.166121960 CEST	53	65500	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.306402922 CEST	53	58670	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.470736027 CEST	53	60544	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.470788956 CEST	53	58094	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.628170013 CEST	53	55270	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.628317118 CEST	53	59387	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.787305117 CEST	53	65202	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.787364960 CEST	53	57266	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.946842909 CEST	53	57790	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:36.947278023 CEST	53	60219	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:37.077946901 CEST	60661	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:37.078145981 CEST	54399	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:37.237628937 CEST	57250	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:37.237801075 CEST	59065	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:37.391083002 CEST	53	59065	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:37.392051935 CEST	53	57250	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:56.438231945 CEST	53	51662	1.1.1.1	192.168.2.5
Apr 24, 2024 01:29:56.931513071 CEST	55128	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:56.931849957 CEST	56807	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:29:57.423970938 CEST	53	53028	1.1.1.1	192.168.2.5
Apr 24, 2024 01:30:19.120187044 CEST	63417	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:19.120403051 CEST	59337	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:32.391669989 CEST	55354	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:32.391972065 CEST	62128	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:32.545355082 CEST	53	55354	1.1.1.1	192.168.2.5
Apr 24, 2024 01:30:32.545773029 CEST	53	62128	1.1.1.1	192.168.2.5
Apr 24, 2024 01:30:32.827827930 CEST	55489	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:32.827923059 CEST	61907	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:33.199908972 CEST	63789	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:33.201030016 CEST	54917	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:33.212119102 CEST	58545	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:33.212483883 CEST	64038	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:33.656905890 CEST	54118	53	192.168.2.5	1.1.1.1
Apr 24, 2024 01:30:33.657264948 CEST	62347	53	192.168.2.5	1.1.1.1

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:30 UTC	674	OUT	GET /6466/ HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:31 UTC	523	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:31 GMT Content-Type: text/html Content-Length: 25470 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Mon, 22 Apr 2024 08:47:42 GMT ETag: "0x8DC62A8DFD12782" x-ms-request-id: c7134230-c01e-003c-52d5-95219a000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232831Z-168bb8d798bdckn765t6bhwrfn00000001t000000001a0us x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:31 UTC	15861	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 53 65 63 75 72 69 74 79 20 63 65 6e 74 65 72 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 73 74 79 Data Ascii: <!DOCTYPE html><html><head><meta name="robots" content="noindex, nofollow" /><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Security center</title><link rel="stylesheet" href="css/sty
2024-04-23 23:28:31 UTC	9609	IN	Data Raw: 09 3c 69 6d 67 20 73 72 63 3d 22 69 6d 61 67 65 73 2f 2d 45 42 71 2d 63 75 72 72 65 6e 74 2e 70 6e 67 22 20 77 69 64 74 68 3d 22 32 30 70 78 22 20 68 65 69 67 68 74 3d 22 32 30 70 78 3b 22 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 31 30 70 78 3b 20 74 6f 70 3a 20 33 33 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 22 20 2f 3e 0a 09 09 09 09 09 09 09 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 20 6c 65 66 74 3a 20 33 30 70 78 22 3e 43 75 72 72 65 6e 74 20 54 68 72 65 61 74 3c 2f 70 3e 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 09 09 3c 62 72 20 2f 3e 3c 62 72 20 2f 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 Data Ascii: <img src="images/-EBq-current.png" width="20px" height="20px;" style="margin-right: 10px; top: 33px; position: absolute" /><p style="font-weight: 400; position: absolute; left: 30px">Current Threat</p></div><br /><br /><div

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:31 UTC	575	OUT	GET /6466/css/styles.css HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:31 UTC	521	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:31 GMT Content-Type: text/css Content-Length: 8998 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Mon, 22 Apr 2024 08:47:42 GMT ETag: "0x8DC62A8DFD14E85" x-ms-request-id: f0b0aab1-f01e-00a1-2ed5-95d320000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232831Z-168bb8d798b22pnzt0dbur5w6s00000000mg000000001nw1 x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:31 UTC	8998	IN	Data Raw: 62 6f 64 79 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 20 6e 6f 6e 65 3b 0a 2d 6d 73 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 20 6e 6f 6e 65 3b 0a 75 73 65 72 2d 73 65 6c 65 63 74 3a 20 6e 6f 6e 65 3b 0a 20 20 2f 2a 0a 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 62 67 2e 70 6e 67 27 29 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 3b 0a 20 20 2a 2f 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 61 6c 69 62 72 69 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 68 69 64 64 65 6e 3b 0a 20 6f Data Ascii: body { background: #fff; -webkit-user-select: none;-ms-user-select: none;user-select: none; /* background: url('bg.png'); background-repeat: no-repeat; background-size: cover; */font-family: "Calibri", sans-serif; overflow-y: hidden; o

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:32 UTC	585	OUT	GET /6466/css/font-awesome.min.css HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:32 UTC	522	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:32 GMT Content-Type: text/css Content-Length: 27428 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Mon, 22 Apr 2024 08:47:42 GMT ETag: "0x8DC62A8DFDFA44C" x-ms-request-id: 332970e8-201e-0079-2cd5-95f479000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232832Z-168bb8d798b8nl86frq151a46000000004xg00000000ck6x x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:32 UTC	15862	IN	Data Raw: 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 35 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 46 6f 6e 74 41 77 65 73 6f 6d 65 27 3b 73 72 63 3a 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 5f 31 2e 65 6f 74 27 29 3b 73 72 63 3a 75 72 6c Data Ascii: /! Font Awesome 4.5.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont_1.eot');src:url
2024-04-23 23:28:32 UTC	11566	IN	Data Raw: 74 2d 6e 75 6d 65 72 69 63 2d 61 73 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 36 32 22 7d 2e 66 61 2d 73 6f 72 74 2d 6e 75 6d 65 72 69 63 2d 64 65 73 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 36 33 22 7d 2e 66 61 2d 74 68 75 6d 62 73 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 36 34 22 7d 2e 66 61 2d 74 68 75 6d 62 73 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 36 35 22 7d 2e 66 61 2d 79 6f 75 74 75 62 65 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 36 36 22 7d 2e 66 61 2d 79 6f 75 74 75 62 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 36 37 22 7d 2e 66 61 2d 78 69 6e 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 Data Ascii: t-numeric-asc:before{content:"\f162"}.fa-sort-numeric-desc:before{content:"\f163"}.fa-thumbs-up:before{content:"\f164"}.fa-thumbs-down:before{content:"\f165"}.fa-youtube-square:before{content:"\f166"}.fa-youtube:before{content:"\f167"}.fa-xing:before{cont

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:32 UTC	621	OUT	GET /6466/images/bg1.jpg HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:32 UTC	430	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:32 GMT Content-Type: image/jpeg Content-Length: 550 Connection: close Last-Modified: Mon, 22 Apr 2024 08:47:47 GMT ETag: "0x8DC62A8E29362C0" x-ms-request-id: ea91dab8-e01e-0014-07d5-954032000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232832Z-168bb8d798b5v6l944pfnrufyw00000000d000000001wux3 x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:32 UTC	550	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://uqgekpc20qn1.azureedge.net/6466/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Chrome Cache Entry: 201

Chrome Cache Entry: 202

Chrome Cache Entry: 203

Chrome Cache Entry: 204

Chrome Cache Entry: 205

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Chrome Cache Entry: 208

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Windows Analysis Report
https://uqgekpc20qn1.azureedge.net/6466/

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:32 UTC	621	OUT	GET /6466/images/bg2.jpg HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:33 UTC	430	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:33 GMT Content-Type: image/jpeg Content-Length: 550 Connection: close Last-Modified: Mon, 22 Apr 2024 08:47:47 GMT ETag: "0x8DC62A8E2ABA22D" x-ms-request-id: 9aef7319-701e-0064-3ad5-95f9c5000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232832Z-168bb8d798bdxx6c54n3memnpw00000004ng00000001pgas x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:33 UTC	550	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:33 UTC	563	OUT	GET /6466/js/jquery.min.js HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:34 UTC	530	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:33 GMT Content-Type: text/javascript Content-Length: 206554 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Mon, 22 Apr 2024 08:47:48 GMT ETag: "0x8DC62A8E2F1C8A4" x-ms-request-id: 9aef7412-701e-0064-17d5-95f9c5000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232833Z-168bb8d798b4bst68753kwrwcg000000013g00000000rk5x x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:34 UTC	15854	IN	Data Raw: 76 61 72 20 5f 30 78 32 61 37 66 39 33 3d 5f 30 78 34 61 38 64 3b 66 75 6e 63 74 69 6f 6e 20 5f 30 78 34 61 38 64 28 5f 30 78 33 37 62 32 33 66 2c 5f 30 78 34 31 32 36 33 32 29 7b 76 61 72 20 5f 30 78 33 36 64 65 38 63 3d 5f 30 78 33 36 64 65 28 29 3b 72 65 74 75 72 6e 20 5f 30 78 34 61 38 64 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 34 61 38 64 61 38 2c 5f 30 78 33 61 33 31 66 36 29 7b 5f 30 78 34 61 38 64 61 38 3d 5f 30 78 34 61 38 64 61 38 2d 30 78 31 38 38 3b 76 61 72 20 5f 30 78 61 32 64 38 34 37 3d 5f 30 78 33 36 64 65 38 63 5b 5f 30 78 34 61 38 64 61 38 5d 3b 72 65 74 75 72 6e 20 5f 30 78 61 32 64 38 34 37 3b 7d 2c 5f 30 78 34 61 38 64 28 5f 30 78 33 37 62 32 33 66 2c 5f 30 78 34 31 32 36 33 32 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 35 38 63 Data Ascii: var _0x2a7f93=_0x4a8d;function _0x4a8d(_0x37b23f,_0x412632){var _0x36de8c=_0x36de();return _0x4a8d=function(_0x4a8da8,_0x3a31f6){_0x4a8da8=_0x4a8da8-0x188;var _0xa2d847=_0x36de8c[_0x4a8da8];return _0xa2d847;},_0x4a8d(_0x37b23f,_0x412632);}(function(_0x58c
2024-04-23 23:28:34 UTC	16384	IN	Data Raw: 64 6f 72 6f 76 61 2d 6f 74 65 74 73 27 29 3a 5f 30 78 32 30 32 34 65 34 5b 5f 30 78 35 30 30 61 35 35 28 30 78 33 33 35 29 5d 28 27 69 64 27 2c 5f 30 78 34 63 64 33 61 64 29 2c 5f 30 78 34 63 64 33 61 64 3d 5f 30 78 35 30 30 61 35 35 28 30 78 34 30 32 29 2b 5f 30 78 34 63 64 33 61 64 2b 5f 30 78 35 30 30 61 35 35 28 30 78 33 61 32 29 2c 5f 30 78 34 33 62 63 61 31 3d 5f 30 78 35 33 33 62 61 38 5b 27 6c 65 6e 67 74 68 27 5d 3b 77 68 69 6c 65 28 5f 30 78 34 33 62 63 61 31 2d 2d 29 5f 30 78 35 33 33 62 61 38 5b 5f 30 78 34 33 62 63 61 31 5d 3d 5f 30 78 34 63 64 33 61 64 2b 5f 30 78 35 32 62 31 31 32 28 5f 30 78 35 33 33 62 61 38 5b 5f 30 78 34 33 62 63 61 31 5d 29 3b 5f 30 78 33 30 37 33 32 38 3d 5f 30 78 38 39 61 35 31 35 5b 5f 30 78 35 30 30 61 35 35 28 30 Data Ascii: dorova-otets'):_0x2024e4[_0x500a55(0x335)]('id',_0x4cd3ad),_0x4cd3ad=_0x500a55(0x402)+_0x4cd3ad+_0x500a55(0x3a2),_0x43bca1=_0x533ba8['length'];while(_0x43bca1--)_0x533ba8[_0x43bca1]=_0x4cd3ad+_0x52b112(_0x533ba8[_0x43bca1]);_0x307328=_0x89a515[_0x500a55(0
2024-04-23 23:28:34 UTC	16384	IN	Data Raw: 31 35 62 3f 5f 30 78 32 63 36 39 61 30 26 26 5f 30 78 32 31 62 39 34 30 5b 5f 30 78 34 33 33 66 63 33 28 30 78 32 64 62 29 5d 28 2d 5f 30 78 32 63 36 39 61 30 5b 5f 30 78 34 33 33 66 63 33 28 30 78 33 34 31 29 5d 29 3d 3d 3d 5f 30 78 32 63 36 39 61 30 3a 27 7e 3d 27 3d 3d 3d 5f 30 78 32 32 32 31 35 62 3f 28 27 5c 78 32 30 27 2b 5f 30 78 32 31 62 39 34 30 5b 5f 30 78 34 33 33 66 63 33 28 30 78 31 64 31 29 5d 28 5f 30 78 39 30 65 34 33 61 2c 27 5c 78 32 30 27 29 2b 27 5c 78 32 30 27 29 5b 5f 30 78 34 33 33 66 63 33 28 30 78 33 36 38 29 5d 28 5f 30 78 32 63 36 39 61 30 29 3e 2d 30 78 31 3a 27 7c 3d 27 3d 3d 3d 5f 30 78 32 32 32 31 35 62 3f 5f 30 78 32 31 62 39 34 30 3d 3d 3d 5f 30 78 32 63 36 39 61 30 7c 7c 5f 30 78 32 31 62 39 34 30 5b 27 73 6c 69 63 65 27 Data Ascii: 15b?_0x2c69a0&&_0x21b940[_0x433fc3(0x2db)](-_0x2c69a0[_0x433fc3(0x341)])===_0x2c69a0:'~='===_0x22215b?('\x20'+_0x21b940[_0x433fc3(0x1d1)](_0x90e43a,'\x20')+'\x20')[_0x433fc3(0x368)](_0x2c69a0)>-0x1:'\|='===_0x22215b?_0x21b940===_0x2c69a0\|\|_0x21b940['slice'
2024-04-23 23:28:34 UTC	16384	IN	Data Raw: 5f 30 78 33 66 35 31 63 33 26 26 5f 30 78 35 34 39 63 33 36 29 7b 5f 30 78 35 30 66 31 63 36 3d 30 78 30 3b 77 68 69 6c 65 28 5f 30 78 31 65 61 62 37 32 3d 5f 30 78 34 32 65 65 34 64 5b 5f 30 78 35 30 66 31 63 36 2b 2b 5d 29 69 66 28 5f 30 78 31 65 61 62 37 32 28 5f 30 78 35 34 39 63 33 36 2c 5f 30 78 31 31 37 66 66 2c 5f 30 78 66 65 30 61 66 66 29 29 7b 5f 30 78 34 65 30 30 37 30 5b 5f 30 78 32 66 39 36 64 33 28 30 78 33 30 35 29 5d 28 5f 30 78 35 34 39 63 33 36 29 3b 62 72 65 61 6b 3b 7d 5f 30 78 32 30 32 36 61 32 26 26 28 5f 30 78 31 33 38 62 30 30 3d 5f 30 78 35 31 32 63 30 66 29 3b 7d 5f 30 78 32 38 37 63 61 33 26 26 28 28 5f 30 78 35 34 39 63 33 36 3d 21 5f 30 78 31 65 61 62 37 32 26 26 5f 30 78 35 34 39 63 33 36 29 26 26 5f 30 78 31 61 30 36 63 61 Data Ascii: _0x3f51c3&&_0x549c36){_0x50f1c6=0x0;while(_0x1eab72=_0x42ee4d[_0x50f1c6++])if(_0x1eab72(_0x549c36,_0x117ff,_0xfe0aff)){_0x4e0070[_0x2f96d3(0x305)](_0x549c36);break;}_0x2026a2&&(_0x138b00=_0x512c0f);}_0x287ca3&&((_0x549c36=!_0x1eab72&&_0x549c36)&&_0x1a06ca
2024-04-23 23:28:34 UTC	16384	IN	Data Raw: 78 34 36 39 32 36 39 3d 7b 27 61 64 64 27 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 32 34 37 33 65 32 3d 5f 30 78 33 38 65 34 37 34 3b 69 66 28 5f 30 78 31 36 61 65 36 62 29 7b 76 61 72 20 5f 30 78 37 64 66 38 33 61 3d 5f 30 78 31 36 61 65 36 62 5b 5f 30 78 32 34 37 33 65 32 28 30 78 33 34 31 29 5d 3b 21 66 75 6e 63 74 69 6f 6e 20 5f 30 78 34 61 38 63 63 33 28 5f 30 78 62 35 64 39 33 37 29 7b 76 61 72 20 5f 30 78 36 65 34 32 33 66 3d 5f 30 78 32 34 37 33 65 32 3b 5f 30 78 35 66 32 65 66 63 5b 5f 30 78 36 65 34 32 33 66 28 30 78 31 65 63 29 5d 28 5f 30 78 62 35 64 39 33 37 2c 66 75 6e 63 74 69 6f 6e 28 5f 30 78 34 36 36 64 63 63 2c 5f 30 78 35 63 34 34 34 38 29 7b 76 61 72 20 5f 30 78 34 66 37 61 33 38 3d 5f 30 78 36 65 34 32 33 66 2c 5f 30 Data Ascii: x469269={'add':function(){var _0x2473e2=_0x38e474;if(_0x16ae6b){var _0x7df83a=_0x16ae6b[_0x2473e2(0x341)];!function _0x4a8cc3(_0xb5d937){var _0x6e423f=_0x2473e2;_0x5f2efc[_0x6e423f(0x1ec)](_0xb5d937,function(_0x466dcc,_0x5c4448){var _0x4f7a38=_0x6e423f,_0
2024-04-23 23:28:34 UTC	16384	IN	Data Raw: 51 75 65 75 65 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 35 39 37 61 32 62 29 7b 76 61 72 20 5f 30 78 34 38 62 62 30 36 3d 5f 30 78 32 64 38 66 33 62 3b 72 65 74 75 72 6e 20 74 68 69 73 5b 5f 30 78 34 38 62 62 30 36 28 30 78 33 30 65 29 5d 28 5f 30 78 35 39 37 61 32 62 7c 7c 27 66 78 27 2c 5b 5d 29 3b 7d 2c 27 70 72 6f 6d 69 73 65 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 33 32 33 30 36 2c 5f 30 78 34 63 33 61 37 38 29 7b 76 61 72 20 5f 30 78 34 34 62 61 63 39 3d 5f 30 78 32 64 38 66 33 62 2c 5f 30 78 32 61 34 36 34 35 2c 5f 30 78 32 36 66 31 35 35 3d 30 78 31 2c 5f 30 78 35 32 62 32 63 39 3d 5f 30 78 35 66 32 65 66 63 5b 5f 30 78 34 34 62 61 63 39 28 30 78 32 35 61 29 5d 28 29 2c 5f 30 78 34 61 35 33 65 38 3d 74 68 69 73 2c 5f 30 78 32 66 63 32 33 63 Data Ascii: Queue':function(_0x597a2b){var _0x48bb06=_0x2d8f3b;return this[_0x48bb06(0x30e)](_0x597a2b\|\|'fx',[]);},'promise':function(_0x332306,_0x4c3a78){var _0x44bac9=_0x2d8f3b,_0x2a4645,_0x26f155=0x1,_0x52b2c9=_0x5f2efc[_0x44bac9(0x25a)](),_0x4a53e8=this,_0x2fc23c
2024-04-23 23:28:34 UTC	16384	IN	Data Raw: 28 5f 30 78 31 63 30 36 66 31 2c 5f 30 78 32 36 32 35 38 34 29 2c 5f 30 78 32 36 32 35 38 34 5b 5f 30 78 35 33 63 66 39 31 28 30 78 32 33 65 29 5d 28 29 26 26 5f 30 78 32 66 38 38 39 32 5b 5f 30 78 35 33 63 66 39 31 28 30 78 32 39 38 29 5d 28 29 3b 7d 7d 2c 5f 30 78 35 66 32 65 66 63 5b 5f 30 78 32 64 38 66 33 62 28 30 78 32 62 34 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 38 30 62 62 66 2c 5f 30 78 31 37 62 61 66 65 2c 5f 30 78 66 66 64 34 64 29 7b 76 61 72 20 5f 30 78 31 34 33 61 34 38 3d 5f 30 78 32 64 38 66 33 62 3b 5f 30 78 33 38 30 62 62 66 5b 5f 30 78 31 34 33 61 34 38 28 30 78 31 65 35 29 5d 26 26 5f 30 78 33 38 30 62 62 66 5b 27 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 27 5d 28 5f 30 78 31 37 62 61 66 65 2c 5f 30 78 66 66 64 Data Ascii: (_0x1c06f1,_0x262584),_0x262584[_0x53cf91(0x23e)]()&&_0x2f8892[_0x53cf91(0x298)]();}},_0x5f2efc[_0x2d8f3b(0x2b4)]=function(_0x380bbf,_0x17bafe,_0xffd4d){var _0x143a48=_0x2d8f3b;_0x380bbf[_0x143a48(0x1e5)]&&_0x380bbf['removeEventListener'](_0x17bafe,_0xffd
2024-04-23 23:28:34 UTC	16384	IN	Data Raw: 78 33 63 61 29 5d 28 5f 30 78 32 37 39 39 30 39 28 74 68 69 73 29 29 2c 5f 30 78 34 30 35 34 34 66 26 26 5f 30 78 34 30 35 34 34 66 5b 27 72 65 70 6c 61 63 65 43 68 69 6c 64 27 5d 28 5f 30 78 35 65 36 37 36 34 2c 74 68 69 73 29 3b 7d 29 2c 5f 30 78 34 30 35 34 34 66 26 26 28 5f 30 78 34 30 35 34 34 66 5b 27 6c 65 6e 67 74 68 27 5d 7c 7c 5f 30 78 34 30 35 34 34 66 5b 27 6e 6f 64 65 54 79 70 65 27 5d 29 3f 74 68 69 73 3a 74 68 69 73 5b 5f 30 78 32 37 34 62 37 63 28 30 78 31 62 39 29 5d 28 29 3b 7d 2c 27 64 65 74 61 63 68 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 62 64 30 62 35 29 7b 72 65 74 75 72 6e 20 74 68 69 73 5b 27 72 65 6d 6f 76 65 27 5d 28 5f 30 78 32 62 64 30 62 35 2c 21 30 78 30 29 3b 7d 2c 27 64 6f 6d 4d 61 6e 69 70 27 3a 66 75 6e 63 74 69 6f Data Ascii: x3ca)](_0x279909(this)),_0x40544f&&_0x40544f['replaceChild'](_0x5e6764,this);}),_0x40544f&&(_0x40544f['length']\|\|_0x40544f['nodeType'])?this:this[_0x274b7c(0x1b9)]();},'detach':function(_0x2bd0b5){return this['remove'](_0x2bd0b5,!0x0);},'domManip':functio
2024-04-23 23:28:34 UTC	16384	IN	Data Raw: 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 30 78 31 36 38 39 65 62 28 74 68 69 73 29 3b 7d 2c 27 74 6f 67 67 6c 65 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 35 37 33 30 39 30 29 7b 76 61 72 20 5f 30 78 34 31 34 37 37 33 3d 5f 30 78 32 64 38 66 33 62 3b 72 65 74 75 72 6e 20 5f 30 78 34 31 34 37 37 33 28 30 78 32 38 65 29 3d 3d 74 79 70 65 6f 66 20 5f 30 78 35 37 33 30 39 30 3f 5f 30 78 35 37 33 30 39 30 3f 74 68 69 73 5b 5f 30 78 34 31 34 37 37 33 28 30 78 31 63 38 29 5d 28 29 3a 74 68 69 73 5b 5f 30 78 34 31 34 37 37 33 28 30 78 31 64 66 29 5d 28 29 3a 74 68 69 73 5b 5f 30 78 34 31 34 37 37 33 28 30 78 31 65 63 29 5d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 31 33 36 30 34 64 3d 5f 30 78 34 31 34 37 37 33 3b 5f 30 78 31 35 66 61 66 61 28 74 Data Ascii: ion(){return _0x1689eb(this);},'toggle':function(_0x573090){var _0x414773=_0x2d8f3b;return _0x414773(0x28e)==typeof _0x573090?_0x573090?this[_0x414773(0x1c8)]():this[_0x414773(0x1df)]():this[_0x414773(0x1ec)](function(){var _0x13604d=_0x414773;_0x15fafa(t
2024-04-23 23:28:34 UTC	16384	IN	Data Raw: 37 31 5b 5f 30 78 32 33 66 32 35 61 5d 5b 27 71 75 65 75 65 27 5d 21 3d 3d 5f 30 78 34 64 37 30 63 37 7c 7c 28 5f 30 78 31 38 61 36 37 31 5b 5f 30 78 32 33 66 32 35 61 5d 5b 27 61 6e 69 6d 27 5d 5b 5f 30 78 35 37 31 37 66 31 28 30 78 32 35 35 29 5d 28 5f 30 78 33 36 32 63 35 65 29 2c 5f 30 78 32 62 64 37 66 62 3d 21 30 78 31 2c 5f 30 78 31 38 61 36 37 31 5b 27 73 70 6c 69 63 65 27 5d 28 5f 30 78 32 33 66 32 35 61 2c 30 78 31 29 29 3b 28 5f 30 78 32 62 64 37 66 62 7c 7c 21 5f 30 78 33 36 32 63 35 65 29 26 26 5f 30 78 35 66 32 65 66 63 5b 27 64 65 71 75 65 75 65 27 5d 28 74 68 69 73 2c 5f 30 78 34 64 37 30 63 37 29 3b 7d 29 3b 7d 2c 27 66 69 6e 69 73 68 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 39 30 33 36 62 29 7b 76 61 72 20 5f 30 78 33 37 34 38 38 62 Data Ascii: 71[_0x23f25a]['queue']!==_0x4d70c7\|\|(_0x18a671[_0x23f25a]['anim'][_0x5717f1(0x255)](_0x362c5e),_0x2bd7fb=!0x1,_0x18a671['splice'](_0x23f25a,0x1));(_0x2bd7fb\|\|!_0x362c5e)&&_0x5f2efc['dequeue'](this,_0x4d70c7);});},'finish':function(_0x19036b){var _0x37488b

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:33 UTC	626	OUT	GET /6466/images/minimize.jpg HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:34 UTC	431	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:33 GMT Content-Type: image/jpeg Content-Length: 2302 Connection: close Last-Modified: Mon, 22 Apr 2024 08:47:47 GMT ETag: "0x8DC62A8E25E02AF" x-ms-request-id: bd02515a-001e-0051-08d5-9595d1000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232833Z-168bb8d798bdckn765t6bhwrfn00000001tg00000000kw4e x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:34 UTC	2302	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 39 35 0a ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 00 27 00 b4 03 01 11 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 95CC'

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:33 UTC	627	OUT	GET /6466/images/kxFy-clip.png HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:34 UTC	430	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:34 GMT Content-Type: image/png Content-Length: 1501 Connection: close Last-Modified: Mon, 22 Apr 2024 08:47:47 GMT ETag: "0x8DC62A8E2CABE5B" x-ms-request-id: e2436f27-501e-0001-40d5-955781000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232833Z-168bb8d798bj2crg3us8a5psdg00000002t000000000m2b8 x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:34 UTC	1501	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 42 00 00 00 44 08 02 00 00 00 ba 6f 74 a2 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 05 8f 49 44 41 54 68 05 ed 9a 5b 6c 14 55 18 c7 2d d6 da 16 b6 a5 b6 45 b6 7d e0 a2 04 4c 4d 91 06 1e 8c 95 82 06 13 b9 18 89 a4 f8 62 62 23 fa a4 81 90 68 52 15 1e f0 96 a8 31 a2 46 1f 54 c0 17 2f 28 f2 c0 45 03 51 01 21 36 81 d4 d8 d8 68 ad e1 1a d6 b6 6e 5b db d2 22 8d b1 fe cc 24 5f 8f 33 67 2e bb 73 66 57 92 d9 6c 36 df 9c 39 df e5 ff 5d ce cc 7e e7 14 4c 4c 4c 5c 73 f5 7f a6 5c fd 10 fe 45 10 c3 f8 3f c5 31 8e 46 1c 0d e3 1e 88 36 a9 de 3d 39 38 ef d5 ee 82 d6 ce f5 1f 5d f8 b5 7f dc b8 f5 22 b0 20 a2 e7 06 46 6f dc f7 db c1 ae 4b a2 69 66 a2 70 73 63 e5 93 4b ab 64 c4 20 11 09 8c 47 Data Ascii: PNGIHDRBDotpHYs+IDATh[lU-E}LMbb#hR1FT/(EQ!6hn["$_3g.sfWl69]~LLL\s\E?1F6=98]" FoKifpscKd G

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:33 UTC	631	OUT	GET /6466/images/qsbs-firewall.png HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:34 UTC	430	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:33 GMT Content-Type: image/png Content-Length: 2350 Connection: close Last-Modified: Mon, 22 Apr 2024 08:47:47 GMT ETag: "0x8DC62A8E25BB91F" x-ms-request-id: 4440250f-101e-0000-09d5-95085d000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232833Z-168bb8d798bdckn765t6bhwrfn00000001t000000001a15q x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:34 UTC	2350	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4d 00 00 00 3f 08 02 00 00 00 2a 81 d2 2d 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 08 e0 49 44 41 54 68 05 ed 5a 0b 50 95 45 14 be 92 a2 22 5c 21 50 e1 22 94 06 62 9a 1a be d2 42 45 f3 91 24 9a 8a a8 63 4d 8a 69 4d a3 a3 59 3a d3 58 5a 5a d3 8c 3a 3e cb 0a 53 b3 32 85 d4 52 41 cd ac 88 48 9d 34 28 2b 03 31 c5 17 60 42 1a a8 85 35 d0 e7 fc 70 fe e3 fe ff fe 77 ef 05 c1 52 c7 b9 73 f6 dc 73 ce ee b7 e7 b5 bb 97 7a 15 15 15 b6 9b e0 9f c7 4d 80 f1 2a c4 5b 38 ff 5f 8e be e5 cf 9b dc 9f 47 8b af ac 3a 70 fe ab e3 97 6a 67 1f 6a 6a ba 7a 2e f5 95 4d 3f 95 4c f8 e8 cc c5 2b e5 de 9e 1e 29 e3 43 fb b4 6a 72 bd d1 86 2f ca 05 54 cc f2 42 bf 66 f3 07 34 77 7b 3a 17 f2 93 40 62 32 Data Ascii: PNGIHDRM?-pHYs+IDAThZPE"\!P"bBE$cMiMY:XZZ:>S2RAH4(+1`B5pwRsszM[8_G:pjgjjz.M?L+)Cjr/TBf4w{:@b2

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:34 UTC	566	OUT	GET /?lang=en HTTP/1.1 Host: ipwho.is Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://uqgekpc20qn1.azureedge.net Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://uqgekpc20qn1.azureedge.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:34 UTC	255	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2024-04-23 23:28:34 UTC	706	IN	Data Raw: 32 62 36 0d 0a 7b 22 69 70 22 3a 22 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 22 2c 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 74 79 70 65 22 3a 22 49 50 76 34 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 76 61 64 61 22 2c 22 72 65 67 69 6f 6e 5f 63 6f 64 65 22 3a 22 4e 56 22 2c 22 63 69 74 79 22 3a 22 4c 61 73 20 56 65 67 61 73 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 36 2e 31 31 34 37 30 37 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 31 31 35 2e 31 37 32 38 34 39 37 2c Data Ascii: 2b6{"ip":"154.16.105.36","success":true,"type":"IPv4","continent":"North America","continent_code":"NA","country":"United States","country_code":"US","region":"Nevada","region_code":"NV","city":"Las Vegas","latitude":36.1147074,"longitude":-115.1728497,

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:34 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-23 23:28:34 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=27266 Date: Tue, 23 Apr 2024 23:28:34 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:34 UTC	627	OUT	GET /6466/images/microsoft.png HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:34 UTC	449	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:34 GMT Content-Type: image/png Content-Length: 239 Connection: close Last-Modified: Mon, 22 Apr 2024 08:47:47 GMT ETag: "0x8DC62A8E2515A5B" x-ms-request-id: 737c3484-301e-0065-4d90-95a619000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232834Z-168bb8d798bmmxfd6g2ey15u14000000079000000001pcy9 x-fd-int-roxy-purgeid: 68867822 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-23 23:28:34 UTC	239	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2f 00 00 00 2e 08 02 00 00 00 37 19 d7 5e 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 a1 49 44 41 54 58 09 ed d2 b1 0d c2 30 18 44 61 27 22 a2 89 94 29 b2 41 58 84 92 21 32 04 c3 d0 31 41 22 a1 ac 91 29 82 28 29 0c 0c f0 aa 1f 45 2e 9e db 93 4f d6 e7 ab 5e e7 3e c5 4e 7b 5f bf 05 d7 b9 89 d5 a4 71 58 ea 60 c5 7f af fb 1a f6 d4 46 1b 16 e0 c4 dd 68 c3 02 9c b8 1b 6d 58 80 13 77 a3 0d 0b 70 e2 6e d8 a6 ca 39 73 ba 77 52 d6 4f 1d 9a db 33 28 f0 be 74 bf 86 e9 18 ec d9 4e 8f b2 6c 7c 0d ff a8 36 da b0 00 27 ee 46 1b 16 e0 c4 dd 68 c3 02 9c b8 1b 6d 58 80 13 77 c3 36 1f 1c 76 0e a3 59 28 fd 52 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR/.7^pHYs+IDATX0Da'")AX!21A")()E.O^>N{_qX`FhmXwpn9swRO3(tNl\|6'FhmXw6vY(RIENDB`

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:35 UTC	607	OUT	GET /6466/js/bootstrap.min.js HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://uqgekpc20qn1.azureedge.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:35 UTC	530	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:35 GMT Content-Type: text/javascript Content-Length: 117452 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Mon, 22 Apr 2024 08:47:48 GMT ETag: "0x8DC62A8E30108AC" x-ms-request-id: eb53023e-b01e-00a0-7dd5-958cfc000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232835Z-168bb8d798bd55d833k1uh49dc00000004tg00000000kv2g x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:35 UTC	15854	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 30 78 35 30 34 63 28 5f 30 78 33 65 35 37 36 31 2c 5f 30 78 31 34 37 64 61 64 29 7b 76 61 72 20 5f 30 78 35 35 66 61 63 61 3d 5f 30 78 35 35 66 61 28 29 3b 72 65 74 75 72 6e 20 5f 30 78 35 30 34 63 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 35 30 34 63 33 34 2c 5f 30 78 62 33 32 61 34 37 29 7b 5f 30 78 35 30 34 63 33 34 3d 5f 30 78 35 30 34 63 33 34 2d 30 78 31 65 37 3b 76 61 72 20 5f 30 78 33 37 64 64 34 38 3d 5f 30 78 35 35 66 61 63 61 5b 5f 30 78 35 30 34 63 33 34 5d 3b 72 65 74 75 72 6e 20 5f 30 78 33 37 64 64 34 38 3b 7d 2c 5f 30 78 35 30 34 63 28 5f 30 78 33 65 35 37 36 31 2c 5f 30 78 31 34 37 64 61 64 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 5f 30 78 35 35 66 61 28 29 7b 76 61 72 20 5f 30 78 33 61 63 66 30 36 3d 5b 27 66 69 6e Data Ascii: function _0x504c(_0x3e5761,_0x147dad){var _0x55faca=_0x55fa();return _0x504c=function(_0x504c34,_0xb32a47){_0x504c34=_0x504c34-0x1e7;var _0x37dd48=_0x55faca[_0x504c34];return _0x37dd48;},_0x504c(_0x3e5761,_0x147dad);}function _0x55fa(){var _0x3acf06=['fin
2024-04-23 23:28:35 UTC	16384	IN	Data Raw: 70 65 27 3a 5f 30 78 31 39 36 33 61 39 28 30 78 33 35 61 29 2c 27 68 61 6e 64 6c 65 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 35 61 38 63 31 64 29 7b 76 61 72 20 5f 30 78 35 38 32 37 30 38 3d 5f 30 78 31 39 36 33 61 39 3b 69 66 28 5f 30 78 34 61 38 33 62 30 28 5f 30 78 35 61 38 63 31 64 5b 5f 30 78 35 38 32 37 30 38 28 30 78 33 36 36 29 5d 29 5b 27 69 73 27 5d 28 74 68 69 73 29 29 72 65 74 75 72 6e 20 5f 30 78 35 61 38 63 31 64 5b 5f 30 78 35 38 32 37 30 38 28 30 78 33 34 64 29 5d 5b 5f 30 78 35 38 32 37 30 38 28 30 78 32 63 36 29 5d 5b 5f 30 78 35 38 32 37 30 38 28 30 78 32 63 61 29 5d 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 3b 7d 7d 3b 76 61 72 20 5f 30 78 31 37 62 65 38 35 3d 27 61 6c 65 72 74 27 2c 5f 30 78 63 62 62 38 39 36 3d 5f 30 78 34 61 Data Ascii: pe':_0x1963a9(0x35a),'handle':function(_0x5a8c1d){var _0x582708=_0x1963a9;if(_0x4a83b0(_0x5a8c1d[_0x582708(0x366)])['is'](this))return _0x5a8c1d[_0x582708(0x34d)][_0x582708(0x2c6)][_0x582708(0x2ca)](this,arguments);}};var _0x17be85='alert',_0xcbb896=_0x4a
2024-04-23 23:28:35 UTC	16384	IN	Data Raw: 28 30 78 32 38 62 29 5d 5b 27 71 75 65 72 79 53 65 6c 65 63 74 6f 72 27 5d 28 5f 30 78 31 32 32 36 33 31 28 30 78 33 34 33 29 29 2c 5f 30 78 35 35 61 32 33 32 3d 74 68 69 73 5b 5f 30 78 31 32 32 36 33 31 28 30 78 33 32 66 29 5d 28 5f 30 78 31 66 37 37 61 35 29 2c 5f 30 78 33 30 61 64 32 34 3d 5f 30 78 31 35 37 38 62 32 7c 7c 5f 30 78 31 66 37 37 61 35 26 26 74 68 69 73 5b 5f 30 78 31 32 32 36 33 31 28 30 78 34 32 64 29 5d 28 5f 30 78 32 66 61 37 38 39 2c 5f 30 78 31 66 37 37 61 35 29 2c 5f 30 78 32 35 38 63 37 66 3d 74 68 69 73 5b 5f 30 78 31 32 32 36 33 31 28 30 78 33 32 66 29 5d 28 5f 30 78 33 30 61 64 32 34 29 2c 5f 30 78 33 64 63 39 62 37 3d 42 6f 6f 6c 65 61 6e 28 74 68 69 73 5b 5f 30 78 31 32 32 36 33 31 28 30 78 33 62 62 29 5d 29 3b 69 66 28 5f 30 Data Ascii: (0x28b)]['querySelector'](_0x122631(0x343)),_0x55a232=this[_0x122631(0x32f)](_0x1f77a5),_0x30ad24=_0x1578b2\|\|_0x1f77a5&&this[_0x122631(0x42d)](_0x2fa789,_0x1f77a5),_0x258c7f=this[_0x122631(0x32f)](_0x30ad24),_0x3dc9b7=Boolean(this[_0x122631(0x3bb)]);if(_0
2024-04-23 23:28:35 UTC	16384	IN	Data Raw: 30 78 34 30 36 29 5d 28 29 5b 27 6f 6e 27 5d 28 27 6d 6f 75 73 65 6f 76 65 72 27 2c 6e 75 6c 6c 2c 5f 30 78 34 61 38 33 62 30 5b 27 6e 6f 6f 70 27 5d 29 2c 74 68 69 73 5b 5f 30 78 33 61 30 32 35 37 28 30 78 32 38 62 29 5d 5b 5f 30 78 33 61 30 32 35 37 28 30 78 33 32 30 29 5d 28 29 2c 74 68 69 73 5b 5f 30 78 33 61 30 32 35 37 28 30 78 32 38 62 29 5d 5b 5f 30 78 33 61 30 32 35 37 28 30 78 33 34 38 29 5d 28 5f 30 78 33 61 30 32 35 37 28 30 78 32 62 32 29 2c 21 30 78 30 29 2c 5f 30 78 34 61 38 33 62 30 28 74 68 69 73 5b 5f 30 78 33 61 30 32 35 37 28 30 78 32 63 32 29 5d 29 5b 5f 30 78 33 61 30 32 35 37 28 30 78 31 65 63 29 5d 28 27 73 68 6f 77 27 29 2c 5f 30 78 34 61 38 33 62 30 28 5f 30 78 35 61 30 62 33 31 29 5b 5f 30 78 33 61 30 32 35 37 28 30 78 31 65 63 Data Ascii: 0x406)]()['on']('mouseover',null,_0x4a83b0['noop']),this[_0x3a0257(0x28b)][_0x3a0257(0x320)](),this[_0x3a0257(0x28b)][_0x3a0257(0x348)](_0x3a0257(0x2b2),!0x0),_0x4a83b0(this[_0x3a0257(0x2c2)])[_0x3a0257(0x1ec)]('show'),_0x4a83b0(_0x5a0b31)[_0x3a0257(0x1ec
2024-04-23 23:28:35 UTC	16384	IN	Data Raw: 36 29 5d 29 5b 5f 30 78 31 31 31 61 34 33 28 30 78 32 64 31 29 5d 26 26 5f 30 78 33 33 33 65 31 31 5b 5f 30 78 31 31 31 61 34 33 28 30 78 32 38 62 29 5d 5b 5f 30 78 31 31 31 61 34 33 28 30 78 33 32 30 29 5d 28 29 3b 7d 29 3b 7d 2c 5f 30 78 31 65 37 63 35 39 5b 27 5f 73 65 74 45 73 63 61 70 65 45 76 65 6e 74 27 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 34 37 31 64 34 39 3d 5f 30 78 34 61 32 65 64 33 2c 5f 30 78 35 61 35 61 34 61 3d 74 68 69 73 3b 74 68 69 73 5b 5f 30 78 34 37 31 64 34 39 28 30 78 32 37 62 29 5d 3f 5f 30 78 34 61 38 33 62 30 28 74 68 69 73 5b 5f 30 78 34 37 31 64 34 39 28 30 78 32 38 62 29 5d 29 5b 27 6f 6e 27 5d 28 5f 30 78 34 37 31 64 34 39 28 30 78 34 32 33 29 2c 66 75 6e 63 74 69 6f 6e 28 5f 30 78 35 39 30 31 65 64 29 Data Ascii: 6)])[_0x111a43(0x2d1)]&&_0x333e11[_0x111a43(0x28b)][_0x111a43(0x320)]();});},_0x1e7c59['_setEscapeEvent']=function(){var _0x471d49=_0x4a2ed3,_0x5a5a4a=this;this[_0x471d49(0x27b)]?_0x4a83b0(this[_0x471d49(0x28b)])['on'](_0x471d49(0x423),function(_0x5901ed)
2024-04-23 23:28:36 UTC	16384	IN	Data Raw: 5f 30 78 35 65 34 66 64 32 28 30 78 33 32 65 29 5d 3f 74 68 69 73 5b 5f 30 78 35 65 34 66 64 32 28 30 78 32 32 66 29 5d 5b 5f 30 78 35 65 34 66 64 32 28 30 78 33 32 65 29 5d 5b 5f 30 78 35 65 34 66 64 32 28 30 78 33 66 61 29 5d 28 74 68 69 73 2c 5f 30 78 33 38 32 33 31 33 2c 74 68 69 73 5b 5f 30 78 35 65 34 66 64 32 28 30 78 32 66 66 29 5d 29 3a 74 68 69 73 5b 5f 30 78 35 65 34 66 64 32 28 30 78 32 32 66 29 5d 5b 5f 30 78 35 65 34 66 64 32 28 30 78 33 32 65 29 5d 2c 5f 30 78 31 39 34 37 32 34 3d 74 68 69 73 5b 5f 30 78 35 65 34 66 64 32 28 30 78 32 35 30 29 5d 28 5f 30 78 31 34 63 66 65 34 29 3b 74 68 69 73 5b 5f 30 78 35 65 34 66 64 32 28 30 78 33 61 32 29 5d 28 5f 30 78 31 39 34 37 32 34 29 3b 76 61 72 20 5f 30 78 33 63 64 34 30 63 3d 74 68 69 73 5b 5f Data Ascii: _0x5e4fd2(0x32e)]?this[_0x5e4fd2(0x22f)][_0x5e4fd2(0x32e)][_0x5e4fd2(0x3fa)](this,_0x382313,this[_0x5e4fd2(0x2ff)]):this[_0x5e4fd2(0x22f)][_0x5e4fd2(0x32e)],_0x194724=this[_0x5e4fd2(0x250)](_0x14cfe4);this[_0x5e4fd2(0x3a2)](_0x194724);var _0x3cd40c=this[_
2024-04-23 23:28:36 UTC	16384	IN	Data Raw: 38 64 39 28 30 78 33 36 61 29 5d 28 5f 30 78 35 61 38 38 64 39 28 30 78 34 31 35 29 29 5b 27 6d 61 74 63 68 27 5d 28 5f 30 78 31 64 37 38 32 35 29 3b 6e 75 6c 6c 21 3d 3d 5f 30 78 32 62 35 36 38 37 26 26 5f 30 78 32 62 35 36 38 37 5b 5f 30 78 35 61 38 38 64 39 28 30 78 32 64 31 29 5d 3e 30 78 30 26 26 5f 30 78 35 33 30 32 38 35 5b 5f 30 78 35 61 38 38 64 39 28 30 78 32 62 35 29 5d 28 5f 30 78 32 62 35 36 38 37 5b 5f 30 78 35 61 38 38 64 39 28 30 78 32 32 33 29 5d 28 27 27 29 29 3b 7d 2c 5f 30 78 31 63 66 31 35 36 5b 5f 30 78 32 39 34 62 66 66 28 30 78 33 65 33 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 35 32 32 30 64 29 7b 76 61 72 20 5f 30 78 32 30 37 32 35 37 3d 5f 30 78 32 39 34 62 66 66 3b 72 65 74 75 72 6e 20 74 68 69 73 5b 5f 30 78 32 30 37 32 Data Ascii: 8d9(0x36a)](_0x5a88d9(0x415))['match'](_0x1d7825);null!==_0x2b5687&&_0x2b5687[_0x5a88d9(0x2d1)]>0x0&&_0x530285[_0x5a88d9(0x2b5)](_0x2b5687[_0x5a88d9(0x223)](''));},_0x1cf156[_0x294bff(0x3e3)]=function(_0x15220d){var _0x207257=_0x294bff;return this[_0x2072
2024-04-23 23:28:36 UTC	3294	IN	Data Raw: 73 5b 5f 30 78 33 32 65 39 31 61 28 30 78 33 30 38 29 5d 28 29 3b 7d 7d 2c 5f 30 78 32 38 38 38 61 37 5b 5f 30 78 32 66 61 37 62 35 28 30 78 33 34 63 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 34 38 36 66 65 38 3d 5f 30 78 32 66 61 37 62 35 3b 74 68 69 73 5b 5f 30 78 34 38 36 66 65 38 28 30 78 32 64 65 29 5d 28 29 2c 74 68 69 73 5b 27 5f 65 6c 65 6d 65 6e 74 27 5d 5b 5f 30 78 34 38 36 66 65 38 28 30 78 32 38 61 29 5d 5b 5f 30 78 34 38 36 66 65 38 28 30 78 32 66 36 29 5d 28 5f 30 78 34 38 36 66 65 38 28 30 78 32 38 64 29 29 26 26 74 68 69 73 5b 5f 30 78 34 38 36 66 65 38 28 30 78 32 38 62 29 5d 5b 5f 30 78 34 38 36 66 65 38 28 30 78 32 38 61 29 5d 5b 5f 30 78 34 38 36 66 65 38 28 30 78 33 32 61 29 5d 28 5f 30 78 34 38 36 66 65 38 28 30 Data Ascii: s[_0x32e91a(0x308)]();}},_0x2888a7[_0x2fa7b5(0x34c)]=function(){var _0x486fe8=_0x2fa7b5;this[_0x486fe8(0x2de)](),this['_element'][_0x486fe8(0x28a)][_0x486fe8(0x2f6)](_0x486fe8(0x28d))&&this[_0x486fe8(0x28b)][_0x486fe8(0x28a)][_0x486fe8(0x32a)](_0x486fe8(0

Timestamp	Bytes transferred	Direction	Data
2024-04-23 23:28:35 UTC	557	OUT	GET /6466/js/main.js HTTP/1.1 Host: uqgekpc20qn1.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://uqgekpc20qn1.azureedge.net/6466/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 23:28:35 UTC	528	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 23:28:35 GMT Content-Type: text/javascript Content-Length: 2871 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Mon, 22 Apr 2024 08:47:48 GMT ETag: "0x8DC62A8E2E6F4C9" x-ms-request-id: 5011337f-601e-008c-43d5-956053000000 x-ms-version: 2018-03-28 x-azure-ref: 20240423T232835Z-168bb8d798b28hm9m3e5rfcdn000000004v000000000s505 x-fd-int-roxy-purgeid: 68867822 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 23:28:35 UTC	2871	IN	Data Raw: 76 61 72 20 5f 30 78 35 39 35 66 37 36 3d 5f 30 78 31 62 38 37 3b 66 75 6e 63 74 69 6f 6e 20 5f 30 78 31 62 38 37 28 5f 30 78 35 31 39 38 34 31 2c 5f 30 78 32 62 36 64 64 61 29 7b 76 61 72 20 5f 30 78 32 38 31 66 66 36 3d 5f 30 78 32 38 31 66 28 29 3b 72 65 74 75 72 6e 20 5f 30 78 31 62 38 37 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 62 38 37 35 34 2c 5f 30 78 31 30 66 37 32 33 29 7b 5f 30 78 31 62 38 37 35 34 3d 5f 30 78 31 62 38 37 35 34 2d 30 78 39 36 3b 76 61 72 20 5f 30 78 32 63 39 33 63 31 3d 5f 30 78 32 38 31 66 66 36 5b 5f 30 78 31 62 38 37 35 34 5d 3b 72 65 74 75 72 6e 20 5f 30 78 32 63 39 33 63 31 3b 7d 2c 5f 30 78 31 62 38 37 28 5f 30 78 35 31 39 38 34 31 2c 5f 30 78 32 62 36 64 64 61 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 5f 30 78 32 38 31 66 28 Data Ascii: var _0x595f76=_0x1b87;function _0x1b87(_0x519841,_0x2b6dda){var _0x281ff6=_0x281f();return _0x1b87=function(_0x1b8754,_0x10f723){_0x1b8754=_0x1b8754-0x96;var _0x2c93c1=_0x281ff6[_0x1b8754];return _0x2c93c1;},_0x1b87(_0x519841,_0x2b6dda);}function _0x281f(