Edit tour

Windows Analysis Report
https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537

Overview

General Information

Sample URL:	https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537
Analysis ID:	1602515
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

HTML body contains low number of good links

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5644 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2216,i,2229795296649985071,8483118368262044682,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://storage.thaicarecloud.org/Package4273221/media/imgs/ff.ico	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/imgs/arrow.png	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/imgs/dots.png	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/imgs/social.png	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/css/style.css	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/imgs/logo.png	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/js/js.js	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/imgs/header-icon3.png	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/css/helpers.css	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/imgs/icon1.png	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/imgs/header-icon2.png	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/imgs/header-icon1.png	Avira URL Cloud: Label: phishing
Source: https://storage.thaicarecloud.org/Package4273221/media/imgs/icon3.png	Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: https://storage.thaicarecloud.org/Package4273221/step2.php?id=93936677

Joe Sandbox AI: Score: 7 Reasons: The brand 'FedEx' is a well-known global courier delivery services company., The URL 'storage.thaicarecloud.org' does not match the legitimate domain 'fedex.com'., The domain 'thaicarecloud.org' does not have any known association with FedEx., The use of a third-party domain with no clear connection to FedEx is suspicious., The presence of input fields requesting personal information such as 'DATE OF BIRTH' and 'PHONE NUMBER' is typical in phishing attempts. DOM: 2.1.pages.csv

Source: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537	HTTP Parser: Number of links: 0
Source: https://storage.thaicarecloud.org/Package4273221/step2.php?id=93936677	HTTP Parser: Number of links: 0

Source: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537	HTTP Parser: Title: Detailed Tracking does not match URL
Source: https://storage.thaicarecloud.org/Package4273221/step2.php?id=93936677	HTTP Parser: Title: Detailed Tracking does not match URL

Source: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537	HTTP Parser: No <meta name="author".. found
Source: https://storage.thaicarecloud.org/Package4273221/step2.php?id=93936677	HTTP Parser: No <meta name="author".. found

Source: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537	HTTP Parser: No <meta name="copyright".. found
Source: https://storage.thaicarecloud.org/Package4273221/step2.php?id=93936677	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:62752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:62788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:62907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:63038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:63079 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Package4273221/step1.php?id=98204537 HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/css/helpers.css HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.2.0/js/all.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://storage.thaicarecloud.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://storage.thaicarecloud.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.0.2/dist/css/bootstrap.min.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://storage.thaicarecloud.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://storage.thaicarecloud.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://storage.thaicarecloud.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/css/style.css HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/logo.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/arrow.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/js/js.js HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/header-icon1.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/header-icon2.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.2.0/js/all.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/header-icon3.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/dots.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/icon1.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/arrow.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/icon3.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/header-icon1.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/js/js.js HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/logo.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/social.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/header-icon2.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/header-icon3.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/dots.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/icon1.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/icon3.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/ff.ico HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/social.png HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/media/imgs/ff.ico HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
Source: global traffic	HTTP traffic detected: GET /Package4273221/step2.php?id=93936677 HTTP/1.1Host: storage.thaicarecloud.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: storage.thaicarecloud.org
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com

Source: chromecache_90.3.dr, chromecache_87.3.dr	String found in binary or memory: http://www.day.com/dam/1.0
Source: chromecache_103.3.dr, chromecache_73.3.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_103.3.dr, chromecache_73.3.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_98.3.dr, chromecache_91.3.dr, chromecache_78.3.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_98.3.dr, chromecache_91.3.dr, chromecache_78.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_98.3.dr, chromecache_78.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62759
Source: unknown	Network traffic detected: HTTP traffic on port 62807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62838
Source: unknown	Network traffic detected: HTTP traffic on port 62907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62791
Source: unknown	Network traffic detected: HTTP traffic on port 62788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62798
Source: unknown	Network traffic detected: HTTP traffic on port 62816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62808
Source: unknown	Network traffic detected: HTTP traffic on port 62790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62800
Source: unknown	Network traffic detected: HTTP traffic on port 62793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62801
Source: unknown	Network traffic detected: HTTP traffic on port 62911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62849
Source: unknown	Network traffic detected: HTTP traffic on port 63079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62842
Source: unknown	Network traffic detected: HTTP traffic on port 62858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62810
Source: unknown	Network traffic detected: HTTP traffic on port 62828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62812
Source: unknown	Network traffic detected: HTTP traffic on port 62792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62813
Source: unknown	Network traffic detected: HTTP traffic on port 62910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62858
Source: unknown	Network traffic detected: HTTP traffic on port 62796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62815
Source: unknown	Network traffic detected: HTTP traffic on port 63038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62816
Source: unknown	Network traffic detected: HTTP traffic on port 62801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62817
Source: unknown	Network traffic detected: HTTP traffic on port 62811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62907
Source: unknown	Network traffic detected: HTTP traffic on port 62808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62788
Source: unknown	Network traffic detected: HTTP traffic on port 62795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62789
Source: unknown	Network traffic detected: HTTP traffic on port 62829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62825
Source: unknown	Network traffic detected: HTTP traffic on port 62789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63038
Source: unknown	Network traffic detected: HTTP traffic on port 62839 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:62752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:62788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:62907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:63038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:63079 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@16/57@20/12

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2216,i,2229795296649985071,8483118368262044682,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2216,i,2229795296649985071,8483118368262044682,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label
https://storage.thaicarecloud.org/Package4273221/media/imgs/ff.ico	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/imgs/arrow.png	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/imgs/dots.png	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/imgs/social.png	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/css/style.css	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/imgs/logo.png	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/js/js.js	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/imgs/header-icon3.png	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/css/helpers.css	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/imgs/icon1.png	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/imgs/header-icon2.png	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/imgs/header-icon1.png	100%	Avira URL Cloud	phishing
https://storage.thaicarecloud.org/Package4273221/media/imgs/icon3.png	100%	Avira URL Cloud	phishing

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.1.229	true	false	high
cdn.jsdelivr.net.cdn.cloudflare.net	104.18.187.31	true	false	high
code.jquery.com	151.101.2.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
www.google.com	142.250.185.228	true	false	high
storage.thaicarecloud.org	61.19.254.8	true	true	unknown
cdn.jsdelivr.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://storage.thaicarecloud.org/Package4273221/media/imgs/ff.ico	false	Avira URL Cloud: phishing	unknown
https://storage.thaicarecloud.org/Package4273221/media/imgs/logo.png	false	Avira URL Cloud: phishing	unknown
https://storage.thaicarecloud.org/Package4273221/media/css/helpers.css	false	Avira URL Cloud: phishing	unknown
https://storage.thaicarecloud.org/Package4273221/media/imgs/dots.png	false	Avira URL Cloud: phishing	unknown
https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js	false		high
https://storage.thaicarecloud.org/Package4273221/media/js/js.js	false	Avira URL Cloud: phishing	unknown
https://storage.thaicarecloud.org/Package4273221/media/css/style.css	false	Avira URL Cloud: phishing	unknown
https://storage.thaicarecloud.org/Package4273221/media/imgs/social.png	false	Avira URL Cloud: phishing	unknown
https://storage.thaicarecloud.org/Package4273221/media/imgs/arrow.png	false	Avira URL Cloud: phishing	unknown
https://storage.thaicarecloud.org/Package4273221/media/imgs/icon1.png	false	Avira URL Cloud: phishing	unknown
https://storage.thaicarecloud.org/Package4273221/media/imgs/header-icon3.png	false	Avira URL Cloud: phishing	unknown
https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css	false		high
https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537	true		unknown
https://storage.thaicarecloud.org/Package4273221/step2.php?id=93936677	true		unknown
https://storage.thaicarecloud.org/Package4273221/media/imgs/header-icon2.png	false	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js	false		high
https://code.jquery.com/jquery-3.6.1.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/all.min.js	false		high
https://storage.thaicarecloud.org/Package4273221/media/imgs/header-icon1.png	false	Avira URL Cloud: phishing	unknown
https://storage.thaicarecloud.org/Package4273221/media/imgs/icon3.png	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/twbs/bootstrap/blob/main/LICENSE)	chromecache_98.3.dr, chromecache_91.3.dr, chromecache_78.3.dr	false	high
https://getbootstrap.com/)	chromecache_98.3.dr, chromecache_91.3.dr, chromecache_78.3.dr	false	high
https://fontawesome.com/license/free	chromecache_103.3.dr, chromecache_73.3.dr	false	high
https://fontawesome.com	chromecache_103.3.dr, chromecache_73.3.dr	false	high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_98.3.dr, chromecache_78.3.dr	false	high
http://www.day.com/dam/1.0	chromecache_90.3.dr, chromecache_87.3.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.1.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
61.19.254.8	storage.thaicarecloud.org	Thailand	9931	CAT-APTheCommunicationAuthoityofThailandCATTH	true
104.18.187.31	cdn.jsdelivr.net.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.66.137	unknown	United States	54113	FASTLYUS	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1602515
Start date and time:	2025-01-30 00:17:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@16/57@20/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 142.250.186.46, 173.194.76.84, 216.58.206.78, 142.250.185.142, 216.58.206.46, 172.217.18.10, 2.17.190.73, 217.20.57.18, 142.250.184.238, 142.250.186.74, 142.250.185.106, 142.250.186.42, 216.58.206.42, 142.250.186.106, 142.250.185.202, 142.250.74.202, 216.58.206.74, 142.250.185.138, 172.217.16.202, 142.250.185.170, 142.250.185.234, 172.217.23.106, 142.250.181.234, 142.250.185.74, 142.250.185.238, 142.250.186.78, 142.250.186.67, 84.201.210.23, 13.107.246.45, 184.28.90.27, 4.175.87.197
Excluded domains from analysis (whitelisted): client.wns.windows.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537

Input	Output
URL: https://storage.thaicarecloud.org Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 0, "spoofed": 0, "reasoning": "The URL 'https://storage.thaicarecloud.org' does not exhibit any clear signs of typosquatting. There are no visual character substitutions or structural changes that suggest an attempt to mimic a well-known brand. The domain 'thaicarecloud.org' appears to be a legitimate domain, possibly related to a cloud storage service for Thai healthcare, as suggested by the name. The use of the subdomain 'storage' is consistent with typical cloud service offerings and does not imply any deceptive intent. There is no indication that this URL is attempting to spoof a known brand, and the context suggests a legitimate purpose unrelated to typosquatting."}
URL: https://storage.thaicarecloud.org
URL: https://storage.thaicarecloud.org/Package4273221/s... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a form submission functionality with some basic input validation. It uses jQuery to mask the 'birth_date' field, and upon clicking the 'booom' button, it collects form data and sends it to the 'processing.php' endpoint using an AJAX POST request. The script also includes a flag to prevent multiple submissions. Overall, the behavior seems to be a legitimate form handling implementation, with no clear indicators of malicious intent." }
$('#birth_date').mask('00/00/0000'); var loaded = false; $('#booom').click(function(){ if( loaded == true ) { return false; } formData = { 'cap' : $('#cap').val(), 'steeep' : $('#steeep').val(), 'address' : $('#address').val(), 'zip_code' : $('#zip_code').val(), 'city' : $('#city').val(), 'birth_date' : $('#birth_date').val(), 'phone' : $('#phone').val(), 'email' : $('#email').val(), } $.post( "processing.php", formData ) .done(function( data ) { window.location.href = data; }); loaded = true; });
URL: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "To complete the delivery as soon as possible. Please confirm the payment (1.99) by clicking next. Online confirmation must be made within the next 14 days, before it expires.", "prominent_button_name": "Next", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Model: Joe Sandbox AI	{ "brands": [ "FedEx" ] }
	{ "brands": [ "FedEx" ] }
URL: https://storage.thaicarecloud.org/Package4273221/step2.php?id=93936677 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "ADDRESS", "CITY", "DATE OF BIRTH (DD/MM/YYYY)", "PHONE NUMBER", "ADDRESS EMAIL" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" } Google indexed: True

URL: https://storage.thaicarecloud.org/Package4273221/step2.php?id=93936677 Model: Joe Sandbox AI	{ "brands": [ "FedEx" ] } Google indexed: True
	{ "brands": [ "FedEx" ] } Google indexed: True
URL: https://storage.thaicarecloud.org/Package4273221/step2.php?id=93936677 Model: Joe Sandbox AI	```json{ "legit_domain": "fedex.com", "classification": "wellknown", "reasons": [ "The brand 'FedEx' is a well-known global courier delivery services company.", "The URL 'storage.thaicarecloud.org' does not match the legitimate domain 'fedex.com'.", "The domain 'thaicarecloud.org' does not have any known association with FedEx.", "The use of a third-party domain with no clear connection to FedEx is suspicious.", "The presence of input fields requesting personal information such as 'DATE OF BIRTH' and 'PHONE NUMBER' is typical in phishing attempts." ], "riskscore": 9} Google indexed: True
URL: storage.thaicarecloud.org Brands: FedEx Input Fields: ADDRESS, CITY, DATE OF BIRTH (DD/MM/YYYY), PHONE NUMBER, ADDRESS EMAIL

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 30, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	1638
Entropy (8bit):	7.820570861027638
Encrypted:	false
SSDEEP:	24:XM+yJYkDXO4KHyEWEvL9uD9H0mFRL/VQmXuO+UEirBdfDQehR128IEm+Enfc+6:AYkDpgZulNimn+UEirB5RT128INw
MD5:	13759FB2C6CBEE7DD5CB0E75A1C4F9F8
SHA1:	E510B10FEDE08B92A4CD47A63FDB9460FD7FED08
SHA-256:	08E0AF481673473E20D15A3E7D688A006670412BD28AE67105AF1BD9E5F09256
SHA-512:	CAD222BA6B6FCCE2B874F51CD90B0808669C43FECFB417B7F6587103205B1D62E349F2339D932D892A9FC3C688902EA3B305BBBED0A1BDCAEF8268985FB5575C
Malicious:	false
Reputation:	low
URL:	https://storage.thaicarecloud.org/Package4273221/media/imgs/social.png
Preview:	.PNG........IHDR.............A.p.....pHYs..........o.d....IDATx..}L.u....P.k.:a....2I6....b....ls.-&8DM\..M..xSg..1.f.6.\b2.DM...Q..d2#l`p1.................../.....p..~..;.(7Q\...j....X,....Nq........Q..p...2..T...FcFH....qk\|\|..EBE...FH...,\|.~...h....d.b.B.)..Vzz...1\.?...K-...L....p...0.1\.N...(s...J..f.x<&.I.R..i`...e...<2W..Z8/\|>..lRR....p.{..B..R\].`..).p.....'d.x.\..v..`.c^....A(..2W<.b.66?..2.^#..."s..7nn0....B.9.9../..Na.h..`.P<.)"w..0y=..nL=.v..#...w.O.]Wb..\.t.........={......?.e..R..P..........'4Ba.#,.,..d.....x......D...2.......r9.[....@....\|Z}...X..t..in...B..K.V.)...cjj...~...,.m.{..R.=.",..E.v_..16.-....a.2....rY....l./.p..5l..B".....P...d>.z....r....WXe.=..b.S.J.gVF..>'Jee..e....3.Y.6..E.1?.CPg...!k...+..........(..sM?.........GX.M4.J.....B.0..Ze..%?....(8.4-..B.......8.n..u..t.F..u...`K..}.......-.....oa..}..'......M..o......=Pplq....` .....}h......'1...#yH....\f>.....a.....>.].6.d...ku.....)..uo....x."..^...*...t.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 30, 2025 00:18:10.496926069 CET	53	52584	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:10.607155085 CET	53	58315	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:11.945542097 CET	53	59762	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:14.749797106 CET	52245	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:14.750060081 CET	54993	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:14.756586075 CET	53	52245	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:14.756625891 CET	53	54993	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:17.186408043 CET	58800	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:17.186825037 CET	53594	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:17.404690027 CET	53	53594	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:17.411292076 CET	53	58800	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:19.165863991 CET	56005	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:19.166016102 CET	52072	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:19.172938108 CET	53	52072	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:19.172977924 CET	53	56005	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:19.186376095 CET	52957	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:19.186521053 CET	62678	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:19.187421083 CET	57281	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:19.187598944 CET	62128	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:19.193140030 CET	53	62678	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:19.193365097 CET	53	52957	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:19.193984985 CET	53	57281	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:19.195306063 CET	53	62128	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:19.996320963 CET	51829	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:19.996452093 CET	54725	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:20.003236055 CET	53	51829	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:20.003253937 CET	53	54725	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:20.143414974 CET	61364	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:20.143717051 CET	55466	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:20.151771069 CET	53121	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:20.151802063 CET	53	61364	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:20.152023077 CET	57916	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:20.152256966 CET	53	55466	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:20.159914017 CET	53	57916	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:20.160032988 CET	53	53121	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:20.870445013 CET	49802	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:20.870652914 CET	61117	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:18:20.876094103 CET	53	57463	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:20.879163027 CET	53	49802	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:21.097642899 CET	53	61117	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:29.071556091 CET	53	63079	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:33.772622108 CET	53	55354	1.1.1.1	192.168.2.6
Jan 30, 2025 00:18:47.787296057 CET	53	65131	1.1.1.1	192.168.2.6
Jan 30, 2025 00:19:10.162542105 CET	53	61086	1.1.1.1	192.168.2.6
Jan 30, 2025 00:19:11.432602882 CET	53	61001	1.1.1.1	192.168.2.6
Jan 30, 2025 00:19:14.811278105 CET	52432	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:19:14.811420918 CET	57832	53	192.168.2.6	1.1.1.1
Jan 30, 2025 00:19:14.818203926 CET	53	57832	1.1.1.1	192.168.2.6
Jan 30, 2025 00:19:14.818252087 CET	53	52432	1.1.1.1	192.168.2.6

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:11 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 2f 68 6c 76 44 30 4d 2b 55 6d 47 73 77 71 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 32 65 61 36 31 61 66 64 65 62 38 35 63 38 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: A/hlvD0M+UmGswqb.1Context: 12ea61afdeb85c8f
2025-01-29 23:18:11 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-29 23:18:11 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 41 2f 68 6c 76 44 30 4d 2b 55 6d 47 73 77 71 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 32 65 61 36 31 61 66 64 65 62 38 35 63 38 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 6b 51 69 75 41 68 51 57 67 4b 50 59 42 6b 46 49 57 4e 51 4b 76 45 4d 68 31 33 49 55 2f 44 79 55 36 2b 47 66 4c 7a 4e 75 55 63 72 7a 74 4a 78 61 66 6f 69 2f 43 63 64 42 53 73 54 32 58 79 79 2f 49 39 5a 32 6c 70 6f 58 6f 4b 67 70 74 72 38 61 63 78 66 37 4c 4e 52 4b 52 4f 78 4c 43 2f 79 6a 4e 47 6b 47 53 56 6c 39 63 63 58 61 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: A/hlvD0M+UmGswqb.2Context: 12ea61afdeb85c8f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdkQiuAhQWgKPYBkFIWNQKvEMh13IU/DyU6+GfLzNuUcrztJxafoi/CcdBSsT2Xyy/I9Z2lpoXoKgptr8acxf7LNRKROxLC/yjNGkGSVl9ccXa
2025-01-29 23:18:11 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 41 2f 68 6c 76 44 30 4d 2b 55 6d 47 73 77 71 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 32 65 61 36 31 61 66 64 65 62 38 35 63 38 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: A/hlvD0M+UmGswqb.3Context: 12ea61afdeb85c8f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-29 23:18:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-29 23:18:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 55 4c 67 47 36 46 48 6a 53 6b 53 6e 45 4d 44 4c 33 61 48 79 47 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ULgG6FHjSkSnEMDL3aHyGw.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:18 UTC	704	OUT	GET /Package4273221/step1.php?id=98204537 HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-29 23:18:19 UTC	360	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:18 GMT Server: Apache/2.4.18 (Ubuntu) Set-Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Content-Length: 7467 Connection: close Content-Type: text/html; charset=UTF-8
2025-01-29 23:18:19 UTC	7467	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 52 65 71 75 69 72 65 64 20 6d 65 74 61 20 74 61 67 73 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 22 20 22 6e 6f 66 Data Ascii: <!doctype html><html> <head> ... Required meta tags --> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="robots" content="noindex," "nof

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:19 UTC	667	OUT	GET /Package4273221/media/css/helpers.css HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:19 UTC	273	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:19 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "a3ab-62cd20056c02f" Accept-Ranges: bytes Content-Length: 41899 Vary: Accept-Encoding Connection: close Content-Type: text/css
2025-01-29 23:18:19 UTC	16384	IN	Data Raw: 2e 66 7a 31 30 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 7a 31 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 7a 31 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 7a 31 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 7a 31 38 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 7a 32 30 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 7a 32 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 7a 32 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 Data Ascii: .fz10{font-size:10px !important}.fz12{font-size:12px !important}.fz14{font-size:14px !important}.fz16{font-size:16px !important}.fz18{font-size:18px !important}.fz20{font-size:20px !important}.fz22{font-size:22px !important}.fz24{font-size:24px !important
2025-01-29 23:18:19 UTC	16384	IN	Data Raw: 2e 6d 6c 37 30 2d 6d 64 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 37 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 6c 37 35 2d 6d 64 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 37 35 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 6c 38 30 2d 6d 64 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 6c 38 35 2d 6d 64 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 35 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 6c 39 30 2d 6d 64 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 39 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 6c 39 35 2d 6d 64 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 39 35 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 6c 31 30 30 2d 6d 64 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 30 70 78 20 21 69 6d 70 6f Data Ascii: .ml70-md{margin-left:70px !important}.ml75-md{margin-left:75px !important}.ml80-md{margin-left:80px !important}.ml85-md{margin-left:85px !important}.ml90-md{margin-left:90px !important}.ml95-md{margin-left:95px !important}.ml100-md{margin-left:100px !impo
2025-01-29 23:18:19 UTC	9131	IN	Data Raw: 6e 74 7d 2e 70 74 31 34 35 2d 6d 64 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 34 35 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 74 31 35 30 2d 6d 64 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 35 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 62 30 2d 6d 64 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 62 31 30 2d 6d 64 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 62 31 35 2d 6d 64 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 62 32 30 2d 6d 64 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 62 32 35 2d 6d 64 7b 70 61 64 64 69 6e 67 Data Ascii: nt}.pt145-md{padding-top:145px !important}.pt150-md{padding-top:150px !important}.pb0-md{padding-bottom:0px !important}.pb10-md{padding-bottom:10px !important}.pb15-md{padding-bottom:15px !important}.pb20-md{padding-bottom:20px !important}.pb25-md{padding

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:19 UTC	571	OUT	GET /ajax/libs/font-awesome/6.2.0/js/all.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://storage.thaicarecloud.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-29 23:18:20 UTC	943	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:20 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cf-Ray: 909cf0d67a4942b9-EWR Server: cloudflare Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 Etag: W/"630e6e62-852a3" Last-Modified: Tue, 30 Aug 2022 20:09:06 GMT Cf-Cdnjs-Via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff Cf-Cache-Status: MISS Expires: Mon, 19 Jan 2026 23:18:20 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Er2FqcJNyUO9l5xrnQQt6noDc8KseTY9kSNman11trM%2BxczzPFLOJxUni7RA4pMD1vHJtMwPXybUiS3ff2wqPfaUG32v2kuqpL8dkzIqjEtYkebPYfAvljezblRemPByKHdSP5G5"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 alt-svc: h3=":443"; ma=86400
2025-01-29 23:18:20 UTC	426	IN	Data Raw: 37 62 65 61 0d 0a 2f 2a 21 0a 20 2a 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 46 72 65 65 20 36 2e 32 2e 30 20 62 79 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 0a 20 2a 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 2f 66 72 65 65 20 28 49 63 6f 6e 73 3a 20 43 43 20 42 59 20 34 2e 30 2c 20 46 6f 6e 74 73 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 6f 64 65 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 32 20 46 6f 6e 74 69 63 6f 6e 73 2c 20 49 6e 63 2e 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 63 Data Ascii: 7bea/! Font Awesome Free 6.2.0 by @fontawesome - https://fontawesome.com * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) * Copyright 2022 Fonticons, Inc. */!function(){"use strict";var c
2025-01-29 23:18:20 UTC	1369	IN	Data Raw: 6d 65 6e 74 2c 65 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 26 26 65 2e 68 65 61 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 26 26 65 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 2c 7e 7a 2e 69 6e 64 65 78 4f 66 28 22 4d 53 49 45 22 29 7c 7c 7a 2e 69 6e 64 65 78 4f 66 28 22 54 72 69 64 65 6e 74 2f 22 29 3b 66 75 6e 63 74 69 6f 6e 20 43 28 73 2c 63 29 7b 76 61 72 20 6c 2c 7a 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 73 29 3b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 26 26 28 6c 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 73 29 2c 63 26 26 28 6c 3d 6c 2e 66 69 6c 74 65 72 28 Data Ascii: ment,e.documentElement&&e.head&&"function"==typeof e.addEventListener&&e.createElement,~z.indexOf("MSIE")\|\|z.indexOf("Trident/");function C(s,c){var l,z=Object.keys(s);return Object.getOwnPropertySymbols&&(l=Object.getOwnPropertySymbols(s),c&&(l=l.filter(
2025-01-29 23:18:20 UTC	1369	IN	Data Raw: 64 22 2c 66 61 73 73 3a 22 73 6f 6c 69 64 22 2c 22 66 61 2d 73 6f 6c 69 64 22 3a 22 73 6f 6c 69 64 22 7d 29 2c 66 29 29 3b 76 61 72 20 6d 3d 6f 28 28 74 28 76 3d 7b 7d 2c 68 2c 7b 73 6f 6c 69 64 3a 22 66 61 73 22 2c 72 65 67 75 6c 61 72 3a 22 66 61 72 22 2c 6c 69 67 68 74 3a 22 66 61 6c 22 2c 74 68 69 6e 3a 22 66 61 74 22 2c 64 75 6f 74 6f 6e 65 3a 22 66 61 64 22 2c 62 72 61 6e 64 73 3a 22 66 61 62 22 2c 6b 69 74 3a 22 66 61 6b 22 7d 29 2c 74 28 76 2c 6e 2c 7b 73 6f 6c 69 64 3a 22 66 61 73 73 22 7d 29 2c 76 29 29 2c 65 3d 28 6f 28 28 74 28 6c 3d 7b 7d 2c 68 2c 7b 66 61 62 3a 22 66 61 2d 62 72 61 6e 64 73 22 2c 66 61 64 3a 22 66 61 2d 64 75 6f 74 6f 6e 65 22 2c 66 61 6b 3a 22 66 61 2d 6b 69 74 22 2c 66 61 6c 3a 22 66 61 2d 6c 69 67 68 74 22 2c 66 61 72 3a Data Ascii: d",fass:"solid","fa-solid":"solid"}),f));var m=o((t(v={},h,{solid:"fas",regular:"far",light:"fal",thin:"fat",duotone:"fad",brands:"fab",kit:"fak"}),t(v,n,{solid:"fass"}),v)),e=(o((t(l={},h,{fab:"fa-brands",fad:"fa-duotone",fak:"fa-kit",fal:"fa-light",far:
2025-01-29 23:18:20 UTC	1369	IN	Data Raw: 61 62 6c 65 2c 20 6e 6f 6e 2d 61 72 72 61 79 20 6f 62 6a 65 63 74 73 20 6d 75 73 74 20 68 61 76 65 20 61 20 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 28 29 20 6d 65 74 68 6f 64 2e 22 29 7d 28 29 2c 5b 22 32 78 73 22 2c 22 78 73 22 2c 22 73 6d 22 2c 22 6c 67 22 2c 22 78 6c 22 2c 22 32 78 6c 22 2c 22 62 65 61 74 22 2c 22 62 6f 72 64 65 72 22 2c 22 66 61 64 65 22 2c 22 62 65 61 74 2d 66 61 64 65 22 2c 22 62 6f 75 6e 63 65 22 2c 22 66 6c 69 70 2d 62 6f 74 68 22 2c 22 66 6c 69 70 2d 68 6f 72 69 7a 6f 6e 74 61 6c 22 2c 22 66 6c 69 70 2d 76 65 72 74 69 63 61 6c 22 2c 22 66 6c 69 70 22 2c 22 66 77 22 2c 22 69 6e 76 65 72 73 65 22 2c 22 6c 61 79 65 72 73 2d 63 6f 75 6e 74 65 72 22 2c 22 6c 61 79 65 72 73 2d 74 65 78 74 22 2c 22 6c 61 79 65 72 73 22 2c 22 Data Ascii: able, non-array objects must have a [Symbol.iterator]() method.")}(),["2xs","xs","sm","lg","xl","2xl","beat","border","fade","beat-fade","bounce","flip-both","flip-horizontal","flip-vertical","flip","fw","inverse","layers-counter","layers-text","layers","
2025-01-29 23:18:20 UTC	1369	IN	Data Raw: 2e 38 2d 32 2e 36 2d 37 35 2e 33 2d 31 33 2e 33 7a 6d 34 30 38 2e 39 2d 31 31 35 2e 32 63 31 35 2e 39 20 30 20 32 38 2e 39 2d 31 32 2e 39 20 32 38 2e 39 2d 32 38 2e 39 73 2d 31 32 2e 39 2d 32 34 2e 35 2d 32 38 2e 39 2d 32 34 2e 35 63 2d 31 35 2e 39 20 30 2d 32 38 2e 39 20 38 2e 36 2d 32 38 2e 39 20 32 34 2e 35 73 31 32 2e 39 20 32 38 2e 39 20 32 38 2e 39 20 32 38 2e 39 7a 6d 2d 32 39 20 31 32 30 2e 35 48 36 34 30 56 32 34 31 2e 35 68 2d 35 37 2e 39 7a 6d 2d 37 33 2e 37 20 30 68 35 37 2e 39 56 31 35 36 2e 37 4c 35 30 38 2e 34 20 31 38 34 7a 6d 2d 33 31 2d 31 31 39 2e 34 63 2d 31 38 2e 32 2d 31 38 2e 32 2d 35 30 2e 34 2d 31 37 2e 31 2d 35 30 2e 34 2d 31 37 2e 31 73 2d 33 32 2e 33 2d 31 2e 31 2d 35 30 2e 34 20 31 37 2e 31 63 2d 31 38 2e 32 20 31 38 2e 32 2d Data Ascii: .8-2.6-75.3-13.3zm408.9-115.2c15.9 0 28.9-12.9 28.9-28.9s-12.9-24.5-28.9-24.5c-15.9 0-28.9 8.6-28.9 24.5s12.9 28.9 28.9 28.9zm-29 120.5H640V241.5h-57.9zm-73.7 0h57.9V156.7L508.4 184zm-31-119.4c-18.2-18.2-50.4-17.1-50.4-17.1s-32.3-1.1-50.4 17.1c-18.2 18.2-
2025-01-29 23:18:20 UTC	1369	IN	Data Raw: 2e 35 31 2d 34 2e 35 20 34 32 2e 37 31 4c 33 30 2e 35 20 33 35 38 2e 34 35 61 32 32 2e 37 39 20 32 32 2e 37 39 20 30 20 30 20 31 2d 32 38 2e 32 31 2d 31 39 2e 36 20 31 39 37 2e 31 36 20 31 39 37 2e 31 36 20 30 20 30 20 31 20 39 2d 38 35 2e 33 32 20 32 32 2e 38 20 32 32 2e 38 20 30 20 30 20 31 20 33 31 2e 36 31 2d 31 33 2e 32 31 7a 6d 34 34 20 32 33 39 2e 32 35 61 31 39 39 2e 34 35 20 31 39 39 2e 34 35 20 30 20 30 20 30 20 37 39 2e 34 32 20 33 32 2e 31 31 41 32 32 2e 37 38 20 32 32 2e 37 38 20 30 20 30 20 30 20 31 39 32 2e 39 34 20 34 39 30 6c 33 2e 39 2d 31 31 30 2e 38 32 63 2e 37 2d 32 31 2e 33 2d 32 35 2e 35 2d 33 31 2e 39 31 2d 33 39 2e 38 31 2d 31 36 2e 31 6c 2d 37 34 2e 32 31 20 38 32 2e 34 61 32 32 2e 38 32 20 32 32 2e 38 32 20 30 20 30 20 30 20 34 Data Ascii: .51-4.5 42.71L30.5 358.45a22.79 22.79 0 0 1-28.21-19.6 197.16 197.16 0 0 1 9-85.32 22.8 22.8 0 0 1 31.61-13.21zm44 239.25a199.45 199.45 0 0 0 79.42 32.11A22.78 22.78 0 0 0 192.94 490l3.9-110.82c.7-21.3-25.5-31.91-39.81-16.1l-74.21 82.4a22.82 22.82 0 0 0 4
2025-01-29 23:18:20 UTC	1369	IN	Data Raw: 31 30 2e 34 2d 31 32 2e 36 20 31 35 2e 32 2d 32 34 2e 31 20 31 35 2e 32 2d 31 36 20 30 2d 32 34 2e 36 2d 32 2e 35 2d 33 37 2e 37 2d 38 2e 33 6c 2d 35 2e 33 2d 32 2e 35 2d 35 2e 36 20 33 34 2e 39 63 39 2e 34 20 34 2e 33 20 32 36 2e 38 20 38 2e 31 20 34 34 2e 38 20 38 2e 33 20 34 32 2e 32 2e 31 20 36 39 2e 37 2d 32 30 2e 38 20 37 30 2d 35 33 7a 4d 35 32 38 20 33 33 31 2e 34 4c 34 39 35 2e 36 20 31 37 36 68 2d 33 31 2e 31 63 2d 39 2e 36 20 30 2d 31 36 2e 39 20 32 2e 38 2d 32 31 20 31 32 2e 39 6c 2d 35 39 2e 37 20 31 34 32 2e 35 48 34 32 36 73 36 2e 39 2d 31 39 2e 32 20 38 2e 34 2d 32 33 2e 33 48 34 38 36 63 31 2e 32 20 35 2e 35 20 34 2e 38 20 32 33 2e 33 20 34 2e 38 20 32 33 2e 33 48 35 32 38 7a 22 5d 2c 6c 61 73 74 66 6d 3a 5b 35 31 32 2c 35 31 32 2c 5b 5d Data Ascii: 10.4-12.6 15.2-24.1 15.2-16 0-24.6-2.5-37.7-8.3l-5.3-2.5-5.6 34.9c9.4 4.3 26.8 8.1 44.8 8.3 42.2.1 69.7-20.8 70-53zM528 331.4L495.6 176h-31.1c-9.6 0-16.9 2.8-21 12.9l-59.7 142.5H426s6.9-19.2 8.4-23.3H486c1.2 5.5 4.8 23.3 4.8 23.3H528z"],lastfm:[512,512,[]
2025-01-29 23:18:20 UTC	1369	IN	Data Raw: 32 33 33 2e 30 39 7a 22 5d 2c 22 63 72 65 61 74 69 76 65 2d 63 6f 6d 6d 6f 6e 73 2d 6e 63 22 3a 5b 34 39 36 2c 35 31 32 2c 5b 5d 2c 22 66 34 65 38 22 2c 22 4d 32 34 37 2e 36 20 38 43 33 38 37 2e 34 20 38 20 34 39 36 20 31 31 35 2e 39 20 34 39 36 20 32 35 36 63 30 20 31 34 37 2e 32 2d 31 31 38 2e 35 20 32 34 38 2d 32 34 38 2e 34 20 32 34 38 43 31 31 33 2e 31 20 35 30 34 20 30 20 33 39 33 2e 32 20 30 20 32 35 36 20 30 20 31 32 33 2e 31 20 31 30 34 2e 37 20 38 20 32 34 37 2e 36 20 38 7a 4d 35 35 2e 38 20 31 38 39 2e 31 63 2d 37 2e 34 20 32 30 2e 34 2d 31 31 2e 31 20 34 32 2e 37 2d 31 31 2e 31 20 36 36 2e 39 20 30 20 31 31 30 2e 39 20 39 32 2e 31 20 32 30 32 2e 34 20 32 30 33 2e 37 20 32 30 32 2e 34 20 31 32 32 2e 34 20 30 20 31 37 37 2e 32 2d 31 30 31 2e 38 Data Ascii: 233.09z"],"creative-commons-nc":[496,512,[],"f4e8","M247.6 8C387.4 8 496 115.9 496 256c0 147.2-118.5 248-248.4 248C113.1 504 0 393.2 0 256 0 123.1 104.7 8 247.6 8zM55.8 189.1c-7.4 20.4-11.1 42.7-11.1 66.9 0 110.9 92.1 202.4 203.7 202.4 122.4 0 177.2-101.8
2025-01-29 23:18:20 UTC	1369	IN	Data Raw: 32 2e 38 32 20 35 2e 36 33 2d 34 31 2e 37 34 20 33 32 2e 32 36 2d 31 2e 32 34 20 31 36 2e 37 39 20 31 31 2e 31 32 20 33 31 2e 34 20 32 39 2e 39 36 20 33 30 2e 34 38 7a 6d 31 37 30 2e 39 32 20 32 33 2e 30 35 63 2d 37 2e 38 36 2e 37 32 2d 31 31 2e 35 32 2d 34 2e 38 36 2d 31 32 2e 36 38 2d 31 30 2e 33 37 6c 2d 34 39 2e 38 2d 31 36 34 2e 36 35 63 2d 2e 39 37 2d 32 2e 37 38 2d 31 2e 36 31 2d 35 2e 36 35 2d 31 2e 39 32 2d 38 2e 35 38 61 34 2e 36 31 20 34 2e 36 31 20 30 20 30 20 31 20 33 2e 38 36 2d 35 2e 32 35 63 2e 32 34 2d 2e 30 34 2d 32 2e 31 33 20 30 20 32 32 2e 32 35 20 30 20 38 2e 37 38 2d 2e 38 38 20 31 31 2e 36 34 20 36 2e 30 33 20 31 32 2e 35 35 20 31 30 2e 33 37 6c 33 35 2e 37 32 20 31 34 30 2e 38 33 20 33 33 2e 31 36 2d 31 34 30 2e 38 33 63 2e 35 33 Data Ascii: 2.82 5.63-41.74 32.26-1.24 16.79 11.12 31.4 29.96 30.48zm170.92 23.05c-7.86.72-11.52-4.86-12.68-10.37l-49.8-164.65c-.97-2.78-1.61-5.65-1.92-8.58a4.61 4.61 0 0 1 3.86-5.25c.24-.04-2.13 0 22.25 0 8.78-.88 11.64 6.03 12.55 10.37l35.72 140.83 33.16-140.83c.53
2025-01-29 23:18:20 UTC	1369	IN	Data Raw: 20 32 31 2e 37 37 20 37 2e 38 20 31 30 2e 31 32 20 31 36 2e 33 38 7a 6d 32 39 2e 31 39 2d 33 33 2e 32 39 63 2d 38 2e 39 36 2d 31 31 2e 35 32 2d 35 39 2e 32 38 2d 35 2e 33 38 2d 38 31 2e 38 31 2d 32 2e 36 39 2d 36 2e 37 39 2e 37 37 2d 37 2e 39 34 2d 35 2e 31 32 2d 31 2e 37 39 2d 39 2e 34 37 20 34 30 2e 30 37 2d 32 38 2e 31 37 20 31 30 35 2e 38 38 2d 32 30 2e 31 20 31 31 33 2e 34 34 2d 31 30 2e 36 33 20 37 2e 35 35 20 39 2e 34 37 2d 32 2e 30 35 20 37 35 2e 34 31 2d 33 39 2e 35 36 20 31 30 36 2e 39 31 2d 35 2e 37 36 20 34 2e 38 37 2d 31 31 2e 32 37 20 32 2e 33 2d 38 2e 37 31 2d 34 2e 31 20 38 2e 34 34 2d 32 31 2e 32 35 20 32 37 2e 33 39 2d 36 38 2e 34 39 20 31 38 2e 34 33 2d 38 30 2e 30 32 7a 22 5d 2c 72 65 64 68 61 74 3a 5b 35 31 32 2c 35 31 32 2c 5b 5d 2c Data Ascii: 21.77 7.8 10.12 16.38zm29.19-33.29c-8.96-11.52-59.28-5.38-81.81-2.69-6.79.77-7.94-5.12-1.79-9.47 40.07-28.17 105.88-20.1 113.44-10.63 7.55 9.47-2.05 75.41-39.56 106.91-5.76 4.87-11.27 2.3-8.71-4.1 8.44-21.25 27.39-68.49 18.43-80.02z"],redhat:[512,512,[],

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:19 UTC	543	OUT	GET /jquery-3.6.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://storage.thaicarecloud.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-29 23:18:19 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89664 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15e40" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 2023576 Date: Wed, 29 Jan 2025 23:18:19 GMT X-Served-By: cache-lga21975-LGA, cache-ewr-kewr1740046-EWR X-Cache: HIT, HIT X-Cache-Hits: 1955, 0 X-Timer: S1738192700.883701,VS0,VE1 Vary: Accept-Encoding
2025-01-29 23:18:19 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-01-29 23:18:19 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-01-29 23:18:19 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 79 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=y.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-01-29 23:18:19 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-01-29 23:18:19 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-01-29 23:18:19 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 76 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ve(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-01-29 23:18:19 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 76 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ve(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-01-29 23:18:19 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-01-29 23:18:19 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 79 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|y.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|y.push(".#.+[+~]"),e.querySelectorAll("\\\f"),y.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-01-29 23:18:19 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 76 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&v(p,e)?-1:t==C\|\|t.ownerDocument==p

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:19 UTC	585	OUT	GET /npm/bootstrap@5.0.2/dist/css/bootstrap.min.css HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://storage.thaicarecloud.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-29 23:18:19 UTC	1096	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:19 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * access-control-expose-headers: * timing-allow-origin: * Cache-Control: public, max-age=31536000, s-maxage=31536000, immutable cross-origin-resource-policy: cross-origin x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains; preload x-jsd-version: 5.0.2 x-jsd-version-type: version etag: W/"260c5-fByeBXPlzqi603M74vxjqoxo6o0" Age: 733450 x-served-by: cache-fra-eddf8230097-FRA, cache-lga21972-LGA x-cache: HIT, HIT vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bIC36Ep7%2BATI2zCLe9k6ZPj293MQ4LNF5qLitv%2BpLASXLZaDnmu4iwuWjMd%2BOJPZl7RLeVhfYff36e0XprtheZqsrN%2Byjemp0zxPXGzqsN1hkB6OvqxY2RFOO7TXw92wxeU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 909cf0d658ec7cff-EWR
2025-01-29 23:18:19 UTC	273	IN	Data Raw: 37 62 32 33 0d 0a 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 35 2e 30 2e 32 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 31 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 31 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 69 6e 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 3a 72 6f 6f 74 7b 2d 2d 62 73 2d 62 6c 75 65 3a 23 30 64 Data Ascii: 7b23@charset "UTF-8";/! Bootstrap v5.0.2 (https://getbootstrap.com/) * Copyright 2011-2021 The Bootstrap Authors * Copyright 2011-2021 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE) */:root{--bs-blue:#0d
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 36 36 31 30 66 32 3b 2d 2d 62 73 2d 70 75 72 70 6c 65 3a 23 36 66 34 32 63 31 3b 2d 2d 62 73 2d 70 69 6e 6b 3a 23 64 36 33 33 38 34 3b 2d 2d 62 73 2d 72 65 64 3a 23 64 63 33 35 34 35 3b 2d 2d 62 73 2d 6f 72 61 6e 67 65 3a 23 66 64 37 65 31 34 3b 2d 2d 62 73 2d 79 65 6c 6c 6f 77 3a 23 66 66 63 31 30 37 3b 2d 2d 62 73 2d 67 72 65 65 6e 3a 23 31 39 38 37 35 34 3b 2d 2d 62 73 2d 74 65 61 6c 3a 23 32 30 63 39 39 37 3b 2d 2d 62 73 2d 63 79 61 6e 3a 23 30 64 63 61 66 30 3b 2d 2d 62 73 2d 77 68 69 74 65 3a 23 66 66 66 3b 2d 2d 62 73 2d 67 72 61 79 3a 23 36 63 37 35 37 64 3b 2d 2d 62 73 2d 67 72 61 79 2d 64 61 72 6b 3a 23 33 34 33 61 34 30 3b 2d 2d 62 73 2d 70 72 69 6d 61 72 79 3a 23 30 64 36 65 66 64 3b 2d 2d 62 73 2d 73 65 63 6f 6e 64 61 72 79 3a 23 36 63 37 35 Data Ascii: 6610f2;--bs-purple:#6f42c1;--bs-pink:#d63384;--bs-red:#dc3545;--bs-orange:#fd7e14;--bs-yellow:#ffc107;--bs-green:#198754;--bs-teal:#20c997;--bs-cyan:#0dcaf0;--bs-white:#fff;--bs-gray:#6c757d;--bs-gray-dark:#343a40;--bs-primary:#0d6efd;--bs-secondary:#6c75
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 31 2c 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 7d 7d 2e 68 32 2c 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 61 6c 63 28 31 2e 33 32 35 72 65 6d 20 2b 20 2e 39 76 77 29 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 7b 2e 68 32 2c 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 7d 7d 2e 68 33 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 61 6c 63 28 31 2e 33 72 65 6d 20 2b 20 2e 36 76 77 29 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 7b 2e 68 33 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 35 72 65 6d 7d 7d 2e 68 34 2c 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 61 6c 63 28 31 2e 32 37 35 72 65 6d 20 2b 20 2e 33 76 77 29 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 Data Ascii: 1,h1{font-size:2.5rem}}.h2,h2{font-size:calc(1.325rem + .9vw)}@media (min-width:1200px){.h2,h2{font-size:2rem}}.h3,h3{font-size:calc(1.3rem + .6vw)}@media (min-width:1200px){.h3,h3{font-size:1.75rem}}.h4,h4{font-size:calc(1.275rem + .3vw)}@media (min-widt
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 6f 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 65 6d 7d 70 72 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 6e 6f 72 6d 61 6c 7d 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 65 6d 3b 63 6f 6c 6f 72 3a 23 64 36 33 33 38 34 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 7d 61 3e 63 6f 64 65 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 6b 62 64 7b 70 61 64 64 69 6e 67 3a 2e 32 72 65 6d 20 2e 34 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 65 6d 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 31 32 35 32 39 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 32 72 65 6d 7d 6b 62 Data Ascii: o;font-size:.875em}pre code{font-size:inherit;color:inherit;word-break:normal}code{font-size:.875em;color:#d63384;word-wrap:break-word}a>code{color:inherit}kbd{padding:.2rem .4rem;font-size:.875em;color:#fff;background-color:#212529;border-radius:.2rem}kb
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 65 3a 63 61 6c 63 28 31 2e 32 37 35 72 65 6d 20 2b 20 2e 33 76 77 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 7b 6c 65 67 65 6e 64 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 7d 7d 6c 65 67 65 6e 64 2b 2a 7b 63 6c 65 61 72 3a 6c 65 66 74 7d 3a 3a 2d 77 65 62 6b 69 74 2d 64 61 74 65 74 69 6d 65 2d 65 64 69 74 2d 64 61 79 2d 66 69 65 6c 64 2c 3a 3a 2d 77 65 62 6b 69 74 2d 64 61 74 65 74 69 6d 65 2d 65 64 69 74 2d 66 69 65 6c 64 73 2d 77 72 61 70 70 65 72 2c 3a 3a 2d 77 65 62 6b 69 74 2d 64 61 74 65 74 69 6d 65 2d 65 64 69 74 2d 68 6f 75 72 2d 66 69 65 6c 64 2c 3a 3a 2d 77 65 62 6b 69 74 2d 64 61 74 65 74 69 6d 65 2d 65 64 69 74 2d 6d 69 6e 75 74 65 2c 3a Data Ascii: e:calc(1.275rem + .3vw);line-height:inherit}@media (min-width:1200px){legend{font-size:1.5rem}}legend+*{clear:left}::-webkit-datetime-edit-day-field,::-webkit-datetime-edit-fields-wrapper,::-webkit-datetime-edit-hour-field,::-webkit-datetime-edit-minute,:
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 72 65 6d 7d 7d 2e 64 69 73 70 6c 61 79 2d 35 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 61 6c 63 28 31 2e 34 32 35 72 65 6d 20 2b 20 32 2e 31 76 77 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 7b 2e 64 69 73 70 6c 61 79 2d 35 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 72 65 6d 7d 7d 2e 64 69 73 70 6c 61 79 2d 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 61 6c 63 28 31 2e 33 37 35 72 65 6d 20 2b 20 31 2e 35 76 77 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 7b 2e 64 69 73 70 6c 61 79 2d 36 7b 66 6f 6e 74 2d 73 69 7a Data Ascii: rem}}.display-5{font-size:calc(1.425rem + 2.1vw);font-weight:300;line-height:1.2}@media (min-width:1200px){.display-5{font-size:3rem}}.display-6{font-size:calc(1.375rem + 1.5vw);font-weight:300;line-height:1.2}@media (min-width:1200px){.display-6{font-siz
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 3a 37 32 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 39 39 32 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6c 67 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6d 64 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 7b 6d 61 78 2d 77 69 64 74 68 3a 39 36 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 30 30 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6c 67 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 6d 64 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 78 6c 7b 6d 61 78 2d 77 69 64 74 68 3a 31 31 34 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 34 30 30 70 78 29 7b 2e 63 6f 6e 74 61 69 6e 65 72 2c 2e 63 6f 6e Data Ascii: :720px}}@media (min-width:992px){.container,.container-lg,.container-md,.container-sm{max-width:960px}}@media (min-width:1200px){.container,.container-lg,.container-md,.container-sm,.container-xl{max-width:1140px}}@media (min-width:1400px){.container,.con
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 25 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 37 36 38 70 78 29 7b 2e 63 6f 6c 2d 6d 64 7b 66 6c 65 78 3a 31 20 30 20 30 25 7d 2e 72 6f 77 2d 63 6f 6c 73 2d 6d 64 2d 61 75 74 6f 3e 2a 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 72 6f 77 2d 63 6f 6c 73 2d 6d 64 2d 31 3e 2a 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 72 6f 77 2d 63 6f 6c 73 2d 6d 64 2d 32 3e 2a 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 35 30 25 7d 2e 72 6f 77 2d 63 6f 6c 73 2d 6d 64 2d 33 3e 2a 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 33 33 2e 33 33 33 33 33 33 33 33 33 33 25 7d 2e 72 6f 77 2d 63 6f 6c 73 2d 6d 64 2d 34 3e 2a 7b 66 6c 65 78 3a 30 20 30 20 61 Data Ascii: %}}@media (min-width:768px){.col-md{flex:1 0 0%}.row-cols-md-auto>{flex:0 0 auto;width:auto}.row-cols-md-1>{flex:0 0 auto;width:100%}.row-cols-md-2>{flex:0 0 auto;width:50%}.row-cols-md-3>{flex:0 0 auto;width:33.3333333333%}.row-cols-md-4>*{flex:0 0 a
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 6c 2d 35 3e 2a 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 32 30 25 7d 2e 72 6f 77 2d 63 6f 6c 73 2d 78 78 6c 2d 36 3e 2a 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 31 36 2e 36 36 36 36 36 36 36 36 36 37 25 7d 7d 2e 63 6f 6c 2d 61 75 74 6f 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 63 6f 6c 2d 31 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 32 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 31 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 33 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 32 35 25 7d 2e 63 6f 6c 2d 34 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 Data Ascii: l-5>{flex:0 0 auto;width:20%}.row-cols-xxl-6>{flex:0 0 auto;width:16.6666666667%}}.col-auto{flex:0 0 auto;width:auto}.col-1{flex:0 0 auto;width:8.33333333%}.col-2{flex:0 0 auto;width:16.66666667%}.col-3{flex:0 0 auto;width:25%}.col-4{flex:0 0 auto;width
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 73 6d 2d 32 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 31 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 73 6d 2d 33 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 32 35 25 7d 2e 63 6f 6c 2d 73 6d 2d 34 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 33 33 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 73 6d 2d 35 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 34 31 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 73 6d 2d 36 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 3a 35 30 25 7d 2e 63 6f 6c 2d 73 6d 2d 37 7b 66 6c 65 78 3a 30 20 30 20 61 75 74 6f 3b 77 69 64 74 68 Data Ascii: x:0 0 auto;width:8.33333333%}.col-sm-2{flex:0 0 auto;width:16.66666667%}.col-sm-3{flex:0 0 auto;width:25%}.col-sm-4{flex:0 0 auto;width:33.33333333%}.col-sm-5{flex:0 0 auto;width:41.66666667%}.col-sm-6{flex:0 0 auto;width:50%}.col-sm-7{flex:0 0 auto;width

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:19 UTC	576	OUT	GET /npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://storage.thaicarecloud.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-29 23:18:19 UTC	1108	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:19 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * access-control-expose-headers: * timing-allow-origin: * Cache-Control: public, max-age=31536000, s-maxage=31536000, immutable cross-origin-resource-policy: cross-origin x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains; preload x-jsd-version: 5.0.2 x-jsd-version-type: version etag: W/"13397-kBFpUnUH/55mLPZNjjYfNZMIlw0" Age: 473324 x-served-by: cache-fra-eddf8230080-FRA, cache-lga21921-LGA x-cache: HIT, HIT vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5IoySRfFBPoReVAqKw6571tqaUBzX0ffHHWo3aQJzw5xLxNa8wkgI4EiLEvpq%2BLRRtrQ99f6LyerTfXmtcA37jPzvkJuYR%2BDp1GnwRfdsGQ68EgICEQ%2FHBWqbL49NVg0wgw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 909cf0d65ac88c05-EWR
2025-01-29 23:18:19 UTC	261	IN	Data Raw: 37 62 31 37 0d 0a 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 35 2e 30 2e 32 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 31 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 69 6e 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c Data Ascii: 7b17/! Bootstrap v5.0.2 (https://getbootstrap.com/) * Copyright 2011-2021 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE) */!function(t,
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 65 29 3a 28 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 7c 7c 73 65 6c 66 29 2e 62 6f 6f 74 73 74 72 61 70 3d 65 28 29 7d 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 63 6f 6e 73 74 20 74 3d 7b 66 69 6e 64 3a 28 74 2c 65 3d 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 Data Ascii: ject"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t\|\|self).bootstrap=e()}(this,(function(){"use strict";const t={find:(t,e=document.documentEle
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 26 26 28 76 6f 69 64 20 30 21 3d 3d 74 2e 6a 71 75 65 72 79 26 26 28 74 3d 74 5b 30 5d 29 2c 76 6f 69 64 20 30 21 3d 3d 74 2e 6e 6f 64 65 54 79 70 65 29 2c 61 3d 65 3d 3e 72 28 65 29 3f 65 2e 6a 71 75 65 72 79 3f 65 5b 30 5d 3a 65 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 65 2e 6c 65 6e 67 74 68 3e 30 3f 74 2e 66 69 6e 64 4f 6e 65 28 65 29 3a 6e 75 6c 6c 2c 6c 3d 28 74 2c 65 2c 69 29 3d 3e 7b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 69 29 2e 66 6f 72 45 61 63 68 28 6e 3d 3e 7b 63 6f 6e 73 74 20 73 3d 69 5b 6e 5d 2c 6f 3d 65 5b 6e 5d 2c 61 3d 6f 26 26 72 28 6f 29 3f 22 65 6c 65 6d 65 6e 74 22 3a 6e 75 6c 6c 3d 3d 28 6c 3d 6f 29 3f 22 22 2b 6c 3a 7b 7d 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 6c 29 2e 6d 61 74 63 68 28 2f 5c 73 28 5b 61 Data Ascii: &&(void 0!==t.jquery&&(t=t[0]),void 0!==t.nodeType),a=e=>r(e)?e.jquery?e[0]:e:"string"==typeof e&&e.length>0?t.findOne(e):null,l=(t,e,i)=>{Object.keys(i).forEach(n=>{const s=i[n],o=e[n],a=o&&r(o)?"element":null==(l=o)?""+l:{}.toString.call(l).match(/\s([a
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 61 63 68 28 74 3d 3e 74 28 29 29 7d 29 2c 6d 2e 70 75 73 68 28 65 29 29 3a 65 28 29 7d 2c 62 3d 74 3d 3e 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 28 29 7d 2c 76 3d 28 74 2c 65 2c 69 3d 21 30 29 3d 3e 7b 69 66 28 21 69 29 72 65 74 75 72 6e 20 76 6f 69 64 20 62 28 74 29 3b 63 6f 6e 73 74 20 6e 3d 28 74 3d 3e 7b 69 66 28 21 74 29 72 65 74 75 72 6e 20 30 3b 6c 65 74 7b 74 72 61 6e 73 69 74 69 6f 6e 44 75 72 61 74 69 6f 6e 3a 65 2c 74 72 61 6e 73 69 74 69 6f 6e 44 65 6c 61 79 3a 69 7d 3d 77 69 6e 64 6f 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 74 29 3b 63 6f 6e 73 74 20 6e 3d 4e 75 6d 62 65 72 2e 70 61 72 73 65 46 6c 6f 61 74 28 65 29 2c 73 3d 4e 75 6d 62 65 72 2e 70 61 72 73 65 46 6c 6f 61 74 28 69 29 3b 72 65 74 Data Ascii: ach(t=>t())}),m.push(e)):e()},b=t=>{"function"==typeof t&&t()},v=(t,e,i=!0)=>{if(!i)return void b(t);const n=(t=>{if(!t)return 0;let{transitionDuration:e,transitionDelay:i}=window.getComputedStyle(t);const n=Number.parseFloat(e),s=Number.parseFloat(i);ret
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 6e 63 74 69 6f 6e 20 78 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 65 26 26 60 24 7b 65 7d 3a 3a 24 7b 4f 2b 2b 7d 60 7c 7c 74 2e 75 69 64 45 76 65 6e 74 7c 7c 4f 2b 2b 7d 66 75 6e 63 74 69 6f 6e 20 44 28 74 29 7b 63 6f 6e 73 74 20 65 3d 78 28 74 29 3b 72 65 74 75 72 6e 20 74 2e 75 69 64 45 76 65 6e 74 3d 65 2c 54 5b 65 5d 3d 54 5b 65 5d 7c 7c 7b 7d 2c 54 5b 65 5d 7d 66 75 6e 63 74 69 6f 6e 20 53 28 74 2c 65 2c 69 3d 6e 75 6c 6c 29 7b 63 6f 6e 73 74 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 3b 66 6f 72 28 6c 65 74 20 73 3d 30 2c 6f 3d 6e 2e 6c 65 6e 67 74 68 3b 73 3c 6f 3b 73 2b 2b 29 7b 63 6f 6e 73 74 20 6f 3d 74 5b 6e 5b 73 5d 5d 3b 69 66 28 6f 2e 6f 72 69 67 69 6e 61 6c 48 61 6e 64 6c 65 72 3d 3d 3d 65 26 26 6f 2e 64 65 6c 65 67 61 74 69 6f 6e 53 Data Ascii: nction x(t,e){return e&&`${e}::${O++}`\|\|t.uidEvent\|\|O++}function D(t){const e=x(t);return t.uidEvent=e,T[e]=T[e]\|\|{},T[e]}function S(t,e,i=null){const n=Object.keys(t);for(let s=0,o=n.length;s<o;s++){const o=t[n[s]];if(o.originalHandler===e&&o.delegationS
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 28 45 2c 22 22 29 2c 43 5b 74 5d 7c 7c 74 7d 63 6f 6e 73 74 20 50 3d 7b 6f 6e 28 74 2c 65 2c 69 2c 6e 29 7b 4e 28 74 2c 65 2c 69 2c 6e 2c 21 31 29 7d 2c 6f 6e 65 28 74 2c 65 2c 69 2c 6e 29 7b 4e 28 74 2c 65 2c 69 2c 6e 2c 21 30 29 7d 2c 6f 66 66 28 74 2c 65 2c 69 2c 6e 29 7b 69 66 28 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 7c 7c 21 74 29 72 65 74 75 72 6e 3b 63 6f 6e 73 74 5b 73 2c 6f 2c 72 5d 3d 49 28 65 2c 69 2c 6e 29 2c 61 3d 72 21 3d 3d 65 2c 6c 3d 44 28 74 29 2c 63 3d 65 2e 73 74 61 72 74 73 57 69 74 68 28 22 2e 22 29 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6f 29 7b 69 66 28 21 6c 7c 7c 21 6c 5b 72 5d 29 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 6a 28 74 2c 6c 2c 72 2c 6f 2c 73 3f 69 3a 6e 75 6c 6c 29 7d 63 26 26 4f 62 6a Data Ascii: (E,""),C[t]\|\|t}const P={on(t,e,i,n){N(t,e,i,n,!1)},one(t,e,i,n){N(t,e,i,n,!0)},off(t,e,i,n){if("string"!=typeof e\|\|!t)return;const[s,o,r]=I(e,i,n),a=r!==e,l=D(t),c=e.startsWith(".");if(void 0!==o){if(!l\|\|!l[r])return;return void j(t,l,r,o,s?i:null)}c&&Obj
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 7d 2c 67 65 74 3a 28 74 2c 65 29 3d 3e 48 2e 68 61 73 28 74 29 26 26 48 2e 67 65 74 28 74 29 2e 67 65 74 28 65 29 7c 7c 6e 75 6c 6c 2c 72 65 6d 6f 76 65 28 74 2c 65 29 7b 69 66 28 21 48 2e 68 61 73 28 74 29 29 72 65 74 75 72 6e 3b 63 6f 6e 73 74 20 69 3d 48 2e 67 65 74 28 74 29 3b 69 2e 64 65 6c 65 74 65 28 65 29 2c 30 3d 3d 3d 69 2e 73 69 7a 65 26 26 48 2e 64 65 6c 65 74 65 28 74 29 7d 7d 3b 63 6c 61 73 73 20 42 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 29 7b 28 74 3d 61 28 74 29 29 26 26 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 3d 74 2c 52 2e 73 65 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 2c 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 44 41 54 41 5f 4b 45 59 2c 74 68 69 73 29 29 7d 64 69 73 70 6f 73 65 28 29 7b 52 2e 72 65 6d 6f 76 65 28 74 Data Ascii: },get:(t,e)=>H.has(t)&&H.get(t).get(e)\|\|null,remove(t,e){if(!H.has(t))return;const i=H.get(t);i.delete(e),0===i.size&&H.delete(t)}};class B{constructor(t){(t=a(t))&&(this._element=t,R.set(this._element,this.constructor.DATA_KEY,this))}dispose(){R.remove(t
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 6e 28 29 7b 63 6f 6e 73 74 20 65 3d 57 2e 67 65 74 4f 72 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 28 74 68 69 73 29 3b 22 63 6c 6f 73 65 22 3d 3d 3d 74 26 26 65 5b 74 5d 28 74 68 69 73 29 7d 29 29 7d 73 74 61 74 69 63 20 68 61 6e 64 6c 65 44 69 73 6d 69 73 73 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 2e 63 6c 6f 73 65 28 74 68 69 73 29 7d 7d 7d 50 2e 6f 6e 28 64 6f 63 75 6d 65 6e 74 2c 22 63 6c 69 63 6b 2e 62 73 2e 61 6c 65 72 74 2e 64 61 74 61 2d 61 70 69 22 2c 27 5b 64 61 74 61 2d 62 73 2d 64 69 73 6d 69 73 73 3d 22 61 6c 65 72 74 22 5d 27 2c 57 2e 68 61 6e 64 6c 65 44 69 73 6d 69 73 73 28 6e 65 77 20 57 29 29 2c 5f 28 57 29 3b 63 6c 61 73 73 20 71 20 65 78 Data Ascii: n(){const e=W.getOrCreateInstance(this);"close"===t&&e[t](this)}))}static handleDismiss(t){return function(e){e&&e.preventDefault(),t.close(this)}}}P.on(document,"click.bs.alert.data-api",'[data-bs-dismiss="alert"]',W.handleDismiss(new W)),_(W);class q ex
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 63 72 6f 6c 6c 4c 65 66 74 7d 7d 2c 70 6f 73 69 74 69 6f 6e 3a 74 3d 3e 28 7b 74 6f 70 3a 74 2e 6f 66 66 73 65 74 54 6f 70 2c 6c 65 66 74 3a 74 2e 6f 66 66 73 65 74 4c 65 66 74 7d 29 7d 2c 46 3d 7b 69 6e 74 65 72 76 61 6c 3a 35 65 33 2c 6b 65 79 62 6f 61 72 64 3a 21 30 2c 73 6c 69 64 65 3a 21 31 2c 70 61 75 73 65 3a 22 68 6f 76 65 72 22 2c 77 72 61 70 3a 21 30 2c 74 6f 75 63 68 3a 21 30 7d 2c 56 3d 7b 69 6e 74 65 72 76 61 6c 3a 22 28 6e 75 6d 62 65 72 7c 62 6f 6f 6c 65 61 6e 29 22 2c 6b 65 79 62 6f 61 72 64 3a 22 62 6f 6f 6c 65 61 6e 22 2c 73 6c 69 64 65 3a 22 28 62 6f 6f 6c 65 61 6e 7c 73 74 72 69 6e 67 29 22 2c 70 61 75 73 65 3a 22 28 73 74 72 69 6e 67 7c 62 6f 6f 6c 65 61 6e 29 22 2c 77 72 61 70 3a 22 62 6f 6f Data Ascii: ocument.body.scrollLeft}},position:t=>({top:t.offsetTop,left:t.offsetLeft})},F={interval:5e3,keyboard:!0,slide:!1,pause:"hover",wrap:!0,touch:!0},V={interval:"(number\|boolean)",keyboard:"boolean",slide:"(boolean\|string)",pause:"(string\|boolean)",wrap:"boo
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 28 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 3f 74 68 69 73 2e 6e 65 78 74 57 68 65 6e 56 69 73 69 62 6c 65 3a 74 68 69 73 2e 6e 65 78 74 29 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 29 29 7d 74 6f 28 65 29 7b 74 68 69 73 2e 5f 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3d 74 2e 66 69 6e 64 4f 6e 65 28 22 2e 61 63 74 69 76 65 2e 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 22 2c 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 3b 63 6f 6e 73 74 20 69 3d 74 68 69 73 2e 5f 67 65 74 49 74 65 6d 49 6e 64 65 78 28 74 68 69 73 2e 5f 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 29 3b 69 66 28 65 3e 74 68 69 73 2e 5f 69 74 65 6d 73 2e 6c 65 6e 67 74 68 2d 31 7c Data Ascii: =setInterval((document.visibilityState?this.nextWhenVisible:this.next).bind(this),this._config.interval))}to(e){this._activeElement=t.findOne(".active.carousel-item",this._element);const i=this._getItemIndex(this._activeElement);if(e>this._items.length-1\|

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:19 UTC	577	OUT	GET /ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://storage.thaicarecloud.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-29 23:18:19 UTC	962	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:19 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03ec3-2087" Last-Modified: Mon, 04 May 2020 16:11:47 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 103015 Expires: Mon, 19 Jan 2026 23:18:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pRhqTAByjDhvAxY7JISUj9BCw9yQuJKkm2ny1701xJOnRjpzmYLO%2F%2B2iZU7MusniOAANwpCxjlDznuw1LkGPjXrabmJAsl5EAqzh2%2BRpbxOOYnwxzVfVDR%2Fu9AXgc%2BZVWNOedTVD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 909cf0d6790e0f51-EWR alt-svc: h3=":443"; ma=86400
2025-01-29 23:18:19 UTC	407	IN	Data Raw: 32 30 38 37 0d 0a 2f 2f 20 6a 51 75 65 72 79 20 4d 61 73 6b 20 50 6c 75 67 69 6e 20 76 31 2e 31 34 2e 31 36 0a 2f 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 69 67 6f 72 65 73 63 6f 62 61 72 2f 6a 51 75 65 72 79 2d 4d 61 73 6b 2d 50 6c 75 67 69 6e 0a 76 61 72 20 24 6a 73 63 6f 6d 70 3d 24 6a 73 63 6f 6d 70 7c 7c 7b 7d 3b 24 6a 73 63 6f 6d 70 2e 73 63 6f 70 65 3d 7b 7d 3b 24 6a 73 63 6f 6d 70 2e 66 69 6e 64 49 6e 74 65 72 6e 61 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 6e 2c 66 29 7b 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 61 3d 53 74 72 69 6e 67 28 61 29 29 3b 66 6f 72 28 76 61 72 20 70 3d 61 2e 6c 65 6e 67 74 68 2c 6b 3d 30 3b 6b 3c 70 3b 6b 2b 2b 29 7b 76 61 72 20 62 3d 61 5b 6b 5d 3b 69 66 28 6e 2e 63 61 6c 6c 28 66 2c 62 2c 6b 2c 61 Data Ascii: 2087// jQuery Mask Plugin v1.14.16// github.com/igorescobar/jQuery-Mask-Pluginvar $jscomp=$jscomp\|\|{};$jscomp.scope={};$jscomp.findInternal=function(a,n,f){a instanceof String&&(a=String(a));for(var p=a.length,k=0;k<p;k++){var b=a[k];if(n.call(f,b,k,a
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 59 46 49 4c 4c 3d 21 31 3b 0a 24 6a 73 63 6f 6d 70 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3d 24 6a 73 63 6f 6d 70 2e 41 53 53 55 4d 45 5f 45 53 35 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 6e 2c 66 29 7b 61 21 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 26 26 61 21 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 26 26 28 61 5b 6e 5d 3d 66 2e 76 61 6c 75 65 29 7d 3b 24 6a 73 63 6f 6d 70 2e 67 65 74 47 6c 6f 62 61 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 Data Ascii: YFILL=!1;$jscomp.defineProperty=$jscomp.ASSUME_ES5\|\|"function"==typeof Object.defineProperties?Object.defineProperty:function(a,n,f){a!=Array.prototype&&a!=Object.prototype&&(a[n]=f.value)};$jscomp.getGlobal=function(a){return"undefined"!=typeof window&&
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 63 6f 6c 6c 61 70 73 65 28 21 30 29 3b 67 2e 6d 6f 76 65 45 6e 64 28 22 63 68 61 72 61 63 74 65 72 22 2c 61 29 3b 67 2e 6d 6f 76 65 53 74 61 72 74 28 22 63 68 61 72 61 63 74 65 72 22 2c 61 29 3b 67 2e 73 65 6c 65 63 74 28 29 7d 7d 7d 63 61 74 63 68 28 42 29 7b 7d 7d 2c 65 76 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 62 2e 6f 6e 28 22 6b 65 79 64 6f 77 6e 2e 6d 61 73 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 62 2e 64 61 74 61 28 22 6d 61 73 6b 2d 6b 65 79 63 6f 64 65 22 2c 61 2e 6b 65 79 43 6f 64 65 7c 7c 61 2e 77 68 69 63 68 29 3b 62 2e 64 61 74 61 28 22 6d 61 73 6b 2d 70 72 65 76 69 75 73 2d 76 61 6c 75 65 22 2c 62 2e 76 61 6c 28 29 29 3b 62 2e 64 61 74 61 28 22 6d 61 73 6b 2d 70 72 65 76 69 75 73 2d 63 61 72 65 74 2d 70 6f 73 22 2c 63 2e 67 65 Data Ascii: collapse(!0);g.moveEnd("character",a);g.moveStart("character",a);g.select()}}}catch(B){}},events:function(){b.on("keydown.mask",function(a){b.data("mask-keycode",a.keyCode\|\|a.which);b.data("mask-previus-value",b.val());b.data("mask-previus-caret-pos",c.ge
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 7d 2c 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 62 2e 69 73 28 22 69 6e 70 75 74 22 29 3f 22 76 61 6c 22 3a 22 74 65 78 74 22 3b 69 66 28 30 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7b 69 66 28 62 5b 63 5d 28 29 21 3d 3d 61 29 62 5b 63 5d 28 61 29 3b 0a 63 3d 62 7d 65 6c 73 65 20 63 3d 62 5b 63 5d 28 29 3b 72 65 74 75 72 6e 20 63 7d 2c 63 61 6c 63 75 6c 61 74 65 43 61 72 65 74 50 6f 73 69 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 64 3d 63 2e 67 65 74 4d 61 73 6b 65 64 28 29 2c 68 3d 63 2e 67 65 74 43 61 72 65 74 28 29 3b 69 66 28 61 21 3d 3d 64 29 7b 76 61 72 20 65 3d 62 2e 64 61 74 61 28 22 6d 61 73 6b 2d 70 72 65 76 69 75 73 2d 63 61 72 65 74 2d 70 6f 73 22 29 7c 7c 30 3b 64 3d 64 2e 6c 65 6e 67 Data Ascii: },val:function(a){var c=b.is("input")?"val":"text";if(0<arguments.length){if(b[c]()!==a)b[c](a);c=b}else c=b[c]();return c},calculateCaretPosition:function(a){var d=c.getMasked(),h=c.getCaret();if(a!==d){var e=b.data("mask-previus-caret-pos")\|\|0;d=d.leng
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 61 6c 3f 28 67 2b 3d 6d 2c 6e 2d 3d 6d 29 3a 71 2e 66 61 6c 6c 62 61 63 6b 3f 28 68 5b 72 5d 28 71 2e 66 61 6c 6c 62 61 63 6b 29 2c 67 2b 3d 6d 2c 6e 2d 3d 6d 29 3a 63 2e 69 6e 76 61 6c 69 64 2e 70 75 73 68 28 7b 70 3a 6e 2c 76 3a 76 2c 65 3a 71 2e 70 61 74 74 65 72 6e 7d 29 2c 6e 2b 3d 6d 3b 65 6c 73 65 7b 69 66 28 21 61 29 68 5b 72 5d 28 79 29 3b 76 3d 3d 3d 79 3f 28 62 2e 70 75 73 68 28 6e 29 2c 6e 2b 3d 6d 29 3a 28 7a 3d 79 2c 62 2e 70 75 73 68 28 6e 2b 77 29 2c 77 2b 2b 29 3b 67 2b 3d 6d 7d 7d 61 3d 64 2e 63 68 61 72 41 74 28 78 29 3b 6b 21 3d 3d 70 2b 31 7c 7c 6c 2e 74 72 61 6e 73 6c 61 74 69 6f 6e 5b 61 5d 7c 7c 68 2e 70 75 73 68 28 61 29 3b 68 3d 68 2e 6a 6f 69 6e 28 22 22 29 3b 63 2e 6d 61 70 4d 61 73 6b 64 69 67 69 74 50 6f 73 69 74 69 6f 6e 73 Data Ascii: al?(g+=m,n-=m):q.fallback?(h[r](q.fallback),g+=m,n-=m):c.invalid.push({p:n,v:v,e:q.pattern}),n+=m;else{if(!a)h[r](y);v===y?(b.push(n),n+=m):(z=y,b.push(n+w),w++);g+=m}}a=d.charAt(x);k!==p+1\|\|l.translation[a]\|\|h.push(a);h=h.join("");c.mapMaskdigitPositions
2025-01-29 23:18:19 UTC	1369	IN	Data Raw: 64 65 72 26 26 62 2e 61 74 74 72 28 22 70 6c 61 63 65 68 6f 6c 64 65 72 22 2c 65 2e 70 6c 61 63 65 68 6f 6c 64 65 72 29 3b 62 2e 64 61 74 61 28 22 6d 61 73 6b 22 29 26 26 62 2e 61 74 74 72 28 22 61 75 74 6f 63 6f 6d 70 6c 65 74 65 22 2c 22 6f 66 66 22 29 3b 67 3d 30 3b 66 6f 72 28 76 61 72 20 66 3d 21 30 3b 67 3c 64 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 7b 76 61 72 20 68 3d 6c 2e 74 72 61 6e 73 6c 61 74 69 6f 6e 5b 64 2e 63 68 61 72 41 74 28 67 29 5d 3b 69 66 28 68 26 26 68 2e 72 65 63 75 72 73 69 76 65 29 7b 66 3d 21 31 3b 62 72 65 61 6b 7d 7d 66 26 26 62 2e 61 74 74 72 28 22 6d 61 78 6c 65 6e 67 74 68 22 2c 64 2e 6c 65 6e 67 74 68 29 2e 64 61 74 61 28 22 6d 61 73 6b 2d 6d 61 78 6c 65 6e 67 74 68 22 2c 21 30 29 3b 63 2e 64 65 73 74 72 6f 79 45 76 65 6e 74 Data Ascii: der&&b.attr("placeholder",e.placeholder);b.data("mask")&&b.attr("autocomplete","off");g=0;for(var f=!0;g<d.length;g++){var h=l.translation[d.charAt(g)];if(h&&h.recursive){f=!1;break}}f&&b.attr("maxlength",d.length).data("mask-maxlength",!0);c.destroyEvent
2025-01-29 23:18:19 UTC	1083	IN	Data Raw: 61 74 61 28 22 6d 61 73 6b 22 29 2e 67 65 74 4d 61 73 6b 65 64 56 61 6c 28 61 29 7d 3b 61 2e 66 6e 2e 75 6e 6d 61 73 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 61 2e 6d 61 73 6b 57 61 74 63 68 65 72 73 5b 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 5d 29 3b 0a 64 65 6c 65 74 65 20 61 2e 6d 61 73 6b 57 61 74 63 68 65 72 73 5b 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 61 28 74 68 69 73 29 2e 64 61 74 61 28 22 6d 61 73 6b 22 29 3b 62 26 26 62 2e 72 65 6d 6f 76 65 28 29 2e 72 65 6d 6f 76 65 44 61 74 61 28 22 6d 61 73 6b 22 29 7d 29 7d 3b 61 2e 66 6e 2e 63 6c 65 61 6e 56 61 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 Data Ascii: ata("mask").getMaskedVal(a)};a.fn.unmask=function(){clearInterval(a.maskWatchers[this.selector]);delete a.maskWatchers[this.selector];return this.each(function(){var b=a(this).data("mask");b&&b.remove().removeData("mask")})};a.fn.cleanVal=function(){retu
2025-01-29 23:18:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:20 UTC	665	OUT	GET /Package4273221/media/css/style.css HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:20 UTC	272	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:20 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "1cbb-62cd20056c02f" Accept-Ranges: bytes Content-Length: 7355 Vary: Accept-Encoding Connection: close Content-Type: text/css
2025-01-29 23:18:20 UTC	7355	IN	Data Raw: 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 77 67 68 74 40 33 30 30 3b 34 30 30 3b 35 30 30 3b 36 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 29 3b 68 74 6d 6c 2c 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 4f 70 65 6e 20 53 61 6e 73 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 31 33 31 62 32 30 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 69 6d 67 7b 6d 61 78 2d 77 69 64 74 Data Ascii: @import url("https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;500;600;700&display=swap");html,body{font-family:'Open Sans', sans-serif;font-size:14px;padding:0;margin:0;color:#131b20;font-weight:400}a:hover{text-decoration:none}img{max-widt

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (41897), with CRLF line terminators
Category:	downloaded
Size (bytes):	41899
Entropy (8bit):	4.739288661217842
Encrypted:	false
SSDEEP:	384:g8xTEBmqsHWJo+Fl9feef03Fvn6cxwkqsZ4JayZkQqLZNPdP/s26Olk9KIYRQ4T9:LOFsOYkcbQcxre9r0QTVcN
MD5:	726C60FC192383FBCF04E19677AD0959
SHA1:	E2E966C2B6164806392449CED617227C27D36AB8
SHA-256:	1C7070CF33DA6ADCB7A6B9FF7EB6E06FD8F64958622D61569B990E8B92C58615
SHA-512:	A45A01385D32C455B8E7601876A4E8CD2444993BB3A25B9B58937B19C767A23764A6A2B99C11FABE6D405FF3A4CEAF137C62EC2C9E142CE1207B0876BB87EB2F
Malicious:	false
Reputation:	low
URL:	https://storage.thaicarecloud.org/Package4273221/media/css/helpers.css
Preview:	.fz10{font-size:10px !important}.fz12{font-size:12px !important}.fz14{font-size:14px !important}.fz16{font-size:16px !important}.fz18{font-size:18px !important}.fz20{font-size:20px !important}.fz22{font-size:22px !important}.fz24{font-size:24px !important}.fz26{font-size:26px !important}.fz28{font-size:28px !important}.fz30{font-size:30px !important}.fz32{font-size:32px !important}.fz34{font-size:34px !important}.fz36{font-size:36px !important}.fz38{font-size:38px !important}.fz40{font-size:40px !important}.fz42{font-size:42px !important}.fz44{font-size:44px !important}.fz46{font-size:46px !important}.fz48{font-size:48px !important}.fz50{font-size:50px !important}.fz52{font-size:52px !important}.fz54{font-size:54px !important}.fz56{font-size:56px !important}.fz58{font-size:58px !important}.fz60{font-size:60px !important}.fz62{font-size:62px !important}.fz70{font-size:70px !important}.fz80{font-size:80px !important}.fz90{font-size:90px !important}.fz100{font-size:100px !important}.fz120

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:20 UTC	711	OUT	GET /Package4273221/media/imgs/logo.png HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:20 UTC	251	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:20 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "462c-62cd20056c02f" Accept-Ranges: bytes Content-Length: 17964 Connection: close Content-Type: image/png
2025-01-29 23:18:21 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b0 00 00 00 32 08 06 00 00 00 fc cf 51 8d 00 00 00 09 70 48 59 73 00 00 17 12 00 00 17 12 01 67 9f d2 52 00 00 3a 2c 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 35 30 2c 20 32 30 31 39 2f 31 30 2f 30 31 2d 31 38 3a 30 33 3a 31 36 20 20 20 20 20 20 20 20 22 3e 0a 20 3c 72 64 66 3a 52 Data Ascii: PNGIHDR2QpHYsgR:,iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?><x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164050, 2019/10/01-18:03:16 "> <rdf:R
2025-01-29 23:18:21 UTC	1580	IN	Data Raw: 08 49 88 e4 a7 90 e1 ba 94 68 2c fe 04 29 1d 81 5a 05 8a 67 2c 8f df 49 70 82 f3 3c dc 0a 05 ae 28 c7 94 df 57 93 19 2d 47 0d 46 23 f3 73 42 54 d1 85 51 89 1b 43 76 eb 8e 5b e2 55 b9 48 b6 f0 44 e2 26 3a 27 0e c9 62 3e 83 7b b5 ae f5 c0 5f 0d 7c 4f 2e 04 5d 89 c0 9d 09 95 f2 3d 5d 08 7c 90 0c 96 46 3b 00 3b 31 d5 c9 e7 db 71 8e 75 22 ef 81 b0 6f 3e 47 e0 b3 11 77 9c 4e 3d 05 59 0d 9d fc b9 f7 02 7f 6d 47 fb ed 98 62 51 e8 88 85 44 0a 5b 34 91 59 6d 6d 42 3c 9d e7 d0 1f 51 47 03 30 32 60 5f 35 68 44 80 0f 03 37 b6 e3 1c 37 63 2a 6d 2b 09 79 5b d7 30 08 6c 2b 5a ae 96 15 d8 d5 a2 63 db 3b 70 a2 0a 22 af b4 3c df 48 4c 5e 77 9b c3 cb 1f 46 70 6a b4 30 f6 52 9e 8d c9 09 0f 6b c7 39 06 60 aa 75 47 e4 4f 77 29 02 1f d1 14 9b 2e 7b 51 87 a9 14 fd 8c cc 08 c4 13 Data Ascii: Ih,)Zg,Ip<(W-GF#sBTQCv[UHD&:'b>{_\|O.]=]\|F;;1qu"o>GwN=YmGbQD[4YmmB<QG02`_5hD77c*m+y[0l+Zc;p"<HL^wFpj0Rk9`uGOw).{Q

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:20 UTC	712	OUT	GET /Package4273221/media/imgs/arrow.png HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:20 UTC	248	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:20 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "111-62cd20056c02f" Accept-Ranges: bytes Content-Length: 273 Connection: close Content-Type: image/png
2025-01-29 23:18:20 UTC	273	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0e 00 00 00 08 08 02 00 00 00 46 73 59 9b 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 00 c3 49 44 41 54 78 da 63 ca 77 58 14 a1 3c d9 57 a4 07 0f 02 2a 00 2a 63 4a 69 75 9c b8 3f 4e 49 47 8c 01 07 10 93 e5 6b dd 10 06 54 c6 d4 1a b7 e1 eb a7 9f 40 8e ae b5 2c a6 3a a0 11 40 83 18 19 19 81 ca 98 be 7e fc 09 34 fc e4 f6 3b 40 d5 ce 11 da c8 ea 80 5c a0 e0 95 63 8f ab fc 57 02 95 31 41 44 27 e4 ee 98 53 73 20 7f b2 47 4a 8b 03 44 c4 2f dd 18 c8 dd b7 f2 6a 6b dc 46 a0 3a a0 08 13 dc 8c 4d 33 cf 4e cc dd e1 12 a9 53 b5 d0 1f a2 07 c8 9d 5d bd 1f ae 80 09 d9 c6 bd 2b ae 56 f9 af d2 b3 91 b5 f4 52 a9 0e 58 05 e4 22 cb 32 a1 f9 e3 de 95 57 79 0e 8b 80 1a 2e 1f 7d 8c 26 05 00 08 55 Data Ascii: PNGIHDRFsYpHYsodIDATxcwX<W**cJiu?NIGkT@,:@~4;@\cW1AD'Ss GJD/jkF:M3NS]+VRX"2Wy.}&U

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:20 UTC	646	OUT	GET /Package4273221/media/js/js.js HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:20 UTC	284	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:20 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "1f0-62cd20056c02f" Accept-Ranges: bytes Content-Length: 496 Vary: Accept-Encoding Connection: close Content-Type: application/javascript
2025-01-29 23:18:20 UTC	496	IN	Data Raw: 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 7b 0d 0a 20 20 20 20 0d 0a 20 20 20 20 24 28 27 2e 69 6e 70 75 74 27 29 2e 66 6f 63 75 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 20 20 20 20 20 20 20 20 24 28 74 68 69 73 29 2e 70 61 72 65 6e 74 28 29 2e 66 69 6e 64 28 22 2e 6c 61 62 65 6c 2d 74 78 74 22 29 2e 61 64 64 43 6c 61 73 73 28 27 6c 61 62 65 6c 2d 61 63 74 69 76 65 27 29 3b 0d 0a 20 20 20 20 7d 29 3b 0d 0a 0d 0a 20 20 20 20 24 28 27 2e 69 6e 70 75 74 27 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 20 20 20 20 20 20 20 20 69 66 28 24 28 74 68 69 73 29 2e 76 61 6c 28 29 2e 6c 65 6e 67 74 68 20 3e 20 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 74 68 69 73 29 2e 70 61 72 65 6e 74 28 29 2e 66 69 6e 64 28 22 2e 6c Data Ascii: jQuery(function($){ $('.input').focus(function(){ $(this).parent().find(".label-txt").addClass('label-active'); }); $('.input').each(function(){ if($(this).val().length > 0) { $(this).parent().find(".l

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:20 UTC	719	OUT	GET /Package4273221/media/imgs/header-icon1.png HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:20 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:20 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "5e5-62cd20056c02f" Accept-Ranges: bytes Content-Length: 1509 Connection: close Content-Type: image/png
2025-01-29 23:18:20 UTC	1509	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5a 00 00 00 1e 08 02 00 00 00 23 03 9e 2f 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 05 97 49 44 41 54 78 da d5 99 3d 4c 5b 57 14 c7 a3 37 34 55 1a 91 a5 64 4a 06 da 6c 86 85 0e 6d 9d 05 c3 50 52 09 3b 53 31 95 92 0e 81 66 21 01 29 2a 52 71 46 60 48 13 09 4a 87 26 78 29 91 6a ca 14 13 a9 c9 42 dd a1 49 5a a9 f1 50 9b 8d 82 94 74 01 a6 44 4a a5 4c ed ef bd bf b9 7a 79 5f fe 28 b6 9b ab 2b 74 de bd e7 1e df fb bf e7 f3 62 0d bd 7d 3d a2 4f a7 7e c8 7f fb fb 1f bf 3c f9 b3 b4 f3 8f d3 20 f8 64 70 a2 6f 39 7a 6d bb 3a 1b fb 32 b9 42 6f 60 ad 75 28 a8 bd 75 ec f0 c8 17 1f e6 36 c7 67 ef 7c 92 bc f8 5e cf e9 93 ef 74 1f d7 14 04 9f 0c ce 17 ce c1 00 1b cc 87 da dd d8 c3 d0 e7 bd Data Ascii: PNGIHDRZ#/pHYsodIDATx=L[W74UdJlmPR;S1f!)*RqF`HJ&x)jBIZPtDJLzy_(+tb}=O~< dpo9zm:2Bo`u(u6g\|^t

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:21 UTC	719	OUT	GET /Package4273221/media/imgs/header-icon3.png HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:22 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:22 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "44d-62cd20056c02f" Accept-Ranges: bytes Content-Length: 1101 Connection: close Content-Type: image/png
2025-01-29 23:18:22 UTC	1101	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 55 00 00 00 1e 08 02 00 00 00 d2 08 c5 a2 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 03 ff 49 44 41 54 78 da d5 99 3f 4c d3 41 14 c7 49 07 4d 30 c1 45 98 64 c0 b8 15 16 18 50 58 5a 19 44 13 5a 26 05 13 58 28 b2 08 25 31 32 50 46 ea 80 9a 80 2c 96 76 b1 26 56 99 f8 93 28 0b 96 41 41 13 db c1 c2 86 90 80 0b 65 82 44 13 26 fd f4 f7 f4 f8 f5 f7 fb 15 83 96 86 bb dc 70 bf 7b ef 1e 7d f7 de fb de f7 0e 57 db 85 c7 47 f4 61 ff eb d9 67 9f bf bc df fa 9a d9 f9 69 34 06 7c 32 19 f4 c4 8f 5e ab 45 77 95 39 b5 73 e7 cf 76 3e b8 9a 58 bf 17 9e b9 e5 eb 6b a8 6b ae be 54 5b 25 22 06 7c 32 39 9e ec 42 01 35 94 cb b4 6d 0e fe 5f b9 79 79 22 d9 dd 39 d4 84 63 d9 ed fd f9 a9 74 a8 7d 7a d0 Data Ascii: PNGIHDRUpHYsodIDATx?LAIM0EdPXZDZ&X(%12PF,v&V(AAeD&p{}WGagi4\|2^Ew9sv>XkkT[%"\|29B5m_yy"9ct}z

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:21 UTC	711	OUT	GET /Package4273221/media/imgs/dots.png HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:22 UTC	248	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:22 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "106-62cd20056c02f" Accept-Ranges: bytes Content-Length: 262 Connection: close Content-Type: image/png
2025-01-29 23:18:22 UTC	262	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 06 00 00 00 14 08 02 00 00 00 21 b0 db 8f 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 00 b8 49 44 41 54 78 da 63 fa ff ff 7f c3 de db 02 4d bb 81 08 c8 00 72 99 36 5d 7f d5 b0 f7 ce 87 1f 7f 80 08 c8 00 72 99 ce 3f fb c4 80 04 80 5c 26 43 29 3e 64 21 20 97 c9 4f 53 ac c1 59 45 80 83 05 88 80 0c 20 97 09 28 53 ef a4 f2 be d6 05 88 80 0c 20 97 89 01 03 80 84 5e 7f fd d5 7b e4 01 10 01 19 20 21 20 65 3a ed 78 c9 f6 1b 40 04 64 00 b9 4c 8b ce 3f 7b f8 e1 3b 44 0b 90 01 e4 62 33 2b ce 50 4a 5e 80 13 c2 01 32 80 5c 26 51 6e b6 d3 59 96 3d 9e 1a 40 04 64 00 b9 20 8d 40 aa d8 46 01 88 80 0c dc ee 6a dc 77 47 b0 79 0f 10 01 19 20 21 2a 06 0e 00 78 4e 72 ed 9a 32 76 ff 00 00 00 00 49 Data Ascii: PNGIHDR!pHYsodIDATxcMr6]r?\&C)>d! OSYE (S ^{ ! e:x@dL?{;Db3+PJ^2\&QnY=@d @FjwGy !*xNr2vI

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:21 UTC	712	OUT	GET /Package4273221/media/imgs/icon1.png HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:22 UTC	248	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:22 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "2a3-62cd20056c02f" Accept-Ranges: bytes Content-Length: 675 Connection: close Content-Type: image/png
2025-01-29 23:18:22 UTC	675	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 1a 00 00 00 1a 08 02 00 00 00 26 28 db 99 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 02 55 49 44 41 54 78 da 63 fa 4f 08 7c 7c f3 ed e1 f5 37 f7 af be 7a f3 ec 33 41 c5 4c 0c 38 c0 91 0d 37 bb 53 b7 c4 eb cc 88 d1 98 96 63 bb 20 cf 7e 51 a2 de cc 08 e5 29 cd 31 1b f6 ae b8 8a 4b 17 16 e3 0e ad bf 91 65 35 bf 2b 75 cb e1 0d 37 df bf fc 8a 2c f5 ed d3 cf d3 3b ef 4e cc dd 91 66 32 67 ff ea 6b 84 8d 9b 5e b6 a7 27 6d eb 93 db ef 18 f0 82 17 0f 3f f6 67 6d 9f 5e ba 07 9f 71 5d 29 9b b7 cf bf c8 40 34 d8 be e0 62 67 ca 66 ec c6 cd 28 db 73 64 e3 2d 06 12 c1 d1 8d b7 80 1e 42 37 0e 18 5e db 48 71 17 8a 1b e7 5f 04 6a 47 31 6e 45 f7 71 06 0a 00 5c 3b 13 24 4d 10 0c 7b 20 a8 98 e7 Data Ascii: PNGIHDR&(pHYsodUIDATxcO\|\|7z3AL87Sc ~Q)1Ke5+u7,;Nf2gk^'m?gm^q])@4bgf(sd-B7^Hq_jG1nEq\;$M{

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:21 UTC	712	OUT	GET /Package4273221/media/imgs/icon3.png HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:22 UTC	248	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:22 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "268-62cd20056c02f" Accept-Ranges: bytes Content-Length: 616 Connection: close Content-Type: image/png
2025-01-29 23:18:22 UTC	616	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 02 00 00 00 6f 15 aa af 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 02 1a 49 44 41 54 78 da cd 94 3d 2c 03 61 18 c7 e5 16 4d 88 5a 5a 0b 12 62 eb 31 b4 03 ca e0 63 29 89 d6 84 0e 58 5a 96 36 ba 30 a8 51 0d 44 42 3a d1 1a 30 b4 31 29 49 63 a9 5a d0 45 97 ea 84 48 74 91 5a 54 48 74 aa ff 79 e4 f5 ba e3 7a 4c 9e 5c 2e 77 ef bd cf ef f9 78 9f ff 09 a5 72 f6 fc f8 9a 8a 5f 95 dd 26 54 fc 6c 2f 85 62 64 e5 dc 65 09 05 26 62 2e 73 e8 38 9a 55 d9 2c a8 23 22 cb 67 4d 26 83 6b b1 e7 b9 50 5c f3 1e f9 7a 77 33 a7 39 4d 20 19 22 b0 3f b2 14 1b b5 4f 5b b6 d2 6e e7 6c e7 fd 5d c1 3f bc 87 4b 89 13 d4 11 ad 5d 0d f4 b5 4a 5f d9 ef 14 db ba a5 57 50 c0 5a f7 1e e5 73 4f Data Ascii: PNGIHDRopHYsodIDATx=,aMZZb1c)XZ60QDB:01)IcZEHtZTHtyzL\.wxr_&Tl/bde&b.s8U,#"gM&kP\zw39M "?O[nl]?K]J_WPZsO

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:22 UTC	713	OUT	GET /Package4273221/media/imgs/social.png HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:23 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:23 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "666-62cd20056c02f" Accept-Ranges: bytes Content-Length: 1638 Connection: close Content-Type: image/png
2025-01-29 23:18:23 UTC	1638	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 1e 08 02 00 00 00 41 80 70 00 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 06 18 49 44 41 54 78 da ed 9b 7d 4c 1b 75 18 c7 cb b5 a5 50 da 6b e9 3a 61 e0 86 c6 b1 c0 32 49 36 c6 8b 91 99 e9 62 9c cb 98 a2 ff 6c 73 ee 2d 26 38 44 4d 5c 06 01 4d a6 c9 78 53 67 a2 2e 31 99 66 c9 36 dd 5c 62 32 91 44 4d b6 99 01 51 b3 c1 64 32 23 6c 60 70 31 a3 e3 a5 c0 f5 0d e8 ab df f6 c8 01 a5 fd f5 ae d7 d3 7f ee c9 2f 97 e7 ee 9e e7 f9 70 f7 fc 7e cf f3 3b d8 28 37 51 5c 2e 97 d5 6a 1d 19 19 b1 58 2c ff 84 04 0a 4e 71 11 b7 dc 92 89 cc e5 cf a5 14 51 c4 e1 70 8c 8e 8e 32 0c a3 54 2a d3 d2 d2 8c 46 63 46 48 a0 e0 14 17 71 6b 7c 7c 1c 00 45 42 45 e6 0a e5 46 48 e1 ec ec 2c 7c fc 7e Data Ascii: PNGIHDRAppHYsodIDATx}LuPk:a2I6bls-&8DM\MxSg.1f6\b2DMQd2#l`p1/p~;(7Q\.jX,NqQp2T*FcFHqk\|\|EBEFH,\|~

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:23 UTC	437	OUT	GET /Package4273221/media/imgs/header-icon3.png HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:24 UTC	249	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:23 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "44d-62cd20056c02f" Accept-Ranges: bytes Content-Length: 1101 Connection: close Content-Type: image/png
2025-01-29 23:18:24 UTC	1101	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 55 00 00 00 1e 08 02 00 00 00 d2 08 c5 a2 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 03 ff 49 44 41 54 78 da d5 99 3f 4c d3 41 14 c7 49 07 4d 30 c1 45 98 64 c0 b8 15 16 18 50 58 5a 19 44 13 5a 26 05 13 58 28 b2 08 25 31 32 50 46 ea 80 9a 80 2c 96 76 b1 26 56 99 f8 93 28 0b 96 41 41 13 db c1 c2 86 90 80 0b 65 82 44 13 26 fd f4 f7 f4 f8 f5 f7 fb 15 83 96 86 bb dc 70 bf 7b ef 1e 7d f7 de fb de f7 0e 57 db 85 c7 47 f4 61 ff eb d9 67 9f bf bc df fa 9a d9 f9 69 34 06 7c 32 19 f4 c4 8f 5e ab 45 77 95 39 b5 73 e7 cf 76 3e b8 9a 58 bf 17 9e b9 e5 eb 6b a8 6b ae be 54 5b 25 22 06 7c 32 39 9e ec 42 01 35 94 cb b4 6d 0e fe 5f b9 79 79 22 d9 dd 39 d4 84 63 d9 ed fd f9 a9 74 a8 7d 7a d0 Data Ascii: PNGIHDRUpHYsodIDATx?LAIM0EdPXZDZ&X(%12PF,v&V(AAeD&p{}WGagi4\|2^Ew9sv>XkkT[%"\|29B5m_yy"9ct}z

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Windows Analysis Report
https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:24 UTC	709	OUT	GET /Package4273221/media/imgs/ff.ico HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:25 UTC	265	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:24 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "1536-62cd20056c02f" Accept-Ranges: bytes Content-Length: 5430 Connection: close Content-Type: image/vnd.microsoft.icon
2025-01-29 23:18:25 UTC	5430	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff Data Ascii: h& (

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:26 UTC	427	OUT	GET /Package4273221/media/imgs/ff.ico HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:26 UTC	265	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:26 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Jan 2025 05:58:40 GMT ETag: "1536-62cd20056c02f" Accept-Ranges: bytes Content-Length: 5430 Connection: close Content-Type: image/vnd.microsoft.icon
2025-01-29 23:18:26 UTC	5430	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff Data Ascii: h& (

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:32 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4a 71 59 59 4d 75 46 7a 4b 6b 79 44 6f 32 57 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 39 62 34 65 38 36 63 63 66 30 66 38 34 62 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: JqYYMuFzKkyDo2Wr.1Context: 49b4e86ccf0f84bd
2025-01-29 23:18:32 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-29 23:18:32 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4a 71 59 59 4d 75 46 7a 4b 6b 79 44 6f 32 57 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 39 62 34 65 38 36 63 63 66 30 66 38 34 62 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 6b 51 69 75 41 68 51 57 67 4b 50 59 42 6b 46 49 57 4e 51 4b 76 45 4d 68 31 33 49 55 2f 44 79 55 36 2b 47 66 4c 7a 4e 75 55 63 72 7a 74 4a 78 61 66 6f 69 2f 43 63 64 42 53 73 54 32 58 79 79 2f 49 39 5a 32 6c 70 6f 58 6f 4b 67 70 74 72 38 61 63 78 66 37 4c 4e 52 4b 52 4f 78 4c 43 2f 79 6a 4e 47 6b 47 53 56 6c 39 63 63 58 61 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: JqYYMuFzKkyDo2Wr.2Context: 49b4e86ccf0f84bd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdkQiuAhQWgKPYBkFIWNQKvEMh13IU/DyU6+GfLzNuUcrztJxafoi/CcdBSsT2Xyy/I9Z2lpoXoKgptr8acxf7LNRKROxLC/yjNGkGSVl9ccXa
2025-01-29 23:18:32 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4a 71 59 59 4d 75 46 7a 4b 6b 79 44 6f 32 57 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 39 62 34 65 38 36 63 63 66 30 66 38 34 62 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: JqYYMuFzKkyDo2Wr.3Context: 49b4e86ccf0f84bd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-29 23:18:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-29 23:18:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 32 58 33 33 57 58 57 2f 45 53 47 37 78 41 68 35 35 68 47 30 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 42X33WXW/ESG7xAh55hG0A.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:33 UTC	838	OUT	GET /Package4273221/step2.php?id=93936677 HTTP/1.1 Host: storage.thaicarecloud.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=9b2j3797cfjbfskco374hfeha6
2025-01-29 23:18:33 UTC	308	IN	HTTP/1.1 200 OK Date: Wed, 29 Jan 2025 23:18:33 GMT Server: Apache/2.4.18 (Ubuntu) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2025-01-29 23:18:33 UTC	6	IN	Data Raw: 32 32 31 35 0d 0a Data Ascii: 2215
2025-01-29 23:18:33 UTC	4529	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 52 65 71 75 69 72 65 64 20 6d 65 74 61 20 74 61 67 73 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 22 20 22 6e 6f 66 Data Ascii: <!doctype html><html> <head> ... Required meta tags --> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="robots" content="noindex," "nof
2025-01-29 23:18:33 UTC	4196	IN	Data Raw: 62 72 69 6e 6b 20 63 6c 61 73 73 3d 22 45 69 77 33 61 46 6d 65 73 73 61 67 65 76 4e 4c 47 50 75 54 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 33 3e 49 6d 70 6f 72 74 61 6e 74 20 4d 65 73 73 61 67 65 21 3c 2f 68 33 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 57 65 20 6e 65 65 64 20 79 6f 75 72 20 41 64 64 72 65 73 73 20 74 6f 20 62 65 20 73 75 72 65 20 74 68 61 74 20 75 6e 61 75 74 68 6f 72 69 7a 65 64 20 70 65 72 73 6f 6e 73 20 63 61 6e 6e 6f 74 20 61 63 63 65 73 73 20 79 6f 75 72 20 70 61 63 6b 61 67 65 73 2c 20 59 6f 75 20 68 61 76 65 20 31 30 20 77 6f 72 6b 69 6e 67 20 64 61 79 73 20 46 72 6f 6d 20 74 68 65 20 61 72 72 69 76 61 6c 20 6f 66 20 79 6f 75 72 20 70 61 63 6b 61 67 65 20 Data Ascii: brink class="Eiw3aFmessagevNLGPuTo"> <h3>Important Message!</h3> <p>We need your Address to be sure that unauthorized persons cannot access your packages, You have 10 working days From the arrival of your package
2025-01-29 23:18:33 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-29 23:18:33 UTC	5	IN	Data Raw: 39 33 62 0d 0a Data Ascii: 93b
2025-01-29 23:18:33 UTC	2363	IN	Data Raw: 6d 65 64 69 75 6d 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 62 65 65 66 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 65 65 66 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6c 67 2d 33 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 64 6a 75 73 74 20 63 6c 61 73 73 3d 22 6b 52 63 47 78 6b 59 77 69 64 67 65 74 58 35 78 41 56 7a 6f 58 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 33 3e 4d 4f 52 45 20 46 52 4f 4d 20 46 45 44 45 58 3c 2f 68 33 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: medium> </beef> <beef class="col-lg-3"> <adjust class="kRcGxkYwidgetX5xAVzoX"> <h3>MORE FROM FEDEX</h3> <ul>
2025-01-29 23:18:33 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-29 23:18:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:18:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 32 46 5a 51 67 6a 55 46 30 69 41 4a 5a 57 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 63 32 38 62 33 66 36 37 33 66 32 38 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: A2FZQgjUF0iAJZW/.1Context: 2f8c28b3f673f285
2025-01-29 23:18:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-29 23:18:53 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 41 32 46 5a 51 67 6a 55 46 30 69 41 4a 5a 57 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 63 32 38 62 33 66 36 37 33 66 32 38 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 6b 51 69 75 41 68 51 57 67 4b 50 59 42 6b 46 49 57 4e 51 4b 76 45 4d 68 31 33 49 55 2f 44 79 55 36 2b 47 66 4c 7a 4e 75 55 63 72 7a 74 4a 78 61 66 6f 69 2f 43 63 64 42 53 73 54 32 58 79 79 2f 49 39 5a 32 6c 70 6f 58 6f 4b 67 70 74 72 38 61 63 78 66 37 4c 4e 52 4b 52 4f 78 4c 43 2f 79 6a 4e 47 6b 47 53 56 6c 39 63 63 58 61 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: A2FZQgjUF0iAJZW/.2Context: 2f8c28b3f673f285<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdkQiuAhQWgKPYBkFIWNQKvEMh13IU/DyU6+GfLzNuUcrztJxafoi/CcdBSsT2Xyy/I9Z2lpoXoKgptr8acxf7LNRKROxLC/yjNGkGSVl9ccXa
2025-01-29 23:18:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 41 32 46 5a 51 67 6a 55 46 30 69 41 4a 5a 57 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 63 32 38 62 33 66 36 37 33 66 32 38 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: A2FZQgjUF0iAJZW/.3Context: 2f8c28b3f673f285<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-29 23:18:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-29 23:18:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 77 4a 54 70 44 66 37 71 42 55 32 4c 63 63 58 71 2b 53 30 69 30 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: wJTpDf7qBU2LccXq+S0i0Q.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2025-01-29 23:19:21 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 55 34 38 36 32 63 45 2f 45 4b 6f 4a 62 4f 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 34 39 31 31 62 30 61 30 38 35 33 38 36 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: BU4862cE/EKoJbOK.1Context: 3c4911b0a0853864
2025-01-29 23:19:21 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-29 23:19:21 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 55 34 38 36 32 63 45 2f 45 4b 6f 4a 62 4f 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 34 39 31 31 62 30 61 30 38 35 33 38 36 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 6b 51 69 75 41 68 51 57 67 4b 50 59 42 6b 46 49 57 4e 51 4b 76 45 4d 68 31 33 49 55 2f 44 79 55 36 2b 47 66 4c 7a 4e 75 55 63 72 7a 74 4a 78 61 66 6f 69 2f 43 63 64 42 53 73 54 32 58 79 79 2f 49 39 5a 32 6c 70 6f 58 6f 4b 67 70 74 72 38 61 63 78 66 37 4c 4e 52 4b 52 4f 78 4c 43 2f 79 6a 4e 47 6b 47 53 56 6c 39 63 63 58 61 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: BU4862cE/EKoJbOK.2Context: 3c4911b0a0853864<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdkQiuAhQWgKPYBkFIWNQKvEMh13IU/DyU6+GfLzNuUcrztJxafoi/CcdBSsT2Xyy/I9Z2lpoXoKgptr8acxf7LNRKROxLC/yjNGkGSVl9ccXa
2025-01-29 23:19:21 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 55 34 38 36 32 63 45 2f 45 4b 6f 4a 62 4f 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 34 39 31 31 62 30 61 30 38 35 33 38 36 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: BU4862cE/EKoJbOK.3Context: 3c4911b0a0853864<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-29 23:19:21 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-29 23:19:21 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 35 47 71 57 4f 75 76 67 48 45 6d 77 45 47 37 68 78 4d 63 4b 43 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 5GqWOuvgHEmwEG7hxMcKCg.0Payload parsing failed.

Target ID:	1
Start time:	18:18:05
Start date:	29/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	18:18:09
Start date:	29/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2216,i,2229795296649985071,8483118368262044682,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	18:18:16
Start date:	29/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre