Edit tour

Windows Analysis Report
https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yR

Overview

General Information

Sample URL:	https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQc
Analysis ID:	1647096
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Found malware configuration

Yara detected AntiDebug via timestamp check

Yara detected HtmlPhish10

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected suspicious Javascript

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,6054834833030071777,5999505531601158188,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

Threatname: Tycoon2FA

{
  "otherweburl": "",
  "websitenames": "[\"godaddy\", \"okta\"]",
  "bes": "[\"Apple.com\",\"Netflix.com\"]",
  "pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]",
  "capnum": "1",
  "appnum": "1",
  "pvn": "0",
  "view": "",
  "pagelinkval": "YfHUv",
  "emailcheck": "0",
  "webname": "rtrim(/web9/, '/')",
  "urlo": "/ajsPH8p5K36UUluO3xYB5ue8P7HcSILuwrngWrMCM0kWrF0jcgKz4",
  "gdf": "/gh18oh6D7F7bBYBES1eIk01uvlUwjXnZDUBcd120"
}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_105	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security

HTML

Source	Rule	Description	Author
2.8.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.8.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
3.18..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.18..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.7.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.7.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.16.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.13.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.23.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
3.19..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.19..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.12..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
3.26..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.4.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
3.6.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.6.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
3.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.4.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.3.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.3.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
3.7.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.7.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
Click to see the 18 entries

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://zx.nhyyupvw.es/klqWOeY3owjLQQSqXQnoe2pau5yzOs8QycR4PXQP5NdVi4JxG78167	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/op5jr0Ze7Fyy3RZsnMoUQKevPOhthwOtuv250cvmjtdN8gTyFY7DGHxltWgmZPJ1ef234	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/ij5JAyHeJDhpnRG4qpaOwqMtG3DhhnbcgXxyqASGklP7LpT8KKHTGxSYHw74Uef206	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/abHzet6HTUrs93gvcd30	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/GDSherpa-regular.woff2	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/lmMtJNHRXQnXLdEOjRHqk01QBxHw6YoRwqNUeEF8K0J38y0pyTgfq	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/GDSherpa-vf2.woff2	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/mno5pkoOS1ZmHnC63KYOUG6z8UAcECMeOGhCuDvzij0FeDGQCvGTIQKaHdmZZWCvAuv220	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/ef1lX6eeTazOuASa74KDuc9g0fkYpHvij2y4RIZMMmkz37AeF90145	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/GDSherpa-regular.woff	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/GDSherpa-bold.woff	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/343OzJOFth6uy5Ia0LQytVklAsRW9F7pMTi8489110	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/wxqbZ3VS7sVdvNUHk18PmnRbCcKPcLv71qq2qglMf90172	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/GDSherpa-vf.woff2	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/opXqWeRCU3gABxRp66BNwUjMDD5T3sijFkmXtj2T1QKxgeT0luJftHef191	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/ajsPH8p5K36UUluO3xYB5ue8P7HcSILuwrngWrMCM0kWrF0jcgKz4	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/uvJUcHVsbtOcTPtMqsqtXcaOUESlVgUmDLn679VPzaa4mYHLCoR4Y7YoxXAmncMgh260	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/favicon.ico	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/kl8lWMPmK7IeRMlQKtLCMaLANqd4uoph3DKxSdIibEjdpfxZJqHwab221	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/wxiAiZUN09zeMhcs2taSdstyPCNIsMOS8mnZX34130	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/ozbjrYHayK7TO2Pn7G0W88tFZi6iwm6sjvrUMnsl	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/GDSherpa-bold.woff2	Avira URL Cloud: Label: malware
Source: https://zx.nhyyupvw.es/34AO6pnkJImzBIwxxy8Ta18916	Avira URL Cloud: Label: malware

Found malware configuration

Source: 3.23.d.script.csv

Malware Configuration Extractor: Tycoon2FA {"otherweburl": "", "websitenames": "[\"godaddy\", \"okta\"]", "bes": "[\"Apple.com\",\"Netflix.com\"]", "pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]", "capnum": "1", "appnum": "1", "pvn": "0", "view": "", "pagelinkval": "YfHUv", "emailcheck": "0", "webname": "rtrim(/web9/, '/')", "urlo": "/ajsPH8p5K36UUluO3xYB5ue8P7HcSILuwrngWrMCM0kWrF0jcgKz4", "gdf": "/gh18oh6D7F7bBYBES1eIk01uvlUwjXnZDUBcd120"}

Phishing

AI detected phishing page

Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'zx.nhyyupvw.es' does not match the legitimate domain for Microsoft., The URL contains a random string 'nhyyupvw' which is not associated with Microsoft., The domain extension '.es' is not typically associated with Microsoft's main services., The presence of input fields for 'Email, phone, or Skype' is common for Microsoft services, but the URL does not match Microsoft's domain, raising suspicion. DOM: 3.6.pages.csv
Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'zx.nhyyupvw.es' does not match the legitimate domain for Microsoft., The URL contains a suspicious domain extension '.es' which is not typically associated with Microsoft., The URL has no clear association with Microsoft and appears to be random, which is a common tactic in phishing attempts. DOM: 3.7.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML

Yara detected Invisible JS

Source: Yara match	File source: 2.7.d.script.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 2.7.d.script.csv, type: HTML
Source: Yara match	File source: 2.12..script.csv, type: HTML
Source: Yara match	File source: 3.26..script.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_105, type: DROPPED

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 3.23.d.script.csv, type: HTML
Source: Yara match	File source: 2.8.d.script.csv, type: HTML
Source: Yara match	File source: 3.18..script.csv, type: HTML
Source: Yara match	File source: 2.16.d.script.csv, type: HTML
Source: Yara match	File source: 2.13.d.script.csv, type: HTML
Source: Yara match	File source: 3.19..script.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 2.15..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://zx.nhyyupvw.es/iSHROnSonGoT/... This script demonstrates several high-risk behaviors, including dynamic code execution, potential data exfiltration, and suspicious redirection. The use of obfuscated code, the presence of a debugger, and the attempt to redirect the user to an unrelated domain (Google) indicate a high likelihood of malicious intent. Overall, this script poses a significant security risk and should be treated with caution.
Source: 2.14..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://zx.nhyyupvw.es/iSHROnSonGoT/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code/URLs. The script appears to be performing malicious activities, such as redirecting to a suspicious domain and collecting user credentials. While the specific purpose is unclear, the overall behavior is highly suspicious and poses a significant risk.
Source: 2.12..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://zx.nhyyupvw.es/iSHROnSonGoT/... This script demonstrates high-risk behaviors, including dynamic code execution through the use of a Proxy object that evaluates decoded strings. The obfuscated nature of the code and the potential for remote code execution make this a high-risk script.
Source: 2.9..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://zx.nhyyupvw.es/iSHROnSonGoT/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` and `decodeURIComponent()` to decode and execute remote code is a clear indicator of malicious intent. Additionally, the script appears to be sending user data to an untrusted domain, which poses a significant risk of data theft or other malicious activities. Overall, this script exhibits a high level of suspicion and should be treated as a potential security threat.
Source: 3.18..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and aggressive DOM manipulation. It checks for the presence of web automation tools, blocks common keyboard shortcuts, disables right-click context menus, and introduces a delay-based debugger trap that redirects the user to an external website. Additionally, it intercepts the clipboard copy event to replace the copied content with a custom string. These behaviors are highly suspicious and indicative of malicious intent, warranting a high-risk score.

Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE

HTTP Parser: Number of links: 0

Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://zx.nhyyupvw.es/iSHROnSonGoT/

HTTP Parser: Base64 decoded: if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) { window.location = "about:blank";}document.addEventListener("keydown", function (event) { function yNOmLteDBy(event) { co...

Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE

HTTP Parser: Title: Proceed For Secure Account Login does not match URL

Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: Invalid link: Terms of use
Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: Invalid link: Privacy & cookies
Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: Invalid link: Terms of use
Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: Invalid link: Privacy & cookies

Source: https://zx.nhyyupvw.es/iSHROnSonGoT/	HTTP Parser: function riynmkhjey(){zbcmpeqmse = atob("pcfet0nuwvbfigh0bww+cjxodg1sigxhbmc9imvuij4kpghlywq+ciagpg1ldgegy2hhcnnldd0ivvrgltgipgogidxtzxrhig5hbwu9inzpzxdwb3j0iibjb250zw50psj3awr0ad1kzxzpy2utd2lkdggsigluaxrpywwtc2nhbgu9ms4wij4kica8dgl0bgu+ug9ydgzvbglvicygqwdlbmn5ic0gtw9kzxjuierlc2lnbjwvdgl0bgu+ciagpgxpbmsgahjlzj0iahr0chm6ly9mb250cy5nb29nbgvhcglzlmnvbs9jc3myp2zhbwlset1nb250c2vycmf0ondnahrandawozcwmczmyw1pbhk9um9ib3rvondnahramzawozqwmds1mdamzglzcgxhet1zd2fwiibyzww9inn0ewxlc2hlzxqipgogidxzdhlszt4kicagic8qiedlbmvyywwgu3r5bgvzicovciagicbib2r5ihskicagicagzm9udc1myw1pbhk6icdsb2jvdg8nlcbzyw5zlxnlcmlmowogicagicbtyxjnaw46ida7ciagicagihbhzgrpbmc6ida7ciagicagignvbg9yoiajmzmzowogicagicbsaw5llwhlawdoddogms42owogicagicbiywnrz3jvdw5klwnvbg9yoiajzjrmngy5owogicagfqokicagiggxlcbomiwgadmgewogicagicbmb250lwzhbwlsetogj01vbnrzzxjyyxqnlcbzyw5zlxnlcmlmowogicagicbjb2xvcjogizjjm2u1mdskicagih0kciagicbhihskicagicagy29sb3i6icmzndk4zgi7ciagicagihrlehqtzgvjb3jhdglvbjogbm9uztskicagih0kciagicbhomhvdmvyihskicagicagdgv4dc1kzwnvcmf0aw9uoib1bmrlc...
Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: var otherweburl = "";var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "yfhuv";var emailcheck = "0";var webname = "rtrim(/web9/, '/')";var urlo = "/ajsph8p5k36uuluo3xyb5ue8p7hcsiluwrngwrmcm0kwrf0jcgkz4";var gdf = "/gh18oh6d7f7bbybes1eik01uvluwjxnzdubcd120";var odf = "/ijhmveiyhphnpiuolkbkfpowx6x923wfbqeuogl3acd650";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "";var useragent = navigator.useragent;var browsername;var userip;var usercountry;var errorcodeexecuted = false;if(useragent.match(/edg/i)){ br...

Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE

HTTP Parser: <input type="password" .../> found

Source: https://538-kadoma.trakcid.com/?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg&e=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce&cee=Y2hyaXN0b3BoZXIuYWxsYW5AcnByby50ZWNo	HTTP Parser: No favicon
Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: No favicon
Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: No favicon

Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: No <meta name="author".. found
Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: No <meta name="author".. found

Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: No <meta name="copyright".. found
Source: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.251.40.100:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.49:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.132.107:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.132.107:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.68:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.73.226:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.150:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.254.174:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.254.174:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.229:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.106:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.73.226:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.180.34:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.155:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.5.189:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.124:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.102.239.211:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.96:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.96:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.113.4:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.91:443 -> 192.168.2.4:49825 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: email.friendbuy-mail.com to https://538-kadoma.trakcid.com/?u=http:%2f%2femail.double.serviceautopilot.com%2fc%2fejwewl1owzaqaocnstdbzvl_8mas2jaoa2lzz51iky2jjc3q2_pvcd_z9uot5uk-wfki4gsfiy5eafwedlyf02lb4hll5ciexzfn3odtjnjp8z772lsqlannuqtriwnjghjborfktvavcjpqfektujyra4nka-vgudocvldxlarnee-gwconoojktjc2egwtqfmchzxhrrxxkcvke49nr5gf19j7oi5zx52vabmu_wt6jchmyp79kdvyej3255_ek8hcbx9fn9ttbo_jm8hmj1sxo5_x2bc8zf7xvdgjjv0y8sk68gec_waaap__35labg&e=ofmfycdniwqje3mlviyty4hpjtccq-ce&cee=y2hyaxn0b3bozxiuywxsyw5acnbyby50zwno
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: email.double.serviceautopilot.com to https://zx.nhyyupvw.es/ishronsongot/

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1 HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index.css HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main.3dfe9f5e.css HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/main.d62e4927.js HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /manifest.json HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?i=0&docs=1&s=1 HTTP/1.1Host: api-bd.linkscan.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, /sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"X-Original-Referer: unknownsec-ch-ua-mobile: ?0Origin: https://lsems.gravityzone.bitdefender.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsems.gravityzone.bitdefender.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.cLv6DfAR7vFo5oY-2FqNn1ouEQnV2mDIj7j69roW5D9YFmBFwPhHpDSZmf-2B3Pr25NKH1kkrAtv-2FXYlYHDcjRTHmkWY1isyzqTHOYSV2VdQ1tT1G8-2FNMDl8wCw4SYq3K-2F-2FiCbQ7dDyP5dZoLD-2FOxtt8eFMBYOTS0pk89J8UmvCWjzbPwK2xEcw4XEiLFMCga6U0GFvQoOCb0P85sJVWK2Uml3XcdplD23kW-2FTxE-2BtGlDca1HjLRLdUKSNEAochyK-2BchY8B8vmew2v65f73My9ah-2BrdDnS6EIzE4TkvMhxdRHCCReZDVmaDqbPzw7053nhs23dod2YDSiaNB84g8YaMUKurnp9p1y-2B1nQpZebeALMEbnVDu6tTmFR7-2FHyGAHsZk61FyHh9uMQKB5L-2BtyOwTzWn7KvQSyyj3dH1rO4cxBBiWvhshRwgiYR7P05IvjezWCT32bX-2BjQB9JYGnHCuTnaAvsCLBHqTRV-2Bn2Hi3bm3nP1-2Baf7Epl-2FSvdYLY6KlQgLtPuXok3CXKypQBjPnRjTQJI-2BLeqRURlVbUeZHSlyws8Vwyao9B57spuIqsg93t3fmhWl9DmdgmDC4XLsl-2B3GEjzzUpMaNfhpwVuK0PSOtmvx-2F38AbYYESVomxnmKLL-2BOKderogjR3e-2Bpxu1MnWhQI-2Bw-3D-3DW0qv_4pihHygNSB0r9RfW0d44OGid9KPtmw14Y7-2FMHyDwcVW3HSjtuwGFBnBjiQG3-2Fb3urCctiPuIQjHAcBM1R6iFYpm7MuQ2WuMW6LagnpHoXYyjCGCl74vz-2FIqMsuMFvpwGAHIATwDXjaOGIaa8JZk1leLIY5Bb4cDMR5o0OowCLV1fOiEjRPd9ecLAxnTxFow1 HTTP/1.1Host: email.friendbuy-mail.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://lsems.gravityzone.bitdefender.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?i=0&docs=1&s=1 HTTP/1.1Host: api-bd.linkscan.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg&e=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce&cee=Y2hyaXN0b3BoZXIuYWxsYW5AcnByby50ZWNo HTTP/1.1Host: 538-kadoma.trakcid.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://lsems.gravityzone.bitdefender.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /flare.js HTTP/1.1Host: track.salesflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://538-kadoma.trakcid.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /token?email=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce HTTP/1.1Host: api.salesflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://538-kadoma.trakcid.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://538-kadoma.trakcid.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /token?email=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce HTTP/1.1Host: api.salesflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@sentry/browser@5.29.2/build/bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveOrigin: https://storage.googleapis.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://storage.googleapis.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /flareprovider.js HTTP/1.1Host: track.salesflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://storage.googleapis.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 538-kadoma.trakcid.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://538-kadoma.trakcid.com/?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg&e=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce&cee=Y2hyaXN0b3BoZXIuYWxsYW5AcnByby50ZWNoAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /devices HTTP/1.1Host: api.salesflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /contacts HTTP/1.1Host: api.salesflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /devices/282019365 HTTP/1.1Host: api.salesflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /interactions/forward?instant=true HTTP/1.1Host: api.salesflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/eJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg HTTP/1.1Host: email.double.serviceautopilot.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iSHROnSonGoT/ HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://zx.nhyyupvw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://zx.nhyyupvw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://zx.nhyyupvw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=YKl5pwJoAzkrTDELv0S0fq189o5tS_CLCjemVlKKogQ-1742822533-1.0.1.1-VmF5njDEhHziMl7HMy9a8I1XfvsNHHJU.bnSymkr9psOUi9a1uvP_gzPkG8_JlUZ8M69MlLT6ZvQbmMjF_ZpWGCdNKQt1Dz5G1Hf.SWwQcM
Source: global traffic	HTTP traffic detected: GET /chiriya@vhhyk0f HTTP/1.1Host: 3ghu.nmpjkg.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://zx.nhyyupvw.esSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://zx.nhyyupvw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chiriya@vhhyk0f HTTP/1.1Host: 3ghu.nmpjkg.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iSHROnSonGoT/ HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://zx.nhyyupvw.es/iSHROnSonGoT/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InphM0FWd1NndVpqRnQvdXlyOS9KS2c9PSIsInZhbHVlIjoiRGg3NGcvdmdPSTV2YlNmWFByVml2VWtrck13KzRkMGdORml2MFp2N1E5S2lOT1lmc0xQZCtFVktxS0ExYisxRVk1dURZbGdmK0xUTGEwOHhjTVJKQlBLSjhSdzg1cXdpaWtKWWNqTmlPUEdFaWttWkZPZlUxeS9QejFqTGRJazAiLCJtYWMiOiJmOTk5ZDAxZDM2NzE1ODZiZjJmZjg5ZDRkMWNjYTJkZjZkODM3ZGEyNWQ1NTRiN2RiYzIwMGYzZTFhMjU4NjY5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ikk3dzBzTW02cWdweG5VbjdObzJjQ0E9PSIsInZhbHVlIjoieHhGclYxVlNmSWc5LzFTdE5zdmpwV0tlS2JBNDFRbWs5S1J3eTVsZ2hzZ3ZyYkozMDIxZEQ5TFlSeTBFaFVVWm43YXZhY0kzQWhLSkFwTFNIcnFYV3dZVSsxTXpxNkk4bS84YlZzT2E4eExqZTIxek1KTTk1NW0vMk5wdEkrNXgiLCJtYWMiOiJiZmVmMTJmYjQ3Zjc0Zjk5Yjk5ODIwMjRkOTE0NDlmY2ZlZjZmNzBhMjRkZWEzY2VlNGRjYWY5ZmI5ODMwZDUxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ozbjrYHayK7TO2Pn7G0W88tFZi6iwm6sjvrUMnsl HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InphM0FWd1NndVpqRnQvdXlyOS9KS2c9PSIsInZhbHVlIjoiRGg3NGcvdmdPSTV2YlNmWFByVml2VWtrck13KzRkMGdORml2MFp2N1E5S2lOT1lmc0xQZCtFVktxS0ExYisxRVk1dURZbGdmK0xUTGEwOHhjTVJKQlBLSjhSdzg1cXdpaWtKWWNqTmlPUEdFaWttWkZPZlUxeS9QejFqTGRJazAiLCJtYWMiOiJmOTk5ZDAxZDM2NzE1ODZiZjJmZjg5ZDRkMWNjYTJkZjZkODM3ZGEyNWQ1NTRiN2RiYzIwMGYzZTFhMjU4NjY5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ikk3dzBzTW02cWdweG5VbjdObzJjQ0E9PSIsInZhbHVlIjoieHhGclYxVlNmSWc5LzFTdE5zdmpwV0tlS2JBNDFRbWs5S1J3eTVsZ2hzZ3ZyYkozMDIxZEQ5TFlSeTBFaFVVWm43YXZhY0kzQWhLSkFwTFNIcnFYV3dZVSsxTXpxNkk4bS84YlZzT2E4eExqZTIxek1KTTk1NW0vMk5wdEkrNXgiLCJtYWMiOiJiZmVmMTJmYjQ3Zjc0Zjk5Yjk5ODIwMjRkOTE0NDlmY2ZlZjZmNzBhMjRkZWEzY2VlNGRjYWY5ZmI5ODMwZDUxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/iSHROnSonGoT/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkxsNEowZUlSbW52WjRKei9jMzZvVUE9PSIsInZhbHVlIjoiaHBlYlYxRmptUUs1TkRISzlVbWhUM1lpUElPd2VtNTJGaGJoMTVIODhLdyt3bDB4YncvVCtER1kzWWVQaVora1pQWmxuMWMwTE54S1FVOWZvakZsZ1pLd1IvVlNRYXBGRGthMnVQRWxGTzRCRkVJSHZvdFV3b2EvTEFPQlcvd2YiLCJtYWMiOiIyYTA5NzliYzU0NjViOGJmMGRmOTA3MDc2OTY4MzBkOTkzNGU2YTdhNTAxYjNkMWM1MjlhMDE2Mjc3YzgyNTIzIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InJRcTgvZTFWWXVuSkxNdk53U1I4SVE9PSIsInZhbHVlIjoiQUptTEdQOW1weUFlMEpTZjlkd2VsZVpOT2YzWmpVdkg2czNWVXFjZWNOcU05SVU2UzQyMUJZTitrQXJtcXdqN3FLNUZMMC9XUlZZR0Faa3BoYXJGckFaN0d0NzE1NDlGWUl5aXVVb213MmlVMUQyQ1RiTWFKcmtkWVBSblM0dDQiLCJtYWMiOiI3OGRiMGE4OTU5YzZiYTBhNzA1NzZlMDlkZDA5MTVlOTc0ZTc2YzE0YzdjYjAxZjcwMTA0NjI1MWQyNDBmN2U1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /lmMtJNHRXQnXLdEOjRHqk01QBxHw6YoRwqNUeEF8K0J38y0pyTgfq HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilo2UDhCcGRtaWJBdEw1aUcyUFF5eFE9PSIsInZhbHVlIjoiMURkZUVhRTN3aG5TWGJ2SEFFUXlJdFFpNm5OeHlXTTBibzd0RG5nWFplUGZKYjFvRHFRaVM3UmNQcTNEdlExL2NXeVFXN3NYRmxTZVVSWktIeXFkbEN3Mml3MlNaMEVhbUtQcGZtSWVDell2WjBGL1lhejBzazJsTzBmeGtxeXkiLCJtYWMiOiI0OWNjNzRmNjhiOGQxODUyMzI2OTBiYmU1YzQ4NmY4ZjhkN2Q1ZjVhYmY4NmMxMWQwNDI2ZTJhMTczZDc2OWZjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEyZTh6RENzdVFlcVRCdTg2T21PalE9PSIsInZhbHVlIjoiazJXTG5kMmhobUxOc3ByRGQxN1Z0cWVXRTgzNDYzcUdCZFZKcGRoN0NZRGdraTZNYm1pNTBFRVRhZFRmRW5hNk96dFdhZnhZbW5sdlJ2NEluN0dpVWplWFRIUWl6Mjhob1VxeVB1eUhKQXN3RU9lYnZyeVNrcndWc2t0VFJSU1YiLCJtYWMiOiI0YTI1ZDBiNWQ4NjFmN2ExMTQxNmNjNjI5NDllODkxODcyZGUwMzQ3MzUzNDc1NTQyNGNiNDE3MDY4NDc2NWYxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://zx.nhyyupvw.es/iSHROnSonGoT/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilo2UDhCcGRtaWJBdEw1aUcyUFF5eFE9PSIsInZhbHVlIjoiMURkZUVhRTN3aG5TWGJ2SEFFUXlJdFFpNm5OeHlXTTBibzd0RG5nWFplUGZKYjFvRHFRaVM3UmNQcTNEdlExL2NXeVFXN3NYRmxTZVVSWktIeXFkbEN3Mml3MlNaMEVhbUtQcGZtSWVDell2WjBGL1lhejBzazJsTzBmeGtxeXkiLCJtYWMiOiI0OWNjNzRmNjhiOGQxODUyMzI2OTBiYmU1YzQ4NmY4ZjhkN2Q1ZjVhYmY4NmMxMWQwNDI2ZTJhMTczZDc2OWZjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEyZTh6RENzdVFlcVRCdTg2T21PalE9PSIsInZhbHVlIjoiazJXTG5kMmhobUxOc3ByRGQxN1Z0cWVXRTgzNDYzcUdCZFZKcGRoN0NZRGdraTZNYm1pNTBFRVRhZFRmRW5hNk96dFdhZnhZbW5sdlJ2NEluN0dpVWplWFRIUWl6Mjhob1VxeVB1eUhKQXN3RU9lYnZyeVNrcndWc2t0VFJSU1YiLCJtYWMiOiI0YTI1ZDBiNWQ4NjFmN2ExMTQxNmNjNjI5NDllODkxODcyZGUwMzQ3MzUzNDc1NTQyNGNiNDE3MDY4NDc2NWYxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /34AO6pnkJImzBIwxxy8Ta18916 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /abHzet6HTUrs93gvcd30 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff2 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveOrigin: https://zx.nhyyupvw.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveOrigin: https://zx.nhyyupvw.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff2 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveOrigin: https://zx.nhyyupvw.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveOrigin: https://zx.nhyyupvw.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://zx.nhyyupvw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://zx.nhyyupvw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://zx.nhyyupvw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf.woff2 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveOrigin: https://zx.nhyyupvw.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf2.woff2 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveOrigin: https://zx.nhyyupvw.essec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /343OzJOFth6uy5Ia0LQytVklAsRW9F7pMTi8489110 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250324%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250324T132233Z&X-Amz-Expires=300&X-Amz-Signature=22556f4cd42058835d32bb1c608b03e7277bcf6a4065ed9ecdcdc71a3a3180da&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://zx.nhyyupvw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kl8lWMPmK7IeRMlQKtLCMaLANqd4uoph3DKxSdIibEjdpfxZJqHwab221 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mno5pkoOS1ZmHnC63KYOUG6z8UAcECMeOGhCuDvzij0FeDGQCvGTIQKaHdmZZWCvAuv220 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wxiAiZUN09zeMhcs2taSdstyPCNIsMOS8mnZX34130 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /opkMSbL6M9fLMQXwSXzFYI6d1G9ZmnEw2Ywap4QGexPrAukiTZ45134 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ef1lX6eeTazOuASa74KDuc9g0fkYpHvij2y4RIZMMmkz37AeF90145 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /klqWOeY3owjLQQSqXQnoe2pau5yzOs8QycR4PXQP5NdVi4JxG78167 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wxqbZ3VS7sVdvNUHk18PmnRbCcKPcLv71qq2qglMf90172 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImI1RUZITlhiVlU5eW5malZkQkZZd1E9PSIsInZhbHVlIjoiK29qVEQxZEZYRlVoclJsdmxYTlBOZ0dNWTBPY3RWZVo2TUU0azc3S01UT1pQT2UwVG1CZXlmMngvcnN2R3RuSGw3dXJhTDhXRFl6Q2ZlSWZjUVFqR1dQWDh3NnZvTlZrTjZ6MHFkQU1QSWJzSzVGajM3MVIxT2dNZ0s1d3c5YWYiLCJtYWMiOiIyMDE0YzAyZGM0NmEwY2Y2M2Q3MjI0ZGJjMjE1MWUwNDZlNmQ0Y2QzMDA3MjliMzRiNTRjZTc3MjRhNzk1ZTg0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFPN2xhYWJmUzgzUjJsQTlNdVVHd2c9PSIsInZhbHVlIjoicjFPcjVkby9CSm12dU54bFFEczdOeWkrenhuNkpuajdhTWZQWWZTdWpjK0N3V1dMRXR3dm5lZnR5TnYrTUdXM2hTNU5ZaDcxWXhsUHVvejhZei8rTkt2blNKbWdsTHdwWXJ5ZTdoejlKcVFMdFFacUNjaHhTRFAwWThndW1RbUciLCJtYWMiOiJmYTMyYTM2OTlkMjU0ZjAwZTEwMGRkNWY0YzkzYjgxZmNkMGJmZDY2NjNmNzAyOWRlNTg3OTY5OTI0ODc3N2U4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://zx.nhyyupvw.es/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /opXqWeRCU3gABxRp66BNwUjMDD5T3sijFkmXtj2T1QKxgeT0luJftHef191 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /kl8lWMPmK7IeRMlQKtLCMaLANqd4uoph3DKxSdIibEjdpfxZJqHwab221 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mno5pkoOS1ZmHnC63KYOUG6z8UAcECMeOGhCuDvzij0FeDGQCvGTIQKaHdmZZWCvAuv220 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /opkMSbL6M9fLMQXwSXzFYI6d1G9ZmnEw2Ywap4QGexPrAukiTZ45134 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ajsPH8p5K36UUluO3xYB5ue8P7HcSILuwrngWrMCM0kWrF0jcgKz4 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wxiAiZUN09zeMhcs2taSdstyPCNIsMOS8mnZX34130 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ij5JAyHeJDhpnRG4qpaOwqMtG3DhhnbcgXxyqASGklP7LpT8KKHTGxSYHw74Uef206 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wxqbZ3VS7sVdvNUHk18PmnRbCcKPcLv71qq2qglMf90172 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /op5jr0Ze7Fyy3RZsnMoUQKevPOhthwOtuv250cvmjtdN8gTyFY7DGHxltWgmZPJ1ef234 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /klqWOeY3owjLQQSqXQnoe2pau5yzOs8QycR4PXQP5NdVi4JxG78167 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /uvJUcHVsbtOcTPtMqsqtXcaOUESlVgUmDLn679VPzaa4mYHLCoR4Y7YoxXAmncMgh260 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQEAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ef1lX6eeTazOuASa74KDuc9g0fkYpHvij2y4RIZMMmkz37AeF90145 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /opXqWeRCU3gABxRp66BNwUjMDD5T3sijFkmXtj2T1QKxgeT0luJftHef191 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ij5JAyHeJDhpnRG4qpaOwqMtG3DhhnbcgXxyqASGklP7LpT8KKHTGxSYHw74Uef206 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /op5jr0Ze7Fyy3RZsnMoUQKevPOhthwOtuv250cvmjtdN8gTyFY7DGHxltWgmZPJ1ef234 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /uvJUcHVsbtOcTPtMqsqtXcaOUESlVgUmDLn679VPzaa4mYHLCoR4Y7YoxXAmncMgh260 HTTP/1.1Host: zx.nhyyupvw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InpEZHBVblY4ZWtrTis2RFU5NUNRZVE9PSIsInZhbHVlIjoiU0ZEYTY5VVd0OWxYY1ByUk1qMytUa2kzUWZ0d2Z2T1BNL2MydXRzc0IvZjB4RC85cG1NOEc2TlBiOGRzMFJkd2sxVE82bGc2MmxKTlBmb3d0Qytkd0VMNmhhcFc3TEwyRkpMTmpWNTM5akl6aHE2T01xQzBlTWxSTGxydUdnRnkiLCJtYWMiOiJkZTk2MzAxMjFlYTQzZGZhMjkwMjJiNWVjODJkYzU0MTBkNWZhYTVlZjVkNTZkMGMwNTY4NWFmYzY0ZDUxZGU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpnWDFnMml2TEFac1hkdUtRcEJURUE9PSIsInZhbHVlIjoiUTZzTGNkcm1HaEV0dmtjY1pkbkFYQjdUYVlFTkwyQ0ZkZVBzWDVUWVZEajZuNmxiS2UrV3hoQ0lHSk9kajZpQUhZV1NGcU9DV3BmSXBoZy94T0tkNXhWYWYwYXk1NUtSQkZFeGhnRXdKeWd5dnc3UDBVdUp0QllnNThEdXhCdWgiLCJtYWMiOiI4OWJmNjdmYTcxZjRlZjRlZjFiNmQyZDcwZDI3OWJhNWI4MDUxZGFhZTA4OWFiN2RmMTI2NzM5Y2JjM2UxMGM5IiwidGFnIjoiIn0%3D

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lsems.gravityzone.bitdefender.com
Source: global traffic	DNS traffic detected: DNS query: api-bd.linkscan.io
Source: global traffic	DNS traffic detected: DNS query: email.friendbuy-mail.com
Source: global traffic	DNS traffic detected: DNS query: 538-kadoma.trakcid.com
Source: global traffic	DNS traffic detected: DNS query: track.salesflare.com
Source: global traffic	DNS traffic detected: DNS query: api.salesflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: email.double.serviceautopilot.com
Source: global traffic	DNS traffic detected: DNS query: zx.nhyyupvw.es
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: 3ghu.nmpjkg.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com

Source: unknown

HTTP traffic detected: POST /devices HTTP/1.1Host: api.salesflare.comConnection: keep-aliveContent-Length: 2sec-ch-ua-platform: "Windows"Authorization: Bearer I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://538-kadoma.trakcid.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://538-kadoma.trakcid.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-guploader-uploadid: AKDAyIv0kEuJbb-GvMWWWIUmqsVZ9IcVuvnzPk-4OY_lhZSSizk1vGYxpB-Ds3WDQvktapN0expires: Mon, 24 Mar 2025 14:22:03 GMTdate: Mon, 24 Mar 2025 13:22:03 GMTcache-control: public, max-age=3600last-modified: Mon, 20 Jan 2025 09:27:00 GMTetag: "35b50977890c59dd87536447601ff3d9"x-goog-generation: 1737365220799885x-goog-metageneration: 1x-goog-stored-content-encoding: identityx-goog-stored-content-length: 2016content-type: text/htmlx-goog-hash: crc32c=Xo/u5A==x-goog-hash: md5=NbUJd4kMWd2HU2RHYB/z2Q==x-goog-storage-class: STANDARDaccept-ranges: bytesContent-Length: 2016server: UploadServervia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: application/json; charset=utf-8vary: originaccess-control-allow-credentials: trueaccess-control-expose-headers: WWW-Authenticate,Server-Authorizationcache-control: no-cachex-cloud-trace-context: e98c7fbd5c71c58001afdde1ea289e0adate: Mon, 24 Mar 2025 13:22:04 GMTserver: Google FrontendContent-Length: 60Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: application/json; charset=utf-8vary: originaccess-control-allow-credentials: trueaccess-control-expose-headers: WWW-Authenticate,Server-Authorizationcache-control: no-cachex-cloud-trace-context: 6bf4bbcff2e98e88517cb4f5a12c2c3fdate: Mon, 24 Mar 2025 13:22:08 GMTserver: Google FrontendContent-Length: 60Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: application/json; charset=utf-8vary: originaccess-control-allow-credentials: trueaccess-control-expose-headers: WWW-Authenticate,Server-Authorizationcache-control: no-cachex-cloud-trace-context: 4cbda8277413224a2f0d787ef0e7ca41date: Mon, 24 Mar 2025 13:22:09 GMTserver: Google FrontendContent-Length: 60Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Mar 2025 13:22:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KPkZxzVpMToDgQzsAnv30V7Ox2khSiVSermLqHpTnyiRrNJxOJktAxsu9JXNNl24xp9lXHvBWvCilejK27GMlgdWg3Q4VP5AsxNvSNpO9FYkjGlXr82IrAN6mTrlSC%2BtDJ6V"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=10264&min_rtt=10196&rtt_var=3872&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2052&delivery_rate=279325&cwnd=244&unsent_bytes=0&cid=73011851cd2819d9&ts=276&x=0"Server: cloudflareCF-RAY: 92567a430f6542b0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=98017&min_rtt=97719&rtt_var=21066&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=1713&delivery_rate=37764&cwnd=232&unsent_bytes=0&cid=3529176cd3ef7ae0&ts=706&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Mar 2025 13:22:30 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: EXPIREDAge: 45Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FpCa8x9RsBG2HNC1GMIVUhv%2BXMk%2Bv%2F7ehltl93pN2oyXW%2B7qDyxyuOVx8RZ7UG34QqNGqV%2BOrFP3hmHRI7%2BCjPmQtTYWqFmHIOk%2BI9GL%2FLBCuDfchQEVnpF0uvAEw8xFjmwc"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingserver-timing: cfL4;desc="?proto=TCP&rtt=9877&min_rtt=9790&rtt_var=3733&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2237&delivery_rate=290909&cwnd=212&unsent_bytes=0&cid=4bc31f65d8fcd778&ts=33&x=0"Cache-Control: max-age=14400Server: cloudflareCF-RAY: 92567a4bdbd78172-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=102907&min_rtt=101649&rtt_var=23336&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1899&delivery_rate=35320&cwnd=251&unsent_bytes=0&cid=8b98e09cbdb75c9c&ts=436&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Mar 2025 13:22:31 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aYlxLvN2ET3YK4hghMmgeyyTfaPx9wEPn3BfXEuEytGiM%2FFLrUzvL0R5%2BiqxNTprg4TOC6UsNeSZTconTwS4%2FRQhbP0nYTbUtpdihC1l1U9i5jIU96aqC%2BP5liQdIXx6Dgmq"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=9869&min_rtt=9765&rtt_var=3736&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2063&delivery_rate=291653&cwnd=235&unsent_bytes=0&cid=d3c5f14cd83b4076&ts=485&x=0"Server: cloudflareCF-RAY: 92567a513bab0f83-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=97113&min_rtt=96310&rtt_var=21525&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1726&delivery_rate=37728&cwnd=221&unsent_bytes=0&cid=a9b15586b06aae9c&ts=909&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Mar 2025 13:22:35 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BaQCVsq1DR7GsyDFXpC4e7QhkaJSKBIKqn3eXyOKojfX1z6%2FphiwBnF1zG1OgOiq%2BHgWcid5QiEwc%2BZrTSJGFmrDp28S7P0Tpyf2WZ9NQv%2BnPe%2Fr2JkEz1KeJgRyugOVfWep"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=9703&min_rtt=9659&rtt_var=3654&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2063&delivery_rate=294854&cwnd=249&unsent_bytes=0&cid=475b2a2500487b4c&ts=219&x=0"Server: cloudflareCF-RAY: 92567a6a9a08134a-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=102136&min_rtt=100227&rtt_var=24022&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=1726&delivery_rate=35123&cwnd=232&unsent_bytes=0&cid=4a8780a303e26cd5&ts=646&x=0"

Source: chromecache_90.2.dr	String found in binary or memory: http://github.com/fent/randexp.js/raw/master/LICENSE
Source: chromecache_136.2.dr	String found in binary or memory: https://538-kadoma.trakcid.com/?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOC
Source: chromecache_111.2.dr	String found in binary or memory: https://app.salesflare.com/#/signup/?campaign=
Source: chromecache_111.2.dr	String found in binary or memory: https://app.salesflare.com/#/signup/?campaign=-trackinglinks-landingpage
Source: chromecache_86.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/
Source: chromecache_136.2.dr	String found in binary or memory: https://email.friendbuy-mail.com/ls/click?upn=u001.cLv6DfAR7vFo5oY-2FqNn1ouEQnV2mDIj7j69roW5D9YFmBFw
Source: chromecache_139.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:100
Source: chromecache_111.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:400
Source: chromecache_139.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Raleway:400
Source: chromecache_139.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:100
Source: chromecache_103.2.dr, chromecache_145.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
Source: chromecache_103.2.dr, chromecache_145.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
Source: chromecache_103.2.dr, chromecache_145.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
Source: chromecache_103.2.dr, chromecache_145.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
Source: chromecache_103.2.dr, chromecache_145.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
Source: chromecache_83.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyC0ITw.woff2)
Source: chromecache_83.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCAIT5lu.woff2)
Source: chromecache_83.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCIIT5lu.woff2)
Source: chromecache_83.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCMIT5lu.woff2)
Source: chromecache_83.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCkIT5lu.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBGEe.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBGEe.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBGEe.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3KUBGEe.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3OUBGEe.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBGEe.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBGEe.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBGEe.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://github.com/fent)
Source: chromecache_134.2.dr	String found in binary or memory: https://github.com/getsentry/sentry-javascript
Source: chromecache_111.2.dr	String found in binary or memory: https://github.com/sindresorhus/prepend-http/blob/040579fb1271df6232dd96a7600c9efb1510eb47/index.js
Source: chromecache_123.2.dr	String found in binary or memory: https://storage.googleapis.com/track.salesflare.com/actual_flare.js
Source: chromecache_136.2.dr	String found in binary or memory: https://storage.googleapis.com/track.salesflare.com/provider.html?xdm_e=https%3A%2F%2F538-kadoma.tra
Source: chromecache_111.2.dr	String found in binary or memory: https://track.salesflare.com/flare.js
Source: chromecache_86.2.dr	String found in binary or memory: https://track.salesflare.com/flareprovider.js
Source: chromecache_92.2.dr	String found in binary or memory: https://www.target.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.251.40.100:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.49:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.132.107:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.132.107:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.68:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.73.226:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.150:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.254.174:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.254.174:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.229:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.106:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.73.226:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.180.34:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.155:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.5.189:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.15.124:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.102.239.211:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.96:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.96:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.113.4:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.124.91:443 -> 192.168.2.4:49825 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5844_1318408739

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5844_1318408739

Jump to behavior

Source: classification engine

Classification label: mal100.phis.evad.win@26/122@56/26

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,6054834833030071777,5999505531601158188,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,6054834833030071777,5999505531601158188,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Malware Analysis System Evasion

Yara detected AntiDebug via timestamp check

Source: Yara match	File source: 2.8.d.script.csv, type: HTML
Source: Yara match	File source: 3.18..script.csv, type: HTML
Source: Yara match	File source: 3.19..script.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://zx.nhyyupvw.es/klqWOeY3owjLQQSqXQnoe2pau5yzOs8QycR4PXQP5NdVi4JxG78167	100%	Avira URL Cloud	malware
https://email.friendbuy-mail.com/ls/click?upn=u001.cLv6DfAR7vFo5oY-2FqNn1ouEQnV2mDIj7j69roW5D9YFmBFw	0%	Avira URL Cloud	safe
https://zx.nhyyupvw.es/op5jr0Ze7Fyy3RZsnMoUQKevPOhthwOtuv250cvmjtdN8gTyFY7DGHxltWgmZPJ1ef234	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/ij5JAyHeJDhpnRG4qpaOwqMtG3DhhnbcgXxyqASGklP7LpT8KKHTGxSYHw74Uef206	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/abHzet6HTUrs93gvcd30	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/GDSherpa-regular.woff2	100%	Avira URL Cloud	malware
https://track.salesflare.com/flareprovider.js	0%	Avira URL Cloud	safe
https://zx.nhyyupvw.es/lmMtJNHRXQnXLdEOjRHqk01QBxHw6YoRwqNUeEF8K0J38y0pyTgfq	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/GDSherpa-vf2.woff2	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/mno5pkoOS1ZmHnC63KYOUG6z8UAcECMeOGhCuDvzij0FeDGQCvGTIQKaHdmZZWCvAuv220	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/ef1lX6eeTazOuASa74KDuc9g0fkYpHvij2y4RIZMMmkz37AeF90145	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/GDSherpa-regular.woff	100%	Avira URL Cloud	malware
https://app.salesflare.com/#/signup/?campaign=	0%	Avira URL Cloud	safe
https://track.salesflare.com/flare.js	0%	Avira URL Cloud	safe
https://lsems.gravityzone.bitdefender.com/index.css	0%	Avira URL Cloud	safe
https://538-kadoma.trakcid.com/favicon.ico	0%	Avira URL Cloud	safe
https://email.double.serviceautopilot.com/c/eJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg	0%	Avira URL Cloud	safe
https://app.salesflare.com/#/signup/?campaign=-trackinglinks-landingpage	0%	Avira URL Cloud	safe
https://zx.nhyyupvw.es/GDSherpa-bold.woff	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/343OzJOFth6uy5Ia0LQytVklAsRW9F7pMTi8489110	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/wxqbZ3VS7sVdvNUHk18PmnRbCcKPcLv71qq2qglMf90172	100%	Avira URL Cloud	malware
https://3ghu.nmpjkg.ru/chiriya@vhhyk0f	0%	Avira URL Cloud	safe
https://538-kadoma.trakcid.com/?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOC	0%	Avira URL Cloud	safe
https://zx.nhyyupvw.es/GDSherpa-vf.woff2	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/opXqWeRCU3gABxRp66BNwUjMDD5T3sijFkmXtj2T1QKxgeT0luJftHef191	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/ajsPH8p5K36UUluO3xYB5ue8P7HcSILuwrngWrMCM0kWrF0jcgKz4	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/uvJUcHVsbtOcTPtMqsqtXcaOUESlVgUmDLn679VPzaa4mYHLCoR4Y7YoxXAmncMgh260	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/favicon.ico	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/kl8lWMPmK7IeRMlQKtLCMaLANqd4uoph3DKxSdIibEjdpfxZJqHwab221	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/wxiAiZUN09zeMhcs2taSdstyPCNIsMOS8mnZX34130	100%	Avira URL Cloud	malware
https://lsems.gravityzone.bitdefender.com/manifest.json	0%	Avira URL Cloud	safe
https://email.friendbuy-mail.com/ls/click?upn=u001.cLv6DfAR7vFo5oY-2FqNn1ouEQnV2mDIj7j69roW5D9YFmBFwPhHpDSZmf-2B3Pr25NKH1kkrAtv-2FXYlYHDcjRTHmkWY1isyzqTHOYSV2VdQ1tT1G8-2FNMDl8wCw4SYq3K-2F-2FiCbQ7dDyP5dZoLD-2FOxtt8eFMBYOTS0pk89J8UmvCWjzbPwK2xEcw4XEiLFMCga6U0GFvQoOCb0P85sJVWK2Uml3XcdplD23kW-2FTxE-2BtGlDca1HjLRLdUKSNEAochyK-2BchY8B8vmew2v65f73My9ah-2BrdDnS6EIzE4TkvMhxdRHCCReZDVmaDqbPzw7053nhs23dod2YDSiaNB84g8YaMUKurnp9p1y-2B1nQpZebeALMEbnVDu6tTmFR7-2FHyGAHsZk61FyHh9uMQKB5L-2BtyOwTzWn7KvQSyyj3dH1rO4cxBBiWvhshRwgiYR7P05IvjezWCT32bX-2BjQB9JYGnHCuTnaAvsCLBHqTRV-2Bn2Hi3bm3nP1-2Baf7Epl-2FSvdYLY6KlQgLtPuXok3CXKypQBjPnRjTQJI-2BLeqRURlVbUeZHSlyws8Vwyao9B57spuIqsg93t3fmhWl9DmdgmDC4XLsl-2B3GEjzzUpMaNfhpwVuK0PSOtmvx-2F38AbYYESVomxnmKLL-2BOKderogjR3e-2Bpxu1MnWhQI-2Bw-3D-3DW0qv_4pihHygNSB0r9RfW0d44OGid9KPtmw14Y7-2FMHyDwcVW3HSjtuwGFBnBjiQG3-2Fb3urCctiPuIQjHAcBM1R6iFYpm7MuQ2WuMW6LagnpHoXYyjCGCl74vz-2FIqMsuMFvpwGAHIATwDXjaOGIaa8JZk1leLIY5Bb4cDMR5o0OowCLV1fOiEjRPd9ecLAxnTxFow1	0%	Avira URL Cloud	safe
https://zx.nhyyupvw.es/ozbjrYHayK7TO2Pn7G0W88tFZi6iwm6sjvrUMnsl	100%	Avira URL Cloud	malware
https://zx.nhyyupvw.es/GDSherpa-bold.woff2	100%	Avira URL Cloud	malware
https://lsems.gravityzone.bitdefender.com/favicon.ico	0%	Avira URL Cloud	safe
https://lsems.gravityzone.bitdefender.com/static/css/main.3dfe9f5e.css	0%	Avira URL Cloud	safe
https://lsems.gravityzone.bitdefender.com/static/js/main.d62e4927.js	0%	Avira URL Cloud	safe
https://zx.nhyyupvw.es/34AO6pnkJImzBIwxxy8Ta18916	100%	Avira URL Cloud	malware

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.1.229	true	false	high
api-bd.linkscan.io	13.249.91.49	true	false	unknown
zx.nhyyupvw.es	172.67.162.155	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
developers.cloudflare.com	104.16.2.189	true	false	high
d3rb3qlp6ej74d.cloudfront.net	13.249.91.19	true	false	unknown
538-kadoma.trakcid.com	34.149.73.226	true	false	unknown
github.com	140.82.113.4	true	false	high
mailgun.org	34.102.239.211	true	false	high
3ghu.nmpjkg.ru	104.21.112.1	true	false	unknown
code.jquery.com	151.101.130.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
d1b13yb8esv0x1.cloudfront.net	18.173.132.107	true	false	unknown
track.salesflare.com	172.66.43.150	true	false	high
www.google.com	142.251.40.100	true	false	high
d19d360lklgih4.cloudfront.net	18.164.124.96	true	false	high
objects.githubusercontent.com	185.199.109.133	true	false	high
api.salesflare.com	35.186.254.174	true	false	high
email.friendbuy-mail.com	unknown	unknown	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	high
lsems.gravityzone.bitdefender.com	unknown	unknown	false	high
email.double.serviceautopilot.com	unknown	unknown	false	high
ok4static.oktacdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7	false		high
https://zx.nhyyupvw.es/GDSherpa-regular.woff2	true	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/lmMtJNHRXQnXLdEOjRHqk01QBxHw6YoRwqNUeEF8K0J38y0pyTgfq	true	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/op5jr0Ze7Fyy3RZsnMoUQKevPOhthwOtuv250cvmjtdN8gTyFY7DGHxltWgmZPJ1ef234	true	Avira URL Cloud: malware	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://zx.nhyyupvw.es/abHzet6HTUrs93gvcd30	true	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/klqWOeY3owjLQQSqXQnoe2pau5yzOs8QycR4PXQP5NdVi4JxG78167	true	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/GDSherpa-vf2.woff2	true	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/ij5JAyHeJDhpnRG4qpaOwqMtG3DhhnbcgXxyqASGklP7LpT8KKHTGxSYHw74Uef206	true	Avira URL Cloud: malware	unknown
https://track.salesflare.com/flareprovider.js	false	Avira URL Cloud: safe	unknown
https://zx.nhyyupvw.es/ef1lX6eeTazOuASa74KDuc9g0fkYpHvij2y4RIZMMmkz37AeF90145	true	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/GDSherpa-regular.woff	true	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/mno5pkoOS1ZmHnC63KYOUG6z8UAcECMeOGhCuDvzij0FeDGQCvGTIQKaHdmZZWCvAuv220	true	Avira URL Cloud: malware	unknown
https://538-kadoma.trakcid.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://track.salesflare.com/flare.js	false	Avira URL Cloud: safe	unknown
https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css	false		high
https://lsems.gravityzone.bitdefender.com/index.css	false	Avira URL Cloud: safe	unknown
https://zx.nhyyupvw.es/wxqbZ3VS7sVdvNUHk18PmnRbCcKPcLv71qq2qglMf90172	true	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/GDSherpa-bold.woff	true	Avira URL Cloud: malware	unknown
https://3ghu.nmpjkg.ru/chiriya@vhhyk0f	false	Avira URL Cloud: safe	unknown
https://api.salesflare.com/contacts	false		high
https://zx.nhyyupvw.es/iSHROnSonGoT/	true		unknown
https://api.salesflare.com/devices/282019365	false		high
https://zx.nhyyupvw.es/343OzJOFth6uy5Ia0LQytVklAsRW9F7pMTi8489110	true	Avira URL Cloud: malware	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://email.double.serviceautopilot.com/c/eJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg	false	Avira URL Cloud: safe	unknown
https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css	false		high
https://api.salesflare.com/interactions/forward?instant=true	false		high
https://zx.nhyyupvw.es/GDSherpa-vf.woff2	false	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/ajsPH8p5K36UUluO3xYB5ue8P7HcSILuwrngWrMCM0kWrF0jcgKz4	false	Avira URL Cloud: malware	unknown
https://api.salesflare.com/devices	false		high
https://zx.nhyyupvw.es/opXqWeRCU3gABxRp66BNwUjMDD5T3sijFkmXtj2T1QKxgeT0luJftHef191	false	Avira URL Cloud: malware	unknown
https://cdn.jsdelivr.net/npm/@sentry/browser@5.29.2/build/bundle.min.js	false		high
https://zx.nhyyupvw.es/ozbjrYHayK7TO2Pn7G0W88tFZi6iwm6sjvrUMnsl	false	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/wxiAiZUN09zeMhcs2taSdstyPCNIsMOS8mnZX34130	false	Avira URL Cloud: malware	unknown
https://email.friendbuy-mail.com/ls/click?upn=u001.cLv6DfAR7vFo5oY-2FqNn1ouEQnV2mDIj7j69roW5D9YFmBFwPhHpDSZmf-2B3Pr25NKH1kkrAtv-2FXYlYHDcjRTHmkWY1isyzqTHOYSV2VdQ1tT1G8-2FNMDl8wCw4SYq3K-2F-2FiCbQ7dDyP5dZoLD-2FOxtt8eFMBYOTS0pk89J8UmvCWjzbPwK2xEcw4XEiLFMCga6U0GFvQoOCb0P85sJVWK2Uml3XcdplD23kW-2FTxE-2BtGlDca1HjLRLdUKSNEAochyK-2BchY8B8vmew2v65f73My9ah-2BrdDnS6EIzE4TkvMhxdRHCCReZDVmaDqbPzw7053nhs23dod2YDSiaNB84g8YaMUKurnp9p1y-2B1nQpZebeALMEbnVDu6tTmFR7-2FHyGAHsZk61FyHh9uMQKB5L-2BtyOwTzWn7KvQSyyj3dH1rO4cxBBiWvhshRwgiYR7P05IvjezWCT32bX-2BjQB9JYGnHCuTnaAvsCLBHqTRV-2Bn2Hi3bm3nP1-2Baf7Epl-2FSvdYLY6KlQgLtPuXok3CXKypQBjPnRjTQJI-2BLeqRURlVbUeZHSlyws8Vwyao9B57spuIqsg93t3fmhWl9DmdgmDC4XLsl-2B3GEjzzUpMaNfhpwVuK0PSOtmvx-2F38AbYYESVomxnmKLL-2BOKderogjR3e-2Bpxu1MnWhQI-2Bw-3D-3DW0qv_4pihHygNSB0r9RfW0d44OGid9KPtmw14Y7-2FMHyDwcVW3HSjtuwGFBnBjiQG3-2Fb3urCctiPuIQjHAcBM1R6iFYpm7MuQ2WuMW6LagnpHoXYyjCGCl74vz-2FIqMsuMFvpwGAHIATwDXjaOGIaa8JZk1leLIY5Bb4cDMR5o0OowCLV1fOiEjRPd9ecLAxnTxFow1	false	Avira URL Cloud: safe	unknown
https://lsems.gravityzone.bitdefender.com/manifest.json	false	Avira URL Cloud: safe	unknown
https://developers.cloudflare.com/favicon.png	false		high
https://zx.nhyyupvw.es/favicon.ico	false	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/uvJUcHVsbtOcTPtMqsqtXcaOUESlVgUmDLn679VPzaa4mYHLCoR4Y7YoxXAmncMgh260	false	Avira URL Cloud: malware	unknown
https://zx.nhyyupvw.es/kl8lWMPmK7IeRMlQKtLCMaLANqd4uoph3DKxSdIibEjdpfxZJqHwab221	false	Avira URL Cloud: malware	unknown
https://538-kadoma.trakcid.com/?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg&e=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce&cee=Y2hyaXN0b3BoZXIuYWxsYW5AcnByby50ZWNo	false		unknown
https://zx.nhyyupvw.es/GDSherpa-bold.woff2	true	Avira URL Cloud: malware	unknown
https://lsems.gravityzone.bitdefender.com/static/css/main.3dfe9f5e.css	false	Avira URL Cloud: safe	unknown
https://lsems.gravityzone.bitdefender.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://api.salesflare.com/token?email=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce	false		high
https://zx.nhyyupvw.es/nhsuodtrjswezsflaorchrctkqf0d3kspt4bu5kij8bveewseay?DIMQHXLNJCKRIDIUCNSQE	true		unknown
https://lsems.gravityzone.bitdefender.com/static/js/main.d62e4927.js	false	Avira URL Cloud: safe	unknown
https://zx.nhyyupvw.es/34AO6pnkJImzBIwxxy8Ta18916	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.jsdelivr.net/npm/	chromecache_86.2.dr	false		high
https://app.salesflare.com/#/signup/?campaign=	chromecache_111.2.dr	false	Avira URL Cloud: safe	unknown
https://email.friendbuy-mail.com/ls/click?upn=u001.cLv6DfAR7vFo5oY-2FqNn1ouEQnV2mDIj7j69roW5D9YFmBFw	chromecache_136.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/fent)	chromecache_90.2.dr	false		high
https://github.com/sindresorhus/prepend-http/blob/040579fb1271df6232dd96a7600c9efb1510eb47/index.js	chromecache_111.2.dr	false		high
https://app.salesflare.com/#/signup/?campaign=-trackinglinks-landingpage	chromecache_111.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/getsentry/sentry-javascript	chromecache_134.2.dr	false		high
https://538-kadoma.trakcid.com/?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOC	chromecache_136.2.dr	false	Avira URL Cloud: safe	unknown
https://www.target.com	chromecache_92.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.249.91.49	api-bd.linkscan.io	United States	16509	AMAZON-02US	false
34.110.180.34	unknown	United States	15169	GOOGLEUS	false
140.82.113.4	github.com	United States	36459	GITHUBUS	false
104.21.15.124	unknown	United States	13335	CLOUDFLARENETUS	false
104.16.5.189	unknown	United States	13335	CLOUDFLARENETUS	false
13.249.91.68	unknown	United States	16509	AMAZON-02US	false
172.66.40.106	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
104.21.112.1	3ghu.nmpjkg.ru	United States	13335	CLOUDFLARENETUS	false
185.199.109.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.21.96.1	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.67.162.155	zx.nhyyupvw.es	United States	13335	CLOUDFLARENETUS	false
104.16.2.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.66.43.150	track.salesflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.1.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
18.164.124.91	unknown	United States	3	MIT-GATEWAYSUS	false
13.249.91.19	d3rb3qlp6ej74d.cloudfront.net	United States	16509	AMAZON-02US	false
18.164.124.96	d19d360lklgih4.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
18.173.132.107	d1b13yb8esv0x1.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
142.251.40.100	www.google.com	United States	15169	GOOGLEUS	false
34.149.73.226	538-kadoma.trakcid.com	United States	2686	ATGS-MMD-ASUS	false
35.186.254.174	api.salesflare.com	United States	15169	GOOGLEUS	false
34.102.239.211	mailgun.org	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1647096
Start date and time:	2025-03-24 14:20:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.evad.win@26/122@56/26

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.64.110, 142.251.41.14, 142.250.65.227, 142.251.16.84, 142.250.65.206, 142.250.65.238, 142.250.176.206, 142.251.40.110, 142.251.40.170, 142.251.40.195, 23.203.176.221, 199.232.214.172, 142.250.81.234, 142.251.40.163, 142.250.65.251, 142.250.81.251, 142.250.65.219, 142.250.80.27, 142.250.80.59, 142.250.72.123, 142.251.41.27, 142.250.80.91, 142.250.176.219, 142.251.40.219, 142.251.32.123, 142.251.40.251, 142.250.80.123, 142.250.64.91, 142.251.35.187, 142.250.65.187, 142.250.64.123, 142.251.40.238, 142.250.65.202, 142.250.65.170, 142.250.64.106, 142.251.41.10, 142.251.40.138, 142.251.40.106, 142.250.80.10, 142.250.80.42, 142.250.72.106, 142.250.64.74, 142.251.35.170, 172.217.165.138, 142.251.32.106, 142.250.65.234, 142.250.80.35, 142.251.41.3, 184.31.69.3, 4.245.163.56
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, storage.googleapis.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzO

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	644
Entropy (8bit):	4.6279651077789685
Encrypted:	false
SSDEEP:	12:EEasTzWl6/Kjsg9GXlxDfwyf+/11C1+/MguB/KQGXlxD3EZAGxtw006cNOBkP1HJ:PaPlKKVkz1f+tPUgo/KQGbEZAuwz65GH
MD5:	541B83C2195088043337E4353B6FD60D
SHA1:	F09630596B6713217984785A64F6EA83E91B49C5
SHA-256:	2658B8874F0D2A12E8726DF78AC8954324C3BBE4695E66BDEF89195FDE64322F
SHA-512:	B2AE42BA9D3A63D3ACB179051B005F2589F147D94F044616AE5DC5705E873F16057C56934262841191263B4C35804EF188BD38CF69CCE0F4B2CF76C05F17B8AD
Malicious:	false
Reputation:	low
Preview:	RIFF\|...WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPHK....W`$....z..".Y..P}0;.PE..G..h....9.@..`..2.......=.T.....-3..ow....&......VP8 :...0........>m&.M.!"......i...O...(.........g....w...XG...

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 14:21:49.045152903 CET	53	50088	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:49.051100016 CET	53	52220	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:49.655329943 CET	53	58336	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:49.759232998 CET	53	55635	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:53.187122107 CET	54022	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:53.187325954 CET	63935	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:53.285615921 CET	53	54022	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:53.285979986 CET	53	63935	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:54.706475019 CET	53212	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:54.706870079 CET	49275	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:54.842971087 CET	53	49275	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:54.850322962 CET	53	53212	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:55.628606081 CET	53	62146	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:57.051702976 CET	51520	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:57.051906109 CET	62111	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:57.155750036 CET	53	62111	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:57.214576960 CET	53	51520	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:57.793051958 CET	54536	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:57.793204069 CET	57507	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:57.896295071 CET	53	57507	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:57.904392958 CET	53	54536	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:58.426968098 CET	65248	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:58.427207947 CET	52483	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:58.536869049 CET	53	65248	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:58.555967093 CET	53	52483	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:58.819619894 CET	59491	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:58.819744110 CET	63708	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:58.959120035 CET	53	59491	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:58.977555990 CET	53	63708	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:59.430893898 CET	56554	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:59.431075096 CET	56920	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:21:59.540180922 CET	53	56920	1.1.1.1	192.168.2.4
Mar 24, 2025 14:21:59.574769974 CET	53	56554	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:00.526316881 CET	50334	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:00.526457071 CET	65388	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:00.625838995 CET	53	59622	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:00.628952026 CET	53	65388	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:00.664881945 CET	53	50334	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:01.367448092 CET	53	58587	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:01.946670055 CET	59184	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:01.946670055 CET	62113	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:02.045175076 CET	53	57669	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:02.051563025 CET	53	62113	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:02.052016020 CET	53	59184	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:02.570894957 CET	55964	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:02.571021080 CET	63194	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:02.592406034 CET	61218	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:02.592745066 CET	55831	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:02.593600988 CET	49511	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:02.593875885 CET	55950	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:02.676430941 CET	53	55964	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:02.677443027 CET	53	63194	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:02.695513010 CET	53	61218	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:02.698718071 CET	53	55831	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:02.699711084 CET	53	55950	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:02.699903965 CET	53	49511	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:06.834804058 CET	53	63355	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:09.417387009 CET	62514	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:09.417583942 CET	51732	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:09.425854921 CET	56992	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:09.426003933 CET	49155	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:09.568162918 CET	53	51732	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:09.568192005 CET	53	49155	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:09.573127985 CET	53	62514	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:09.577512980 CET	53	56992	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:10.004916906 CET	54476	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:10.005258083 CET	57497	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:10.117455006 CET	53	54476	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:10.136320114 CET	53	57497	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:11.614039898 CET	52833	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:11.614259005 CET	62094	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:11.620904922 CET	64002	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:11.621073961 CET	64893	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:11.713634014 CET	53	52833	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:11.715791941 CET	53	62094	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:11.720356941 CET	53	64893	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:11.720382929 CET	53	64002	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:12.403867960 CET	54029	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:12.404417992 CET	55155	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:12.506875038 CET	53	54029	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:12.508970022 CET	53	55155	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:13.492285013 CET	62592	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:13.492434978 CET	60444	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:13.595369101 CET	53	62592	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:13.595832109 CET	53	60444	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:25.797898054 CET	51405	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:25.798218012 CET	49303	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:25.915441036 CET	53	49303	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:25.927308083 CET	53	59937	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:26.181737900 CET	53	51405	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:27.251183033 CET	55456	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:27.251332045 CET	64730	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:27.362016916 CET	53	64730	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:27.388694048 CET	53	55456	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:28.443063021 CET	58068	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:28.443552017 CET	53438	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:28.461972952 CET	54889	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:28.462342978 CET	65327	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:28.564259052 CET	53	54889	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:28.571459055 CET	53	65327	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:28.616889000 CET	53	53438	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:28.640981913 CET	53	58068	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:29.479769945 CET	55016	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:29.480103970 CET	57753	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:29.579509020 CET	53	57753	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:29.580845118 CET	53	55016	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:32.647213936 CET	56686	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:32.647569895 CET	60881	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:32.651164055 CET	58118	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:32.651436090 CET	51227	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:32.747432947 CET	53	60881	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:32.747998953 CET	53	56686	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:32.749727964 CET	53	58118	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:32.754057884 CET	53	51227	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:33.212456942 CET	56758	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:33.212650061 CET	58252	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:33.312002897 CET	53	56758	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:33.312338114 CET	53	58252	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:35.271440983 CET	62139	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:35.271584988 CET	61034	53	192.168.2.4	1.1.1.1
Mar 24, 2025 14:22:35.375473976 CET	53	61034	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:35.383625031 CET	53	62139	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:40.300864935 CET	53	57992	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:48.525569916 CET	53	63219	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:48.582441092 CET	53	63106	1.1.1.1	192.168.2.4
Mar 24, 2025 14:22:51.191198111 CET	138	138	192.168.2.4	192.168.2.255
Mar 24, 2025 14:22:51.647336006 CET	53	62372	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:55 UTC	2064	OUT	GET /scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQn [TRUNCATED] Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:55 UTC	586	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 880 Connection: close Date: Sun, 23 Mar 2025 14:22:53 GMT Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT ETag: "eba76f3b62e097867c0b5d15cf4315af" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 31f764b3af7bd53499e97e3e9c790b42.cloudfront.net (CloudFront), 1.1 5fa99ef375c5959c4f49f2be6d383208.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 X-Cache: Miss from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: GtXqv8Dc775CqsxzNDNYGhgj9N0BOCUR6ndQPV5-Jey31dwyPfQZkQ== Age: 82743
2025-03-24 13:21:55 UTC	880	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 63 61 6e 22 2f 3e 3c 6c 69 6e Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><meta name="description" content="Scan"/><lin

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:55 UTC	1962	OUT	GET /index.css HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhu [TRUNCATED] Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:55 UTC	583	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 134 Connection: close Date: Mon, 24 Mar 2025 12:52:27 GMT Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT ETag: "6748fbbc7fb3b016e371219d605b1239" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 0ed062928320c9569a09db8a928795e4.cloudfront.net (CloudFront), 1.1 7002831b3049ff1090da3f99329ed2b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: uTvUA5F2LFl7qpmcBoJtzM2kuTwZaGHBjDlVLat7Dc29gANRZKhCEw== Age: 1769
2025-03-24 13:21:55 UTC	134	IN	Data Raw: 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 32 32 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 61 6c 65 77 61 79 2c 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 0a 7d Data Ascii: body { background-color: #fff; color: #222; font-family: Raleway,HelveticaNeue,Helvetica Neue,Helvetica,Arial,sans-serif}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:55 UTC	1981	OUT	GET /static/css/main.3dfe9f5e.css HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhu [TRUNCATED] Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:55 UTC	606	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 4584 Connection: close Date: Mon, 24 Mar 2025 13:19:42 GMT Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT ETag: "8fc5a2f23a27198d9e865e74add2673c" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 fc5ebd2517d85e358aa686aaadd64c2a.cloudfront.net (CloudFront), 1.1 bf1882b87be33343d40479518a081ae2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: DgQe95lmVHO7VZ4zXm5TZg9JKvRVXTvLxuD6YY_GxYJp37GA3YnpeA== Age: 134
2025-03-24 13:21:55 UTC	4584	IN	Data Raw: 2e 73 63 61 6e 6e 65 72 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 65 72 2d 73 70 69 6e 20 31 2e 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 65 72 2d 73 70 69 6e 20 31 2e 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 62 6f 72 64 65 72 3a 32 70 78 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 37 65 6d 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 2e 35 65 6d 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 77 69 64 74 68 3a 37 65 6d 7d 2e 73 63 61 6e 2d 63 6c 65 61 6e 7b 64 69 73 70 6c 61 Data Ascii: .scanner{-webkit-animation:loader-spin 1.2s linear infinite;animation:loader-spin 1.2s linear infinite;border:2px solid;border-radius:50%;display:inline-block;height:7em;margin-bottom:3.5em;position:relative;vertical-align:top;width:7em}.scan-clean{displa

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:55 UTC	1965	OUT	GET /static/js/main.d62e4927.js HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhu [TRUNCATED] Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:55 UTC	624	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 266441 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 fdcbbd5c4c7c5e8b036965d289e584e2.cloudfront.net (CloudFront), 1.1 7d0657ff87fb72111ec5925ada0e3d80.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Date: Mon, 24 Mar 2025 12:44:07 GMT ETag: "f3dc5fda1f5ecbd5f39d4bf333d98130" Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: r2hEmDl5P9vWgA9Vy7TEbUpoDV1rpvCDMx6o9x0L1w5nG24kjzfvng== Age: 12656
2025-03-24 13:21:55 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 61 69 6e 2e 64 36 32 65 34 39 32 37 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 38 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 34 37 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 7d 6f 2e 72 65 73 65 74 57 61 72 6e 69 6e 67 43 61 63 68 65 3d 61 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6e 2c 61 2c 6f 2c 69 29 7b 69 66 28 69 21 3d 3d 72 29 7b 76 61 72 20 6c 3d 6e 65 77 20 45 72 72 6f 72 Data Ascii: /! For license information please see main.d62e4927.js.LICENSE.txt /!function(){var e={888:function(e,t,n){"use strict";var r=n(47);function a(){}function o(){}o.resetWarningCache=a,e.exports=function(){function e(e,t,n,a,o,i){if(i!==r){var l=new Error
2025-03-24 13:21:55 UTC	16384	IN	Data Raw: 2c 33 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3a 65 7d 76 61 72 20 6b 65 3d 6e 75 6c 6c 2c 78 65 3d 6e 75 6c 6c 2c 45 65 3d 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 5f 65 28 65 29 7b 69 66 28 65 3d 62 61 28 65 29 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 3d 74 79 70 65 6f 66 20 6b 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 32 38 30 29 29 3b 76 61 72 20 74 3d 65 2e 73 74 61 74 65 4e 6f 64 65 3b 74 26 26 28 74 3d 53 61 28 74 29 2c 6b 65 28 65 2e 73 74 61 74 65 4e 6f 64 65 2c 65 2e 74 79 70 65 2c 74 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 43 65 28 65 29 7b 78 65 3f 45 65 3f 45 65 2e 70 75 73 68 28 65 29 3a 45 65 3d 5b 65 5d 3a 78 65 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 4f 65 28 29 7b 69 66 28 78 65 29 7b 76 Data Ascii: ,3===e.nodeType?e.parentNode:e}var ke=null,xe=null,Ee=null;function _e(e){if(e=ba(e)){if("function"!==typeof ke)throw Error(o(280));var t=e.stateNode;t&&(t=Sa(t),ke(e.stateNode,e.type,t))}}function Ce(e){xe?Ee?Ee.push(e):Ee=[e]:xe=e}function Oe(){if(xe){v
2025-03-24 13:21:55 UTC	3017	IN	Data Raw: 6e 28 74 29 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 77 69 6e 64 6f 77 2c 74 3d 51 28 29 3b 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 2e 48 54 4d 4c 49 46 72 61 6d 65 45 6c 65 6d 65 6e 74 3b 29 7b 74 72 79 7b 76 61 72 20 6e 3d 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 74 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 7d 63 61 74 63 68 28 72 29 7b 6e 3d 21 31 7d 69 66 28 21 6e 29 62 72 65 61 6b 3b 74 3d 51 28 28 65 3d 74 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 29 2e 64 6f 63 75 6d 65 6e 74 29 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 70 72 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 Data Ascii: n(t))))}function dr(){for(var e=window,t=Q();t instanceof e.HTMLIFrameElement;){try{var n="string"===typeof t.contentWindow.location.href}catch(r){n=!1}if(!n)break;t=Q((e=t.contentWindow).document)}return t}function pr(e){var t=e&&e.nodeName&&e.nodeName.t
2025-03-24 13:21:56 UTC	16384	IN	Data Raw: 20 65 6d 70 74 69 65 64 20 65 6e 63 72 79 70 74 65 64 20 65 6e 64 65 64 20 65 72 72 6f 72 20 67 6f 74 50 6f 69 6e 74 65 72 43 61 70 74 75 72 65 20 69 6e 70 75 74 20 69 6e 76 61 6c 69 64 20 6b 65 79 44 6f 77 6e 20 6b 65 79 50 72 65 73 73 20 6b 65 79 55 70 20 6c 6f 61 64 20 6c 6f 61 64 65 64 44 61 74 61 20 6c 6f 61 64 65 64 4d 65 74 61 64 61 74 61 20 6c 6f 61 64 53 74 61 72 74 20 6c 6f 73 74 50 6f 69 6e 74 65 72 43 61 70 74 75 72 65 20 6d 6f 75 73 65 44 6f 77 6e 20 6d 6f 75 73 65 4d 6f 76 65 20 6d 6f 75 73 65 4f 75 74 20 6d 6f 75 73 65 4f 76 65 72 20 6d 6f 75 73 65 55 70 20 70 61 73 74 65 20 70 61 75 73 65 20 70 6c 61 79 20 70 6c 61 79 69 6e 67 20 70 6f 69 6e 74 65 72 43 61 6e 63 65 6c 20 70 6f 69 6e 74 65 72 44 6f 77 6e 20 70 6f 69 6e 74 65 72 4d 6f 76 65 Data Ascii: emptied encrypted ended error gotPointerCapture input invalid keyDown keyPress keyUp load loadedData loadedMetadata loadStart lostPointerCapture mouseDown mouseMove mouseOut mouseOver mouseUp paste pause play playing pointerCancel pointerDown pointerMove
2025-03-24 13:21:56 UTC	16384	IN	Data Raw: 64 61 74 65 51 75 65 75 65 29 26 26 28 74 3d 74 2e 73 68 61 72 65 64 2c 30 21 3d 3d 28 34 31 39 34 32 34 30 26 6e 29 29 29 7b 76 61 72 20 72 3d 74 2e 6c 61 6e 65 73 3b 6e 7c 3d 72 26 3d 65 2e 70 65 6e 64 69 6e 67 4c 61 6e 65 73 2c 74 2e 6c 61 6e 65 73 3d 6e 2c 79 74 28 65 2c 6e 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 44 6f 28 65 2c 74 29 7b 76 61 72 20 6e 3d 65 2e 75 70 64 61 74 65 51 75 65 75 65 2c 72 3d 65 2e 61 6c 74 65 72 6e 61 74 65 3b 69 66 28 6e 75 6c 6c 21 3d 3d 72 26 26 6e 3d 3d 3d 28 72 3d 72 2e 75 70 64 61 74 65 51 75 65 75 65 29 29 7b 76 61 72 20 61 3d 6e 75 6c 6c 2c 6f 3d 6e 75 6c 6c 3b 69 66 28 6e 75 6c 6c 21 3d 3d 28 6e 3d 6e 2e 66 69 72 73 74 42 61 73 65 55 70 64 61 74 65 29 29 7b 64 6f 7b 76 61 72 20 69 3d 7b 65 76 65 6e 74 54 69 6d 65 3a 6e Data Ascii: dateQueue)&&(t=t.shared,0!==(4194240&n))){var r=t.lanes;n\|=r&=e.pendingLanes,t.lanes=n,yt(e,n)}}function Do(e,t){var n=e.updateQueue,r=e.alternate;if(null!==r&&n===(r=r.updateQueue)){var a=null,o=null;if(null!==(n=n.firstBaseUpdate)){do{var i={eventTime:n
2025-03-24 13:21:56 UTC	15202	IN	Data Raw: 29 2c 6d 69 2e 6c 61 6e 65 73 7c 3d 6e 2c 44 75 7c 3d 6e 2c 65 2e 62 61 73 65 53 74 61 74 65 3d 21 30 29 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 5a 69 28 65 2c 74 29 7b 76 61 72 20 6e 3d 62 74 3b 62 74 3d 30 21 3d 3d 6e 26 26 34 3e 6e 3f 6e 3a 34 2c 65 28 21 30 29 3b 76 61 72 20 72 3d 70 69 2e 74 72 61 6e 73 69 74 69 6f 6e 3b 70 69 2e 74 72 61 6e 73 69 74 69 6f 6e 3d 7b 7d 3b 74 72 79 7b 65 28 21 31 29 2c 74 28 29 7d 66 69 6e 61 6c 6c 79 7b 62 74 3d 6e 2c 70 69 2e 74 72 61 6e 73 69 74 69 6f 6e 3d 72 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 6c 28 29 7b 72 65 74 75 72 6e 20 4f 69 28 29 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 7d 66 75 6e 63 74 69 6f 6e 20 74 6c 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 6e 73 28 65 29 3b 69 66 28 6e 3d 7b 6c 61 6e 65 3a 72 2c 61 Data Ascii: ),mi.lanes\|=n,Du\|=n,e.baseState=!0),t)}function Zi(e,t){var n=bt;bt=0!==n&&4>n?n:4,e(!0);var r=pi.transition;pi.transition={};try{e(!1),t()}finally{bt=n,pi.transition=r}}function el(){return Oi().memoizedState}function tl(e,t,n){var r=ns(e);if(n={lane:r,a
2025-03-24 13:21:56 UTC	12792	IN	Data Raw: 75 7c 3d 74 2e 6c 61 6e 65 73 2c 30 3d 3d 3d 28 6e 26 74 2e 63 68 69 6c 64 4c 61 6e 65 73 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 69 66 28 6e 75 6c 6c 21 3d 3d 65 26 26 74 2e 63 68 69 6c 64 21 3d 3d 65 2e 63 68 69 6c 64 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 31 35 33 29 29 3b 69 66 28 6e 75 6c 6c 21 3d 3d 74 2e 63 68 69 6c 64 29 7b 66 6f 72 28 6e 3d 4c 73 28 65 3d 74 2e 63 68 69 6c 64 2c 65 2e 70 65 6e 64 69 6e 67 50 72 6f 70 73 29 2c 74 2e 63 68 69 6c 64 3d 6e 2c 6e 2e 72 65 74 75 72 6e 3d 74 3b 6e 75 6c 6c 21 3d 3d 65 2e 73 69 62 6c 69 6e 67 3b 29 65 3d 65 2e 73 69 62 6c 69 6e 67 2c 28 6e 3d 6e 2e 73 69 62 6c 69 6e 67 3d 4c 73 28 65 2c 65 2e 70 65 6e 64 69 6e 67 50 72 6f 70 73 29 29 2e 72 65 74 75 72 6e 3d 74 3b 6e 2e 73 69 62 6c 69 6e 67 3d 6e Data Ascii: u\|=t.lanes,0===(n&t.childLanes))return null;if(null!==e&&t.child!==e.child)throw Error(o(153));if(null!==t.child){for(n=Ls(e=t.child,e.pendingProps),t.child=n,n.return=t;null!==e.sibling;)e=e.sibling,(n=n.sibling=Ls(e,e.pendingProps)).return=t;n.sibling=n
2025-03-24 13:21:56 UTC	6396	IN	Data Raw: 29 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 34 3a 72 3d 66 75 2c 61 3d 64 75 2c 66 75 3d 6e 2e 73 74 61 74 65 4e 6f 64 65 2e 63 6f 6e 74 61 69 6e 65 72 49 6e 66 6f 2c 64 75 3d 21 30 2c 70 75 28 65 2c 74 2c 6e 29 2c 66 75 3d 72 2c 64 75 3d 61 3b 62 72 65 61 6b 3b 63 61 73 65 20 30 3a 63 61 73 65 20 31 31 3a 63 61 73 65 20 31 34 3a 63 61 73 65 20 31 35 3a 69 66 28 21 58 6c 26 26 28 6e 75 6c 6c 21 3d 3d 28 72 3d 6e 2e 75 70 64 61 74 65 51 75 65 75 65 29 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 72 2e 6c 61 73 74 45 66 66 65 63 74 29 29 29 7b 61 3d 72 3d 72 2e 6e 65 78 74 3b 64 6f 7b 76 61 72 20 6f 3d 61 2c 69 3d 6f 2e 64 65 73 74 72 6f 79 3b 6f 3d 6f 2e 74 61 67 2c 76 6f 69 64 20 30 21 3d 3d 69 26 26 28 30 21 3d 3d 28 32 26 6f 29 7c 7c 30 21 3d 3d 28 34 26 6f 29 29 Data Ascii: ));break;case 4:r=fu,a=du,fu=n.stateNode.containerInfo,du=!0,pu(e,t,n),fu=r,du=a;break;case 0:case 11:case 14:case 15:if(!Xl&&(null!==(r=n.updateQueue)&&null!==(r=r.lastEffect))){a=r=r.next;do{var o=a,i=o.destroy;o=o.tag,void 0!==i&&(0!==(2&o)\|\|0!==(4&o))
2025-03-24 13:21:56 UTC	12792	IN	Data Raw: 3d 5a 6c 3b 69 66 28 74 3d 3d 3d 65 29 7b 5a 6c 3d 6e 75 6c 6c 3b 62 72 65 61 6b 7d 76 61 72 20 6e 3d 74 2e 73 69 62 6c 69 6e 67 3b 69 66 28 6e 75 6c 6c 21 3d 3d 6e 29 7b 6e 2e 72 65 74 75 72 6e 3d 74 2e 72 65 74 75 72 6e 2c 5a 6c 3d 6e 3b 62 72 65 61 6b 7d 5a 6c 3d 74 2e 72 65 74 75 72 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 78 75 28 65 29 7b 66 6f 72 28 3b 6e 75 6c 6c 21 3d 3d 5a 6c 3b 29 7b 76 61 72 20 74 3d 5a 6c 3b 74 72 79 7b 73 77 69 74 63 68 28 74 2e 74 61 67 29 7b 63 61 73 65 20 30 3a 63 61 73 65 20 31 31 3a 63 61 73 65 20 31 35 3a 76 61 72 20 6e 3d 74 2e 72 65 74 75 72 6e 3b 74 72 79 7b 61 75 28 34 2c 74 29 7d 63 61 74 63 68 28 75 29 7b 5f 73 28 74 2c 6e 2c 75 29 7d 62 72 65 61 6b 3b 63 61 73 65 20 31 3a 76 61 72 20 72 3d 74 2e 73 74 61 74 65 4e 6f Data Ascii: =Zl;if(t===e){Zl=null;break}var n=t.sibling;if(null!==n){n.return=t.return,Zl=n;break}Zl=t.return}}function xu(e){for(;null!==Zl;){var t=Zl;try{switch(t.tag){case 0:case 11:case 15:var n=t.return;try{au(4,t)}catch(u){_s(t,n,u)}break;case 1:var r=t.stateNo
2025-03-24 13:21:56 UTC	12792	IN	Data Raw: 3d 3d 3d 74 26 26 28 30 3d 3d 3d 28 31 26 65 2e 6d 6f 64 65 29 3f 74 3d 31 3a 28 74 3d 63 74 2c 30 3d 3d 3d 28 31 33 30 30 32 33 34 32 34 26 28 63 74 3c 3c 3d 31 29 29 26 26 28 63 74 3d 34 31 39 34 33 30 34 29 29 29 3b 76 61 72 20 6e 3d 74 73 28 29 3b 6e 75 6c 6c 21 3d 3d 28 65 3d 52 6f 28 65 2c 74 29 29 26 26 28 76 74 28 65 2c 74 2c 6e 29 2c 61 73 28 65 2c 6e 29 29 7d 66 75 6e 63 74 69 6f 6e 20 50 73 28 65 29 7b 76 61 72 20 74 3d 65 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 2c 6e 3d 30 3b 6e 75 6c 6c 21 3d 3d 74 26 26 28 6e 3d 74 2e 72 65 74 72 79 4c 61 6e 65 29 2c 4f 73 28 65 2c 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 54 73 28 65 2c 74 29 7b 76 61 72 20 6e 3d 30 3b 73 77 69 74 63 68 28 65 2e 74 61 67 29 7b 63 61 73 65 20 31 33 3a 76 61 72 20 72 3d 65 2e 73 Data Ascii: ===t&&(0===(1&e.mode)?t=1:(t=ct,0===(130023424&(ct<<=1))&&(ct=4194304)));var n=ts();null!==(e=Ro(e,t))&&(vt(e,t,n),as(e,n))}function Ps(e){var t=e.memoizedState,n=0;null!==t&&(n=t.retryLane),Os(e,n)}function Ts(e,t){var n=0;switch(e.tag){case 13:var r=e.s

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:57 UTC	1931	OUT	OPTIONS /scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS [TRUNCATED] Host: api-bd.linkscan.io Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-original-referer Origin: https://lsems.gravityzone.bitdefender.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://lsems.gravityzone.bitdefender.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:57 UTC	624	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 0 Connection: close Date: Mon, 24 Mar 2025 13:21:57 GMT Access-Control-Allow-Methods: OPTIONS,GET x-amzn-RequestId: 5a160111-6125-484d-aeb2-b450cb973553 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,X-Original-Referer x-amz-apigw-id: H7ticE7ADoEEDAQ= X-Cache: Miss from cloudfront Via: 1.1 0872a9ea1fab6d5bf06432bb20551d5c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: vx_LBRqOQ4Q7dT-GQdqph1gJ3tXPPXpOopJfZ6CXD3bUYZei42gdVg==

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:57 UTC	2010	OUT	GET /favicon.ico HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhu [TRUNCATED] Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:57 UTC	625	IN	HTTP/1.1 200 OK Content-Type: image/vnd.microsoft.icon Content-Length: 17542 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 65cdd88e2e6e21b095c2caf59292000c.cloudfront.net (CloudFront), 1.1 83e921b0368805d97d43167d106203f2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Date: Mon, 24 Mar 2025 13:19:43 GMT ETag: "fba58480381fefa10f97bd44c76c87c7" Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: l4PAI4p5SoxMSiH7p5CgLweZJzX5mzb8z6_R1sjFzrEfQEHAWXhumA== Age: 48820
2025-03-24 13:21:57 UTC	15990	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 01 00 20 00 68 04 00 00 46 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 ae 04 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 0e 00 00 30 30 00 00 01 00 20 00 a8 25 00 00 de 1e 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 39 00 00 ff a4 00 00 ff e5 00 00 ff f9 00 00 ff fb 00 00 ff ec 00 00 ff b5 00 00 ff 52 00 00 ff 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 0a 00 00 ff 9d 00 00 ff fe 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff c0 00 00 ff 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 07 00 00 ff bf 00 00 ff ff 00 Data Ascii: hF 600 %( @9R
2025-03-24 13:21:57 UTC	1552	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 06 00 00 ff 8f 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff e9 00 00 ff 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 5c 00 00 ff Data Ascii: T\

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:57 UTC	1951	OUT	GET /manifest.json HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhu [TRUNCATED] Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:57 UTC	590	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 290 Connection: close Date: Mon, 24 Mar 2025 13:19:44 GMT Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT ETag: "b0efba333d201884ace7da8c274c50d6" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 7e915a939f247f09de4523929f10bb0a.cloudfront.net (CloudFront), 1.1 93a5047483e29b6e88eb9b3ac46c575a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: 3kxhCLGrXLazBNYIRF1t_l3kHEcElSt4eY59SChV5e2b-23RVV7CKw== Age: 134
2025-03-24 13:21:57 UTC	290	IN	Data Raw: 7b 0a 20 20 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 20 22 4c 69 6e 6b 73 63 61 6e 22 2c 0a 20 20 22 6e 61 6d 65 22 3a 20 22 4c 69 6e 6b 73 63 61 6e 22 2c 0a 20 20 22 69 63 6f 6e 73 22 3a 20 5b 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 22 73 72 63 22 3a 20 22 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2c 0a 20 20 20 20 20 20 22 73 69 7a 65 73 22 3a 20 22 36 34 78 36 34 20 33 32 78 33 32 20 32 34 78 32 34 20 31 36 78 31 36 22 2c 0a 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 0a 20 20 20 20 7d 0a 20 20 5d 2c 0a 20 20 22 73 74 61 72 74 5f 75 72 6c 22 3a 20 22 2e 22 2c 0a 20 20 22 64 69 73 70 6c 61 79 22 3a 20 22 73 74 61 6e 64 61 6c 6f 6e 65 22 2c 0a 20 20 22 74 68 65 6d 65 5f 63 6f 6c 6f 72 22 3a 20 22 23 30 30 30 30 30 30 22 2c Data Ascii: { "short_name": "Linkscan", "name": "Linkscan", "icons": [ { "src": "favicon.ico", "sizes": "64x64 32x32 24x24 16x16", "type": "image/x-icon" } ], "start_url": ".", "display": "standalone", "theme_color": "#000000",

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:57 UTC	2029	OUT	GET /scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQn [TRUNCATED] Host: api-bd.linkscan.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" X-Original-Referer: unknown sec-ch-ua-mobile: ?0 Origin: https://lsems.gravityzone.bitdefender.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://lsems.gravityzone.bitdefender.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:58 UTC	562	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2995 Connection: close Date: Mon, 24 Mar 2025 13:21:58 GMT X-Amzn-Trace-Id: Root=1-67e15c76-625d8ab959b3f72a5114295a;Parent=7145057a9f5859e8;Sampled=0;Lineage=1:92f4b973:0 x-amzn-RequestId: 829ac4b1-6e34-4d9c-ac5f-4e4ae2e073cb Access-Control-Allow-Origin: * x-amz-apigw-id: H7tiiHlEDoEEDRw= X-Cache: Miss from cloudfront Via: 1.1 c49eddbbbee7a3b1464851f470bede1e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: Vv3Uzbh6A4E9bRH9Sh6yPEwDnhtwHj_eqqQ9g1h6FchrKrQ8cTznYg==
2025-03-24 13:21:58 UTC	2995	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 64 61 74 61 22 3a 7b 22 6f 72 69 67 69 6e 61 6c 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 65 6d 61 69 6c 2e 66 72 69 65 6e 64 62 75 79 2d 6d 61 69 6c 2e 63 6f 6d 2f 6c 73 2f 63 6c 69 63 6b 3f 75 70 6e 3d 75 30 30 31 2e 63 4c 76 36 44 66 41 52 37 76 46 6f 35 6f 59 2d 32 46 71 4e 6e 31 6f 75 45 51 6e 56 32 6d 44 49 6a 37 6a 36 39 72 6f 57 35 44 39 59 46 6d 42 46 77 50 68 48 70 44 53 5a 6d 66 2d 32 42 33 50 72 32 35 4e 4b 48 31 6b 6b 72 41 74 76 2d 32 46 58 59 6c 59 48 44 63 6a 52 54 48 6d 6b 57 59 31 69 73 79 7a 71 54 48 4f 59 53 56 32 56 64 51 31 74 54 31 47 38 2d 32 46 4e 4d 44 6c 38 77 43 77 34 53 59 71 33 4b 2d 32 46 2d 32 46 69 43 62 51 37 64 44 79 50 35 64 5a 6f 4c 44 2d 32 46 4f 78 74 74 38 65 46 4d Data Ascii: {"success":true,"data":{"originalUrl":"https://email.friendbuy-mail.com/ls/click?upn=u001.cLv6DfAR7vFo5oY-2FqNn1ouEQnV2mDIj7j69roW5D9YFmBFwPhHpDSZmf-2B3Pr25NKH1kkrAtv-2FXYlYHDcjRTHmkWY1isyzqTHOYSV2VdQ1tT1G8-2FNMDl8wCw4SYq3K-2F-2FiCbQ7dDyP5dZoLD-2FOxtt8eFM

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:58 UTC	1650	OUT	GET /ls/click?upn=u001.cLv6DfAR7vFo5oY-2FqNn1ouEQnV2mDIj7j69roW5D9YFmBFwPhHpDSZmf-2B3Pr25NKH1kkrAtv-2FXYlYHDcjRTHmkWY1isyzqTHOYSV2VdQ1tT1G8-2FNMDl8wCw4SYq3K-2F-2FiCbQ7dDyP5dZoLD-2FOxtt8eFMBYOTS0pk89J8UmvCWjzbPwK2xEcw4XEiLFMCga6U0GFvQoOCb0P85sJVWK2Uml3XcdplD23kW-2FTxE-2BtGlDca1HjLRLdUKSNEAochyK-2BchY8B8vmew2v65f73My9ah-2BrdDnS6EIzE4TkvMhxdRHCCReZDVmaDqbPzw7053nhs23dod2YDSiaNB84g8YaMUKurnp9p1y-2B1nQpZebeALMEbnVDu6tTmFR7-2FHyGAHsZk61FyHh9uMQKB5L-2BtyOwTzWn7KvQSyyj3dH1rO4cxBBiWvhshRwgiYR7P05IvjezWCT32bX-2BjQB9JYGnHCuTnaAvsCLBHqTRV-2Bn2Hi3bm3nP1-2Baf7Epl-2FSvdYLY6KlQgLtPuXok3CXKypQBjPnRjTQJI-2BLeqRURlVbUeZHSlyws8Vwyao9B57spuIqsg93t3fmhWl9DmdgmDC4XLsl-2B3GEjzzUpMaNfhpwVuK0PSOtmvx-2F38AbYYESVomxnmKLL-2BOKderogjR3e-2Bpxu1MnWhQI-2Bw-3D-3DW0qv_4pihHygNSB0r9RfW0d44OGid9KPtmw14Y7-2FMHyDwcVW3HSjtuwGFBnBjiQG3-2Fb3urCctiPuIQjHAcBM1R6iFYpm7MuQ2WuMW6LagnpHoXYyjCGCl74vz-2FIqMsuMFvpwGAHIATwDXjaOGIaa8JZk1leLIY5Bb4cDMR5o0OowCLV1fOiEjRPd9ecLAxnTxFow1 HTTP/1.1 Host: email.friendbuy-mail.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://lsems.gravityzone.bitdefender.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:59 UTC	879	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Content-Length: 514 Connection: close Server: nginx Date: Mon, 24 Mar 2025 13:21:59 GMT X-Robots-Tag: noindex, nofollow Location: https://538-kadoma.trakcid.com/?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg&e=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce&cee=Y2hyaXN0b3BoZXIuYWxsYW5AcnByby50ZWNo X-Cache: Miss from cloudfront Via: 1.1 43504ac56caa49011c8a16d1cb156142.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P2 X-Amz-Cf-Id: u6KTlMgn-SQ1tPtAQ7_hChhJvG1n3hAzYxaI4n_pjdvYzpTN09SUYg==
2025-03-24 13:21:59 UTC	514	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 35 33 38 2d 6b 61 64 6f 6d 61 2e 74 72 61 6b 63 69 64 2e 63 6f 6d 2f 3f 75 3d 68 74 74 70 3a 25 32 46 25 32 46 65 6d 61 69 6c 2e 64 6f 75 62 6c 65 2e 73 65 72 76 69 63 65 61 75 74 6f 70 69 6c 6f 74 2e 63 6f 6d 25 32 46 63 25 32 46 65 4a 77 45 77 4c 31 4f 77 7a 41 51 41 4f 43 6e 73 54 64 62 7a 76 6c 5f 38 4d 41 53 32 4a 41 6f 41 32 4c 7a 7a 35 31 69 4b 59 32 6a 4a 43 33 71 32 5f 50 56 63 64 5f 7a 39 75 6f 74 35 55 4b 2d 57 46 4b 69 34 47 53 46 69 59 35 45 41 46 57 45 64 6c 59 46 30 32 4c 42 34 48 6c 4c 35 43 49 45 78 7a 46 4e 33 6f 44 54 4a 6e 6a 50 38 5a 37 37 32 6c 73 71 6c 41 4e 4e 55 51 74 72 49 77 6e 6a 67 68 4a 42 6f 52 66 6b 74 56 61 56 43 6a 70 51 66 45 6b 74 55 6a 59 52 61 34 6e 6b 41 2d 56 47 75 Data Ascii: <a href="https://538-kadoma.trakcid.com/?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGu

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:59 UTC	1763	OUT	GET /scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQn [TRUNCATED] Host: api-bd.linkscan.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:59 UTC	560	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 74 Connection: close Date: Mon, 24 Mar 2025 13:21:59 GMT X-Amzn-Trace-Id: Root=1-67e15c77-1a7ad5294ae86beb2447895d;Parent=6a8df0a9acfa986c;Sampled=0;Lineage=1:92f4b973:0 x-amzn-RequestId: d7f8a91d-260c-469f-bbcf-e1b0b8354115 Access-Control-Allow-Origin: * x-amz-apigw-id: H7tiuFvajoEEcbA= X-Cache: Miss from cloudfront Via: 1.1 7002831b3049ff1090da3f99329ed2b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: EGMWlVsIQ6ehSb8gR7jV7Chy4DNm5dZ7qpf7yIZlzP-RTiV4aACDrg==
2025-03-24 13:21:59 UTC	74	IN	Data Raw: 7b 22 65 72 72 6f 72 54 79 70 65 22 3a 22 73 74 72 69 6e 67 22 2c 22 65 72 72 6f 72 4d 65 73 73 61 67 65 22 3a 22 49 6e 74 65 67 72 69 74 79 20 6d 61 74 63 68 20 66 61 69 6c 75 72 65 22 2c 22 74 72 61 63 65 22 3a 5b 5d 7d Data Ascii: {"errorType":"string","errorMessage":"Integrity match failure","trace":[]}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:21:59 UTC	1163	OUT	GET /?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg&e=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce&cee=Y2hyaXN0b3BoZXIuYWxsYW5AcnByby50ZWNo HTTP/1.1 Host: 538-kadoma.trakcid.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://lsems.gravityzone.bitdefender.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:21:59 UTC	747	IN	HTTP/1.1 200 OK x-guploader-uploadid: AKDAyIsvAgSAkLMmQl54N_B2PodJArFKibnI1GUT8SYraOtIKZA6TyO6nV2ytUq5PQ0a-St2 expires: Mon, 24 Mar 2025 14:21:59 GMT date: Mon, 24 Mar 2025 13:21:59 GMT cache-control: public, max-age=3600 last-modified: Mon, 20 Jan 2025 09:27:00 GMT etag: "78877e3ed39845f745b02a119900ec49" x-goog-generation: 1737365220556059 x-goog-metageneration: 1 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 6443 content-type: text/html x-goog-hash: crc32c=tv1Ghg== x-goog-hash: md5=eId+PtOYRfdFsCoRmQDsSQ== x-goog-storage-class: STANDARD accept-ranges: bytes Content-Length: 6443 server: UploadServer via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:21:59 UTC	473	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 74 72 61 63 6b 2e 73 61 6c 65 73 66 6c 61 72 65 2e 63 6f 6d 2f 66 6c 61 72 65 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 0a 20 20 20 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 Data Ascii: <html> <head> <title>Redirecting...</title> <script src="https://track.salesflare.com/flare.js"></script> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet"> </head> <body style="
2025-03-24 13:21:59 UTC	1220	IN	Data Raw: 68 65 61 64 69 6e 67 22 3e 57 61 6e 74 20 74 6f 20 74 72 61 63 6b 20 79 6f 75 72 20 65 6d 61 69 6c 73 20 75 73 69 6e 67 20 53 61 6c 65 73 66 6c 61 72 65 20 61 73 20 77 65 6c 6c 3f 3c 2f 68 31 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 34 38 70 78 3b 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 69 64 3d 22 74 72 69 61 6c 42 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 73 66 2d 62 75 74 74 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 70 70 2e 73 61 6c 65 73 66 6c 61 72 65 2e 63 6f 6d 2f 23 Data Ascii: heading">Want to track your emails using Salesflare as well?</h1> </div> <div style="display:flex; margin-top: 48px;"> <a id="trialButton" class="sf-button" href="https://app.salesflare.com/#
2025-03-24 13:21:59 UTC	1220	IN	Data Raw: 74 69 6f 6e 20 69 73 56 61 6c 69 64 28 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 76 61 72 73 2e 74 20 7c 7c 20 76 61 72 73 2e 65 20 7c 7c 20 21 76 61 72 73 2e 75 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 42 61 73 65 64 20 6f 6e 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 73 69 6e 64 72 65 73 6f 72 68 75 73 2f 70 72 65 70 65 6e 64 2d 68 74 74 70 2f 62 6c 6f 62 2f 30 34 30 35 37 39 66 62 31 32 37 31 64 66 36 32 33 32 64 64 39 36 61 37 36 30 30 63 39 65 66 62 31 35 31 30 65 62 34 37 2f 69 6e 64 65 78 2e 6a 73 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 73 61 6e 69 74 69 7a 65 55 52 4c 28 75 72 6c 29 20 7b 0a 0a 20 20 20 20 20 Data Ascii: tion isValid() { return vars.t \|\| vars.e \|\| !vars.u; } // Based on https://github.com/sindresorhus/prepend-http/blob/040579fb1271df6232dd96a7600c9efb1510eb47/index.js function sanitizeURL(url) {
2025-03-24 13:21:59 UTC	1220	IN	Data Raw: 20 20 64 65 63 6f 64 65 64 20 3d 20 75 6e 65 73 63 61 70 65 28 73 74 72 69 6e 67 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 65 72 72 6f 72 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 6d 2c 20 75 2c 20 6c 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6f 72 69 67 69 6e 61 6c 55 72 6c 20 3d 20 76 61 72 73 2e 75 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6f 72 69 67 69 6e 61 6c 55 72 6c 20 3d 3d 3d 20 75 Data Ascii: decoded = unescape(string); } return decoded; } window.onerror = function (m, u, l) { try { var originalUrl = vars.u; if (originalUrl === u
2025-03-24 13:21:59 UTC	1220	IN	Data Raw: 66 20 28 21 69 73 56 61 6c 69 64 55 72 6c 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6f 6d 61 69 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 67 69 6e 3b 20 2f 2f 20 67 65 74 20 74 68 65 20 70 72 6f 74 6f 63 6f 6c 20 61 6e 64 20 64 6f 6d 61 69 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2e 73 74 61 72 74 73 57 69 74 68 28 27 2f 73 27 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 6d 61 69 6e 20 2b 3d 20 27 2f 73 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 Data Ascii: f (!isValidUrl) { var domain = window.location.origin; // get the protocol and domain if (window.location.pathname.startsWith('/s')) { domain += '/s'; } window.location.hr
2025-03-24 13:21:59 UTC	1090	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2e 73 66 2d 62 75 74 74 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 75 70 70 65 72 63 61 73 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: text-align: center; } } .sf-button { margin:auto; text-transform: uppercase;

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:00 UTC	575	OUT	GET /flare.js HTTP/1.1 Host: track.salesflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://538-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:01 UTC	1200	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 13:22:01 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close x-guploader-uploadid: AKDAyIsEEhWAZQhlr3rjtluk5y32ovWrpdTNcshiAfickGtghtmS_qCeDJYocU0OqFH5AFdSNHclU04 x-goog-generation: 1721220840788064 x-goog-metageneration: 2 x-goog-stored-content-encoding: gzip x-goog-stored-content-length: 468 content-language: en x-goog-hash: crc32c=SndjCg== x-goog-hash: md5=uQ1qbcWz0Hk8yvnPYkH7uw== x-goog-storage-class: STANDARD expires: Mon, 24 Mar 2025 14:40:28 GMT Cache-Control: public, max-age=14400 last-modified: Wed, 17 Jul 2024 12:54:00 GMT vary: Accept-Encoding,Origin alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Age: 9693 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lE68uHTI15nHAbyRDSYwb9q20DX%2B3PgTF4ue0vhSxt8H9vD12B2Rd71V41KBGljRpjDQoBPsnun%2FoSD9pVOr%2FktnnyEnUsBmdb6lGRb5ppfm8h%2BZwEloVT5s2LDUJZglMZSNrAaE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15552000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 925679949d09c44d-EWR
2025-03-24 13:22:01 UTC	218	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 39 39 30 30 30 26 6d 69 6e 5f 72 74 74 3d 39 38 37 34 36 26 72 74 74 5f 76 61 72 3d 32 31 30 31 37 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 32 26 72 65 63 76 5f 62 79 74 65 73 3d 31 31 34 37 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 37 36 38 35 26 63 77 6e 64 3d 32 33 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 36 38 64 36 34 63 37 62 61 34 37 63 38 38 37 63 26 74 73 3d 32 36 37 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=99000&min_rtt=98746&rtt_var=21017&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1147&delivery_rate=37685&cwnd=232&unsent_bytes=0&cid=68d64c7ba47c887c&ts=267&x=0"
2025-03-24 13:22:01 UTC	949	IN	Data Raw: 33 61 65 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 73 63 72 69 70 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 73 63 72 69 70 74 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 74 72 61 63 6b 2e 73 61 6c 65 73 66 6c 61 72 65 2e 63 6f 6d 2f 61 63 74 75 61 6c 5f 66 6c 61 72 65 2e 6a 73 22 3b 66 6f 72 28 76 61 72 20 6c 6f 61 64 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2c 73 63 72 69 70 74 45 6c 65 6d 65 6e 74 73 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 2c 69 3d 30 3b 69 3c 73 63 72 69 70 74 45 6c 65 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 69 2b 2b Data Ascii: 3ae"use strict";var script=document.createElement("script");script.src="https://storage.googleapis.com/track.salesflare.com/actual_flare.js";for(var loadScriptElement,scriptElements=document.getElementsByTagName("script"),i=0;i<scriptElements.length;i++
2025-03-24 13:22:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:02 UTC	611	OUT	GET /token?email=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce HTTP/1.1 Host: api.salesflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://538-kadoma.trakcid.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://538-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:02 UTC	530	IN	HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin access-control-allow-origin: https://538-kadoma.trakcid.com access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache accept-ranges: bytes x-cloud-trace-context: ccef15d186c77578a9fb629d79ffca55 date: Mon, 24 Mar 2025 13:22:02 GMT server: Google Frontend Content-Length: 66 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:02 UTC	66	IN	Data Raw: 7b 22 74 72 61 63 6b 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 49 35 39 30 79 78 79 6b 65 2d 5a 36 4f 30 4d 6a 5f 5f 75 77 77 78 36 31 6d 4c 62 74 77 58 6d 5a 46 76 31 37 77 78 7a 50 2d 4e 37 37 4d 22 7d Data Ascii: {"tracking_token":"I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77M"}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:02 UTC	426	OUT	GET /token?email=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce HTTP/1.1 Host: api.salesflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:03 UTC	469	IN	HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache accept-ranges: bytes x-cloud-trace-context: 9be959e149b2289de91da474b8308886 date: Mon, 24 Mar 2025 13:22:03 GMT server: Google Frontend Content-Length: 66 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:03 UTC	66	IN	Data Raw: 7b 22 74 72 61 63 6b 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 49 35 39 30 79 78 79 6b 65 2d 5a 36 4f 30 4d 6a 5f 5f 75 77 77 78 36 31 6d 4c 62 74 77 58 6d 5a 46 76 31 37 77 78 7a 50 2d 4e 37 37 4d 22 7d Data Ascii: {"tracking_token":"I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77M"}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:02 UTC	612	OUT	GET /npm/@sentry/browser@5.29.2/build/bundle.min.js HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive Origin: https://storage.googleapis.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://storage.googleapis.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:03 UTC	769	IN	HTTP/1.1 200 OK Connection: close Content-Length: 65311 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=31536000, s-maxage=31536000, immutable Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: application/javascript; charset=utf-8 X-JSD-Version: 5.29.2 X-JSD-Version-Type: version ETag: W/"ff1f-tqCXvFcJJITCoIIqq76zHuvUrxQ" Accept-Ranges: bytes Age: 420128 Date: Mon, 24 Mar 2025 13:22:03 GMT X-Served-By: cache-fra-etou8220037-FRA, cache-lga21969-LGA X-Cache: HIT, MISS Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2025-03-24 13:22:03 UTC	16384	IN	Data Raw: 2f 2a 21 20 40 73 65 6e 74 72 79 2f 62 72 6f 77 73 65 72 20 35 2e 32 39 2e 32 20 28 36 62 34 66 33 30 34 29 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 67 65 74 73 65 6e 74 72 79 2f 73 65 6e 74 72 79 2d 6a 61 76 61 73 63 72 69 70 74 20 2a 2f 0a 76 61 72 20 53 65 6e 74 72 79 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 28 6e 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 6e 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 20 69 6e 20 6e 29 Data Ascii: /! @sentry/browser 5.29.2 (6b4f304) \| https://github.com/getsentry/sentry-javascript /var Sentry=function(t){var n=function(t,r){return(n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,n){t.__proto__=n}\|\|function(t,n){for(var r in n)
2025-03-24 13:22:03 UTC	16384	IN	Data Raw: 2c 6e 29 7b 76 61 72 20 72 2c 65 3b 69 66 28 74 26 26 63 74 5b 74 5d 29 74 72 79 7b 66 6f 72 28 76 61 72 20 69 3d 61 28 63 74 5b 74 5d 7c 7c 5b 5d 29 2c 6f 3d 69 2e 6e 65 78 74 28 29 3b 21 6f 2e 64 6f 6e 65 3b 6f 3d 69 2e 6e 65 78 74 28 29 29 7b 76 61 72 20 75 3d 6f 2e 76 61 6c 75 65 3b 74 72 79 7b 75 28 6e 29 7d 63 61 74 63 68 28 6e 29 7b 72 74 2e 65 72 72 6f 72 28 22 45 72 72 6f 72 20 77 68 69 6c 65 20 74 72 69 67 67 65 72 69 6e 67 20 69 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 20 68 61 6e 64 6c 65 72 2e 5c 6e 54 79 70 65 3a 20 22 2b 74 2b 22 5c 6e 4e 61 6d 65 3a 20 22 2b 52 28 75 29 2b 22 5c 6e 45 72 72 6f 72 3a 20 22 2b 6e 29 7d 7d 7d 63 61 74 63 68 28 74 29 7b 72 3d 7b 65 72 72 6f 72 3a 74 7d 7d 66 69 6e 61 6c 6c 79 7b 74 72 79 7b 6f 26 26 21 6f 2e Data Ascii: ,n){var r,e;if(t&&ct[t])try{for(var i=a(ct[t]\|\|[]),o=i.next();!o.done;o=i.next()){var u=o.value;try{u(n)}catch(n){rt.error("Error while triggering instrumentation handler.\nType: "+t+"\nName: "+R(u)+"\nError: "+n)}}}catch(t){r={error:t}}finally{try{o&&!o.
2025-03-24 13:22:03 UTC	16384	IN	Data Raw: 72 3d 74 2e 69 6e 74 65 67 72 61 74 69 6f 6e 73 2c 65 3d 5b 5d 3b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 29 29 7b 76 61 72 20 69 3d 72 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 6e 61 6d 65 7d 29 2c 6f 3d 5b 5d 3b 6e 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 2d 31 3d 3d 3d 69 2e 69 6e 64 65 78 4f 66 28 74 2e 6e 61 6d 65 29 26 26 2d 31 3d 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 74 2e 6e 61 6d 65 29 26 26 28 65 2e 70 75 73 68 28 74 29 2c 6f 2e 70 75 73 68 28 74 2e 6e 61 6d 65 29 29 7d 29 2c 72 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 2d 31 3d 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 74 2e 6e 61 6d 65 29 26 26 28 65 2e 70 75 73 68 28 74 29 2c 6f 2e 70 75 73 68 28 74 2e 6e 61 Data Ascii: r=t.integrations,e=[];if(Array.isArray(r)){var i=r.map(function(t){return t.name}),o=[];n.forEach(function(t){-1===i.indexOf(t.name)&&-1===o.indexOf(t.name)&&(e.push(t),o.push(t.name))}),r.forEach(function(t){-1===o.indexOf(t.name)&&(e.push(t),o.push(t.na
2025-03-24 13:22:03 UTC	16159	IN	Data Raw: 33 2a 72 3b 76 61 72 20 65 3d 44 61 74 65 2e 70 61 72 73 65 28 22 22 2b 6e 29 3b 72 65 74 75 72 6e 20 69 73 4e 61 4e 28 65 29 3f 59 3a 65 2d 74 7d 28 6f 2c 73 29 29 2c 21 30 29 7d 2c 6e 7d 28 29 2c 6a 6e 3d 57 28 29 2c 5f 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 26 26 74 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7c 7c 74 68 69 73 7d 72 65 74 75 72 6e 20 72 28 6e 2c 74 29 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 6e 64 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 4c 74 28 59 74 28 74 2c 74 68 69 73 2e 4e 74 29 2c 74 29 7d 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 6e 64 53 65 73 73 69 6f 6e 3d 66 75 Data Ascii: 3*r;var e=Date.parse(""+n);return isNaN(e)?Y:e-t}(o,s)),!0)},n}(),jn=W(),_n=function(t){function n(){return null!==t&&t.apply(this,arguments)\|\|this}return r(n,t),n.prototype.sendEvent=function(t){return this.Lt(Yt(t,this.Nt),t)},n.prototype.sendSession=fu

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:02 UTC	583	OUT	GET /flareprovider.js HTTP/1.1 Host: track.salesflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://storage.googleapis.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:03 UTC	1242	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 13:22:03 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close x-guploader-uploadid: AFIdbgTF9Uk9z4RUlEKKKkl0w00CmzIRu8eduB51AeLLPUybQqXnwXq-dKEvJj2qtR8bNG7y Cache-Control: public, max-age=14400 expires: Mon, 24 Mar 2025 16:58:23 GMT last-modified: Wed, 17 Jul 2024 12:54:02 GMT etag: W/"20dc9361bafa4df7c9ec1bdddeb62d02" vary: Accept-Encoding vary: Origin x-goog-generation: 1721220842789364 x-goog-metageneration: 2 x-goog-stored-content-encoding: gzip x-goog-stored-content-length: 10695 content-language: en x-goog-hash: crc32c=tqZ19A== x-goog-hash: md5=INyTYbr6TffJ7Bvd3rYtAg== x-goog-storage-class: STANDARD alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Age: 1420 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RsLYMP9NYWN4mT9XwgaUpwhwwglPN6q3ZhWcMgLEnPCeemPu2o0RV%2FAVpWOg31yNloxhYfR9yhOsc%2F1zFELVQjtqCp8FaroBOHN5tHoqcMh8Mfx3JeVZOYSWIhN1NsyFLDEfC2l6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15552000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 925679a158d7c40e-EWR
2025-03-24 13:22:03 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 30 31 34 37 39 26 6d 69 6e 5f 72 74 74 3d 31 30 30 36 34 37 26 72 74 74 5f 76 61 72 3d 32 32 34 38 33 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 33 26 72 65 63 76 5f 62 79 74 65 73 3d 31 31 35 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 36 31 31 30 26 63 77 6e 64 3d 32 33 30 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 32 30 66 34 61 37 33 30 34 61 37 62 31 39 37 65 26 74 73 3d 32 38 35 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=101479&min_rtt=100647&rtt_var=22483&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1155&delivery_rate=36110&cwnd=230&unsent_bytes=0&cid=20f4a7304a7b197e&ts=285&x=0"
2025-03-24 13:22:03 UTC	1276	IN	Data Raw: 37 39 37 32 0d 0a 76 61 72 20 72 70 63 3b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 65 72 72 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 22 55 6e 63 61 75 67 68 74 20 53 79 6e 74 61 78 45 72 72 6f 72 3a 20 46 61 69 6c 65 64 20 74 6f 20 65 78 65 63 75 74 65 20 27 70 6f 73 74 4d 65 73 73 61 67 65 27 20 6f 6e 20 27 57 69 6e 64 6f 77 27 3a 20 49 6e 76 61 6c 69 64 20 74 61 72 67 65 74 20 6f 72 69 67 69 6e 20 27 27 20 69 6e 20 61 20 63 61 6c 6c 20 74 6f 20 27 70 6f 73 74 4d 65 73 73 61 67 65 27 2e 22 3d 3d 3d 65 2e 6d 65 73 73 61 67 65 26 26 77 69 6e 64 6f 77 2e 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 59 6f 75 20 61 72 65 20 72 75 6e 6e 69 6e 67 20 66 6c 61 72 65 2e Data Ascii: 7972var rpc;window.addEventListener("error",function(e){e.preventDefault(),"Uncaught SyntaxError: Failed to execute 'postMessage' on 'Window': Invalid target origin '' in a call to 'postMessage'."===e.message&&window.console.warn("You are running flare.
2025-03-24 13:22:03 UTC	1369	IN	Data Raw: 6e 2c 74 29 7b 65 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 6e 2c 74 2c 21 31 29 7d 3b 65 6c 73 65 7b 69 66 28 21 6a 28 67 2c 22 61 74 74 61 63 68 45 76 65 6e 74 22 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 42 72 6f 77 73 65 72 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 29 3b 75 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 6e 2c 74 29 7d 2c 76 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 65 2e 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 6e 2c 74 29 7d 7d 76 61 72 20 65 2c 6f 2c 61 3d 21 31 2c 69 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 29 7b 69 66 28 21 61 29 7b 61 3d 21 30 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 69 2e 6c 65 6e 67 74 Data Ascii: n,t){e.removeEventListener(n,t,!1)};else{if(!j(g,"attachEvent"))throw new Error("Browser not supported");u=function(e,n,t){e.attachEvent("on"+n,t)},v=function(e,n,t){e.detachEvent("on"+n,t)}}var e,o,a=!1,i=[];function M(){if(!a){a=!0;for(var e=0;e<i.lengt
2025-03-24 13:22:03 UTC	1369	IN	Data Raw: 76 6f 69 64 20 68 28 6f 2c 31 29 7d 4d 28 29 7d 7d 29 28 29 29 2c 75 28 67 2c 22 6c 6f 61 64 22 2c 4d 29 29 3b 76 61 72 20 41 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 6e 2c 74 3d 7b 7d 2c 72 3d 28 65 3d 65 2e 73 75 62 73 74 72 69 6e 67 28 31 29 2e 73 70 6c 69 74 28 22 26 22 29 29 2e 6c 65 6e 67 74 68 3b 72 2d 2d 3b 29 74 5b 28 6e 3d 65 5b 72 5d 2e 73 70 6c 69 74 28 22 3d 22 29 29 5b 30 5d 5d 3d 70 28 6e 5b 31 5d 29 3b 72 65 74 75 72 6e 20 74 7d 28 2f 78 64 6d 5f 65 3d 2f 2e 74 65 73 74 28 66 2e 73 65 61 72 63 68 29 3f 66 2e 73 65 61 72 63 68 3a 66 2e 68 61 73 68 29 3b 66 75 6e 63 74 69 6f 6e 20 52 28 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 7d 76 61 72 20 44 2c 4a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 Data Ascii: void h(o,1)}M()}})()),u(g,"load",M));var A=function(e){for(var n,t={},r=(e=e.substring(1).split("&")).length;r--;)t[(n=e[r].split("="))[0]]=p(n[1]);return t}(/xdm_e=/.test(f.search)?f.search:f.hash);function R(e){return void 0===e}var D,J=function(){var e
2025-03-24 13:22:03 UTC	1369	IN	Data Raw: 28 74 2c 65 2e 70 72 6f 70 73 29 2c 74 2e 62 6f 72 64 65 72 3d 74 2e 66 72 61 6d 65 42 6f 72 64 65 72 3d 30 2c 74 2e 61 6c 6c 6f 77 54 72 61 6e 73 70 61 72 65 6e 63 79 3d 21 30 2c 65 2e 63 6f 6e 74 61 69 6e 65 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 65 2e 6f 6e 4c 6f 61 64 26 26 75 28 74 2c 22 6c 6f 61 64 22 2c 65 2e 6f 6e 4c 6f 61 64 29 2c 65 2e 75 73 65 50 6f 73 74 29 7b 76 61 72 20 6f 2c 61 3d 65 2e 63 6f 6e 74 61 69 6e 65 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6c 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 66 6f 72 6d 22 29 29 3b 69 66 28 61 2e 74 61 72 67 65 74 3d 74 2e 6e 61 6d 65 2c 61 2e 61 63 74 69 6f 6e 3d 72 2c 61 2e 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 2e 75 73 65 50 Data Ascii: (t,e.props),t.border=t.frameBorder=0,t.allowTransparency=!0,e.container.appendChild(t),e.onLoad&&u(t,"load",e.onLoad),e.usePost){var o,a=e.container.appendChild(l.createElement("form"));if(a.target=t.name,a.action=r,a.method="POST","object"==typeof e.useP
2025-03-24 13:22:03 UTC	1369	IN	Data Raw: 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 22 2b 65 2e 72 65 6d 6f 74 65 29 3b 73 77 69 74 63 68 28 65 2e 70 72 6f 74 6f 63 6f 6c 3d 74 29 7b 63 61 73 65 22 30 22 3a 69 66 28 49 28 65 2c 7b 69 6e 74 65 72 76 61 6c 3a 31 30 30 2c 64 65 6c 61 79 3a 32 65 33 2c 75 73 65 52 65 73 69 7a 65 3a 21 30 2c 75 73 65 50 61 72 65 6e 74 3a 21 31 2c 75 73 65 50 6f 6c 6c 69 6e 67 3a 21 31 7d 2c 21 30 29 2c 65 2e 69 73 48 6f 73 74 29 7b 69 66 28 21 65 2e 6c 6f 63 61 6c 29 7b 66 6f 72 28 76 61 72 20 72 2c 6f 3d 66 2e 70 72 6f 74 6f 63 6f 6c 2b 22 2f 2f 22 2b 66 2e 68 6f 73 74 2c 61 3d 6c 2e 62 6f 64 79 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 69 6d 67 22 29 2c 69 3d 61 2e 6c 65 6e 67 74 68 Data Ascii: row new Error("Access denied for "+e.remote);switch(e.protocol=t){case"0":if(I(e,{interval:100,delay:2e3,useResize:!0,useParent:!1,usePolling:!1},!0),e.isHost){if(!e.local){for(var r,o=f.protocol+"//"+f.host,a=l.body.getElementsByTagName("img"),i=a.length
2025-03-24 13:22:03 UTC	1369	IN	Data Raw: 65 29 7b 66 6f 72 28 76 61 72 20 6e 2c 74 3d 7b 69 6e 63 6f 6d 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 74 68 69 73 2e 75 70 2e 69 6e 63 6f 6d 69 6e 67 28 65 2c 6e 29 7d 2c 6f 75 74 67 6f 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 74 68 69 73 2e 64 6f 77 6e 2e 6f 75 74 67 6f 69 6e 67 28 65 2c 6e 29 7d 2c 63 61 6c 6c 62 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 75 70 2e 63 61 6c 6c 62 61 63 6b 28 65 29 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 64 6f 77 6e 2e 69 6e 69 74 28 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 64 6f 77 6e 2e 64 65 73 74 72 6f 79 28 29 7d 7d 2c 72 3d 30 2c 6f 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 6f 3b 72 2b 2b 29 49 28 6e 3d 65 Data Ascii: e){for(var n,t={incoming:function(e,n){this.up.incoming(e,n)},outgoing:function(e,n){this.down.outgoing(e,n)},callback:function(e){this.up.callback(e)},init:function(){this.down.init()},destroy:function(){this.down.destroy()}},r=0,o=e.length;r<o;r++)I(n=e
2025-03-24 13:22:03 UTC	1369	IN	Data Raw: 29 7d 2c 6f 2e 69 6e 69 74 28 29 7d 2c 53 2e 73 74 61 63 6b 2e 53 61 6d 65 4f 72 69 67 69 6e 54 72 61 6e 73 70 6f 72 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 2c 72 2c 6f 3b 72 65 74 75 72 6e 20 6e 3d 7b 6f 75 74 67 6f 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 72 28 65 29 2c 74 26 26 74 28 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 2c 74 3d 6e 75 6c 6c 29 7d 2c 6f 6e 44 4f 4d 52 65 61 64 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 3d 50 28 65 2e 72 65 6d 6f 74 65 29 2c 65 2e 69 73 48 6f 73 74 3f 28 49 28 65 2e 70 72 6f 70 73 2c 7b 73 72 63 3a 43 28 65 2e 72 65 6d 6f 74 65 2c 7b 78 64 6d 5f 65 3a 66 2e 70 Data Ascii: )},o.init()},S.stack.SameOriginTransport=function(e){var n,t,r,o;return n={outgoing:function(e,n,t){r(e),t&&t()},destroy:function(){t&&(t.parentNode.removeChild(t),t=null)},onDOMReady:function(){o=P(e.remote),e.isHost?(I(e.props,{src:C(e.remote,{xdm_e:f.p
2025-03-24 13:22:03 UTC	1369	IN	Data Raw: 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 29 29 3b 76 61 72 20 72 3d 22 63 61 6c 6c 62 61 63 6b 3d 66 6c 61 73 68 5f 6c 6f 61 64 65 64 22 2b 64 28 74 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 2d 2e 5d 2f 67 2c 22 5f 22 29 29 2b 22 26 70 72 6f 74 6f 3d 22 2b 79 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2b 22 26 64 6f 6d 61 69 6e 3d 22 2b 64 28 4e 28 79 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 29 2b 22 26 70 6f 72 74 3d 22 2b 64 28 79 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 6d 61 74 63 68 28 5f 29 5b 34 5d 7c 7c 22 22 29 2b 22 26 6e 73 3d 22 2b 64 28 78 29 3b 63 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 6f 62 6a 65 63 74 20 68 65 69 67 68 74 3d 27 32 30 27 20 77 69 64 74 68 3d 27 32 30 27 20 74 79 70 65 3d 27 61 70 70 6c 69 63 61 Data Ascii: .body.appendChild(c));var r="callback=flash_loaded"+d(t.replace(/[\-.]/g,"_"))+"&proto="+y.location.protocol+"&domain="+d(N(y.location.href))+"&port="+d(y.location.href.match(_)[4]\|\|"")+"&ns="+d(x);c.innerHTML="<object height='20' width='20' type='applica
2025-03-24 13:22:03 UTC	1369	IN	Data Raw: 29 29 7d 76 61 72 20 6e 3d 4e 28 6f 2e 73 77 66 29 3b 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 26 26 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 2e 69 6e 69 74 3f 65 28 29 3a 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 3f 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 2e 71 75 65 75 65 2e 70 75 73 68 28 65 29 3a 28 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 3d 7b 71 75 65 75 65 3a 5b 65 5d 7d 2c 75 28 6e 29 29 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 28 74 2e 6f 6e 44 4f 4d 52 65 61 64 79 2c 74 29 7d 7d 7d 2c 53 2e 73 74 61 63 6b 2e 50 6f 73 74 4d 65 73 73 61 67 65 54 72 61 6e 73 70 6f Data Ascii: ))}var n=N(o.swf);S.stack.FlashTransport[n]&&S.stack.FlashTransport[n].init?e():S.stack.FlashTransport[n]?S.stack.FlashTransport[n].queue.push(e):(S.stack.FlashTransport[n]={queue:[e]},u(n))},init:function(){F(t.onDOMReady,t)}}},S.stack.PostMessageTranspo

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:03 UTC	531	OUT	OPTIONS /devices HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: authorization Origin: https://538-kadoma.trakcid.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://538-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:03 UTC	660	IN	HTTP/1.1 204 No Content access-control-allow-origin: https://538-kadoma.trakcid.com access-control-allow-methods: POST access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-salesflare-client,x-result-count,x-salesflare-actor access-control-max-age: 86400 access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: 22283e14ca414d14861eff78b0b41f2f date: Mon, 24 Mar 2025 13:22:03 GMT content-type: text/html server: Google Frontend Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:03 UTC	1059	OUT	GET /favicon.ico HTTP/1.1 Host: 538-kadoma.trakcid.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://538-kadoma.trakcid.com/?u=http:%2F%2Femail.double.serviceautopilot.com%2Fc%2FeJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg&e=oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce&cee=Y2hyaXN0b3BoZXIuYWxsYW5AcnByby50ZWNo Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:03 UTC	754	IN	HTTP/1.1 404 Not Found x-guploader-uploadid: AKDAyIv0kEuJbb-GvMWWWIUmqsVZ9IcVuvnzPk-4OY_lhZSSizk1vGYxpB-Ds3WDQvktapN0 expires: Mon, 24 Mar 2025 14:22:03 GMT date: Mon, 24 Mar 2025 13:22:03 GMT cache-control: public, max-age=3600 last-modified: Mon, 20 Jan 2025 09:27:00 GMT etag: "35b50977890c59dd87536447601ff3d9" x-goog-generation: 1737365220799885 x-goog-metageneration: 1 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 2016 content-type: text/html x-goog-hash: crc32c=Xo/u5A== x-goog-hash: md5=NbUJd4kMWd2HU2RHYB/z2Q== x-goog-storage-class: STANDARD accept-ranges: bytes Content-Length: 2016 server: UploadServer via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:03 UTC	466	IN	Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 73 74 79 6c 65 2d 73 72 63 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 69 6d 67 2d 73 72 63 20 64 61 74 61 3a 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 22 3e 0a 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: <!DOCTYPE html><html><head><meta http-equiv="Content-type" content="text/html; charset=utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'"><title>Page not found
2025-03-24 13:22:03 UTC	1220	IN	Data Raw: 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 20 6d 61 72 67 69 6e 3a 20 35 30 70 78 20 61 75 74 6f 20 34 30 70 78 20 61 75 74 6f 3b 20 77 69 64 74 68 3a 20 36 30 30 70 78 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 7d 0a 0a 20 20 20 20 20 20 61 20 7b 20 63 6f 6c 6f 72 3a 20 23 34 31 38 33 63 34 3b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 20 7d 0a 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 20 7d 0a 0a 20 20 20 20 20 20 68 31 20 7b 20 77 69 64 74 68 3a 20 38 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 20 6c 65 66 74 3a 20 2d 31 30 30 70 78 3b 20 6c 65 74 74 65 72 2d 73 70 61 Data Ascii: } .container { margin: 50px auto 40px auto; width: 600px; text-align: center; } a { color: #4183c4; text-decoration: none; } a:hover { text-decoration: underline; } h1 { width: 800px; position:relative; left: -100px; letter-spa
2025-03-24 13:22:03 UTC	330	IN	Data Raw: 20 20 20 23 73 75 67 67 65 73 74 69 6f 6e 73 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 36 36 36 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 32 30 30 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 0a 3c 70 3e 3c 73 74 72 6f 6e 67 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 70 3e 0a 3c 70 3e 0a 54 68 65 20 73 69 74 65 20 63 6f 6e 66 69 67 75 72 65 64 Data Ascii: #suggestions a { color: #666666; font-weight: 200; font-size: 14px; margin: 0 10px; } </style></head><body><div class="container"><h1>404</h1><p><strong>Page not found</strong></p><p>The site configured

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:04 UTC	703	OUT	POST /devices HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Content-Length: 2 sec-ch-ua-platform: "Windows" Authorization: Bearer I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://538-kadoma.trakcid.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://538-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:04 UTC	2	OUT	Data Raw: 7b 7d Data Ascii: {}
2025-03-24 13:22:04 UTC	508	IN	HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin access-control-allow-origin: https://538-kadoma.trakcid.com access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: ebfcdfec43d7b878f577a2d5214463b9 date: Mon, 24 Mar 2025 13:22:04 GMT server: Google Frontend Content-Length: 16 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:04 UTC	16	IN	Data Raw: 7b 22 69 64 22 3a 32 38 32 30 31 39 33 36 35 7d Data Ascii: {"id":282019365}

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Tycoon2FA

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:04 UTC	389	OUT	GET /devices HTTP/1.1 Host: api.salesflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:05 UTC	454	IN	HTTP/1.1 404 Not Found content-type: application/json; charset=utf-8 vary: origin access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: e98c7fbd5c71c58001afdde1ea289e0a date: Mon, 24 Mar 2025 13:22:04 GMT server: Google Frontend Content-Length: 60 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:05 UTC	60	IN	Data Raw: 7b 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"statusCode":404,"error":"Not Found","message":"Not Found"}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:04 UTC	532	OUT	OPTIONS /contacts HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: authorization Origin: https://538-kadoma.trakcid.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://538-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:05 UTC	660	IN	HTTP/1.1 204 No Content access-control-allow-origin: https://538-kadoma.trakcid.com access-control-allow-methods: POST access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-salesflare-client,x-result-count,x-salesflare-actor access-control-max-age: 86400 access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: 74cba5cd857fb969fec159b4252f125e date: Mon, 24 Mar 2025 13:22:04 GMT content-type: text/html server: Google Frontend Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:05 UTC	705	OUT	POST /contacts HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Content-Length: 39 sec-ch-ua-platform: "Windows" Authorization: Bearer I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://538-kadoma.trakcid.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://538-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:05 UTC	39	OUT	Data Raw: 7b 22 65 6d 61 69 6c 22 3a 22 63 68 72 69 73 74 6f 70 68 65 72 2e 61 6c 6c 61 6e 40 72 70 72 6f 2e 74 65 63 68 22 7d Data Ascii: {"email":"christopher.allan@rpro.tech"}
2025-03-24 13:22:05 UTC	508	IN	HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin access-control-allow-origin: https://538-kadoma.trakcid.com access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: 6ff79d2fcf0d9c2f4270b9702228cec1 date: Mon, 24 Mar 2025 13:22:05 GMT server: Google Frontend Content-Length: 16 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:05 UTC	16	IN	Data Raw: 7b 22 69 64 22 3a 32 37 39 33 33 34 37 34 35 7d Data Ascii: {"id":279334745}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:06 UTC	390	OUT	GET /contacts HTTP/1.1 Host: api.salesflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:06 UTC	543	IN	HTTP/1.1 401 Unauthorized www-authenticate: Bearer, Bearer, cookie content-type: application/json; charset=utf-8 vary: origin access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization,access-control-allow-headers,x-result-count cache-control: no-cache x-cloud-trace-context: c4179619a8814f60ceb8c6d2c733dd9e date: Mon, 24 Mar 2025 13:22:06 GMT server: Google Frontend Content-Length: 76 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:06 UTC	31	IN	Data Raw: 7b 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 31 2c 22 65 72 72 6f 72 22 3a 22 55 6e 61 75 Data Ascii: {"statusCode":401,"error":"Unau
2025-03-24 13:22:06 UTC	45	IN	Data Raw: 74 68 6f 72 69 7a 65 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 4d 69 73 73 69 6e 67 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 22 7d Data Ascii: thorized","message":"Missing authentication"}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:06 UTC	540	OUT	OPTIONS /devices/282019365 HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Accept: / Access-Control-Request-Method: PUT Access-Control-Request-Headers: authorization Origin: https://538-kadoma.trakcid.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://538-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:06 UTC	659	IN	HTTP/1.1 204 No Content access-control-allow-origin: https://538-kadoma.trakcid.com access-control-allow-methods: PUT access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-salesflare-client,x-result-count,x-salesflare-actor access-control-max-age: 86400 access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: f6f25c39cd37faebb46fafc3d06a9571 date: Mon, 24 Mar 2025 13:22:06 GMT content-type: text/html server: Google Frontend Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:06 UTC	713	OUT	PUT /devices/282019365 HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Content-Length: 21 sec-ch-ua-platform: "Windows" Authorization: Bearer I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://538-kadoma.trakcid.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://538-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:06 UTC	21	OUT	Data Raw: 7b 22 63 6f 6e 74 61 63 74 22 3a 32 37 39 33 33 34 37 34 35 7d Data Ascii: {"contact":279334745}
2025-03-24 13:22:08 UTC	508	IN	HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin access-control-allow-origin: https://538-kadoma.trakcid.com access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: d04948d4e560867dc1d3de430dc8456a date: Mon, 24 Mar 2025 13:22:08 GMT server: Google Frontend Content-Length: 16 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:08 UTC	16	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 7d Data Ascii: {"success":true}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:08 UTC	557	OUT	OPTIONS /interactions/forward?instant=true HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: authorization Origin: https://538-kadoma.trakcid.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://538-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:08 UTC	660	IN	HTTP/1.1 204 No Content access-control-allow-origin: https://538-kadoma.trakcid.com access-control-allow-methods: POST access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-salesflare-client,x-result-count,x-salesflare-actor access-control-max-age: 86400 access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: 59d4d1e34649f10054c10b42e864df51 date: Mon, 24 Mar 2025 13:22:08 GMT content-type: text/html server: Google Frontend Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:08 UTC	399	OUT	GET /devices/282019365 HTTP/1.1 Host: api.salesflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:08 UTC	454	IN	HTTP/1.1 404 Not Found content-type: application/json; charset=utf-8 vary: origin access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: 6bf4bbcff2e98e88517cb4f5a12c2c3f date: Mon, 24 Mar 2025 13:22:08 GMT server: Google Frontend Content-Length: 60 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:08 UTC	60	IN	Data Raw: 7b 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"statusCode":404,"error":"Not Found","message":"Not Found"}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:09 UTC	731	OUT	POST /interactions/forward?instant=true HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Content-Length: 533 sec-ch-ua-platform: "Windows" Authorization: Bearer I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://538-kadoma.trakcid.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://538-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:09 UTC	533	OUT	Data Raw: 7b 22 69 6e 74 65 72 61 63 74 69 6f 6e 67 72 6f 75 70 22 3a 7b 22 64 65 76 69 63 65 22 3a 22 32 38 32 30 31 39 33 36 35 22 2c 22 74 79 70 65 22 3a 22 66 6f 72 77 61 72 64 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 73 65 6d 73 2e 67 72 61 76 69 74 79 7a 6f 6e 65 2e 62 69 74 64 65 66 65 6e 64 65 72 2e 63 6f 6d 2f 22 2c 22 65 6d 61 69 6c 22 3a 22 6f 46 4d 66 79 43 64 6e 69 57 71 6a 45 33 4d 6c 56 69 59 54 59 34 48 50 4a 54 63 63 51 2d 63 65 22 7d 2c 22 75 72 6c 22 3a 22 68 74 74 70 3a 2f 2f 65 6d 61 69 6c 2e 64 6f 75 62 6c 65 2e 73 65 72 76 69 63 65 61 75 74 6f 70 69 6c 6f 74 2e 63 6f 6d 2f 63 2f 65 4a 77 45 77 4c 31 4f 77 7a 41 51 41 4f 43 6e 73 54 64 62 7a 76 6c 5f 38 4d 41 53 32 4a 41 6f 41 32 4c 7a 7a 35 31 69 4b 59 32 6a 4a 43 Data Ascii: {"interactiongroup":{"device":"282019365","type":"forward","referrer":"https://lsems.gravityzone.bitdefender.com/","email":"oFMfyCdniWqjE3MlViYTY4HPJTccQ-ce"},"url":"http://email.double.serviceautopilot.com/c/eJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC
2025-03-24 13:22:09 UTC	508	IN	HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin access-control-allow-origin: https://538-kadoma.trakcid.com access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: e5de6778871aac13792c54c0b88c1cec date: Mon, 24 Mar 2025 13:22:09 GMT server: Google Frontend Content-Length: 16 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:09 UTC	16	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 7d Data Ascii: {"success":true}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 13:22:09 UTC	415	OUT	GET /interactions/forward?instant=true HTTP/1.1 Host: api.salesflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 13:22:09 UTC	454	IN	HTTP/1.1 404 Not Found content-type: application/json; charset=utf-8 vary: origin access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: 4cbda8277413224a2f0d787ef0e7ca41 date: Mon, 24 Mar 2025 13:22:09 GMT server: Google Frontend Content-Length: 60 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-24 13:22:09 UTC	60	IN	Data Raw: 7b 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"statusCode":404,"error":"Not Found","message":"Not Found"}