Edit tour

Windows Analysis Report
35

Overview

General Information

Sample Name:	35
Analysis ID:	682137
MD5:	aeada84492f8313f44aae7c56d5d3f8f
SHA1:	a24677f6a7549cba7301d32a0132e153be989544
SHA256:	e94b94022adbee8686effd8c966a5380989bf8a8241c3fddd29a11de332afb6a
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Classification

Process Tree

System is start

OpenWith.exe (PID: 1264 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: 5D37A62943F1071FFFFE1DE74B8F2778)

OpenWith.exe (PID: 2972 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: 5D37A62943F1071FFFFE1DE74B8F2778)

AcroRd32.exe (PID: 2320 cmdline: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\35 MD5: 0EAC436587F5A1BEF8AEB2E2381D2405)

RdrCEF.exe (PID: 5268 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 4AC861CBCAFA331A72C04BF35AE792E3)

chrome.exe (PID: 3932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%74%6F%2D%63%6C%69%63%6B%2E%66%75%6E%2F%65%72%69%58%46%76%4B%56%48%63%36%23%79%65%78%6F%72%79%76%6A%78%6A&sa=D&sntz=1&usg=AOvVaw2t3jeNlZEFZI-xvhukbEyl MD5: 74859601FB4BEEA84B40D874CCB56CAB)

chrome.exe (PID: 6336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1752,12796533771390455494,5363625801302401924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:8 MD5: 74859601FB4BEEA84B40D874CCB56CAB)

cleanup

HTTP traffic detected: HTTP/1.1 404 Not FoundAccept-Ranges: bytesAge: 221725Cache-Control: max-age=604800Content-Type: text/html; charset=UTF-8Date: Thu, 11 Aug 2022 03:08:18 GMTExpires: Thu, 18 Aug 2022 03:08:18 GMTLast-Modified: Mon, 08 Aug 2022 13:32:53 GMTServer: ECS (bsa/EB1A)Vary: Accept-EncodingX-Cache: 404-HITContent-Length: 1256Connection: close

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.3:56422 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.3:56421 version: TLS 1.2

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9rscy23_i5v9my_174.tmp

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: classification engine

Classification label: clean2.win@31/65@9/10

Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\35
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%74%6F%2D%63%6C%69%63%6B%2E%66%75%6E%2F%65%72%69%58%46%76%4B%56%48%63%36%23%79%65%78%6F%72%79%76%6A%78%6A&sa=D&sntz=1&usg=AOvVaw2t3jeNlZEFZI-xvhukbEyl
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1752,12796533771390455494,5363625801302401924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:8
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\35
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%74%6F%2D%63%6C%69%63%6B%2E%66%75%6E%2F%65%72%69%58%46%76%4B%56%48%63%36%23%79%65%78%6F%72%79%76%6A%78%6A&sa=D&sntz=1&usg=AOvVaw2t3jeNlZEFZI-xvhukbEyl
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1752,12796533771390455494,5363625801302401924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Windows\System32\OpenWith.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Source: C:\Windows\System32\OpenWith.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2972:120:WilError_02

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.1552

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

File opened: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\crash_reporter.cfg

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\OpenWith.exe

Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\35

Source: Joe Sandbox View	IP Address: 93.184.216.34 93.184.216.34
Source: Joe Sandbox View	IP Address: 93.184.216.34 93.184.216.34

Source: unknown	Network traffic detected: HTTP traffic on port 56421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56421
Source: unknown	Network traffic detected: HTTP traffic on port 56424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60753
Source: unknown	Network traffic detected: HTTP traffic on port 56422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56423
Source: unknown	Network traffic detected: HTTP traffic on port 63811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63659
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51086
Source: unknown	Network traffic detected: HTTP traffic on port 60942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60753 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=92.0.4515.107&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-92.0.4515.107Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /url?q=%68%74%74%70%73%3A%2F%2F%74%6F%2D%63%6C%69%63%6B%2E%66%75%6E%2F%65%72%69%58%46%76%4B%56%48%63%36%23%79%65%78%6F%72%79%76%6A%78%6A&sa=D&sntz=1&usg=AOvVaw2t3jeNlZEFZI-xvhukbEyl HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9X-Client-Data: CKqPywE=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620
Source: global traffic	HTTP traffic detected: GET /eriXFvKVHc6 HTTP/1.1Host: to-click.funConnection: keep-alivesec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?utm_source=g3Ase2bbTdNbHV HTTP/1.1Host: sweetiestouch2u.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"sec-ch-ua-mobile: ?0Referer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"Origin: https://sweetiestouch2u.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media.ext HTTP/1.1Host: example.orgConnection: keep-alivesec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://sweetiestouch2u.com/Accept-Language: en-US,en;q=0.9Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-heart-red.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: sweetiestouch2u.com
Source: global traffic	HTTP traffic detected: GET /lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-heart.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: sweetiestouch2u.com
Source: global traffic	HTTP traffic detected: GET /lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-times-blue.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: sweetiestouch2u.com
Source: global traffic	HTTP traffic detected: GET /lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/m1.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: sweetiestouch2u.com
Source: global traffic	HTTP traffic detected: GET /lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-times.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: sweetiestouch2u.com

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	11 Process Injection	LSASS Memory	11 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label
https://to-click.fun/eriXFvKVHc6	0%	Avira URL Cloud	safe
https://sweetiestouch2u.com/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-heart-red.svg	0%	Avira URL Cloud	safe
https://sweetiestouch2u.com/?utm_source=g3Ase2bbTdNbHV	0%	Avira URL Cloud	safe
https://sweetiestouch2u.com/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-times.svg	0%	Avira URL Cloud	safe
https://sweetiestouch2u.com/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-heart.svg	0%	Avira URL Cloud	safe
https://sweetiestouch2u.com/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-times-blue.svg	0%	Avira URL Cloud	safe
https://sweetiestouch2u.com/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/m1.jpg	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gstaticadssl.l.google.com	142.250.186.67	true	false		high
example.org	93.184.216.34	true	false		high
accounts.google.com	172.217.16.205	true	false		high
to-click.fun	5.161.54.249	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.185.132	true	false		high
clients.l.google.com	142.250.185.142	true	false		high
sweetiestouch2u.com	188.114.97.3	true	false		unknown
clients2.google.com	unknown	unknown	false		high
code.jquery.com	unknown	unknown	false		high
cdn.jsdelivr.net	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://to-click.fun/eriXFvKVHc6	false	Avira URL Cloud: safe	unknown
https://sweetiestouch2u.com/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-heart-red.svg	false	Avira URL Cloud: safe	unknown
https://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%74%6F%2D%63%6C%69%63%6B%2E%66%75%6E%2F%65%72%69%58%46%76%4B%56%48%63%36%23%79%65%78%6F%72%79%76%6A%78%6A&sa=D&sntz=1&usg=AOvVaw2t3jeNlZEFZI-xvhukbEyl	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=92.0.4515.107&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://sweetiestouch2u.com/?utm_source=g3Ase2bbTdNbHV	false	Avira URL Cloud: safe	unknown
https://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%74%6F%2D%63%6C%69%63%6B%2E%66%75%6E%2F%65%72%69%58%46%76%4B%56%48%63%36%23%79%65%78%6F%72%79%76%6A%78%6A&sa=D&sntz=1&usg=AOvVaw2t3jeNlZEFZI-xvhukbEyl	false		high
https://sweetiestouch2u.com/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-times.svg	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://sweetiestouch2u.com/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-heart.svg	false	Avira URL Cloud: safe	unknown
https://sweetiestouch2u.com/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-times-blue.svg	false	Avira URL Cloud: safe	unknown
https://sweetiestouch2u.com/?a=1868012&cr=57748&lid=19953&mh=TWpVZHNsdmF5SEF4eWJmcm9BaGdMV1Z6cEVXeE54YXRRUndzRU8tMzU4NzU%3D&mmid=2760&p=0&rf=uu&rn=zc4ZodGUys4WmdeVEhG&t=notrack	false		unknown
https://sweetiestouch2u.com/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/m1.jpg	false	Avira URL Cloud: safe	unknown
https://example.org/media.ext	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.67	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
93.184.216.34	example.org	European Union	15133	EDGECASTUS	false
172.217.16.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	sweetiestouch2u.com	European Union	13335	CLOUDFLARENETUS	false
142.250.185.142	clients.l.google.com	United States	15169	GOOGLEUS	false
5.161.54.249	to-click.fun	Germany	24940	HETZNER-ASDE	false

IP
192.168.2.1
127.0.0.1

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	682137
Start date and time:	2022-08-11 05:06:22 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 28s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	35
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@31/65@9/10
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.635434451938335
Encrypted:	false
SSDEEP:	6:men9YOFLvEWdM9QfPu/wZx9tFflBi7Z+P41:vDRM9YPuIZx9nfuZi
MD5:	0FC1648A0D19CDD69F1792624A33FE7C
SHA1:	EFF08B65B1FF7183FA66F11175A9DA4C75BF9AC3
SHA-256:	10DAD571F7116A7D9ED43F2AB3C4831BC012D9FF5C86C76D55A693151885DBB8
SHA-512:	A81526D3AFBC08A52D0CCA5F05BB5FCAB546FCCC09C27E69CAD62EB78CBF1FDEB723467614A955C39EBAC81107687B9B0C9A69FC3AAA9BD371F198B1E8EEE1F7
Malicious:	false
Reputation:	low
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js .(.L.D/......*. (.G<..A.A..Eo......................d.{v.^.G...d.W.:...P..k%..A..Eo..................

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	115777
Entropy (8bit):	6.032929733000421
Encrypted:	false
SSDEEP:	1536:NGWYBRYGI1pneBQOwQgdWtxwXcBxA1wqW23vfhPwDlLeSfhCsjUtjOjXMWe1:NCj2QyQgd2xNBIwqn3vfh2lvRgyjXC
MD5:	549D76754A5BFFB6B274ED5E03095283
SHA1:	758028EDBF578FBFE4AA52E5CFAAD15F64FDC91D
SHA-256:	C4E56759663F91C8A639EAB1EA4707AF9DA377BC4CFAF7DBB9F70405CAB35D91
SHA-512:	04D64B6F57B0147FFE750C04C4FC42A6120D3FE2D638ABC9AB2F5FF541078786C0ED5498F411EFBA7AB2E44AFA414C8CCDFB9B1B0BD99E4D29D3F713700453A3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"91.0.4472.77"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.660219693490909e+12,"network":1.660187295e+12,"ticks":246420290.0,"uncertainty":3722295.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABBQ7WxpM2gT7fMNkY5iRxkAAAAAAIAAAAAABBmAAAAAQAAIAAAALDWDwoLRYqp0NkiPsTxUN2QcOPsitaJrdacpo+ULE2PAAAAAA6AAAAAAgAAIAAAAOIeKQBWbQSCqXv1OSNS2lIZGHfAdJRwvbkapN4/FWvwMAAAAPz8I/w07KQb4Ut8ObsBGVgFwbuU88R362cCGZpNEtOEILJDMaKWOA4Y9ejBRTt5kEAAAADq8RkIezfgqGPgEaEMkhoGd9qhyBeyucXcRUPEI7mgYIxaDt8C5FJrjkEhV5EOUcUmR2SCzqYelImLnfOlbhRQ"},"policy":{"last_statistics_update":"13304693289712948"},"profile":{"info_cache":{"Default":{"active_time":1660219692.015397,"avatar_icon":"chrom

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 11, 2022 05:08:14.523781061 CEST	49901	443	192.168.2.3	172.217.16.205
Aug 11, 2022 05:08:14.523833036 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:14.523926020 CEST	49901	443	192.168.2.3	172.217.16.205
Aug 11, 2022 05:08:14.524224043 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:14.524274111 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:14.524363995 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:14.524885893 CEST	49901	443	192.168.2.3	172.217.16.205
Aug 11, 2022 05:08:14.524915934 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:14.525011063 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:14.525043011 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:14.583643913 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:14.584434986 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:14.595161915 CEST	60753	443	192.168.2.3	142.250.185.132
Aug 11, 2022 05:08:14.595211983 CEST	443	60753	142.250.185.132	192.168.2.3
Aug 11, 2022 05:08:14.595376015 CEST	60753	443	192.168.2.3	142.250.185.132
Aug 11, 2022 05:08:14.596395016 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:14.596429110 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:14.596688032 CEST	49901	443	192.168.2.3	172.217.16.205
Aug 11, 2022 05:08:14.596741915 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:14.597021103 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:14.597161055 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:14.598040104 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:14.598136902 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:14.598352909 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:14.598483086 CEST	49901	443	192.168.2.3	172.217.16.205
Aug 11, 2022 05:08:14.629671097 CEST	60753	443	192.168.2.3	142.250.185.132
Aug 11, 2022 05:08:14.629718065 CEST	443	60753	142.250.185.132	192.168.2.3
Aug 11, 2022 05:08:14.686876059 CEST	443	60753	142.250.185.132	192.168.2.3
Aug 11, 2022 05:08:14.695053101 CEST	60753	443	192.168.2.3	142.250.185.132
Aug 11, 2022 05:08:14.695101023 CEST	443	60753	142.250.185.132	192.168.2.3
Aug 11, 2022 05:08:14.696348906 CEST	443	60753	142.250.185.132	192.168.2.3
Aug 11, 2022 05:08:14.696482897 CEST	60753	443	192.168.2.3	142.250.185.132
Aug 11, 2022 05:08:15.018774033 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:15.019201040 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:15.019203901 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:15.019963026 CEST	49901	443	192.168.2.3	172.217.16.205
Aug 11, 2022 05:08:15.020261049 CEST	60753	443	192.168.2.3	142.250.185.132
Aug 11, 2022 05:08:15.020339012 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:15.020621061 CEST	443	60753	142.250.185.132	192.168.2.3
Aug 11, 2022 05:08:15.020715952 CEST	49901	443	192.168.2.3	172.217.16.205
Aug 11, 2022 05:08:15.020751953 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:15.021109104 CEST	60753	443	192.168.2.3	142.250.185.132
Aug 11, 2022 05:08:15.021142960 CEST	443	60753	142.250.185.132	192.168.2.3
Aug 11, 2022 05:08:15.052177906 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:15.052321911 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:15.052360058 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:15.052392960 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:15.052624941 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:15.063389063 CEST	443	60753	142.250.185.132	192.168.2.3
Aug 11, 2022 05:08:15.063512087 CEST	60753	443	192.168.2.3	142.250.185.132
Aug 11, 2022 05:08:15.071484089 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:15.071634054 CEST	49901	443	192.168.2.3	172.217.16.205
Aug 11, 2022 05:08:15.071671009 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:15.072022915 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:15.072099924 CEST	49901	443	192.168.2.3	172.217.16.205
Aug 11, 2022 05:08:15.132433891 CEST	51086	443	192.168.2.3	142.250.185.142
Aug 11, 2022 05:08:15.132457018 CEST	443	51086	142.250.185.142	192.168.2.3
Aug 11, 2022 05:08:15.138896942 CEST	49901	443	192.168.2.3	172.217.16.205
Aug 11, 2022 05:08:15.138932943 CEST	443	49901	172.217.16.205	192.168.2.3
Aug 11, 2022 05:08:15.329714060 CEST	60753	443	192.168.2.3	142.250.185.132
Aug 11, 2022 05:08:15.329758883 CEST	443	60753	142.250.185.132	192.168.2.3
Aug 11, 2022 05:08:15.812881947 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:15.812942982 CEST	443	63811	5.161.54.249	192.168.2.3
Aug 11, 2022 05:08:15.813060045 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:15.816442013 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:15.816468954 CEST	443	63811	5.161.54.249	192.168.2.3
Aug 11, 2022 05:08:16.065457106 CEST	443	63811	5.161.54.249	192.168.2.3
Aug 11, 2022 05:08:16.113277912 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:16.129771948 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:16.129802942 CEST	443	63811	5.161.54.249	192.168.2.3
Aug 11, 2022 05:08:16.132683039 CEST	443	63811	5.161.54.249	192.168.2.3
Aug 11, 2022 05:08:16.132795095 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:16.189734936 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:16.190048933 CEST	443	63811	5.161.54.249	192.168.2.3
Aug 11, 2022 05:08:16.190855980 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:16.190886974 CEST	443	63811	5.161.54.249	192.168.2.3
Aug 11, 2022 05:08:16.314291000 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:16.324450016 CEST	443	63811	5.161.54.249	192.168.2.3
Aug 11, 2022 05:08:16.324563026 CEST	443	63811	5.161.54.249	192.168.2.3
Aug 11, 2022 05:08:16.324667931 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:16.328947067 CEST	63811	443	192.168.2.3	5.161.54.249
Aug 11, 2022 05:08:16.328974962 CEST	443	63811	5.161.54.249	192.168.2.3
Aug 11, 2022 05:08:16.573808908 CEST	60942	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:16.573858976 CEST	443	60942	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:16.573987007 CEST	60942	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:16.574536085 CEST	60942	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:16.574558973 CEST	443	60942	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:16.627881050 CEST	443	60942	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:16.640682936 CEST	60942	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:16.640754938 CEST	443	60942	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:16.643599033 CEST	443	60942	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:16.643701077 CEST	60942	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:16.681545973 CEST	60942	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:16.681853056 CEST	443	60942	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:16.681935072 CEST	60942	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:16.725914955 CEST	443	60942	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:16.769254923 CEST	443	60942	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:16.769342899 CEST	443	60942	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:16.769407988 CEST	443	60942	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:16.769443989 CEST	60942	443	192.168.2.3	188.114.97.3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 11, 2022 05:08:14.437222004 CEST	63463	53	192.168.2.3	1.1.1.1
Aug 11, 2022 05:08:14.454571962 CEST	53	63463	1.1.1.1	192.168.2.3
Aug 11, 2022 05:08:14.460470915 CEST	60072	53	192.168.2.3	1.1.1.1
Aug 11, 2022 05:08:14.462836027 CEST	57930	53	192.168.2.3	1.1.1.1
Aug 11, 2022 05:08:14.477977991 CEST	53	60072	1.1.1.1	192.168.2.3
Aug 11, 2022 05:08:14.480330944 CEST	53	57930	1.1.1.1	192.168.2.3
Aug 11, 2022 05:08:15.626008034 CEST	50468	53	192.168.2.3	1.1.1.1
Aug 11, 2022 05:08:15.735641003 CEST	53	50468	1.1.1.1	192.168.2.3
Aug 11, 2022 05:08:16.334803104 CEST	50909	53	192.168.2.3	1.1.1.1
Aug 11, 2022 05:08:16.518194914 CEST	53	50909	1.1.1.1	192.168.2.3
Aug 11, 2022 05:08:17.201244116 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.219064951 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.223109007 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.223165035 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.223182917 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.224201918 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.262310982 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.269685984 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.270602942 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.279973984 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.280018091 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.280049086 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.280075073 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.286839962 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.288180113 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.294435024 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.301750898 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.301985979 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.318576097 CEST	65277	53	192.168.2.3	1.1.1.1
Aug 11, 2022 05:08:17.319171906 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.411371946 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.415445089 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.415813923 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.416102886 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.416398048 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.416686058 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.422013998 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.434298992 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.434331894 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.439141035 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.440227032 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.440260887 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.441163063 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.443908930 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.493128061 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.510288000 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.510682106 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.510792971 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.511012077 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.511373043 CEST	52016	53	192.168.2.3	1.1.1.1
Aug 11, 2022 05:08:17.956718922 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.974482059 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.979585886 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.979767084 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.979806900 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.979899883 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.979942083 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.979980946 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.980048895 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.980083942 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.980120897 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.980154991 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:17.984101057 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.984175920 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.984262943 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.984373093 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:17.984447002 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.001275063 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001312971 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001349926 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001388073 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001421928 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001457930 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001496077 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001529932 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001568079 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001604080 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001640081 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001641035 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.001677990 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.001754045 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.001847029 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.001900911 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.002017975 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.002060890 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.002078056 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.002144098 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.002181053 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.002216101 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.002252102 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.002281904 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.002289057 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.002329111 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.002367020 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.003443956 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.003541946 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.003624916 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.018723011 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.018790960 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.018829107 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.018866062 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.018901110 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.018938065 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.018974066 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019011021 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019047976 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019083023 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019114971 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.019118071 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019155979 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019191027 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019211054 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.019227028 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019263983 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019299984 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019308090 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.019337893 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019371986 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019407988 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019432068 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.019443989 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.019471884 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.020524979 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.020560026 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.020565033 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.020570040 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.020575047 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.020580053 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.037599087 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.045521021 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.145065069 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.162985086 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.196701050 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:18.228493929 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:18.232446909 CEST	63967	53	192.168.2.3	1.1.1.1
Aug 11, 2022 05:08:18.249584913 CEST	53	63967	1.1.1.1	192.168.2.3
Aug 11, 2022 05:08:19.028876066 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:19.046567917 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:19.052058935 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:19.052081108 CEST	443	54146	188.114.97.3	192.168.2.3
Aug 11, 2022 05:08:19.052761078 CEST	54146	443	192.168.2.3	188.114.97.3
Aug 11, 2022 05:08:20.692375898 CEST	61825	53	192.168.2.3	1.1.1.1
Aug 11, 2022 05:08:20.865446091 CEST	53	61825	1.1.1.1	192.168.2.3

Timestamp	kBytes transferred	Direction	Data
2022-08-11 03:08:15 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=92.0.4515.107&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-92.0.4515.107 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-11 03:08:15 UTC	2	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-UdWKATbrUdy0fFJ8awxpUw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 11 Aug 2022 03:08:15 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5700 X-Daystart: 72495 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-11 03:08:15 UTC	3	IN	Data Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 37 30 30 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 37 32 34 39 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5700" elapsed_seconds="72495"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-08-11 03:08:15 UTC	3	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-08-11 03:08:15 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-11 03:08:15 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620
2022-08-11 03:08:15 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-08-11 03:08:15 UTC	5	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 11 Aug 2022 03:08:15 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-MIzBAZV3b4KWjeXNML11zQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-MIzBAZV3b4KWjeXNML11zQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-11 03:08:15 UTC	6	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-08-11 03:08:15 UTC	6	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-11 03:08:21 UTC	107	OUT	GET /lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-times.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: sweetiestouch2u.com
2022-08-11 03:08:22 UTC	108	IN	HTTP/1.1 200 OK Date: Thu, 11 Aug 2022 03:08:22 GMT Content-Type: image/svg+xml Content-Length: 364 Connection: close Last-Modified: Tue, 10 May 2022 09:38:15 GMT ETag: "627a3287-16c" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Access-Control-Expose-Headers: Content-Length,Content-Range Cache-Control: max-age=1800 CF-Cache-Status: EXPIRED Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z3tGogxMMQLZrGL94rrue4Ys2d31RVEkuHBYNlmfeRDqVP%2FOnO%2B8FF9qV%2BC%2FpozQOW3fkNomUCNCpobNlwkrwUdTVPH2RPvhUYcncOOYUk81AvC7pIalaYHEtMXey1Sudq5D5CzD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 738dc42c9e47bb43-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-11 03:08:22 UTC	109	IN	Data Raw: 3c 73 76 67 20 68 65 69 67 68 74 3d 22 31 37 39 32 22 20 77 69 64 74 68 3d 22 31 37 39 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 20 64 3d 22 4d 31 34 39 30 20 31 33 32 32 71 30 20 34 30 2d 32 38 20 36 38 6c 2d 31 33 36 20 31 33 36 71 2d 32 38 20 32 38 2d 36 38 20 32 38 74 2d 36 38 2d 32 38 6c 2d 32 39 34 2d 32 39 34 2d 32 39 34 20 32 39 34 71 2d 32 38 20 32 38 2d 36 38 20 32 38 74 2d 36 38 2d 32 38 6c 2d 31 33 36 2d 31 33 36 71 2d 32 38 2d 32 38 2d 32 38 2d 36 38 74 32 38 2d 36 38 6c 32 39 34 2d 32 39 34 2d 32 39 34 2d 32 39 34 71 2d 32 38 2d 32 38 2d 32 38 2d 36 38 74 32 38 2d 36 38 6c 31 33 36 2d 31 33 36 71 32 38 2d 32 38 20 36 38 Data Ascii: <svg height="1792" width="1792" xmlns="http://www.w3.org/2000/svg"><path fill="#fff" d="M1490 1322q0 40-28 68l-136 136q-28 28-68 28t-68-28l-294-294-294 294q-28 28-68 28t-68-28l-136-136q-28-28-28-68t28-68l294-294-294-294q-28-28-28-68t28-68l136-136q28-28 68
2022-08-11 03:08:22 UTC	109	IN	Data Raw: 20 32 38 20 32 38 20 36 38 74 2d 32 38 20 36 38 6c 2d 32 39 34 20 32 39 34 20 32 39 34 20 32 39 34 71 32 38 20 32 38 20 32 38 20 36 38 7a 22 2f 3e 3c 2f 73 76 67 3e Data Ascii: 28 28 68t-28 68l-294 294 294 294q28 28 28 68z"/></svg>

Timestamp	kBytes transferred	Direction	Data
2022-08-11 03:08:15 UTC	1	OUT	GET /url?q=%68%74%74%70%73%3A%2F%2F%74%6F%2D%63%6C%69%63%6B%2E%66%75%6E%2F%65%72%69%58%46%76%4B%56%48%63%36%23%79%65%78%6F%72%79%76%6A%78%6A&sa=D&sntz=1&usg=AOvVaw2t3jeNlZEFZI-xvhukbEyl HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92" sec-ch-ua-mobile: ?0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 X-Client-Data: CKqPywE= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+620
2022-08-11 03:08:15 UTC	3	IN	HTTP/1.1 200 OK Location: https://to-click.fun/eriXFvKVHc6#yexoryvjxj Cache-Control: private Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 BFCache-Opt-In: unload P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Thu, 11 Aug 2022 03:08:15 GMT Server: gws Content-Length: 385 X-XSS-Protection: 0 Expires: Thu, 11 Aug 2022 03:08:15 GMT Set-Cookie: __Secure-ENID=6.SE=D5t-FZQmyWJrPyIzdaZOwvH2osJo-1hZZX8jDPCgZipXhAmKawj9FI-pRi_SisI8c6k3ETdr8rzoESEVPEzTQUiZVzZ2aK9mkLyhaLCqIEzV4GSxz7wd680xOBkLHhKQNLG79qJ-wL_KUqmmj1e2n5Bv9YHQSAMM01LtoYZmpmU; expires=Sun, 10-Sep-2023 19:26:33 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-08-11 03:08:15 UTC	4	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 54 49 54 4c 45 3e 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 74 6f 2d 63 6c 69 63 6b 2e 66 75 6e 2f 65 72 69 58 46 76 4b 56 48 63 36 23 79 65 78 6f 72 79 76 6a 78 6a 22 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 6f 6e 4c 6f 61 64 3d 22 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 73 3a 2f 2f 74 6f 2d 63 6c 69 63 6b 2e 66 75 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>Redirecting</TITLE><META HTTP-EQUIV="refresh" content="1; url=https://to-click.fun/eriXFvKVHc6#yexoryvjxj"></HEAD><BODY onLoad="location.replace('https://to-click.fu

Timestamp	kBytes transferred	Direction	Data
2022-08-11 03:08:16 UTC	6	OUT	GET /eriXFvKVHc6 HTTP/1.1 Host: to-click.fun Connection: keep-alive sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92" sec-ch-ua-mobile: ?0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-11 03:08:16 UTC	7	IN	HTTP/1.1 302 Found Server: nginx Date: Thu, 11 Aug 2022 03:08:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate,post-check=0,pre-check=0 Expires: 0 Last-Modified: Thu, 11 Aug 2022 03:08:16 GMT Location: https://sweetiestouch2u.com/?utm_source=g3Ase2bbTdNbHV Pragma: no-cache Set-Cookie: _subid=ke01dc5ghv6;Expires=Sunday, 11-Sep-2022 03:08:16 GMT;Max-Age=2678400;Path=/ Set-Cookie: fc907=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI5OFwiOjE2NjAxODcyOTZ9LFwiY2FtcGFpZ25zXCI6e1wiMTQxXCI6MTY2MDE4NzI5Nn0sXCJ0aW1lXCI6MTY2MDE4NzI5Nn0ifQ.wqITsClQ0ZdBgHGhIwLhdRKDsoiL74X1U3n8XIkmpBw;Expires=Friday, 22-Mar-2075 06:16:32 GMT;Max-Age=1660273696;Path=/ Vary: Accept-Encoding Access-Control-Allow-Origin: *

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 35

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\64766d63a539c3ca_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\78bff3512887b83d_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0

Windows Analysis Report
35

Timestamp	kBytes transferred	Direction	Data
2022-08-11 03:08:16 UTC	8	OUT	GET /?utm_source=g3Ase2bbTdNbHV HTTP/1.1 Host: sweetiestouch2u.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92" sec-ch-ua-mobile: ?0 Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-11 03:08:16 UTC	8	IN	HTTP/1.1 200 OK Date: Thu, 11 Aug 2022 03:08:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: max-age=0, private, must-revalidate Cross-Origin-Window-Policy: deny Set-Cookie: k=SFMyNTY.g3QAAAAHbQAAAARhdW5xdAAAAAFtAAAABTk0ODE4bQAAAApwbFplcWJBa0x3bQAAAANoaWRtAAAAJk1qVWRzbHZheUhBeHliZnJvQWhnTFdWenBFV3hOeGF0UVJ3c0VPbQAAAAJobGQAA25pbG0AAAAFc3ViXzFkAANuaWxtAAAABXN1Yl8yZAADbmlsbQAAAAd0cmFja2VybQAAAAdub3RyYWNrbQAAAAN1bnFtAAAADGpPaEFybGFkalFDVg.3k3I9_-D4wnzo68cXigHAQ_ZFbfr-qRRYcqme9n0EfM; path=/; expires=Fri, 11 Aug 2023 03:08:16 GMT; max-age=31536000 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none X-Xss-Protection: 1; mode=block CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1CZmL2X9mJai5skH4QCqJVghKqQnm%2FxgwYAO94ZmxzpMi7%2BbfA83npJGOcWp6VwS1S20qc7XD%2BbeANfH8LaObP%2BZNSwY2XOZ2PJj5czpt9UwNyWQDuJad5rmfrec9F2FCPyIYzg2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 738dc40c4a679bd0-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-11 03:08:16 UTC	10	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2022-08-11 03:08:16 UTC	10	IN	Data Raw: 32 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 Data Ascii: 200<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0,maximum-scale=1.0, user-scalable=no"><meta name="r
2022-08-11 03:08:16 UTC	10	IN	Data Raw: 66 66 61 0d 0a 75 62 73 65 74 3d 6c 61 74 69 6e 2d 65 78 74 22 29 3b 2e 66 61 64 65 49 6e 55 70 7b 61 6e 69 6d 61 74 69 6f 6e 3a 61 20 2e 34 73 20 66 6f 72 77 61 72 64 73 7d 40 6b 65 79 66 72 61 6d 65 73 20 61 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 32 72 65 6d 2c 30 29 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 7d 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 4d 6f 6e 74 73 65 72 72 61 74 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 7d 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c Data Ascii: ffaubset=latin-ext");.fadeInUp{animation:a .4s forwards}@keyframes a{0%{opacity:0;transform:translate3d(0,2rem,0)}to{opacity:1;transform:translateZ(0)}}body{font-family:Montserrat,Arial,Helvetica,sans-serif;font-size:16px;line-height:1.4}h1,h2,h3,h4,h5,
2022-08-11 03:08:16 UTC	11	IN	Data Raw: 7a 2d 69 6e 64 65 78 3a 33 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 75 70 70 65 72 63 61 73 65 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 61 64 75 6c 74 20 73 70 61 6e 7b 74 65 78 74 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 7d 2e 6d 61 69 6e 7b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 Data Ascii: z-index:3;text-transform:uppercase;font-size:.875rem;display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center;-ms-flex-direction:column;flex-direction:column}.adult span{text-shadow:none}.main{display:-ms-flexbox;display:flex;-ms-flex-dir
2022-08-11 03:08:16 UTC	13	IN	Data Raw: 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 32 35 72 65 6d 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 7d 2e 67 75 72 6c 5f 5f 6e 61 68 20 2e 69 6d 67 20 69 6d 67 2c 2e 67 75 72 6c 5f 5f 79 65 61 68 20 2e 69 6d 67 20 69 6d 67 7b 77 69 64 74 68 3a 31 2e 35 72 65 6d 3b 68 65 69 67 68 74 3a 31 2e 35 72 65 6d 7d 2e 67 75 72 6c 5f 5f 6e 61 68 20 73 70 61 6e 2e 63 6f 75 6e 74 2c 2e 67 75 72 6c 5f 5f 79 65 61 68 20 73 70 61 6e 2e 63 6f 75 6e 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 7d 2e 62 74 6e 62 6f 78 7b 77 69 64 74 68 3a 31 Data Ascii: -items:center;-ms-flex-pack:center;justify-content:center;margin-bottom:.25rem;background:#fff}.gurl__nah .img img,.gurl__yeah .img img{width:1.5rem;height:1.5rem}.gurl__nah span.count,.gurl__yeah span.count{font-size:1.25rem;line-height:1}.btnbox{width:1
2022-08-11 03:08:16 UTC	14	IN	Data Raw: 66 62 37 0d 0a 72 65 6d 3b 6d 69 6e 2d 77 69 64 74 68 3a 36 2e 35 72 65 6d 3b 68 65 69 67 68 74 3a 36 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 20 31 72 65 6d 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 62 74 6e 2d 2d 72 6f 75 6e 64 20 69 6d 67 2e 74 69 6d 65 73 2c 2e 6e 6f 74 2d 62 74 6e 2d 2d 72 6f 75 6e 64 20 69 6d 67 2e 74 69 6d 65 73 7b 77 69 64 74 68 3a 33 72 65 6d 3b 68 65 69 67 68 74 3a 33 72 65 6d 7d 2e 62 74 6e 2d 2d 72 6f 75 6e 64 20 69 6d 67 2e 68 65 61 72 74 2c 2e 6e 6f 74 2d 62 74 6e 2d 2d 72 6f 75 6e 64 20 69 6d 67 2e 68 65 61 72 74 7b 77 69 64 74 68 3a 33 72 65 6d 3b 68 65 69 67 68 74 3a 33 72 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a Data Ascii: fb7rem;min-width:6.5rem;height:6.5rem;margin:0 1rem;-ms-flex-direction:column;flex-direction:column}.btn--round img.times,.not-btn--round img.times{width:3rem;height:3rem}.btn--round img.heart,.not-btn--round img.heart{width:3rem;height:3rem;margin-top:
2022-08-11 03:08:16 UTC	15	IN	Data Raw: 62 74 6e 62 6f 78 20 61 2c 2e 73 74 65 70 2e 61 63 74 69 76 65 20 2e 73 74 65 70 5f 5f 68 65 61 64 65 72 7b 6f 70 61 63 69 74 79 3a 31 7d 2e 73 74 65 70 2e 68 69 64 64 65 6e 20 2e 73 74 65 70 5f 5f 62 6f 64 79 2c 2e 73 74 65 70 2e 68 69 64 64 65 6e 20 2e 73 74 65 70 5f 5f 66 6f 6f 74 65 72 2c 2e 73 74 65 70 2e 68 69 64 64 65 6e 20 2e 73 74 65 70 5f 5f 68 65 61 64 65 72 7b 6f 70 61 63 69 74 79 3a 30 7d 2e 62 67 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 30 7d 2e 62 67 2c 2e 62 67 3a 61 66 74 65 72 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d Data Ascii: btnbox a,.step.active .step__header{opacity:1}.step.hidden .step__body,.step.hidden .step__footer,.step.hidden .step__header{opacity:0}.bg{position:fixed!important;z-index:0}.bg,.bg:after{width:100%;height:100%;left:0;top:0;right:0;bottom:0;display:block}
2022-08-11 03:08:16 UTC	17	IN	Data Raw: 62 65 3c 2f 61 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 64 75 6c 74 22 3e 3c 73 70 61 6e 3e 61 64 75 6c 74 20 6f 6e 6c 79 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 6d 61 69 6e 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 74 65 70 62 6f 78 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 74 65 70 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 74 65 70 5f 5f 69 6e 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 74 65 70 5f 5f 68 65 61 64 65 72 22 3e 3c 68 31 20 63 6c 61 73 73 3d 22 74 2d 63 65 6e 74 65 72 22 3e 57 68 6f 20 69 73 20 74 68 65 20 68 6f 74 74 65 73 74 20 6f 6e 65 3f 3c 2f 68 31 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d Data Ascii: be</a><div class="adult"><span>adult only</span></div><main class="main"><div class="container"><div class="stepbox"> <div class="step"> <div class="step__inner"> <div class="step__header"><h1 class="t-center">Who is the hottest one?</h1></div><div class=
2022-08-11 03:08:16 UTC	18	IN	Data Raw: 31 30 33 33 0d 0a 3c 69 6d 67 20 63 6c 61 73 73 3d 22 74 69 6d 65 73 22 20 73 72 63 3d 22 2f 6c 73 74 61 74 69 63 2f 61 65 39 64 36 63 34 63 31 30 38 61 37 65 65 39 39 32 33 66 38 32 65 32 33 30 36 62 63 62 39 63 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 2d 68 65 61 72 74 2d 72 65 64 2e 73 76 67 22 3e 3c 2f 64 69 76 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 76 65 72 2d 73 6c 69 64 65 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 72 6c 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 72 6c 5f 5f 61 76 61 74 61 72 20 6c 61 7a 79 6c 6f 61 64 22 20 64 61 74 61 2d 73 72 63 3d 22 2f 6c 73 74 61 74 69 63 2f 61 65 Data Ascii: 1033<img class="times" src="/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-heart-red.svg"></div><span class="count"></span></div></div></div></div><div class="mover-slide"><div class="gurl"><div class="gurl__avatar lazyload" data-src="/lstatic/ae
2022-08-11 03:08:16 UTC	19	IN	Data Raw: 36 62 63 62 39 63 2f 69 6d 61 67 65 73 2f 6d 35 2e 6a 70 67 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 72 6c 5f 5f 73 74 61 74 69 73 74 69 63 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 72 6c 5f 5f 6e 61 68 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 3c 69 6d 67 20 63 6c 61 73 73 3d 22 74 69 6d 65 73 22 20 73 72 63 3d 22 2f 6c 73 74 61 74 69 63 2f 61 65 39 64 36 63 34 63 31 30 38 61 37 65 65 39 39 32 33 66 38 32 65 32 33 30 36 62 63 62 39 63 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 2d 74 69 6d 65 73 2d 62 6c 75 65 2e 73 76 67 22 3e 3c 2f 64 69 76 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 72 6c 5f 5f 79 65 61 68 22 3e Data Ascii: 6bcb9c/images/m5.jpg"></div><div class="gurl__statistic"> <div class="gurl__nah"><div class="img"><img class="times" src="/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-times-blue.svg"></div><span class="count"></span></div><div class="gurl__yeah">
2022-08-11 03:08:16 UTC	21	IN	Data Raw: 61 73 73 3d 22 74 69 6d 65 73 22 20 73 72 63 3d 22 2f 6c 73 74 61 74 69 63 2f 61 65 39 64 36 63 34 63 31 30 38 61 37 65 65 39 39 32 33 66 38 32 65 32 33 30 36 62 63 62 39 63 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 2d 68 65 61 72 74 2d 72 65 64 2e 73 76 67 22 3e 3c 2f 64 69 76 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 76 65 72 2d 73 6c 69 64 65 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 72 6c 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 72 6c 5f 5f 61 76 61 74 61 72 20 6c 61 7a 79 6c 6f 61 64 22 20 64 61 74 61 2d 73 72 63 3d 22 2f 6c 73 74 61 74 69 63 2f 61 65 39 64 36 63 34 63 31 30 38 61 37 65 65 Data Ascii: ass="times" src="/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-heart-red.svg"></div><span class="count"></span></div></div></div></div><div class="mover-slide"><div class="gurl"><div class="gurl__avatar lazyload" data-src="/lstatic/ae9d6c4c108a7ee
2022-08-11 03:08:16 UTC	22	IN	Data Raw: 2f 6d 31 30 2e 6a 70 67 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 72 6c 5f 5f 73 74 61 74 69 73 74 69 63 22 3e 20 0d 0a Data Ascii: /m10.jpg"></div><div class="gurl__statistic">
2022-08-11 03:08:16 UTC	22	IN	Data Raw: 35 34 66 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 72 6c 5f 5f 6e 61 68 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 3c 69 6d 67 20 63 6c 61 73 73 3d 22 74 69 6d 65 73 22 20 73 72 63 3d 22 2f 6c 73 74 61 74 69 63 2f 61 65 39 64 36 63 34 63 31 30 38 61 37 65 65 39 39 32 33 66 38 32 65 32 33 30 36 62 63 62 39 63 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 2d 74 69 6d 65 73 2d 62 6c 75 65 2e 73 76 67 22 3e 3c 2f 64 69 76 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 72 6c 5f 5f 79 65 61 68 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 3c 69 6d 67 20 63 6c 61 73 73 3d 22 74 69 6d 65 73 22 20 73 72 63 3d 22 2f 6c 73 74 61 74 69 63 2f 61 65 39 Data Ascii: 54f<div class="gurl__nah"><div class="img"><img class="times" src="/lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-times-blue.svg"></div><span class="count"></span></div><div class="gurl__yeah"><div class="img"><img class="times" src="/lstatic/ae9
2022-08-11 03:08:16 UTC	23	IN	Data Raw: 62 32 36 0d 0a 3c 61 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 2d 62 6c 6f 63 6b 20 62 74 6e 2d 2d 70 72 69 6d 61 72 79 22 20 68 72 65 66 3d 22 2f 67 6f 2f 3f 61 3d 31 38 36 38 30 31 32 26 63 72 3d 35 37 37 34 38 26 6c 69 64 3d 31 39 39 35 33 26 6d 68 3d 54 57 70 56 5a 48 4e 73 64 6d 46 35 53 45 46 34 65 57 4a 6d 63 6d 39 42 61 47 64 4d 56 31 5a 36 63 45 56 58 65 45 35 34 59 58 52 52 55 6e 64 7a 52 55 38 74 4d 7a 55 34 4e 7a 55 25 33 44 26 6d 6d 69 64 3d 32 37 36 30 26 70 3d 30 26 72 66 3d 75 75 26 72 6e 3d 7a 63 34 5a 6f 64 47 55 79 73 34 57 6d 64 65 56 45 68 47 26 74 3d 6e 6f 74 72 61 63 6b 22 3e 69 20 61 67 72 65 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 2e 73 74 65 Data Ascii: b26<a class="btn btn--block btn--primary" href="/go/?a=1868012&cr=57748&lid=19953&mh=TWpVZHNsdmF5SEF4eWJmcm9BaGdMV1Z6cEVXeE54YXRRUndzRU8tMzU4NzU%3D&mmid=2760&p=0&rf=uu&rn=zc4ZodGUys4WmdeVEhG&t=notrack">i agree</a></div></div></div></div></div>... /.ste
2022-08-11 03:08:16 UTC	25	IN	Data Raw: 63 2f 69 6d 61 67 65 73 2f 6d 31 30 2e 6a 70 67 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 2e 62 67 2d 2d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 6a 71 75 65 72 79 2e 63 6f 6d 2f 6a 71 75 65 72 79 2d 33 2e 33 2e 31 2e 6d 69 6e 2e 6a 73 22 20 69 6e 74 65 67 72 69 74 79 3d 22 73 68 61 32 35 36 2d 46 67 70 43 62 2f 4b 4a 51 6c 4c 4e 66 4f 75 39 31 74 61 33 32 6f 2f 4e 4d 5a 78 6c 74 77 52 6f 38 51 74 6d 6b 4d 52 64 41 75 38 3d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 6c 61 7a 79 6c 6f 61 64 40 32 2e 30 2e 30 2d 72 Data Ascii: c/images/m10.jpg"></div></div>... /.bg--><script src="https://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8=" crossorigin="anonymous"></script><script src="https://cdn.jsdelivr.net/npm/lazyload@2.0.0-r
2022-08-11 03:08:16 UTC	26	IN	Data Raw: 63 74 69 6f 6e 28 74 29 7b 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 69 28 6e 28 74 68 69 73 29 29 7d 29 7d 29 7d 28 6a 51 75 65 72 79 29 3b 66 75 6e 63 74 69 6f 6e 20 64 69 73 61 62 6c 65 43 6f 70 79 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 72 65 45 6e 61 62 6c 65 28 29 7b 72 65 74 75 72 6e 21 30 7d 24 28 66 75 6e 63 74 0d 0a Data Ascii: ction(t){t.preventDefault(),i(n(this))})})}(jQuery);function disableCopy(e){return!1}function reEnable(){return!0}$(funct
2022-08-11 03:08:16 UTC	26	IN	Data Raw: 35 33 35 0d 0a 69 6f 6e 28 29 7b 24 28 74 68 69 73 29 2e 62 69 6e 64 28 22 63 6f 6e 74 65 78 74 6d 65 6e 75 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 7d 29 7d 29 2c 24 28 64 6f 63 75 6d 65 6e 74 29 2e 6b 65 79 64 6f 77 6e 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 32 33 21 3d 65 2e 6b 65 79 43 6f 64 65 26 26 28 28 21 65 2e 63 74 72 6c 4b 65 79 7c 7c 21 65 2e 73 68 69 66 74 4b 65 79 7c 7c 37 33 21 3d 65 2e 6b 65 79 43 6f 64 65 29 26 26 76 6f 69 64 20 30 29 7d 29 2c 64 6f 63 75 6d 65 6e 74 2e 6f 6e 73 65 6c 65 63 74 73 74 61 72 74 3d 6e 65 77 20 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 66 61 6c 73 65 22 29 2c 77 69 6e 64 6f 77 2e 73 69 64 65 62 61 72 26 26 28 64 6f 63 75 6d Data Ascii: 535ion(){$(this).bind("contextmenu",function(e){e.preventDefault()})}),$(document).keydown(function(e){return 123!=e.keyCode&&((!e.ctrlKey\|\|!e.shiftKey\|\|73!=e.keyCode)&&void 0)}),document.onselectstart=new Function("return false"),window.sidebar&&(docum
2022-08-11 03:08:16 UTC	28	IN	Data Raw: 31 64 38 0d 0a 2f 3f 61 3d 31 38 36 38 30 31 32 26 63 72 3d 35 37 37 34 38 26 6c 69 64 3d 31 39 39 35 33 26 6d 68 3d 54 57 70 56 5a 48 4e 73 64 6d 46 35 53 45 46 34 65 57 4a 6d 63 6d 39 42 61 47 64 4d 56 31 5a 36 63 45 56 58 65 45 35 34 59 58 52 52 55 6e 64 7a 52 55 38 74 4d 7a 55 34 4e 7a 55 25 33 44 26 6d 6d 69 64 3d 32 37 36 30 26 70 3d 30 26 72 66 3d 75 75 26 72 6e 3d 7a 63 34 5a 6f 64 47 55 79 73 34 57 6d 64 65 56 45 68 47 26 74 3d 6e 6f 74 72 61 63 6b 22 3b 0a 20 20 20 20 69 66 20 28 75 20 21 3d 3d 20 22 22 29 20 7b 0a 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 2c 20 75 29 0a 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 Data Ascii: 1d8/?a=1868012&cr=57748&lid=19953&mh=TWpVZHNsdmF5SEF4eWJmcm9BaGdMV1Z6cEVXeE54YXRRUndzRU8tMzU4NzU%3D&mmid=2760&p=0&rf=uu&rn=zc4ZodGUys4WmdeVEhG&t=notrack"; if (u !== "") { history.replaceState(null, document.title, u) }</script><script
2022-08-11 03:08:16 UTC	28	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2022-08-11 03:08:16 UTC	28	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-11 03:08:17 UTC	28	OUT	GET /s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2 HTTP/1.1 Host: fonts.gstatic.com Connection: keep-alive sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92" Origin: https://sweetiestouch2u.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://fonts.googleapis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-11 03:08:17 UTC	29	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Timing-Allow-Origin: * Content-Length: 12708 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 04 Aug 2022 05:41:25 GMT Expires: Fri, 04 Aug 2023 05:41:25 GMT Cache-Control: public, max-age=31536000 Age: 595612 Last-Modified: Mon, 11 Jul 2022 18:55:59 GMT Content-Type: font/woff2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-08-11 03:08:17 UTC	30	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 31 a4 00 10 00 00 00 00 7b e8 00 00 31 44 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 76 1b d2 48 1c 86 34 06 60 3f 53 54 41 54 48 00 85 12 11 08 0a 81 81 48 e7 2b 0b 84 40 00 01 36 02 24 03 88 7c 04 20 05 84 7c 07 20 0c 07 1b 77 6b b3 11 51 d7 47 ef 56 14 25 8b f5 2b 47 45 29 11 7d 41 f6 7f 38 e0 86 0c b0 e1 eb 0d a0 f8 6e 13 46 42 3d ab 97 23 02 b6 35 aa 6a 11 dd fc 3d d7 c8 03 9b ef 67 38 93 9f 21 0e 01 c8 cc b8 01 e3 17 09 c7 31 74 51 85 f6 54 cb 64 0d 91 8e d0 d8 27 b9 a4 41 b4 66 55 f7 cc 2c 8b ec 3a 62 bb 9b 45 03 be 8b 84 2c 84 c5 7c 91 c0 91 e7 88 10 82 f8 06 22 7e 46 c4 89 98 40 94 7c b2 11 23 22 c6 19 c9 85 a8 2f 4f ff 3f f6 fc f6 cc 7d df 0d d3 fa 57 47 2d 9a 48 88 78 f3 8c 87 06 59 Data Ascii: wOF21{1DvH4`?STATHH+@6$\| \| wkQGV%+GE)}A8nFB=#5j=g8!1tQTd'AfU,:bE,\|"~F@\|#"/O?}WG-HxY
2022-08-11 03:08:17 UTC	30	IN	Data Raw: 63 6c 08 3e c8 7c 90 11 24 64 04 61 7e ff d7 a9 cd db ad 53 c6 6b 75 bd b7 97 5a d3 48 c1 49 48 69 72 81 60 45 b6 82 f4 05 08 a3 8f 40 1c 05 f0 df 80 00 1d 02 07 e7 06 b4 4a 8b e4 7a 13 c5 75 d2 02 57 a6 96 e9 f6 ad b6 08 f2 5e f7 c0 e1 0d 8e b2 38 3c df d9 20 39 23 e3 7d 10 f5 ce ce ee 60 30 58 62 41 9c 59 ec 92 fe 0d 41 3e 9f ee 9c 01 96 87 d7 62 0f ef 0c 29 e3 1d 48 be 39 23 83 bb 93 33 26 b3 3e c8 5e 91 b1 41 a6 20 fc 50 59 ac f0 23 a5 b1 a2 0f 63 05 91 fc ef ef 9b be de 99 d3 72 a9 65 c5 c8 ce 6b 47 4c ff df fd 03 36 9e 86 4d f4 00 ff 44 09 67 31 a5 01 e7 8b ad 7d bc a4 05 b7 ba 45 0c fc 5a 43 2d 91 59 4e 73 9c dd de ff af 1b 3b d4 99 d9 3d e0 b9 af 72 29 a5 88 04 09 e2 8a 48 90 20 41 9c c7 ef 1e 63 4b 8f f8 65 b0 7d ab 80 9e c0 0b 2a d6 2a 76 03 82 Data Ascii: cl>\|$da~SkuZHIHir`E@JzuW^8< 9#}`0XbAYA>b)H9#3&>^A PY#crekGL6MDg1}EZC-YNs;=r)H AcKe}**v
2022-08-11 03:08:17 UTC	31	IN	Data Raw: 52 2f f2 19 fb 90 80 fe 1c 51 df f0 98 62 e7 23 95 0c ed 78 e1 77 0a 32 3f 6f c8 1d ce 1c f9 4a 9d 35 f9 23 dc 19 bc 76 d1 1e 53 2e 3b 2e 20 4e 73 18 75 2b 23 b6 1c 4d e5 a4 ab fd 94 9c 94 84 57 96 1a ec 35 cc ea e7 dd 29 52 58 16 0f 6b c3 94 50 85 8e cd 45 12 1e d4 dd 13 13 92 6a 0d b1 a3 ba a0 08 6a 61 17 ca ed 72 95 95 dd b6 c3 dd 29 29 32 71 00 ef 8a 4f 86 bb a9 b4 9d c9 a6 9c 21 72 d7 00 05 69 c4 a4 87 75 d6 14 5d 46 d2 84 77 76 54 5f b7 81 61 99 ed 56 ac 86 0f fb 44 b8 69 c9 06 67 70 f0 4e 24 30 f8 ab 7b 64 77 bf f1 1b 9a f1 5e 6e 03 c3 52 c2 da 59 61 c7 94 15 1c 9f e8 57 46 38 55 f9 3a 03 cd d7 48 82 31 67 c3 3c bd 3f 8c 34 75 57 69 99 9f c9 fb 4f 54 49 a3 a3 27 f9 74 5c 1b d0 36 34 3e da 1a 8a 66 53 b7 89 38 19 6f 2c 53 a1 af 34 a4 0d 44 56 af 0c Data Ascii: R/Qb#xw2?oJ5#vS.;. Nsu+#MW5)RXkPEjjar))2qO!riu]FwvT_aVDigpN$0{dw^nRYaWF8U:H1g<?4uWiOTI't\64>fS8o,S4DV
2022-08-11 03:08:17 UTC	32	IN	Data Raw: d5 8f 2d ed 42 96 7f 5b 2f 03 5b ec 96 78 42 55 be 55 28 2a 36 a5 2b 6b 61 7e d3 af 19 d6 63 e6 f6 20 0a de 19 0e d0 f9 87 5c 8a 57 f9 2f 36 69 ed 56 71 15 42 76 bd b5 3b fd bd 5e 0b 43 43 c1 bc 47 e1 5b 75 1f 6b 32 94 10 21 3c 82 2b 1d 54 5e c2 ab 57 a8 0c 47 5a bc a4 79 53 7f 6c 1b 7a b9 4d da 02 28 25 5b 6a b7 0c a3 f0 c5 2d b7 bf 63 d8 93 f1 15 20 44 a8 70 bd 64 30 c8 55 a0 dc 18 63 b5 db cf e4 ac 0b 2e e9 f4 17 33 2a 17 27 0f c0 31 f1 70 1c e7 24 ce 59 de fe e2 81 91 4b 21 8f 48 3e 09 8e 61 52 b9 54 37 b7 ef 50 0f b0 60 c0 91 4b 80 de e3 5b 89 03 64 41 23 80 ff a7 3b 52 be 78 85 80 7e 80 32 40 15 80 35 86 c1 58 06 7b 79 db cf 80 38 38 17 11 05 34 88 a6 11 88 5c 86 33 46 8e 92 14 eb 4d 8b 4a 9a 1d 72 39 24 9d 4b 89 22 fe b1 03 85 46 2a 30 da 58 23 8c Data Ascii: -B[/[xBUU(6+ka~c \W/6iVqBv;^CCG[uk2!<+T^WGZySlzM(%[j-c Dpd0Uc.3'1p$YK!H>aRT7P`K[dA#;Rx~2@5X{y884\3FMJr9$K"F*0X#
2022-08-11 03:08:17 UTC	34	IN	Data Raw: 26 5c 84 13 0e 3a e9 b9 b3 11 42 27 4e bc 44 c9 32 64 ca 62 50 a0 50 3f ff 53 a4 d8 10 e5 2a 54 aa 56 c3 68 a8 46 4d 46 38 e6 9b e3 ba dd b6 c7 7d 9d 1e f8 d3 77 ef 23 c0 07 63 5c f1 cc 29 1f 23 c2 67 4f 6d b4 29 56 78 e1 9d 7d b1 c6 06 63 5d b5 cd 56 db b5 e3 50 0c 0b 2c 1e 3e 6b 52 22 62 12 4e ec 39 70 24 a0 e2 41 cd 8d 17 77 ff f2 a4 15 24 98 46 2f 3e aa 44 8b 14 25 46 1f 7a b1 12 a4 4b 91 2a 4d be 1c b9 f2 24 f9 d9 20 fd 0d 30 d8 40 5d 4a 34 a8 55 a7 de 30 65 86 f3 56 ca ec 87 4b 2e 3b e7 82 8b ce 23 c8 98 89 00 20 67 02 00 bd 04 20 27 01 f1 b7 00 fb bb 00 f6 73 60 9e 06 00 14 9d 97 3e 2c 0a 6a 65 7f 14 68 17 83 5c 99 06 44 78 c5 a6 19 1c 0b 31 34 db 27 11 ec c3 20 22 71 25 f4 46 32 7a 2b 3f 29 7d ca 24 98 3e 24 4a 2d 2b 46 b5 d4 cf ce c7 0b 8b 9a 6a Data Ascii: &\:B'ND2dbPP?STVhFMF8}w#c\)#gOm)Vx}c]VP,>kR"bN9p$Aw$F/>D%FzKM$ 0@]J4U0eVK.;# g 's`>,jeh\Dx14' "q%F2z+?)}$>$J-+Fj
2022-08-11 03:08:17 UTC	35	IN	Data Raw: 38 a8 3b c7 d8 98 70 c0 cf 00 8d 92 13 d5 83 d5 be 5a 9b 6e 86 bb 7e 8a a9 5e ad 69 40 d9 a1 05 d2 aa 22 63 c6 2d cb 63 fd 85 45 06 3f 8a f9 b0 19 2c bd 85 86 b3 77 e3 a7 8a 4d cb fe 1f e4 65 f0 62 4e f9 92 e5 7f 3a 5e cc d5 28 a1 25 0b 8c d3 97 21 7a 88 25 38 b9 42 3a 6c d1 a4 3b 60 9b 93 71 48 3d 23 5f 5e dc 00 24 49 39 28 60 38 f1 b1 bf 82 20 59 2e a1 09 d9 5c 99 80 75 dc 72 36 21 a4 76 4f c9 a4 39 2f a0 21 39 98 3a 7d 4a 9d 20 93 7f b8 77 d8 22 0e 9c 21 36 36 c9 38 4f 3c a3 83 35 e9 be 61 78 99 ed 80 3f 04 d4 3e ea 96 e4 99 e8 db a9 14 d7 a0 d2 d4 8c 15 4d 3e fc ee 31 31 36 16 61 58 4b 6a 6a 14 00 95 a0 07 54 fa e5 a2 2b 92 a9 cf 9b 05 5c dd ed 61 cd 0f 2f cc 05 8e 32 ad 1b af 9c f8 fc 21 69 02 ce ca cc 41 bb 4c d6 3c 0b 4a e9 36 b5 fc e4 35 b9 97 3c Data Ascii: 8;pZn~^i@"c-cE?,wMebN:^(%!z%8B:l;`qH=#_^$I9(`8 Y.\ur6!vO9/!9:}J w"!668O<5ax?>M>116aXKjjT+\a/2!iAL<J65<
2022-08-11 03:08:17 UTC	36	IN	Data Raw: e8 2f f9 8e a8 23 9a 48 92 68 c9 4e 58 f2 2f 28 d3 da bd ba 7f 85 ea e1 c7 3e 1a 43 e1 27 17 9a 5d 3c 1d 7a 13 e5 7a ca 7e 89 5a 0a 8a 25 a7 50 ea 90 a4 ad 4d 30 77 d7 77 c3 ee 7f ff f9 ec dc ab d8 1b 96 7d f0 35 9c 67 86 3c fd 4c dc 18 c8 62 f6 97 a6 cb f9 1f 92 2e 09 7a 62 b6 8b 2f 21 b4 4a 75 b8 53 19 33 74 97 ee 5d 77 61 b0 b3 d4 e8 2b 6b 64 7f 0c b9 9c 3f 28 f1 39 ae 0a 09 ae 51 68 c2 5d 4a f0 65 cc 07 7d 18 f6 db 18 4c e5 9a 17 2d 5a 30 3b 75 d3 50 47 6f 43 5a ea 18 da 64 df ba 63 e1 22 44 84 0e 7b cb b6 89 58 db c8 e9 93 0a 24 dd c3 e9 ef b4 78 7e bc 2d fe 83 16 f7 f7 b6 25 7d 7d 20 f3 5e bd fc f5 0c 24 8a e5 ba 19 99 be 1f 69 c1 5f 21 de a9 2d 21 45 cb c3 3f 26 2b bf b7 c3 91 9d e1 fd 2f c5 9e f6 39 24 53 f1 19 9a c1 c2 5f fb 69 fd e8 cf f5 be 8a Data Ascii: /#HhNX/(>C']<zz~Z%PM0ww}5g<Lb.zb/!JuS3t]wa+kd?(9Qh]Je}L-Z0;uPGoCZdc"D{X$x~-%}} ^$i_!-!E?&+/9$S_i
2022-08-11 03:08:17 UTC	38	IN	Data Raw: ec 41 c9 d8 97 45 86 ad 1f 5c de fa 28 f3 ba 74 c2 fb 4a df f5 ef 77 ed ea c6 90 0e 0f 33 33 3b 5e fe 4f 11 8b 5b 5d e6 1a 78 bd 2b 91 47 e6 90 6f 94 b6 ff e8 9c fa da 9f f0 09 4c dd fe bc 4c 77 40 92 1c 66 f6 19 7a 83 53 55 bc 6e b2 dd b7 29 3f 7b aa 2e 62 bd 5f 05 0b 5f 92 29 6d 5a ab 3b 34 a6 d0 73 1a fe b4 02 87 6d 84 be 9b 7f 4f 52 76 d8 64 5e ee 64 f2 08 1b 6c 7c e4 18 8d fc 9b c7 bd 62 eb 66 b5 49 87 98 f3 1e ac e0 15 3d 7f 60 cb 5f b8 b8 59 e3 ae 10 d9 25 52 91 d5 5d 21 5f d9 56 a9 a4 44 6c 38 5f 85 1b 15 4a 1c 55 89 a4 02 7d 60 d0 d1 4b f5 3f c4 a5 a1 44 c2 7a 5b 2e 3f db 9c 36 4f 88 46 e5 d5 ef c7 20 95 f3 8d 0d da f6 67 32 82 cc 7d 0c 76 b0 af eb 35 a1 09 b3 62 49 65 25 21 75 a0 70 8a 20 be a8 c0 f6 e5 af 4f ea 9f 9b e0 a5 2d 9f df 37 f0 8a 3d Data Ascii: AE\(tJw33;^O[]x+GoLLw@fzSUn)?{.b__)mZ;4smORvd^dl\|bfI=`_Y%R]!_VDl8_JU}`K?Dz[.?6OF g2}v5bIe%!up O-7=
2022-08-11 03:08:17 UTC	39	IN	Data Raw: 87 bc cf 21 90 9f e3 71 0e 82 7d 0f 0e e8 ee 7b 8a 0a 96 f1 92 39 fb 5b 06 e3 db d9 cc ef 41 f8 6c e1 cd 01 e6 b7 b3 df 3e 88 cc 51 c6 e4 92 5c 37 7f 2d 28 bd 22 f8 2f 4f f8 a5 d3 3d c6 77 74 c6 37 0c e6 0b 0c fa 5d b0 b4 f7 cc 57 f3 04 af 3a df 63 de e9 ad 3b cc 6f 93 74 fe 70 81 a7 57 7c ce 6c 7c bc 70 56 0f 75 00 77 63 a9 8a 49 b6 86 85 aa 80 b5 81 af 75 ab 85 67 37 3d 59 34 c7 9d 7d 8f 8e 10 a6 33 df e9 7d 0f 04 ad c8 78 ab 48 39 ff f4 9e 8e 0d b3 d5 4e de c9 0d 5d 13 5b 95 d2 80 89 ae 53 3f a4 4e 39 19 ef d2 19 18 03 f4 77 c1 d8 5b b6 c6 be 63 30 df ab ff 7d 30 e7 84 9c 25 63 d2 65 2c 1a ad d0 44 67 9a 0a 41 d5 b0 b5 ee 3c d4 6e 5a ed 39 ba 2b 00 2c 9c db 9c d9 bf ee 0d 91 ec 9f 46 dc 07 16 06 ec 3a ba 88 3b bb ef b0 9a 47 5e 3c 18 9e d2 7c fa 20 17 Data Ascii: !q}{9[Al>Q\7-("/O=wt7]W:c;otpW\|l\|pVuwcIug7=Y4}3}xH9N][S?N9w[c0}0%ce,DgA<nZ9+,F:;G^<\|
2022-08-11 03:08:17 UTC	40	IN	Data Raw: 2c bf 90 3e cc 16 9a b9 3c 8b 54 0a c4 08 21 7b d8 75 7e 45 ad 4c 33 fd aa 07 ea f7 a8 ef 17 e5 46 43 75 5f 34 96 ce fb f6 a6 05 ed 08 16 b4 91 8d ab c0 8e 21 aa 0b 22 e1 79 55 03 d8 e1 72 40 fc 3c c2 7c 16 11 81 e5 21 c0 60 7d cd 75 ce ad a2 59 be a4 ce bd 92 76 c9 de 4e 70 f9 37 3f bb 80 6f 15 8b f8 36 3b 5f 24 16 d4 94 68 35 bd e0 56 29 f5 4a 8f b2 57 dd aa 32 f7 ab 68 f5 4c 6a 06 88 61 0b 32 d6 5a b1 27 31 6a 62 a5 b9 d2 e4 08 b5 c0 ef 4d f9 3b 0a 0b 77 e4 17 ac c6 dc d5 4f 88 82 9d 9a c0 b7 89 36 4c a3 df a6 d1 6e d3 a7 5a c0 b3 f8 d0 60 d5 9a 41 f0 b4 98 93 55 69 04 68 2e 5e 32 68 3f c5 cc 8b 9a b4 3b 00 3e 39 c5 5f 9f 73 99 ff f0 37 ae c5 df 3c ac b5 1e fc fa aa 22 3c bf 28 5a 5c 14 41 5d 16 50 37 98 a9 78 ee aa c8 7e 55 91 30 7f 1a cf 9e 78 6e 4d Data Ascii: ,><T!{u~EL3FCu_4!"yUr@<\|!`}uYvNp7?o6;_$h5V)JW2hLja2Z'1jbM;wO6LnZ`AUih.^2h?;>9_s7<"<(Z\A]P7x~U0xnM
2022-08-11 03:08:17 UTC	41	IN	Data Raw: f3 a3 48 cd eb a1 8d 16 e6 21 42 1b 0f f4 eb 70 17 0d 15 10 da 88 88 1b 3a 4c 17 90 ad 4a f2 84 53 f7 ea 8b 3f 9f a4 07 15 43 2d 05 c8 aa c3 af 1d 64 79 85 f9 31 cc 18 33 7c 5a 82 d4 0e 24 49 36 ca 56 3d b3 9f 1a 77 fa f9 42 d2 c4 b2 bd 20 ad 52 37 98 c7 bb 6a d8 35 dc a3 dd 54 5d 24 28 17 94 1d 11 27 30 17 62 21 1e 22 21 15 72 20 03 f4 f1 94 6c a7 32 f3 28 28 c1 19 d4 e0 63 7a ed 9e 5d 1e 2a a5 f9 9b d9 34 c9 2c 87 bc bb b8 d2 75 a1 10 36 27 34 d4 d5 cd 19 8f 8c 05 0d 87 e0 88 69 be 49 89 d7 74 bf b2 eb 4d ae a1 86 77 1b 86 29 d0 ac 96 66 22 50 11 f7 8e 47 64 dc 36 28 8c a8 ee 22 91 e0 fc 02 c3 8c 10 62 06 ad 76 07 a1 86 49 a4 fc bb 34 94 f7 8c 50 41 d8 df 2b c1 59 34 87 07 ac 82 df 00 58 69 71 e5 8c 50 c7 ef a8 55 0e 45 17 b2 73 03 71 e9 94 46 23 11 c0 Data Ascii: H!Bp:LJS?C-dy13\|Z$I6V=wB R7j5T]$('0b!"!r l2((cz]*4,u6'4iItMw)f"PGd6("bvI4PA+Y4XiqPUEsqF#

Timestamp	kBytes transferred	Direction	Data
2022-08-11 03:08:18 UTC	42	OUT	GET /media.ext HTTP/1.1 Host: example.org Connection: keep-alive sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Accept: /* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Referer: https://sweetiestouch2u.com/ Accept-Language: en-US,en;q=0.9 Range: bytes=0-
2022-08-11 03:08:18 UTC	42	IN	HTTP/1.1 404 Not Found Accept-Ranges: bytes Age: 221725 Cache-Control: max-age=604800 Content-Type: text/html; charset=UTF-8 Date: Thu, 11 Aug 2022 03:08:18 GMT Expires: Thu, 18 Aug 2022 03:08:18 GMT Last-Modified: Mon, 08 Aug 2022 13:32:53 GMT Server: ECS (bsa/EB1A) Vary: Accept-Encoding X-Cache: 404-HIT Content-Length: 1256 Connection: close
2022-08-11 03:08:18 UTC	43	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 61 6d 70 6c 65 20 44 6f 6d 61 69 6e 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 Data Ascii: <!doctype html><html><head> <title>Example Domain</title> <meta charset="utf-8" /> <meta http-equiv="Content-type" content="text/html; charset=utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1" /> <style t

Timestamp	kBytes transferred	Direction	Data
2022-08-11 03:08:20 UTC	44	OUT	GET /lstatic/ae9d6c4c108a7ee9923f82e2306bcb9c/images/icon-heart-red.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: sweetiestouch2u.com
2022-08-11 03:08:21 UTC	48	IN	HTTP/1.1 200 OK Date: Thu, 11 Aug 2022 03:08:21 GMT Content-Type: image/svg+xml Content-Length: 811 Connection: close Last-Modified: Tue, 10 May 2022 09:38:15 GMT ETag: "627a3287-32b" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Access-Control-Expose-Headers: Content-Length,Content-Range Cache-Control: max-age=1800 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EZO6L2dvl4clsgDd%2BQpjZDwgadHfYGluUE0wq2JfnLvn8SmlDKh%2Fa7uyNvuesgkG%2FQOdE6ggYrIXfX1OEI8GTcmT6J8YEYnu6qkX2BaPeZlLJ0%2F1mqRT8Qfp%2F1UAw0u1zxiyNdKZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 738dc4274ef29b83-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-11 03:08:21 UTC	49	IN	Data Raw: 3c 73 76 67 20 68 65 69 67 68 74 3d 22 31 37 39 32 22 20 77 69 64 74 68 3d 22 31 37 39 32 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 73 76 67 32 37 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 64 65 66 73 20 69 64 3d 22 64 65 66 73 33 31 22 3e 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 32 39 22 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 69 64 3d 22 73 74 6f 70 36 32 35 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 72 65 64 22 20 73 74 6f 70 2d 6f 70 61 63 69 74 79 3d 22 31 22 Data Ascii: <svg height="1792" width="1792" version="1.1" id="svg27" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg"><defs id="defs31"><linearGradient id="linearGradient629"><stop offset="0" id="stop625" stop-color="red" stop-opacity="1"
2022-08-11 03:08:21 UTC	49	IN	Data Raw: 20 73 74 6f 70 2d 6f 70 61 63 69 74 79 3d 22 31 22 2f 3e 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 78 6c 69 6e 6b 3a 68 72 65 66 3d 22 23 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 32 39 22 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 33 31 22 20 78 31 3d 22 32 33 30 2e 31 33 37 22 20 79 31 3d 22 34 38 37 2e 38 39 22 20 78 32 3d 22 31 32 30 38 2e 39 38 36 22 20 79 32 3d 22 39 36 31 2e 39 37 33 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 2f 3e 3c 2f 64 65 66 73 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 75 72 6c 28 23 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 33 31 29 22 20 64 3d 22 4d 38 39 36 20 31 36 36 34 71 2d 32 36 20 30 2d 34 Data Ascii: stop-opacity="1"/></linearGradient><linearGradient xlink:href="#linearGradient629" id="linearGradient631" x1="230.137" y1="487.89" x2="1208.986" y2="961.973" gradientUnits="userSpaceOnUse"/></defs><path fill="url(#linearGradient631)" d="M896 1664q-26 0-4

Target ID:	0
Start time:	05:06:52
Start date:	11/08/2022
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff7f6dc0000
File size:	119840 bytes
MD5 hash:	5D37A62943F1071FFFFE1DE74B8F2778
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Target ID:	4
Start time:	05:07:14
Start date:	11/08/2022
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff7f6dc0000
File size:	119840 bytes
MD5 hash:	5D37A62943F1071FFFFE1DE74B8F2778
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Target ID:	5
Start time:	05:07:20
Start date:	11/08/2022
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\35
Imagebase:	0xa60000
File size:	3141816 bytes
MD5 hash:	0EAC436587F5A1BEF8AEB2E2381D2405
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Target ID:	8
Start time:	05:07:26
Start date:	11/08/2022
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0xa80000
File size:	7227576 bytes
MD5 hash:	4AC861CBCAFA331A72C04BF35AE792E3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Target ID:	9
Start time:	05:08:07
Start date:	11/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?q=%68%74%74%70%73%3A%2F%2F%74%6F%2D%63%6C%69%63%6B%2E%66%75%6E%2F%65%72%69%58%46%76%4B%56%48%63%36%23%79%65%78%6F%72%79%76%6A%78%6A&sa=D&sntz=1&usg=AOvVaw2t3jeNlZEFZI-xvhukbEyl
Imagebase:	0x7ff68c970000
File size:	2438312 bytes
MD5 hash:	74859601FB4BEEA84B40D874CCB56CAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Target ID:	12
Start time:	05:08:09
Start date:	11/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1752,12796533771390455494,5363625801302401924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:8
Imagebase:	0x7ff68c970000
File size:	2438312 bytes
MD5 hash:	74859601FB4BEEA84B40D874CCB56CAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate