Edit tour

Windows Analysis Report
DocuFlex.exe

Overview

General Information

Sample name:	DocuFlex.exe
Analysis ID:	1618576
MD5:	134873893d8eaf390fa9779e814c6a3c
SHA1:	d3a88b605259789add1ca8c9033c96c042fa6bd1
SHA256:	571fdc22749fce2dd5865022a0d43a1cd48a02e3e9a883d010789c50796e2aff
Infos:

Detection

Score:	42
Range:	0 - 100
Confidence:	100%

Compliance

Score:	64
Range:	0 - 100

Signatures

Suricata IDS alerts for network traffic

Joe Sandbox ML detected suspicious sample

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64_ra

DocuFlex.exe (PID: 4040 cmdline: "C:\Users\user\Desktop\DocuFlex.exe" MD5: 134873893D8EAF390FA9779E814C6A3C)

dllhost.exe (PID: 2844 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

cmd.exe (PID: 2036 cmdline: "C:\Windows\System32\cmd.exe" /c start /b node . MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

node.exe (PID: 2660 cmdline: node . MD5: 1CBBF81FC27F911C3E1239DFCFF5E6C6)

cmd.exe (PID: 3312 cmdline: C:\Windows\system32\cmd.exe /d /s /c "clipboard.exe --paste" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

clipboard.exe (PID: 2464 cmdline: clipboard.exe --paste MD5: BDF7D4CCD2CE8CC7AB6AE80914496799)

cmd.exe (PID: 4952 cmdline: C:\Windows\system32\cmd.exe /d /s /c "clipboard.exe --copy" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

clipboard.exe (PID: 6044 cmdline: clipboard.exe --copy MD5: BDF7D4CCD2CE8CC7AB6AE80914496799)

chrome.exe (PID: 3920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window --user-data-dir=C:\Users\user\AppData\Local\PDFInstaller\chrome-profile --start-maximized --app=http://localhost:56097 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\PDFInstaller\chrome-profile" --mojo-platform-channel-handle=2184 --field-trial-handle=2028,i,5394899628148401723,17653549358450679821,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 2844 cmdline: "cmd.exe" /c schtasks /create /tn "PDF" /xml "C:\Users\user\AppData\Local\PDFInstaller\task.xml" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5388 cmdline: schtasks /create /tn "PDF" /xml "C:\Users\user\AppData\Local\PDFInstaller\task.xml" /f MD5: 48C2FE20575769DE916F48EF0676A965)

chrome.exe (PID: 4992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --hide-crash-restore-bubble --restore-last-session --new-window "? starttt" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1948,i,11845434080885918371,8269590411636599663,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn "PDF" /xml "C:\Users\user\AppData\Local\PDFInstaller\task.xml" /f, CommandLine: schtasks /create /tn "PDF" /xml "C:\Users\user\AppData\Local\PDFInstaller\task.xml" /f, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "cmd.exe" /c schtasks /create /tn "PDF" /xml "C:\Users\user\AppData\Local\PDFInstaller\task.xml" /f, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2844, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn "PDF" /xml "C:\Users\user\AppData\Local\PDFInstaller\task.xml" /f, ProcessId: 5388, ProcessName: schtasks.exe

Source:	Binary string: c:\ws\out\Release\node.pdb! source: DocuFlex.exe, 00000000.00000000.1168081456.0000000005985000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: c:\ws\out\Release\node.pdb source: DocuFlex.exe, 00000000.00000000.1168081456.0000000005985000.00000002.00000001.01000000.00000003.sdmp

Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: docu-flex.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /log HTTP/1.1Content-Type: text/plain; charset=utf-8Host: docu-flex.comContent-Length: 24Expect: 100-continue

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.43
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.43
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.43
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 54.84.201.116
Source: unknown	TCP traffic detected without corresponding DNS query: 54.84.201.116
Source: unknown	TCP traffic detected without corresponding DNS query: 54.84.201.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.38.233
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.38.233
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.57
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.38.233
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.57
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.38.233
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.43
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.43
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: docu-flex.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: dns-tunnel-check.googlezip.net
Source: global traffic	DNS traffic detected: DNS query: tunnel.googlezip.net
Source: global traffic	DNS traffic detected: DNS query: id.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: i.ytimg.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: static.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0CAE3D30	0_2_0CAE3D30
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0CAE3E48	0_2_0CAE3E48
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0CAE341C	0_2_0CAE341C
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0CD1C509	0_2_0CD1C509
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0CD10040	0_2_0CD10040
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0CD1D690	0_2_0CD1D690
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0CD1AE49	0_2_0CD1AE49
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0CD1D1C8	0_2_0CD1D1C8
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0E480D90	0_2_0E480D90
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0E48749C	0_2_0E48749C
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0E4821B1	0_2_0E4821B1
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0E4821B1	0_2_0E4821B1
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0E488388	0_2_0E488388
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_0E480D90	0_2_0E480D90
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A1F298	0_2_10A1F298
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A16CF8	0_2_10A16CF8
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A1B5E8	0_2_10A1B5E8
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A14EA0	0_2_10A14EA0
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A1D6C0	0_2_10A1D6C0
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A1A250	0_2_10A1A250
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A30040	0_2_10A30040
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A3E430	0_2_10A3E430
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A307A0	0_2_10A307A0
Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A31470	0_2_10A31470

Source: clipboard_x86_64.exe.0.dr	Static PE information: Number of sections : 13 > 10
Source: clipboard_i686.exe.0.dr	Static PE information: Number of sections : 15 > 10
Source: clipboard.exe.0.dr	Static PE information: Number of sections : 15 > 10

Source: DocuFlex.exe, 00000000.00000002.1619558958.000000000628E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DocuFlex.exe
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000005BAD000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamenode.exe* vs DocuFlex.exe

Source: C:\Users\user\Desktop\DocuFlex.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_03

Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: docu-flex.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /search?q=starttt&sourceid=chrome&ie=UTF-8 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /search?q=starttt&sourceid=chrome&ie=UTF-8&sei=Whm1Z7GaM6Dc7_UPmK2Y2A0 HTTP/1.1Host: www.google.comConnection: keep-alivertt: 250downlink: 1.35sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/search?q=starttt&sourceid=chrome&ie=UTF-8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=EpcDvCEfgKJF6wQ9H7HTw5D9eTN1IdCbBMlyTY6-JM7tAOhPchs4PDxfDYXm1Y2SV6idZMswmaaTwELJPoriyACtatXQOVduYAv1uKhgZdYuekHtf63xfkHBFxVYe-15wZvDfXNju1X4Xa88_oT2DanCSz8BOcSmlOnszRo4Mifx8kiS4inveDlns5pUlpBcWydP_NdQLHo20ho; SG_SS=*LhKaEkryAAaUZktqtGZ93Sjxdy6fv_4EADQBEArZ1Biv4UcgIkzspqneWcWDCX6biNekSp2TjAdEbZlCewyhNBzUy9jgr2Afjg8rkmbhPQAAADJtAAAACFcBB0EANdLzCTctUBG8HkjdtTOqigpUu8kNEqWMia6w5L_7sbuHvJYnVhByVyRlquuTvRJQ2LZLDvPWpgI6t9Gms8JXiEdv3lR2ExS_9PjF6yPHV5AI4meXKZxYxBVfiUjIdnSHEKramv9aIGAx1j2Rre2q6N0iPYBnFOgqM57eKGHJPvH_ZgEViFoOcVrzIDMOEtwL-uKqAnJdpu8r3yZ7yNqHgJy27HHHkKZ17pFOOKjgfC6aDX1QFTWxGzSs-G9Bu9NnqYUMH5aESw0zAeLBXSlToN_aBIZS1LEWRBkM70L35XK_3D6XNKHfA5whKCCkGgpZSOAVWxOPFNOgh-4ejSLpCYAwAFdg7SN6xH8UQlLeBhVHefhR9MQ6ZGS95IYLzZMA_nbFA5s8I7g3bauEXmAuUYfc97tZQMuItH6UOnN8u9mxnuXDdWPO-0jfD7eVhZrbqG1QD7cTNZi7Rw3e9RQg6gjtn-9PEcxlcjJQm1jjRVjaRtAwPCm6P3nu6U2O_lbAbMTk10r84p5JTF31yqNcdU3s1pjiTlk3VW883lGdfmJc_K2UKH9tPxP3Txqv6ZmOjNI6DhY-QBr1-yNSk_b24vAYuBWxxIQYtAbAENg6DkNxLddomM2KphPGhryTHi2mmQI9TIVF0JfAuCvr4o1VALfHZnQ4TR_Z1v-fcVPvxnMEdU6J9GvF4YACvypkDR7kAv3lOcPxSrTVxdJwob0-1ktAFMQGsEOiqds4odTH7x7lE4nzxKsjRDPsQoYl7PU8v8sJmct774_a7UgOw49cmEXwQE0oKIdMwyIGzUqU7OcLUBWmtWznMPjuBpVLE9Aa33bf
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/search?q=starttt&sourceid=chrome&ie=UTF-8&sei=Whm1Z7GaM6Dc7_UPmK2Y2A0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M
Source: global traffic	HTTP traffic detected: GET /xjs/_/ss/k=xjs.s.J-afBL40dv0.L.B1.O/am=AOIQIAQAAAACAABACAAVAAQAAAAAAAAAAAAAAAAAAAAAAAAASAAAAIAAAQAAAAAAgAAAAAARAAAAlEkAAAAAghMCIMAOAAAAAB-AQJwKgAAAAAAAQACABAAAAAAEAAIAJIQAAAAEAAAAQBAAAAACACwAACAAAAgAAAAIAwMAMAAAAAAIAEIIAgAQABgAAAdAAEgAACCAAxAAsBAEAGAAAIAAAAAKwEMwDICgAmAARwABAACACAAAAAAAAgCEAABgAFAAAAQIAAB6AAjABwAgCSIAQAgAAAFQCAAIAAAAASAAAACAIBAAAABaAACOgQEIAAAAAAAAABIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAEA/d=1/ed=1/br=1/rs=ACT90oHGymGXzmSL_ynnO9_AgzhVUzXrTQ/m=X3N0Bf,attn,cdos,gwc,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=1/ed=1/dg=3/br=1/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;Afksuc:wMx0R;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DM55c:imLrKe;DMzTfb:fNTHad;DULqB:RKfG5c;Dkk6ge:JZmW9e;DpcR3d:zL72xf;Du7NI:C6zLgf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;FqHJkd:yQamIb;G0KhTb:LIaoZ;G6wU6e:hezEbd;GEkGdd:e1RzQd;GleZL:J1A7Od;HMDDWe:G8QUdb;HoYVKb:PkDN7e;HqeXPd:cmbnH;IBADCc:RYquRb;IZrNqe:P8ha2c;IoGlCf:b5lhvb;JXJSm:ii1RGf;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KpRAue:Tia57b;LBgRLc:SdcwHb,XVMNvd;LEikZe:byfTOb,lsjVmc;LXA8b:q7OdKd;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;PqHfGe:im2cZe;Q1Ow7b:x5CSu;Q6C5kf:pfdZCe;QGR0gd:Mlhmy;Qw8Feb:jpavUe;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RCF5Sd:X1kBmd;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,fTfGO;SNUn3:ZwDk9d,x8cHvb;ScI3Yc:e7Hzgb,e7Hzgb;ShpF6e:N0pvGc;SwCqAd:fXbCZc;SzQQ3e:dNhofb;TxfV6d:YORN0b;U96pRd:FsR04;UBKJZ:LGDJGb;UDrY1c:eps46d;UVmjEd:EesRsb;UVzb9c:IvPZ6d;Uvc8o:VDovNc;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VhA7bd:vAmQFf;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YIZmRd:A1yn5d;YV5bee:IvPZ6d;ZMvdv:PHFPjb;ZSH6tc:QAvyLe;ZWEUA:afR4Cf;Zen4yb:jMF88c;ZlOOMb:P0I0Ec;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aCJ9tf:qKftvc;aZ61od:arTwJ;af0EJf:ghinId;bDXwRe:UsyOtc;bFZ6gf:RsDQqe;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dowIGb:ebZ3mb,ebZ3mb;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;euOXY:OZjbQ;flqRgb:ox2Q7c;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;heHB1:sFczq;hjRo6e:F62sG;hlqGX:FWz1ic;hsLsYc:Vl118;hwoVHd:zw4U8c;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;iySzae:a6xXfd;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kbAm9d:MkHyGd;lOO0Vd:OTA3Ae;lbfkyf:MqGdUd;lkq0A:JyBE3e;mWzs9c:fz5ukf;mzW4Id:nYdusb;nAFL3:NTMZac,s39S4;nJw4Gd:dPFZH;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO;oUlnpc:RagDlc;oVHXxc:HODIOb;okUaUd:wItadb;pDHPSc:BWn2ed;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:ww04Df;qGV2uc:HHi04c;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qafBPd:sgY6Zb,yDVVkb;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;rdexKf:FEkKD;ropkZ:UT1DG;sTsDMc:kHVSUb;sZmdvc:rdGEfc;slIQ5d:pnOULd;tGdRVe:CS1mob;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uknmt:GkPrzb;uuQkY:u2V3ud;vEYCNb:FaqsVd;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:O1Gjze,TtcO
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/16521530460/?gad_source=1&adview_type=4&adview_query_id=CPnZr9GxzosDFQCjgwcdc6U7BA HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger, event-source=navigation-sourceReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M
Source: global traffic	HTTP traffic detected: GET /verify/ABY0gVta9JEzQ8ZtTeqom8kYXjB-f_EwIvFGz9bsT-GSyHH7FjvY6BZwAbpPTL12wTkvYLxrPMEDi45aRv3Rd910N3JpB9-5tkCxUJD0FokQRCB7lg HTTP/1.1Host: id.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M
Source: global traffic	HTTP traffic detected: GET /images/nav_logo321.webp HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/search?q=starttt&sourceid=chrome&ie=UTF-8&sei=Whm1Z7GaM6Dc7_UPmK2Y2A0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M
Source: global traffic	HTTP traffic detected: GET /vi/5pejh45JcSU/mqdefault.jpg?sqp=-oaymwEFCJQBEFM&rs=AMzJL3mIJXwMIoq3AodQXWVfv_dBlMnOUw HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi/bZaOtydCOlc/mqdefault.jpg?sqp=-oaymwEFCJQBEFM&rs=AMzJL3luB9JX8X5kPT_yXpBvBHE3YFVM4A HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /compressiontest/gzip.html HTTP/1.1Host: www.google.comConnection: keep-alivertt: 250downlink: 1.35sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /complete/search?q&cp=0&client=gws-wiz-serp&xssi=t&gs_pcrt=2&hl=en&authuser=0&pq=starttt&psi=Wxm1Z82XGIWilQe77s3oDQ.1739921756765&dpr=1&nolsbt=1 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /complete/search?q=starttt&cp=0&client=gws-wiz-serp&xssi=t&gs_pcrt=3&hl=en&authuser=0&pq=starttt&psi=Wxm1Z82XGIWilQe77s3oDQ.1739921756765&dpr=1&ofp=EAE HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/ck=xjs.s.J-afBL40dv0.L.B1.O/am=AOIQIAQAAAACAABACAAVAAQAAAAAAAAAAAAAAAAAAAAAAAAASAAAAIAAAQAAAAAAgAAAAARRAAKAlEkAAAAAgpMCIMAOAAAAAB-ARJwKgAAAAAEBQACChAAABAAEAAIAJoQAAAIWAAEDQBAAAAACACwAACAAgQgA-_2PAwMAMAAAAAAIAEIIQgIQABgAAAdcAEgI8CHYAxIAsBCEAGAAAIAAAAAKwEMwDICgAmAARwABAACADAAAAAAAAgGEAABgAFD0AQQIAAB6AAjABwAgCSIAQAgAgAFQCAAJ_AAAASAAAACOIBAACBBaAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/ujg=1/rs=ACT90oGKARqzuXTr1-twHgnDnoV1cean1Q/m=UMk45c,bplExb,nMfLA,O19q8,xMHx5e,R6UkWb,tW711b,UX8qee,tDA9G,sy4t0,syz1,syyz,sy14s,syzf,syyy,syze,syz2,syz3,sy3ax,sy3ay,sy3az,sy30r,sy12q,sy2v1,syr7,sy2uy,sy2uv,sy16e,sy14p,sy14q,sy14r,sy3if,sy19a,sy14o,sy139,sy13a,sy137,sy135,sy3b0,sy30p,sy199,sy155,sy154,sy14e,sy156,sy13s,sy13q,sy14d,Eox39d,sy80,sy7z,syip,syil,syim,syik,syiy,syiw,syiv,syiu,syiq,syij,syc9,syee,syef,sycb,sycq,syci,sycn,sycm,sycl,syck,sych,syc6,sycf,sycg,syco,syct,sycr,sycc,syc1,syca,syc7,sycu,syc5,sybv,sybs,sybd,syb0,sybp,syag,syd7,syb1,syeh,syec,sye0,sye4,sydv,sydu,sydp,sydn,syaf,syae,sydo,sydl,sydk,sydt,sydq,sydi,sydh,sydg,syde,sydd,sydf,syda,syd9,syat,syd6,sybm,sybi,syb2,sybg,syb5,syb4,sybc,syba,syb9,syb3,syai,sya6,sydb,sycx,sycy,sycz,sybu,syby,sydr,syi9,syii,syie,syif,sy8w,sy8s,sy8v,syib,syge,syig,syia,syi8,syi5,syi4,syi3,syi1,sy8z,uxMpU,syht,syer,sydx,syen,syep,syei,syeq,syek,sybx,syd0,syel,syed,sy9m,sy9h,sy9g,sy9f,sy9e,Mlhmy,QGR0gd,OTA3Ae,sy81,EEDORb,PoEs9b,Pjplud,sy9a,sy96,sy94,A1yn5d,YIZmRd,uY49fb,sy8p,sy8n,sy8o,sy8m,sy8k,byfTOb,lsjVmc,LEikZe,kWgXee,ovKuLd,sgY6Zb,sy9s,sy9q,sy8y,xUdipf,NwH0H?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/ck=xjs.s.J-afBL40dv0.L.B1.O/am=AOIQIAQAAAACAABACAAVAAQAAAAAAAAAAAAAAAAAAAAAAAAASAAAAIAAAQAAAAAAgAAAAARRAAKAlEkAAAAAgpMCIMAOAAAAAB-ARJwKgAAAAAEBQACChAAABAAEAAIAJoQAAAIWAAEDQBAAAAACACwAACAAgQgA-_2PAwMAMAAAAAAIAEIIQgIQABgAAAdcAEgI8CHYAxIAsBCEAGAAAIAAAAAKwEMwDICgAmAARwABAACADAAAAAAAAgGEAABgAFD0AQQIAAB6AAjABwAgCSIAQAgAgAFQCAAJ_AAAASAAAACOIBAACBBaAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/ujg=1/rs=ACT90oGKARqzuXTr1-twHgnDnoV1cean1Q/m=gychg,ZfAoz,yDVVkb,qafBPd,ebZ3mb,dowIGb,sy5of,sy4rh,DpX64d,uKlGbf,sy5og,EufiNb,sy5hu,sy3op,sy2b0,sytt,tIj4fb,sy2bs,w4UyN,sy1a9,sy19c,sykw,syjs,sy12r,Mbif2,ipWLfe,sy1ab,QVaUhf,sy4tt,sy4ts,sy4tr,sy4tq,SJpD2c,sy81d,sy2i5,sy142,sy2hz,sy2c4,syux,syg6,sy810,sy7y5,sy15p,sy15j,sy15c,sy15e,sy148,sy147,sy13p,sy149,sy143,sy33e,syyu,bEGPrc,sy1oj,sy81f,sy81e,mBG1hd,sy60x,mscaJf,sy6ed,sGwFce,HxbScf,eAR4Hf,sy6ee,sy4qx,h3zgVb,lRePd,sy4tn,nN2e1e,sy5q6,sy6ef,sy24r,IRJCef,sy81g,sy5q7,scFHte,pr5okc,IFqxxc,sy4to,OXpAmf,sy6eq,sy4qr,sy4qq,sy1nq,sy1nr,sy16n,sy14a,sy140,sy141,sy13w,sy13x,sy13u,sy13t,sy13v,sy104,sy105,sy103,sy106,sy102,sy107,syzu,syzt,syzv,sy108,sy109,GElbSc,syty,sytv,sytu,syts,DPreE,sy6ea,xdV1C,sy5o0,HYSCof,sy8ag,sy6b1,sy1rt,sy1mw,KSk4yc,ma4xG,sy173,sy171,sy172,sy176,sy16z,sy170,syua,syub,sygd,sygc,syg3,syg2,syga,syue,syuf,sy174,syu6,E9M6Uc,syug,NO84gd,b5lhvb,IoGlCf,syu1,syu0,sytz,C8HsP,syul,syuj,syud,gOTY1,syvs,syvo,syvq,syvp,syvd,syvg,syvt,syvn,syvl,syvk,syvi,syv5,syv8,syv7,syvb,syva,syv9,syv3,syuu,syv6,syus,syur,syut,syuq,syvm,PbHo4e,sy17e,L1AAkb,hezEbd,sy79p,sy3rs,SC7lYd,sy49x,msmzHf,sy7fu,pHXghd?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/ck=xjs.s.J-afBL40dv0.L.B1.O/am=AOIQIAQAAAACAABACAAVAAQAAAAAAAAAAAAAAAAAAAAAAAAASAAAAIAAAQAAAAAAgAAAAARRAAKAlEkAAAAAgpMCIMAOAAAAAB-ARJwKgAAAAAEBQACChAAABAAEAAIAJoQAAAIWAAEDQBAAAAACACwAACAAgQgA-_2PAwMAMAAAAAAIAEIIQgIQABgAAAdcAEgI8CHYAxIAsBCEAGAAAIAAAAAKwEMwDICgAmAARwABAACADAAAAAAAAgGEAABgAFD0AQQIAAB6AAjABwAgCSIAQAgAgAFQCAAJ_AAAASAAAACOIBAACBBaAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/ujg=1/rs=ACT90oGKARqzuXTr1-twHgnDnoV1cean1Q/m=G6wU6e,sy18d,sy1b5,sy18c,sy1b4,sy1b3,Wn3aEc,sy7r9,sy6hy,sy4ks,sy40d,sy335,syzr,Um3BXb,K02r3e,sy40f,sy40e,sy1b9,sy1bc,sy153,qKrDxc,sy5q5,sy1qi,Z2vhDb,sy6i0,syx9,XN4wKf?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/md=2/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; NID=521=DwY8rbcZBIWJ_sj09IBEbo1H3QSa-Py1RRpNvjDy3RVKD4twZV0BqxAIkEBXFyKpLXWG2W2XSW-UxvLvh2H8DYRse5Oh5szuuk5kfG-kwAakTS_h5jeCuWC0aCHHLmnvEDLjqEXGJMWziEYDPu09MssRRRRCgROGxF_z_yV9viLikYm3T41qvLOirU_UdMnLEcub1KXNwooUFUrDLz6tT9iX2Y9yg7f1-4AALWpDwd8M; GZ=Z=0
Source: global traffic	HTTP traffic detected: GET /client_204?atyp=i&biw=1034&bih=870&ei=Wxm1Z82XGIWilQe77s3oDQ&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; NID=521=SZe-cJTgVVkm6EE901uz0AP2vBUgwhoYifrRDZ5MvCI_a6ZOfOjDvcErI8QfZgALvfn-TnozDpRQP61v2PWg4Y6cRSMKYOvsI3lYFdmxSeNaNb5hF9CwaylhUc9xEtNL9m5Zo3uWdHh5eq6oZIn3wXlRQWhSj22_eB14KfBQ1dN4glklCOv__0NeMbvqpmd2dDlKm-QZ5DQdL98qOZf6IZnkSKeoe7Aw7MlYwTNoetZU4pC3YmAA1dKhyg
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/ck=xjs.s.J-afBL40dv0.L.B1.O/am=AOIQIAQAAAACAABACAAVAAQAAAAAAAAAAAAAAAAAAAAAAAAASAAAAIAAAQAAAAAAgAAAAARRAAKAlEkAAAAAgpMCIMAOAAAAAB-ARJwKgAAAAAEBQACChAAABAAEAAIAJoQAAAIWAAEDQBAAAAACACwAACAAgQgA-_2PAwMAMAAAAAAIAEIIQgIQABgAAAdcAEgI8CHYAxIAsBCEAGAAAIAAAAAKwEMwDICgAmAARwABAACADAAAAAAAAgGEAABgAFD0AQQIAAB6AAjABwAgCSIAQAgAgAFQCAAJ_AAAASAAAACOIBAACBBaAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/ujg=1/rs=ACT90oGKARqzuXTr1-twHgnDnoV1cean1Q/m=sb_wiz,aa,abd,sy3a7,syy9,syy8,syy0,syy7,syya,async,sy17u,bgd,sy84r,foot,sy24p,kyn,sy1yv,sy2aq,lli,sf,syxw,syxx,sy7mm,sonic,sy1mk,syha,sy3pc,sy16v,sy1s5,sy1s6,spch,tl,sywm,sywl,rtH1bd,sy4aa,sy4a8,syy3,syy5,sywv,syws,sy4a9,syzl,EkevXb,SMquOb,EiD4Fe,sywt,sywp,sywr,d5EhJe,syyw,sy1oe,sy1od,sy1oc,sy1ob,sy1oa,sy1o9,sy1o8,sy1o4,sy1ek,sy1em,sy1el,sy1ej,syx3,syx0,syx5,T1HOxc,syx1,sywz,zx30Y,sy1oi,sy1oh,sy1o1,Wo3n8,sy29s,NEW1Qc,xBbsrc,sy29u,IX53Tb,sy8bu,sy8bv,sy6kg,ND0kmf,sy661,sy16a,zGLm3b,sy4cd,sy4c5,sy4c7,sy3sr,sy1i4,sy4cc,sy4cr,sy4cq,sy4cp,sy4c2,sy4co,KHourd,sy4ug,T5VV,sy3rp,aDVF7,sy667,rhYw1b,sy4u7,FzTajd,IhkWbc,sy4ua,sy4gc,oPmHrb,sy2ao,sy2bf,Tia57b,KpRAue,sy2av,sy2b2,sy2az,sy2bg,NyeqM,sy4ci,sy4ch,sy4cb,O9SqHb,M6QgBb,sy1be,sy1bd,sy14c,syu8,EO13pd,sy3qc,I9y8sd,MpJwZc,UUJqVe,sy84,sOXFj,sy83,s39S4,oGtAuc,NTMZac,nAFL3,sy8i,sy8h,q0xTif,y05UD,sy8cf,sy4qw,sy1v1,sy2ml,sy1tc,sy2js,sy1tt,sy1ei,sy1tl,sy1eh,sy1eg,sy1bv,sy1f2,sy2jr,sy1tq,sy16f,sy1tr,sy1cn,sy1te,sy1tp,sy1tf,sy1tm,sy2jt,sy1tx,sy1bw,syr8,sy2lr,sy2eo,sy14u,sy2lu,sy1tb,sy2k3,sy1z5,sy2jp,sy2li,sy1th,sy2lj,sy1ho,sy2ay,sy1w1,sy1w2,epYOx,RagDlc?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; NID=521=SZe-cJTgVVkm6EE901uz0AP2vBUgwhoYifrRDZ5MvCI_a6ZOfOjDvcErI8QfZgALvfn-TnozDpRQP61v2PWg4Y6cRSMKYOvsI3lYFdmxSeNaNb5hF9CwaylhUc9xEtNL9m5Zo3uWdHh5eq6oZIn3wXlRQWhSj22_eB14KfBQ1dN4glklCOv__0NeMbvqpmd2dDlKm-QZ5DQdL98qOZf6IZnkSKeoe7Aw7MlYwTNoetZU4pC3YmAA1dKhyg
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/ck=xjs.s.J-afBL40dv0.L.B1.O/am=AOIQIAQAAAACAABACAAVAAQAAAAAAAAAAAAAAAAAAAAAAAAASAAAAIAAAQAAAAAAgAAAAARRAAKAlEkAAAAAgpMCIMAOAAAAAB-ARJwKgAAAAAEBQACChAAABAAEAAIAJoQAAAIWAAEDQBAAAAACACwAACAAgQgA-_2PAwMAMAAAAAAIAEIIQgIQABgAAAdcAEgI8CHYAxIAsBCEAGAAAIAAAAAKwEMwDICgAmAARwABAACADAAAAAAAAgGEAABgAFD0AQQIAAB6AAjABwAgCSIAQAgAgAFQCAAJ_AAAASAAAACOIBAACBBaAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/ujg=1/rs=ACT90oGKARqzuXTr1-twHgnDnoV1cean1Q/m=sy8qk,sy7eb,HWk0Gf,sy185,syy6,C8ffD,sy187,sy189,ZUBru,sy18b,sy18a,sy188,rTuANe,sy40c,sy100,yfZcPd,syzn,syzm,Dpem5c,sy184,sy17y,sy17z,sy11h,Fy1Pv?xjs=s3 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; NID=521=SZe-cJTgVVkm6EE901uz0AP2vBUgwhoYifrRDZ5MvCI_a6ZOfOjDvcErI8QfZgALvfn-TnozDpRQP61v2PWg4Y6cRSMKYOvsI3lYFdmxSeNaNb5hF9CwaylhUc9xEtNL9m5Zo3uWdHh5eq6oZIn3wXlRQWhSj22_eB14KfBQ1dN4glklCOv__0NeMbvqpmd2dDlKm-QZ5DQdL98qOZf6IZnkSKeoe7Aw7MlYwTNoetZU4pC3YmAA1dKhyg
Source: global traffic	HTTP traffic detected: GET /xjs/_/ss/k=xjs.s.J-afBL40dv0.L.B1.O/am=AOIQIAQAAAACAABACAAVAAQAAAAAAAAAAAAAAAAAAAAAAAAASAAAAIAAAQAAAAAAgAAAAAARAAAAlEkAAAAAghMCIMAOAAAAAB-AQJwKgAAAAAAAQACABAAAAAAEAAIAJIQAAAAEAAAAQBAAAAACACwAACAAAAgAAAAIAwMAMAAAAAAIAEIIAgAQABgAAAdAAEgAACCAAxAAsBAEAGAAAIAAAAAKwEMwDICgAmAARwABAACACAAAAAAAAgCEAABgAFAAAAQIAAB6AAjABwAgCSIAQAgAAAFQCAAIAAAAASAAAACAIBAAAABaAACOgQEIAAAAAAAAABIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAEA/d=0/br=1/rs=ACT90oHGymGXzmSL_ynnO9_AgzhVUzXrTQ/m=symz,sy1ng?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; NID=521=SZe-cJTgVVkm6EE901uz0AP2vBUgwhoYifrRDZ5MvCI_a6ZOfOjDvcErI8QfZgALvfn-TnozDpRQP61v2PWg4Y6cRSMKYOvsI3lYFdmxSeNaNb5hF9CwaylhUc9xEtNL9m5Zo3uWdHh5eq6oZIn3wXlRQWhSj22_eB14KfBQ1dN4glklCOv__0NeMbvqpmd2dDlKm-QZ5DQdL98qOZf6IZnkSKeoe7Aw7MlYwTNoetZU4pC3YmAA1dKhyg
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q/m=sy2aa,P10Owf,sy1pl,sy1ou,WlNQGd,sy4k3,sy4in,nabPbb,sy1ot,sy1or,symz,sy1ng,CnSW2d,sy81j,sy5o6,sy1i6,syzi,syzg,syzh,sy1ps,sy1pq,VD4Qme,syhu,BYwJlf,sy19b,sy198,sy197,VEbNoe,syvy,UBXHI,sy18h,sy18g,Dq2Yjb,sy18k,sy18j,sy18i,NVlnE,sy17w,sy17v,qmdEUe,sy18m,sy18l,sy186,UqGwg,sy1re,fiAufb,sy1rd,sy1rc,q00IXe,sy1ri,sy1rh,sy1rf,Fh0l0,sy4cz,qcH9Lc,sy4c4,sy4ce,gCngrf,pjDTFb,sy4cn,sy2qo,KgxeNb,sy4cj,khkNpe?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; NID=521=SZe-cJTgVVkm6EE901uz0AP2vBUgwhoYifrRDZ5MvCI_a6ZOfOjDvcErI8QfZgALvfn-TnozDpRQP61v2PWg4Y6cRSMKYOvsI3lYFdmxSeNaNb5hF9CwaylhUc9xEtNL9m5Zo3uWdHh5eq6oZIn3wXlRQWhSj22_eB14KfBQ1dN4glklCOv__0NeMbvqpmd2dDlKm-QZ5DQdL98qOZf6IZnkSKeoe7Aw7MlYwTNoetZU4pC3YmAA1dKhyg
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q/m=sy1o2,sy1nz,gSZvdb?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; NID=521=SZe-cJTgVVkm6EE901uz0AP2vBUgwhoYifrRDZ5MvCI_a6ZOfOjDvcErI8QfZgALvfn-TnozDpRQP61v2PWg4Y6cRSMKYOvsI3lYFdmxSeNaNb5hF9CwaylhUc9xEtNL9m5Zo3uWdHh5eq6oZIn3wXlRQWhSj22_eB14KfBQ1dN4glklCOv__0NeMbvqpmd2dDlKm-QZ5DQdL98qOZf6IZnkSKeoe7Aw7MlYwTNoetZU4pC3YmAA1dKhyg
Source: global traffic	HTTP traffic detected: GET /async/bgasy?ei=Wxm1Z82XGIWilQe77s3oDQ&opi=89978449&yv=3&cs=0&async=_fmt:jspb HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-DoS-Behavior: Embedsec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; NID=521=SZe-cJTgVVkm6EE901uz0AP2vBUgwhoYifrRDZ5MvCI_a6ZOfOjDvcErI8QfZgALvfn-TnozDpRQP61v2PWg4Y6cRSMKYOvsI3lYFdmxSeNaNb5hF9CwaylhUc9xEtNL9m5Zo3uWdHh5eq6oZIn3wXlRQWhSj22_eB14KfBQ1dN4glklCOv__0NeMbvqpmd2dDlKm-QZ5DQdL98qOZf6IZnkSKeoe7Aw7MlYwTNoetZU4pC3YmAA1dKhyg
Source: global traffic	HTTP traffic detected: GET /client_204?cs=1&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; NID=521=SZe-cJTgVVkm6EE901uz0AP2vBUgwhoYifrRDZ5MvCI_a6ZOfOjDvcErI8QfZgALvfn-TnozDpRQP61v2PWg4Y6cRSMKYOvsI3lYFdmxSeNaNb5hF9CwaylhUc9xEtNL9m5Zo3uWdHh5eq6oZIn3wXlRQWhSj22_eB14KfBQ1dN4glklCOv__0NeMbvqpmd2dDlKm-QZ5DQdL98qOZf6IZnkSKeoe7Aw7MlYwTNoetZU4pC3YmAA1dKhyg; DV=Qx3WQJ5Kc6oaoLzqnEwKQNDx4bC2URk
Source: global traffic	HTTP traffic detected: GET /async/vpkg?vet=10ahUKEwiNsavRsc6LAxUFUeUKHTt3E90Qj5gNCCM..i&ei=Wxm1Z82XGIWilQe77s3oDQ&opi=89978449&yv=3&cs=0&async=_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.s.en.rVvGaTzUuak.2018.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.s.J-afBL40dv0.L.B1.O%2Fam%3DAOIQIAQAAAACAABACAAVAAQAAAAAAAAAAAAAAAAAAAAAAAAASAAAAIAAAQAAAAAAgAAAAAARAAAAlEkAAAAAghMCIMAOAAAAAB-AQJwKgAAAAAAAQACABAAAAAAEAAIAJIQAAAAEAAAAQBAAAAACACwAACAAAAgAAAAIAwMAMAAAAAAIAEIIAgAQABgAAAdAAEgAACCAAxAAsBAEAGAAAIAAAAAKwEMwDICgAmAARwABAACACAAAAAAAAgCEAABgAFAAAAQIAAB6AAjABwAgCSIAQAgAAAFQCAAIAAAAASAAAACAIBAAAABaAACOgQEIAAAAAAAAABIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAEA%2Fbr%3D1%2Frs%3DACT90oHGymGXzmSL_ynnO9_AgzhVUzXrTQ,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.s.en.rVvGaTzUuak.2018.O%2Fck%3Dxjs.s.J-afBL40dv0.L.B1.O%2Fam%3DAOIQIAQAAAACAABACAAVAAQAAAAAAAAAAAAAAAAAAAAAAAAASAAAAIAAAQAAAAAAgAAAAARRAAKAlEkAAAAAgpMCIMAOAAAAAB-ARJwKgAAAAAEBQACChAAABAAEAAIAJoQAAAIWAAEDQBAAAAACACwAACAAgQgA-_2PAwMAMAAAAAAIAEIIQgIQABgAAAdcAEgI8CHYAxIAsBCEAGAAAIAAAAAKwEMwDICgAmAARwABAACADAAAAAAAAgGEAABgAFD0AQQIAAB6AAjABwAgCSIAQAgAgAFQCAAJ_AAAASAAAACOIBAACBBaAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oGKARqzuXTr1-twHgnDnoV1cean1Q,_fmt:prog,_id:QPwIld HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-DoS-Behavior: Embedsec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; NID=521=SZe-cJTgVVkm6EE901uz0AP2vBUgwhoYifrRDZ5MvCI_a6ZOfOjDvcErI8QfZgALvfn-TnozDpRQP61v2PWg4Y6cRSMKYOvsI3lYFdmxSeNaNb5hF9Cwayl
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q/m=lOO0Vd,sy9b,P6sQOc?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; DV=Qx3WQJ5Kc6oaoLzqnEwKQNDx4bC2URk; NID=521=N_kW7kQ9anzHezVqq-Z8ViVjLPxA-K3C5X24RgYfGY7hNt_kkqgR02_zGbfD3_b6XLCwBq-lsln8YQAHgMSXUbg6uEDhpUSx-2D_9lbnLW-6wa6CkjjvvxpZAONd3MFT92mx5yYSBsbMftug9zc_gJZIbHPd731iNNhuMnJCGR54uy1Evkf_Ln38qyajoxi7cUpSOi8-XrTFDeCtIQ_E3ANWp2DwZ3-M5pwg3MuT8LwO74BRYHtnuFyu7OLOPw
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q/m=syi0,aLUfP?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; DV=Qx3WQJ5Kc6oaoLzqnEwKQNDx4bC2URk; NID=521=N_kW7kQ9anzHezVqq-Z8ViVjLPxA-K3C5X24RgYfGY7hNt_kkqgR02_zGbfD3_b6XLCwBq-lsln8YQAHgMSXUbg6uEDhpUSx-2D_9lbnLW-6wa6CkjjvvxpZAONd3MFT92mx5yYSBsbMftug9zc_gJZIbHPd731iNNhuMnJCGR54uy1Evkf_Ln38qyajoxi7cUpSOi8-XrTFDeCtIQ_E3ANWp2DwZ3-M5pwg3MuT8LwO74BRYHtnuFyu7OLOPw
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q/m=Ko78Df?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; DV=Qx3WQJ5Kc6oaoLzqnEwKQNDx4bC2URk; NID=521=N_kW7kQ9anzHezVqq-Z8ViVjLPxA-K3C5X24RgYfGY7hNt_kkqgR02_zGbfD3_b6XLCwBq-lsln8YQAHgMSXUbg6uEDhpUSx-2D_9lbnLW-6wa6CkjjvvxpZAONd3MFT92mx5yYSBsbMftug9zc_gJZIbHPd731iNNhuMnJCGR54uy1Evkf_Ln38qyajoxi7cUpSOi8-XrTFDeCtIQ_E3ANWp2DwZ3-M5pwg3MuT8LwO74BRYHtnuFyu7OLOPw
Source: global traffic	HTTP traffic detected: GET /xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q/m=I46Hvd?xjs=s4 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; DV=Qx3WQJ5Kc6oaoLzqnEwKQNDx4bC2URk; NID=521=N_kW7kQ9anzHezVqq-Z8ViVjLPxA-K3C5X24RgYfGY7hNt_kkqgR02_zGbfD3_b6XLCwBq-lsln8YQAHgMSXUbg6uEDhpUSx-2D_9lbnLW-6wa6CkjjvvxpZAONd3MFT92mx5yYSBsbMftug9zc_gJZIbHPd731iNNhuMnJCGR54uy1Evkf_Ln38qyajoxi7cUpSOi8-XrTFDeCtIQ_E3ANWp2DwZ3-M5pwg3MuT8LwO74BRYHtnuFyu7OLOPw
Source: global traffic	HTTP traffic detected: GET /instream/ad_status.js HTTP/1.1Host: static.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/id HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.youtube.comX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/id?slf_rd=1 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.youtube.comX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; DV=Qx3WQJ5Kc6oaoLzqnEwKQNDx4bC2URk; NID=521=N_kW7kQ9anzHezVqq-Z8ViVjLPxA-K3C5X24RgYfGY7hNt_kkqgR02_zGbfD3_b6XLCwBq-lsln8YQAHgMSXUbg6uEDhpUSx-2D_9lbnLW-6wa6CkjjvvxpZAONd3MFT92mx5yYSBsbMftug9zc_gJZIbHPd731iNNhuMnJCGR54uy1Evkf_Ln38qyajoxi7cUpSOi8-XrTFDeCtIQ_E3ANWp2DwZ3-M5pwg3MuT8LwO74BRYHtnuFyu7OLOPw
Source: global traffic	HTTP traffic detected: GET /gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=Wxm1Z82XGIWilQe77s3oDQ&zx=1739921772354&opi=89978449 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"rtt: 300sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2dRHkIKHhlRecSkGfgmJmT9DW8DEI8FFeiIjuQYzA3FDzI7XQ_YFA; GZ=Z=0; DV=Qx3WQJ5Kc6oaoLzqnEwKQNDx4bC2URk; NID=521=N_kW7kQ9anzHezVqq-Z8ViVjLPxA-K3C5X24RgYfGY7hNt_kkqgR02_zGbfD3_b6XLCwBq-lsln8YQAHgMSXUbg6uEDhpUSx-2D_9lbnLW-6wa6CkjjvvxpZAONd3MFT92mx5yYSBsbMftug9zc_gJZIbHPd731iNNhuMnJCGR54uy1Evkf_Ln38qyajoxi7cUpSOi8-XrTFDeCtIQ_E3ANWp2DwZ3-M5pwg3MuT8LwO74BRYHtnuFyu7OLOPw
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5oisP-vad288S8SaQyCn0RwQHSIttmiNDpxXDfc0dgfkE18nHRFB5IE7DCCRzCEkfumOI3oXlIU55eRn7-4QTmfrpKK1Q1_K1hSMP-BRAmwO3xfOisMGZbKH2bU3lj5sAMZSmuWqsmeuCl9c5iEEK0agqvWXpPfz-A/EFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ_25_2_2_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /webstore/inlineinstall/detail/efaidnbmnnnibpcajpcglclefindmkaj HTTP/1.1Host: chrome.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://.css
Source: DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://.jpg
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://blog.izs.me)
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://blog.izs.me/)
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://marijnhaverbeke.nl/git/acorn
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://narwhaljs.org)
Source: DocuFlex.exe, 00000000.00000002.1632147933.000000000833B000.00000004.00000800.00020000.00000000.sdmp, DocuFlex.exe, 00000000.00000002.1691697586.000000000DB83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.attribution.com/ads/1.0/
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://scripts.sil.org/OFL
Source: DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://travis-ci.org/grncdr/merge-stream)
Source: DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.0000000000902000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ascendercorp.com/
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.ht
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.electrovir.com
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com

Source: unknown	Process created: C:\Users\user\Desktop\DocuFlex.exe "C:\Users\user\Desktop\DocuFlex.exe"
Source: C:\Users\user\Desktop\DocuFlex.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Source: C:\Users\user\Desktop\DocuFlex.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b node .
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\PDFInstaller\node.exe node .
Source: C:\Users\user\Desktop\DocuFlex.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c schtasks /create /tn "PDF" /xml "C:\Users\user\AppData\Local\PDFInstaller\task.xml" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "PDF" /xml "C:\Users\user\AppData\Local\PDFInstaller\task.xml" /f
Source: C:\Users\user\Desktop\DocuFlex.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --hide-crash-restore-bubble --restore-last-session --new-window "? starttt"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1948,i,11845434080885918371,8269590411636599663,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "clipboard.exe --paste"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\PDFInstaller\clipboard.exe clipboard.exe --paste
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "clipboard.exe --copy"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\PDFInstaller\clipboard.exe clipboard.exe --copy
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window --user-data-dir=C:\Users\user\AppData\Local\PDFInstaller\chrome-profile --start-maximized --app=http://localhost:56097
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\PDFInstaller\chrome-profile" --mojo-platform-channel-handle=2184 --field-trial-handle=2028,i,5394899628148401723,17653549358450679821,262144 /prefetch:8
Source: C:\Users\user\Desktop\DocuFlex.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /b node .	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --hide-crash-restore-bubble --restore-last-session --new-window "? starttt"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\PDFInstaller\node.exe node .	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "clipboard.exe --paste"	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "clipboard.exe --copy"	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window --user-data-dir=C:\Users\user\AppData\Local\PDFInstaller\chrome-profile --start-maximized --app=http://localhost:56097	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "PDF" /xml "C:\Users\user\AppData\Local\PDFInstaller\task.xml" /f	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1948,i,11845434080885918371,8269590411636599663,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\PDFInstaller\clipboard.exe clipboard.exe --paste	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\PDFInstaller\clipboard.exe clipboard.exe --copy	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\PDFInstaller\chrome-profile" --mojo-platform-channel-handle=2184 --field-trial-handle=2028,i,5394899628148401723,17653549358450679821,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\clipboard.exe	Section loaded: apphelp.dll	Jump to behavior

Source: DocuFlex.lnk.0.dr	LNK file: ..\AppData\Local\PDFInstaller\viewer.vbs
Source: Google Drive.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: node.exe.0.dr	Static PE information: section name: _RDATA
Source: clipboard_i686.exe.0.dr	Static PE information: section name: /4
Source: clipboard_i686.exe.0.dr	Static PE information: section name: /14
Source: clipboard_i686.exe.0.dr	Static PE information: section name: /29
Source: clipboard_i686.exe.0.dr	Static PE information: section name: /41
Source: clipboard_i686.exe.0.dr	Static PE information: section name: /55
Source: clipboard_i686.exe.0.dr	Static PE information: section name: /67
Source: clipboard_i686.exe.0.dr	Static PE information: section name: /78
Source: clipboard_i686.exe.0.dr	Static PE information: section name: /89
Source: clipboard_x86_64.exe.0.dr	Static PE information: section name: .xdata
Source: clipboard_x86_64.exe.0.dr	Static PE information: section name: /4
Source: clipboard_x86_64.exe.0.dr	Static PE information: section name: /19
Source: clipboard_x86_64.exe.0.dr	Static PE information: section name: /31
Source: clipboard_x86_64.exe.0.dr	Static PE information: section name: /45
Source: clipboard.exe.0.dr	Static PE information: section name: /4
Source: clipboard.exe.0.dr	Static PE information: section name: /14
Source: clipboard.exe.0.dr	Static PE information: section name: /29
Source: clipboard.exe.0.dr	Static PE information: section name: /41
Source: clipboard.exe.0.dr	Static PE information: section name: /55
Source: clipboard.exe.0.dr	Static PE information: section name: /67
Source: clipboard.exe.0.dr	Static PE information: section name: /78
Source: clipboard.exe.0.dr	Static PE information: section name: /89

Source: C:\Users\user\Desktop\DocuFlex.exe	Code function: 0_2_10A136D4 push ebx; iretd	0_2_10A136DA
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Code function: 11_2_00007FF6B610C240 push eax; ret	11_2_00007FF6B610C241
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Code function: 11_2_00007FF6B610AF07 push ecx; ret	11_2_00007FF6B610AF08

Source: C:\Users\user\Desktop\DocuFlex.exe	File created: C:\Users\user\AppData\Local\PDFInstaller\node_modules\clipboardy\fallbacks\windows\clipboard_x86_64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DocuFlex.exe	File created: C:\Users\user\AppData\Local\PDFInstaller\node_modules\clipboardy\fallbacks\windows\clipboard_i686.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DocuFlex.exe	File created: C:\Users\user\AppData\Local\PDFInstaller\clipboard.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DocuFlex.exe	File created: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\PDFInstaller\node.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\DocuFlex.exe	Memory allocated: 68C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Memory allocated: 82F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Memory allocated: A2F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DocuFlex.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Thread delayed: delay time: 599173	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Thread delayed: delay time: 599061	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Thread delayed: delay time: 598949	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Thread delayed: delay time: 598835	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Thread delayed: delay time: 598727	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Thread delayed: delay time: 598615	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DocuFlex.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\BrowserMetrics\BrowserMetrics-67B51980-F50.pma

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Crashpad\settings.dat

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\080175bf-37fc-4c9c-8b04-4cf5c7974ba3.tmp

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\28ccde4e-50a9-4902-ac8c-b5f2ee96f559.tmp

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\57db242e-d831-4efb-b387-63351c82ac18.tmp

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\76c7d2b2-0f8e-4421-81c5-8e7fa8b6b8eb.tmp

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Affiliation Database

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Cache\Cache_Data\data_0

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Cache\Cache_Data\data_1

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Cache\Cache_Data\data_2

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Cache\Cache_Data\data_3

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Cache\Cache_Data\f_000001

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Cache\Cache_Data\f_000002

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Cache\Cache_Data\f_000003

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Cache\Cache_Data\f_000004

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Cache\Cache_Data\f_000005

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Cache\Cache_Data\index

C:\Users\user\AppData\Local\PDFInstaller\chrome-profile\Default\Code Cache\js\1ff89b0b120c0a63_0

Windows Analysis Report
DocuFlex.exe

Source: C:\Users\user\Desktop\DocuFlex.exe	Window / User API: threadDelayed 8920			Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe	Window / User API: threadDelayed 990			Jump to behavior

Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -99888s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -99776s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -99665s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -99553s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -99427s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -99301s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -599173s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -599061s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -598949s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -598835s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -598727s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DocuFlex.exe TID: 3928	Thread sleep time: -598615s >= -30000s	Jump to behavior

Source: DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: bCK1sK9IRQq9qEmUv4RDsNuESgMjGWdqb8FuvAY5N9GIIvejQjBAMA8GA1UdEwEB/wQFMAMB
Source: DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: DocuFlex.exe, 00000000.00000002.1622751939.00000000062F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	11 Masquerading	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner
C:\Users\user\AppData\Local\PDFInstaller\clipboard.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\bin.is-docker	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\bin.is-inside-container	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\bin.node-which	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\bin\is-docker.ps1	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\bin\is-inside-container.ps1	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\bin\node-which.ps1	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\clipboardy\fallbacks\linux.xsel	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\clipboardy\fallbacks\windows\clipboard_i686.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\clipboardy\fallbacks\windows\clipboard_x86_64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\is_docker\cli.js	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\is_inside_container\cli.js	0%	ReversingLabs
C:\Users\user\AppData\Local\PDFInstaller\node_modules\which\bin.node-which	0%	ReversingLabs

Source	Detection	Scanner	Label
https://fetch.spec.whatwg.org/#requestcache	0%	Avira URL Cloud	safe
https://w3c.github.io/webappsec-referrer-policy/#referrer-policy	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#dom-response	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#prod-ClassStringDisjunctionContents	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#concept-header-list-delete	0%	Avira URL Cloud	safe
https://fetch.spec.whatwg.org/#header-list-contains	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#prod-ClassUnion	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#prod-ClassSetRange	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#prod-ClassSetSyntaxCharacter	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.185.78	true	false	high
i.ytimg.com	216.58.206.54	true	false	high
static.doubleclick.net	142.250.185.198	true	false	high
youtube-ui.l.google.com	142.250.184.206	true	false	high
play.google.com	142.250.185.238	true	false	high
googleads.g.doubleclick.net	142.250.186.66	true	false	high
www3.l.google.com	142.250.185.110	true	false	high
dns-tunnel-check.googlezip.net	216.239.34.159	true	false	high
tunnel.googlezip.net	216.239.34.157	true	false	high
id.google.com	142.251.34.3	true	false	high
www.google.com	142.250.185.164	true	false	high
googlehosted.l.googleusercontent.com	216.58.206.33	true	false	high
docu-flex.com	188.114.96.3	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
chrome.google.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://www.google.com/xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q/m=Ko78Df?xjs=s4	false	high
https://www.google.com/gen_204?atyp=i&ei=Wxm1Z82XGIWilQe77s3oDQ&dt19=2&prm23=0&zx=1739921759649&opi=89978449	false	high
https://www.google.com/favicon.ico	false	high
https://www.google.com/gen_204?atyp=csi&ei=Yhm1Z-qPDJTo7_UPjoTHuQs&s=async&astyp=vpkg&ima=0&imn=0&mem=ujhs.14,tjhs.19,jhsl.2173,dm.8&nv=ne.1,feid.a05b6882-d4bb-4924-8e87-c1ae9c0429eb&hp=&rt=ttfb.1356,st.1628,bs.107100,aaft.1630,acrt.1630,art.1630&zx=1739921761325&opi=89978449	false	high
https://www.google.com/gen_204?atyp=i&ei=Wxm1Z82XGIWilQe77s3oDQ&ct=slh&v=t1&m=HV&aqid=Wxm1Z7nAHIDGjuwP88ruIQ&pv=0.9982937533289784&me=1:1739921754534,V,0,0,1034,870:0,B,2596:0,N,1,Wxm1Z82XGIWilQe77s3oDQ:0,R,1,8,28,36,92,33:0,R,1,CAsQAA,28,88,861,57:0,R,1,CAsQAQ,28,88,841,45:0,R,1,CBIQAA,18,88,36,45:0,R,1,CBIQAQ,18,102,36,31:0,R,1,CBEQAA,56,90,66,42:0,R,1,CBEQAQ,56,90,66,42:0,R,1,CBAQAA,123,90,63,42:0,R,1,CBAQAQ,123,90,63,42:0,R,1,CA8QAA,188,90,79,42:0,R,1,CA8QAQ,188,90,79,42:0,R,1,CA4QAA,269,90,55,42:0,R,1,CA4QAQ,269,90,55,42:0,R,1,CA0QAA,326,90,54,42:0,R,1,CA0QAQ,326,90,54,42:0,R,1,CAwQAA,382,90,67,42:0,R,1,CAwQAQ,382,90,67,42:0,R,1,CAQQBw,28,188,652,2131:0,R,1,CCQQAA,28,188,652,354:0,R,1,CBsQAA,28,240,204,242:0,R,1,CBoQAA,252,240,204,242:0,R,1,CBwQAA,476,240,204,242:0,R,1,CCQQCA,28,506,652,36:0,R,1,CCMQAA,28,586,652,117:0,R,1,CB4QAA,28,733,652,95:0,R,1,CCEQAA,28,857,652,117:2209,x:35917,e,B&zx=1739921792661&opi=89978449	false	high
https://www.google.com/gen_204?atyp=i&ei=Wxm1Z82XGIWilQe77s3oDQ&vet=12ahUKEwiNsavRsc6LAxUFUeUKHTt3E90QuqMJegQIBxAA..s&bl=NndY&s=web&lpl=CAUYATAPOANiCAgFEIDcsuoC&zx=1739921759730&opi=89978449	false	high
https://www.google.com/xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q/m=sy2aa,P10Owf,sy1pl,sy1ou,WlNQGd,sy4k3,sy4in,nabPbb,sy1ot,sy1or,symz,sy1ng,CnSW2d,sy81j,sy5o6,sy1i6,syzi,syzg,syzh,sy1ps,sy1pq,VD4Qme,syhu,BYwJlf,sy19b,sy198,sy197,VEbNoe,syvy,UBXHI,sy18h,sy18g,Dq2Yjb,sy18k,sy18j,sy18i,NVlnE,sy17w,sy17v,qmdEUe,sy18m,sy18l,sy186,UqGwg,sy1re,fiAufb,sy1rd,sy1rc,q00IXe,sy1ri,sy1rh,sy1rf,Fh0l0,sy4cz,qcH9Lc,sy4c4,sy4ce,gCngrf,pjDTFb,sy4cn,sy2qo,KgxeNb,sy4cj,khkNpe?xjs=s4	false	high
https://www.google.com/xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAARQAAKAAAAAAAAAAJAAIAAAAAAAAACABAAAAAAAAAEBQACChAAABAAAAAAAJgAAAAIWAAEDAAAAAAAAACAAAAAAgQgA-_2HAwAAAAAAAAAAAAAIQAIAAAAAAABcAAAI8CHYAwIAAACAAAAAAIAAAAAAAEAAAACAAgAAAAAAAAAABAAAAAAAAAEAAAAgAAD0AQAAAAAAAAAAAAAACAAAAAAAgAFQAAAB_AAAAAAAAAAOAAAACBAAAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/rs=ACT90oEb5gFabjsgECjDfOsDNg-rPiA7_Q/m=I46Hvd?xjs=s4	false	high
https://www.google.com/xjs/_/js/k=xjs.s.en.rVvGaTzUuak.2018.O/ck=xjs.s.J-afBL40dv0.L.B1.O/am=AOIQIAQAAAACAABACAAVAAQAAAAAAAAAAAAAAAAAAAAAAAAASAAAAIAAAQAAAAAAgAAAAARRAAKAlEkAAAAAgpMCIMAOAAAAAB-ARJwKgAAAAAEBQACChAAABAAEAAIAJoQAAAIWAAEDQBAAAAACACwAACAAgQgA-_2PAwMAMAAAAAAIAEIIQgIQABgAAAdcAEgI8CHYAxIAsBCEAGAAAIAAAAAKwEMwDICgAmAARwABAACADAAAAAAAAgGEAABgAFD0AQQIAAB6AAjABwAgCSIAQAgAgAFQCAAJ_AAAASAAAACOIBAACBBaAACOgQEIAAAAAAAAwB4AHg8IhxQWAAAAAAAAAAAAAAAAgAAkCOZA-gsCEAAAAAAAAAAAAAAAAAAAAFIETVzeAIA/d=0/dg=0/br=1/ujg=1/rs=ACT90oGKARqzuXTr1-twHgnDnoV1cean1Q/m=UMk45c,bplExb,nMfLA,O19q8,xMHx5e,R6UkWb,tW711b,UX8qee,tDA9G,sy4t0,syz1,syyz,sy14s,syzf,syyy,syze,syz2,syz3,sy3ax,sy3ay,sy3az,sy30r,sy12q,sy2v1,syr7,sy2uy,sy2uv,sy16e,sy14p,sy14q,sy14r,sy3if,sy19a,sy14o,sy139,sy13a,sy137,sy135,sy3b0,sy30p,sy199,sy155,sy154,sy14e,sy156,sy13s,sy13q,sy14d,Eox39d,sy80,sy7z,syip,syil,syim,syik,syiy,syiw,syiv,syiu,syiq,syij,syc9,syee,syef,sycb,sycq,syci,sycn,sycm,sycl,syck,sych,syc6,sycf,sycg,syco,syct,sycr,sycc,syc1,syca,syc7,sycu,syc5,sybv,sybs,sybd,syb0,sybp,syag,syd7,syb1,syeh,syec,sye0,sye4,sydv,sydu,sydp,sydn,syaf,syae,sydo,sydl,sydk,sydt,sydq,sydi,sydh,sydg,syde,sydd,sydf,syda,syd9,syat,syd6,sybm,sybi,syb2,sybg,syb5,syb4,sybc,syba,syb9,syb3,syai,sya6,sydb,sycx,sycy,sycz,sybu,syby,sydr,syi9,syii,syie,syif,sy8w,sy8s,sy8v,syib,syge,syig,syia,syi8,syi5,syi4,syi3,syi1,sy8z,uxMpU,syht,syer,sydx,syen,syep,syei,syeq,syek,sybx,syd0,syel,syed,sy9m,sy9h,sy9g,sy9f,sy9e,Mlhmy,QGR0gd,OTA3Ae,sy81,EEDORb,PoEs9b,Pjplud,sy9a,sy96,sy94,A1yn5d,YIZmRd,uY49fb,sy8p,sy8n,sy8o,sy8m,sy8k,byfTOb,lsjVmc,LEikZe,kWgXee,ovKuLd,sgY6Zb,sy9s,sy9q,sy8y,xUdipf,NwH0H?xjs=s3	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://nodejs.org/api/v8.html#v8_v8_serialize_value)	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000002.1632147933.0000000008829000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc6455#section-1.3	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-Atom	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.fontbureau.com/designers	DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	false		high
https://console.spec.whatwg.org/#table	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/moxystudio/node-cross-spawn	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://registry.npmjs.org/onetime/-/onetime-6.0.0.tgz	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/moxystudio/node-cross-spawn/issues/82)	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://encoding.spec.whatwg.org/#textencoder	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://fetch.spec.whatwg.org/#dom-response	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://nodejs.org/api/webstreams.html#streamconsumersbufferstream)	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://tc39.es/ecma262/#prod-ClassStringDisjunctionContents	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/tc39/proposal-weakrefs	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://goo.gl/t5IS6M).	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/api/stream.html#readablepipedestination-options)	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000002.1632147933.0000000008829000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tc39.es/ecma262/#prod-ClassSetRange	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.galapagosdesign.com/DPlease	DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/issues/44985	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/api/webstreams.html#streamconsumerstextstream)	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://url.spec.whatwg.org/#concept-urlencoded-serializer	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparams	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/ehmicky/get-node)	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000002.1632147933.0000000008829000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nodejs.org/api/fs.html	DocuFlex.exe, 00000000.00000000.1168081456.00000000051A4000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API#Browser_compatibility).	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://codecov.io/gh/ehmicky/human-signals)	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/nodejs/node/pull/21313	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.ascendercorp.com/	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.midnight-commander.org/browser/lib/tty/key.c	DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/	DocuFlex.exe, 00000000.00000000.1168081456.00000000051A4000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://tools.ietf.org/html/rfc7540#section-8.1.2.5	DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.squid-cache.org/Doc/config/half_closed_clients/	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://transloadit.com?utm_source=sindresorhus&utm_medium=referral&utm_campaign=sponsorship&utm_con	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://tc39.es/ecma262/#sec-timeclip	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/api/process.html#processarch)	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/nodejs/node/pull/33661	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
http://narwhaljs.org)	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/sindresorhus/into-stream)	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/WICG/scheduling-apis	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/nodejs/node/pull/48477#issuecomment-1604586650	DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://code.google.com/p/chromium/issues/detail?id=25916	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://fetch.spec.whatwg.org/#concept-header-list-delete	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://webidl.spec.whatwg.org/#abstract-opdef-converttoint	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://fetch.spec.whatwg.org/#fetch-timing-info	DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/dist/latest-v6.x/docs/api/child_process.html#child_process_options_stdio).	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000002.1632147933.0000000008829000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/12607	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/sindresorhus/win-clipboard).	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope.	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/#sec-line-terminators	DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://w3c.github.io/webappsec-referrer-policy/#referrer-policy	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://fetch.spec.whatwg.org/#requestcache	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://fetch.spec.whatwg.org/#header-list-contains	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://medium.com/	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
http://html4/loose.dtd	DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.founder.com.cn/cn/bThe	DocuFlex.exe, 00000000.00000002.1668733388.000000000C452000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tc39.es/ecma262/#prod-ClassSetSyntaxCharacter	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#prod-ClassUnion	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.unicode.org/copyright.html	DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.000000000477E000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.0000000004769000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.0000000003874000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.00000000047A4000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.0000000004274000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/api/process.html#process_signal_events).	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/api/stream.html#stream_class_stream_readable).	DocuFlex.exe, 00000000.00000002.1632147933.00000000088B1000.00000004.00000800.00020000.00000000.sdmp, DocuFlex.exe, 00000000.00000002.1632147933.00000000088C9000.00000004.00000800.00020000.00000000.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://heycam.github.io/webidl/#es-iterable-entries	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://heycam.github.io/webidl/#es-interfaces	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/api/process.html#process_signal_events)	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000002.1632147933.0000000008829000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/isaacs/isexe.git	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/nodejs/node/issues	DocuFlex.exe, 00000000.00000000.1168081456.00000000051A4000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/denoland/deno/blob/main/LICENSE.md.	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://tc39.github.io/ecma262/#sec-object.prototype.tostring	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://url.spec.whatwg.org/#urlsearchparams	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://crbug.com/v8/8520	DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/sponsors/isaacs	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nodejs.org/download/release/v20.12.2/node-v20.12.2-headers.tar.gz	DocuFlex.exe, 00000000.00000000.1168081456.00000000051A4000.00000002.00000001.01000000.00000003.sdmp, DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/moxystudio/node-cross-spawn/actions/workflows/ci.yaml/badge.svg	DocuFlex.exe, 00000000.00000000.1168081456.0000000001302000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.rfc-editor.org/rfc/rfc9110#section-5.2	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://streams.spec.whatwg.org/#example-manual-write-with-backpressure	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/nodejs/node/pull/30380#issuecomment-552948364	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://heycam.github.io/webidl/#dfn-iterator-prototype-object	DocuFlex.exe, 00000000.00000000.1168081456.0000000002A7A000.00000002.00000001.01000000.00000003.sdmp	false		high
http://.jpg	DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high
https://datatracker.ietf.org/doc/html/rfc7238	DocuFlex.exe, 00000000.00000000.1168081456.000000000347A000.00000002.00000001.01000000.00000003.sdmp	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.206.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
216.58.206.54	i.ytimg.com	United States	15169	GOOGLEUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
142.251.34.3	id.google.com	United States	15169	GOOGLEUS	false
216.58.212.132	unknown	United States	15169	GOOGLEUS	false
142.250.185.198	static.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.185.110	www3.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	docu-flex.com	European Union	13335	CLOUDFLARENETUS	false
172.217.18.22	unknown	United States	15169	GOOGLEUS	false
142.250.186.66	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
216.239.34.157	tunnel.googlezip.net	United States	15169	GOOGLEUS	false