Edit tour

Windows Analysis Report
Ipsen USA RFP.pdf

Overview

General Information

Sample name:	Ipsen USA RFP.pdf
Analysis ID:	1647419
MD5:	0b7825636347aa9ae5abdeb1905edbd4
SHA1:	43cabd41f02c4b39962b0ddcc85a8cbf6bac3f5e
SHA256:	79f28beb1a523c490120f4c1be70ac15fe8fb7550fba3764630628ee52ea889c
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6868 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Ipsen USA RFP.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7124 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1572,i,17589608329626494226,1086582052272382565,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://eyyaltynews.com/securefile/email-template.html MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2032,i,1863015428361609272,14328580475443675155,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://eyyaltynews.com/securefile/email-template.html MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://eyyaltynews.com/securefile/email-template.html

Joe Sandbox AI: Score: 9 Reasons: The brand 'Cloudflare' is a well-known internet security and performance company., The URL 'eyyaltynews.com' does not match the legitimate domain 'cloudflare.com'., The domain 'eyyaltynews.com' does not have any apparent connection to Cloudflare., The URL contains no recognizable elements related to Cloudflare, suggesting a potential phishing attempt., The presence of an input field requesting an email address on an unrelated domain is suspicious. DOM: 0.1.pages.csv

Source: https://eyyaltynews.com/securefile/email-template.html

HTTP Parser: Number of links: 0

Source: https://eyyaltynews.com/securefile/email-template.html

HTTP Parser: Base64 decoded: https://rfp.securedeveloperhub.de/J0hSY

Source: https://eyyaltynews.com/securefile/email-template.html

HTTP Parser: Title: Secure Document Access does not match URL

Source: https://eyyaltynews.com/securefile/email-template.html	HTTP Parser: No favicon
Source: https://eyyaltynews.com/securefile/email-template.html	HTTP Parser: No favicon
Source: https://eyyaltynews.com/securefile/email-template.html	HTTP Parser: No favicon
Source: https://eyyaltynews.com/securefile/email-template.html	HTTP Parser: No favicon

Source: https://eyyaltynews.com/securefile/email-template.html	HTTP Parser: No <meta name="author".. found
Source: https://eyyaltynews.com/securefile/email-template.html	HTTP Parser: No <meta name="author".. found
Source: https://eyyaltynews.com/securefile/email-template.html	HTTP Parser: No <meta name="author".. found

Source: https://eyyaltynews.com/securefile/email-template.html	HTTP Parser: No <meta name="copyright".. found
Source: https://eyyaltynews.com/securefile/email-template.html	HTTP Parser: No <meta name="copyright".. found
Source: https://eyyaltynews.com/securefile/email-template.html	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	HTTPS traffic detected: 208.91.198.81:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.91.198.81:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49750 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41
Source: Joe Sandbox View	IP Address: 208.91.198.81 208.91.198.81

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81
Source: unknown	TCP traffic detected without corresponding DNS query: 208.91.198.81

Source: global traffic	HTTP traffic detected: GET /securefile/email-template.html HTTP/1.1Host: eyyaltynews.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://eyyaltynews.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://eyyaltynews.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://eyyaltynews.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/lqi8i/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://eyyaltynews.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=925890068fec49aa&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/lqi8i/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=9258900688e658c1&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: eyyaltynews.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyyaltynews.com/securefile/email-template.htmlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: eyyaltynews.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyyaltynews.com/securefile/email-template.htmlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1785170061:1742841052:UsQfaBa_zEUVpfW-ViWsHOf14Uigd-nkbFZh4vmrZfI/9258900688e658c1/TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/90605971:1742840827:oID_OK0KPEBaFjrqV1VD9LXn4gNj1wLsREK3Hh32ooM/925890068fec49aa/OUH_lw1ZrO9k52HS7lu7RY6EJtTprXq0qXwNnTzjzEI-1742844411-1.1.1.1-d24Wj.MBIbD8_HS9LHTCYzl7lt.8hYXP7t_vSDYzoKHGH5pt6V16NYURJSlKIk1u HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/9258900688e658c1/1742844413215/HG--9zQ253LJPkk HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/9258900688e658c1/1742844413215/HG--9zQ253LJPkk HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/925890068fec49aa/1742844414100/scvWf6CYEEIqVbs HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/lqi8i/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/9258900688e658c1/1742844413224/062b52c2a80169cfb22a4fc6ea9486df20425347aac4beb3c0153ca0d14f45f7/BpFnN7xD3G-JtCR HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/925890068fec49aa/1742844414100/scvWf6CYEEIqVbs HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/925890068fec49aa/1742844414101/5fd1288e97f5c0f9287f6048330149a8d1e135e21d65000a42785f808bab09fc/iRsMcm3v5cRSixr HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/lqi8i/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1785170061:1742841052:UsQfaBa_zEUVpfW-ViWsHOf14Uigd-nkbFZh4vmrZfI/9258900688e658c1/TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/90605971:1742840827:oID_OK0KPEBaFjrqV1VD9LXn4gNj1wLsREK3Hh32ooM/925890068fec49aa/OUH_lw1ZrO9k52HS7lu7RY6EJtTprXq0qXwNnTzjzEI-1742844411-1.1.1.1-d24Wj.MBIbD8_HS9LHTCYzl7lt.8hYXP7t_vSDYzoKHGH5pt6V16NYURJSlKIk1u HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1785170061:1742841052:UsQfaBa_zEUVpfW-ViWsHOf14Uigd-nkbFZh4vmrZfI/9258900688e658c1/TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1785170061:1742841052:UsQfaBa_zEUVpfW-ViWsHOf14Uigd-nkbFZh4vmrZfI/9258900688e658c1/TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3340sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8cf-chl: TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6Xcf-chl-ra: 0sec-ch-ua-mobile: ?0Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Mar 2025 19:26:53 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 22:06:31 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Mar 2025 19:26:53 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 22:06:31 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html

Source: chromecache_165.14.dr	String found in binary or memory: http://cdn.jsinit.directfwd.com/sk-jspark_init.php
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_171.14.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js
Source: fcdc1f46-8396-42af-9537-74ce8ef943bf.tmp.2.dr, 7942011d-b4dc-40b0-bd63-2af3d90de473.tmp.2.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: chromecache_171.14.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Poppins:wght
Source: chromecache_167.14.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1JlFc-K.woff2)
Source: chromecache_167.14.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2)
Source: chromecache_167.14.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiEyp8kv8JHgFVrJJfecg.woff2)
Source: chromecache_167.14.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiEyp8kv8JHgFVrJJnecmNE.woff2)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 208.91.198.81:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.91.198.81:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49750 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir7300_618608074

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir7300_618608074

Jump to behavior

Source: classification engine

Classification label: mal48.phis.winPDF@43/72@9/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6956

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91onds2a_ul5ncd_5d8.tmp

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Ipsen USA RFP.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1572,i,17589608329626494226,1086582052272382565,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://eyyaltynews.com/securefile/email-template.html
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://eyyaltynews.com/securefile/email-template.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2032,i,1863015428361609272,14328580475443675155,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://eyyaltynews.com/securefile/email-template.html	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://eyyaltynews.com/securefile/email-template.html	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1572,i,17589608329626494226,1086582052272382565,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2032,i,1863015428361609272,14328580475443675155,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: Ipsen USA RFP.pdf	Initial sample: PDF keyword /JS count = 0
Source: Ipsen USA RFP.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91onds2a_ul5ncd_5d8.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91onds2a_ul5ncd_5d8.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Ipsen USA RFP.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	13 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://cdn.jsinit.directfwd.com/sk-jspark_init.php	0%	Avira URL Cloud	safe
https://eyyaltynews.com/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
e8652.dscx.akamaiedge.net	23.216.136.238	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	142.251.40.132	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=925890068fec49aa&lang=auto	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://eyyaltynews.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/9258900688e658c1/1742844413224/062b52c2a80169cfb22a4fc6ea9486df20425347aac4beb3c0153ca0d14f45f7/BpFnN7xD3G-JtCR	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/9258900688e658c1/1742844413215/HG--9zQ253LJPkk	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1785170061:1742841052:UsQfaBa_zEUVpfW-ViWsHOf14Uigd-nkbFZh4vmrZfI/9258900688e658c1/TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=9258900688e658c1&lang=auto	false		high
https://challenges.cloudflare.com/turnstile/v0/b/708f7a809116/api.js	false		high
https://eyyaltynews.com/securefile/email-template.html	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/lqi8i/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/925890068fec49aa/1742844414100/scvWf6CYEEIqVbs	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/925890068fec49aa/1742844414101/5fd1288e97f5c0f9287f6048330149a8d1e135e21d65000a42785f808bab09fc/iRsMcm3v5cRSixr	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://cdn.jsinit.directfwd.com/sk-jspark_init.php	chromecache_165.14.dr	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	fcdc1f46-8396-42af-9537-74ce8ef943bf.tmp.2.dr, 7942011d-b4dc-40b0-bd63-2af3d90de473.tmp.2.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.216.136.238	e8652.dscx.akamaiedge.net	United States	7016	CCCH-3US	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.251.40.132	www.google.com	United States	15169	GOOGLEUS	false
208.91.198.81	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1647419
Start date and time:	2025-03-24 20:25:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ipsen USA RFP.pdf
Detection:	MAL
Classification:	mal48.phis.winPDF@43/72@9/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.51.56.185, 52.22.41.97, 3.233.129.217, 52.6.155.20, 3.219.243.226, 162.159.61.3, 172.64.41.3, 199.232.214.172, 23.200.0.196, 23.200.0.173, 142.250.80.110, 142.251.40.195, 142.251.179.84, 142.250.65.238, 142.250.65.170, 142.251.35.174, 142.250.65.195, 142.251.32.106, 142.251.40.138, 142.251.40.202, 142.251.35.170, 142.251.40.234, 142.251.41.10, 142.250.80.74, 142.250.65.234, 142.250.80.42, 142.250.81.234, 142.250.80.106, 142.251.40.106, 142.250.65.202, 142.251.40.170, 142.250.176.202, 142.251.40.238, 142.251.32.110, 142.250.64.78, 142.251.40.206, 142.250.176.206, 142.250.80.99, 142.251.40.110, 142.250.80.46, 4.175.87.197, 184.31.69.3, 23.200.196.138
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, clientservices.googleapis.com, eyyaltynews.com, acroipm2.adobe.com, clients2.google.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, wu-b-net.trafficmanager.net, clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, fonts.gstatic.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, armmf.adobe.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:26:38	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.216.136.238	https://www.transfernow.net/en/bld?utm_source=20250321oYBy7zgb	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
208.91.198.81	IPE Rigging Corp Request For Proposal.pdf	Get hash	malicious	Unknown	Browse
	Ksciarillo_Reord_Adjustment.docx	Get hash	malicious	Unknown	Browse
	Ksciarillo_Reord_Adjustment.docx	Get hash	malicious	Unknown	Browse
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse
	https://api.spently.com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=r20.rs6.net/tn.jsp?f=001I13MqBq24Teb-ms1-xydTCiVDYP5m1iGycpzcmqktk6WbPU7N7Tk5fjF-m-9fTAiBDbE2PrFzBux_C_H-WPOeAN7C6b7qH4hWL1-1pMgZMEFAqy4cSguAzOgZXZ8hSd-emmInj9ONws2JsaE6FiWPw==&c=&ch==&__=/asdf/c2NvdHQuYnJvd25AbWxjaW5zdXJhbmNlLmNvbS5hdQ==	Get hash	malicious	HTMLPhisher	Browse
104.18.94.41	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse
	https://wkf.ms/4ixHviw	Get hash	malicious	HTMLPhisher	Browse
	https://wkf.ms/4iQZ6lp	Get hash	malicious	HTMLPhisher	Browse
	https://jainiklifesciences.com/proposals	Get hash	malicious	HTMLPhisher	Browse
	https://link.bsru.ac.th/189h	Get hash	malicious	ScreenConnect Tool	Browse
	https://s3.eu-central-1.amazonaws.com/mailo.html.prod/d684bfaf-79e4-4dfc-84aa-fdb21e3b152c.html	Get hash	malicious	HTMLPhisher	Browse
	Invoice-92010-0verdue-ORDER.docx	Get hash	malicious	HTMLPhisher	Browse
	https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6	Get hash	malicious	Unknown	Browse
	http://evite.one/e	Get hash	malicious	HTMLPhisher	Browse
104.18.95.41	https://8tf7eelab.cc.rs6.net	Get hash	malicious	Unknown	Browse
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse
	https://wkf.ms/4iQZ6lp	Get hash	malicious	HTMLPhisher	Browse
	http://jmf-properties.com	Get hash	malicious	Unknown	Browse
	https://jainiklifesciences.com/proposals	Get hash	malicious	HTMLPhisher	Browse
	https://link.bsru.ac.th/189h	Get hash	malicious	ScreenConnect Tool	Browse
	https://s3.eu-central-1.amazonaws.com/mailo.html.prod/d684bfaf-79e4-4dfc-84aa-fdb21e3b152c.html	Get hash	malicious	HTMLPhisher	Browse
	https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6	Get hash	malicious	Unknown	Browse
	http://evite.one/e	Get hash	malicious	HTMLPhisher	Browse
	b10ad005.eml	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
challenges.cloudflare.com	https://8tf7eelab.cc.rs6.net	Get hash	malicious	Unknown	Browse	104.18.95.41
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://wkf.ms/4ixHviw	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	https://wkf.ms/4iQZ6lp	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	http://jmf-properties.com	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://jainiklifesciences.com/proposals	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	https://link.bsru.ac.th/189h	Get hash	malicious	ScreenConnect Tool	Browse	104.18.95.41
	https://s3.eu-central-1.amazonaws.com/mailo.html.prod/d684bfaf-79e4-4dfc-84aa-fdb21e3b152c.html	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	Invoice-92010-0verdue-ORDER.docx	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
bg.microsoft.map.fastly.net	general.ps1	Get hash	malicious	Kdot Stealer	Browse	199.232.214.172
	Final-Payment-Doc#243414512.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	2xHGY40ElK.exe	Get hash	malicious	Iris Stealer	Browse	199.232.214.172
	JpPY0mRA9f.exe	Get hash	malicious	Vidar	Browse	199.232.210.172
	jn8DY8kfrM.msi	Get hash	malicious	Unknown	Browse	199.232.214.172
	MM-7925-0224_110_AD.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.214.172
	1208_37832604.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	Productlist2025.com.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	Teklif TalebiRFQ-25-004668.exe	Get hash	malicious	VIP Keylogger	Browse	199.232.214.172
	NTS_eTaxInvoice.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.210.172
e8652.dscx.akamaiedge.net	Final-Payment-Doc#243414512.pdf	Get hash	malicious	Unknown	Browse	23.39.37.95
	Fatura-03-2025.pdf	Get hash	malicious	Unknown	Browse	23.197.253.105
	Invoice1-1706517.pdf	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	23.46.224.249
	Invoice Number INV132146-1.pdf	Get hash	malicious	Unknown	Browse	23.46.224.249
	Invoice Number INV132146-1.pdf	Get hash	malicious	Unknown	Browse	23.48.144.248
	Invoice Number INV132146-1.pdf	Get hash	malicious	Unknown	Browse	23.48.144.248
	mp3.bat	Get hash	malicious	Unknown	Browse	23.46.224.249
	new.bat	Get hash	malicious	Unknown	Browse	23.39.37.95
	CLAIM3456709.lnk.bin.lnk	Get hash	malicious	DanaBot	Browse	104.76.101.49
	Microsoft Security Slate - March 20, 2025.pdf	Get hash	malicious	Unknown	Browse	23.39.37.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://8tf7eelab.cc.rs6.net	Get hash	malicious	Unknown	Browse	104.18.11.213
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.bing.com/ck/a?!&&p=e81ff1b9f175bc97b5aba94538245134c97a0f2e284b6d1b7f4817cef43c829bJmltdHM9MTc0Mjc3NDQwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly93d3cuZm90b3BvcmNlbGFuYS5jb20uYnIvbW9kZWxvcy1lc3BlY2lhaXMv&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.56.60
	https://smky.app/afyga4	Get hash	malicious	Unknown	Browse	104.18.1.47
	general.ps1	Get hash	malicious	Unknown	Browse	172.64.149.23
	general.ps1	Get hash	malicious	Kdot Stealer	Browse	172.64.149.23
	https://tinyurl.com/SA-Recycling	Get hash	malicious	Unknown	Browse	104.18.36.224
	https://wkf.ms/4ixHviw	Get hash	malicious	HTMLPhisher	Browse	104.16.123.96
	EXTERNAL Cash Flow Analysis Final Review Needed Before Submission.msg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
PUBLIC-DOMAIN-REGISTRYUS	Price Inquiry PO 211436.pdf.z.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	https://magneticmarketing.com/_tracking/email_click/broadcast/jYzzDJ?token=eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6InRpbUBjYXN0cmlnYW5vY3BhLmNvbSIsInN1YiI6NzcyOTY0OTIsImlkIjo3NzI5NjQ5MiwiYXV0aF9zIjoiJDJhJDExJHZINXY4eTRDOUNpelhCbVpDSHlPMC4iLCJuYW1lIjoiVGltIENhc3RyaWdhbm8iLCJsb2NhbGUiOiJlbiIsImV4cCI6MTY5NjI2MDE5NX0.CnHD4Mi842aYOqDUX6wh34PfGgflIpXKwIdlzNIIZys&url=https%3A%2F%2Fmodelingworld%2Ein%2Fmob%2FZXhhbXBsZUBlbWFpbC5jb20%3D	Get hash	malicious	HTMLPhisher	Browse	204.11.59.228
	Payment Regarding Shipment pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	https://sauravsadangi.com/project	Get hash	malicious	Unknown	Browse	216.10.246.86
	https://sauravsadangi.com/project	Get hash	malicious	Unknown	Browse	216.10.246.86
	Order_6600987.vbs	Get hash	malicious	Remcos, GuLoader	Browse	162.215.253.110
	https://bmchaturvedi.in/wp-content/uploads/admin.php	Get hash	malicious	Unknown	Browse	103.21.58.194
	01903025ZW-BP001.vbs	Get hash	malicious	Remcos, GuLoader	Browse	162.215.253.110
	https://bmchaturvedi.in/wp-content/uploads/admin.php	Get hash	malicious	Unknown	Browse	103.21.58.194
	https://bmchaturvedi.in/wp-content/uploads/admin.php	Get hash	malicious	Unknown	Browse	103.21.58.194
CCCH-3US	https://8tf7eelab.cc.rs6.net	Get hash	malicious	Unknown	Browse	23.216.132.75
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse	23.216.132.28
	YourToDo.svg	Get hash	malicious	HTMLPhisher	Browse	23.216.132.21
	https://urlzs.com/KxwhQD	Get hash	malicious	HTMLPhisher	Browse	23.216.132.21
	https://www.transfernow.net/en/bld?utm_source=20250321oYBy7zgb	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	http://t.dripemail2.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzQyNDg1MjAxLCJuYmYiOjE3NDI0ODUyMDEsImFjY291bnRfaWQiOiI5MjExNzMxIiwiZGVsaXZlcnlfaWQiOiI2ZGY2cmIydXVwbjY4cnNhdWo0NCIsInRva2VuIjoiNmRmNnJiMnV1cG42OHJzYXVqNDQiLCJzZW5kX2F0IjoxNzQyNDgzOTQ4LCJlbWFpbF9pZCI6MTA1MDc4ODcsImVtYWlsYWJsZV90eXBlIjoiQnJvYWRjYXN0IiwiZW1haWxhYmxlX2lkIjo0MTkzMDc4LCJ1cmwiOiJodHRwOi8vZ2NyLnVwcGxleC5jby5rZT9fX3M9cWMwZ2JsdTk1emZnYmh3ZHp5OG4mdXRtX3NvdXJjZT1kcmlwJnV0bV9tZWRpdW09ZW1haWwmdXRtX2NhbXBhaWduPVdlK2dvdCthK21ha2VvdmVyLiJ9.nJ9tzd3-jhbWgSNwRLHamHKYwZXuNcZIG2E1QBFM5fg	Get hash	malicious	HTMLPhisher	Browse	23.216.132.80
	Receipt.docm	Get hash	malicious	Unknown	Browse	23.216.136.171
	d8b22e2e.msg	Get hash	malicious	HTMLPhisher	Browse	23.216.132.28
	http://t.co/l51CDdZ5yK	Get hash	malicious	Unknown	Browse	23.216.132.59
	https://keap.app/contact-us/4633654512405098	Get hash	malicious	HTMLPhisher	Browse	23.216.132.28
CLOUDFLARENETUS	https://8tf7eelab.cc.rs6.net	Get hash	malicious	Unknown	Browse	104.18.11.213
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	702cb6e..eml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.bing.com/ck/a?!&&p=e81ff1b9f175bc97b5aba94538245134c97a0f2e284b6d1b7f4817cef43c829bJmltdHM9MTc0Mjc3NDQwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly93d3cuZm90b3BvcmNlbGFuYS5jb20uYnIvbW9kZWxvcy1lc3BlY2lhaXMv&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.56.60
	https://smky.app/afyga4	Get hash	malicious	Unknown	Browse	104.18.1.47
	general.ps1	Get hash	malicious	Unknown	Browse	172.64.149.23
	general.ps1	Get hash	malicious	Kdot Stealer	Browse	172.64.149.23
	https://tinyurl.com/SA-Recycling	Get hash	malicious	Unknown	Browse	104.18.36.224
	https://wkf.ms/4ixHviw	Get hash	malicious	HTMLPhisher	Browse	104.16.123.96
	EXTERNAL Cash Flow Analysis Final Review Needed Before Submission.msg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.193308350168174
Encrypted:	false
SSDEEP:	6:iO+XhN+q2PRN2nKuAl9OmbnIFUtMXEDZmwaXEzVkwORN2nKuAl9OmbjLJ:7+XhN+vaHAahFUtMXED/aXEzV5JHAaSJ
MD5:	2D58E979E3CA3EE991BD47B5CF06F4DD
SHA1:	AD0D9EEB8AA3FF3E2238FCAB2776ED1451E76508
SHA-256:	7AC8F0EF812ED306ADB6798F84908483AF803D798A2A26275F903D1DB9DA03DB
SHA-512:	BCFD11A3B78601AB73DE471BB8DC83ABAAC3A45A61AE3D6B82A494C5FBAD113412F063E5520840AB89910539C2355FA2655E604BB1FC6D76CE695C81EECD23E8
Malicious:	false
Reputation:	low
Preview:	2025/03/24-15:26:26.718 12bc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/24-15:26:26.720 12bc Recovering log #3.2025/03/24-15:26:26.720 12bc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HoUinYn:IUyY
MD5:	903747EA4323C522742842A52CE710C9
SHA1:	9F806EA4288867A31A4AD53AC171AA4029DF182B
SHA-256:	4BD8B60F91849C936AE45615145A7B7BE2CF803322A30BABBAE7267A142CA5BB
SHA-512:	EEF73DC29A38ED70FFCFC321931BCB5B5A29FAAC356E8F6D84F57C532EEF44AE75021C341CF7DAE26B8211924A1C0E0EC4735F6BFC4AF3970A48EB63BFB7895F
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCVy1Wy10LnKlEgUNg6hbPSGue2jrqToPZg==?alt=proto
Preview:	CgkKBw2DqFs9GgA=

File type:	PDF document, version 2.0 (zip deflate encoded)
Entropy (8bit):	7.457694771741842
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Ipsen USA RFP.pdf
File size:	25'011 bytes
MD5:	0b7825636347aa9ae5abdeb1905edbd4
SHA1:	43cabd41f02c4b39962b0ddcc85a8cbf6bac3f5e
SHA256:	79f28beb1a523c490120f4c1be70ac15fe8fb7550fba3764630628ee52ea889c
SHA512:	7dbfe92b42f0ba82057e12c157f6dde6206727e4473306acfd89a2a20cdb2c0a280a2f91c0248efe5d5a3fda0de36f492a6f64a3a6a3786a5f6bd830a67621a8
SSDEEP:	768:59FI/Y3l4Lq6YIeE9w/SRbA+hNqJ/PJ3xseXXTkewCFTC:5Nl4fmEm/fVxPpXXJC
TLSH:	21B2C008DE2B4CADE84B4972B09C7B9B820B28C2621519FF326D85446F0D372BC99EC5
File Content Preview:	%PDF-2.0.%.....6 0 obj<</Linearized 1/L 25011/O 11/E 21670/N 1/T 24718/H [ 1313 300]>>.endobj. .7 0 obj<</Root 8 0 R/Info 4 0 R/ID[<CCAE

General
Header:	%PDF-2.0
Total Entropy:	7.457695
Total Bytes:	25011
Stream Entropy:	7.637873
Stream Bytes:	22156
Entropy outside Streams:	4.376688
Bytes outside Streams:	2855
Number of EOF found:	2
Bytes after EOF:

Name	Count
obj	14
endobj	14
stream	11
endstream	11
xref	0
trailer	0
startxref	2
/Page	1
/Encrypt	0
/ObjStm	3
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5	Preview
12	4002c0f2a4c00280	26c2524a4c9c672e999c81573a6c3c0b
18	60406d5767724050	4591326b29a818ee388495cbff2669e4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 20:26:38.698690891 CET	55329	53	192.168.2.16	1.1.1.1
Mar 24, 2025 20:26:38.802974939 CET	53	55329	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:48.901258945 CET	53	57809	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:49.031594992 CET	53	50091	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:49.145291090 CET	53	49811	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:49.149926901 CET	53	63410	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:49.402609110 CET	53	52264	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:49.708497047 CET	53	53365	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:50.253325939 CET	60846	53	192.168.2.16	1.1.1.1
Mar 24, 2025 20:26:50.253525019 CET	49163	53	192.168.2.16	1.1.1.1
Mar 24, 2025 20:26:50.356408119 CET	53	58275	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:50.357556105 CET	53	60846	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:50.357628107 CET	53	49163	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:50.910531044 CET	53	65528	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:51.423362970 CET	49533	53	192.168.2.16	1.1.1.1
Mar 24, 2025 20:26:51.423706055 CET	62404	53	192.168.2.16	1.1.1.1
Mar 24, 2025 20:26:51.529238939 CET	53	49533	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:51.531265974 CET	53	62404	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:52.552411079 CET	55992	53	192.168.2.16	1.1.1.1
Mar 24, 2025 20:26:52.552612066 CET	57706	53	192.168.2.16	1.1.1.1
Mar 24, 2025 20:26:52.656007051 CET	53	57706	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:52.656830072 CET	53	55992	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:53.647579908 CET	52421	53	192.168.2.16	1.1.1.1
Mar 24, 2025 20:26:53.647733927 CET	60729	53	192.168.2.16	1.1.1.1
Mar 24, 2025 20:26:53.747836113 CET	53	52421	1.1.1.1	192.168.2.16
Mar 24, 2025 20:26:53.748045921 CET	53	60729	1.1.1.1	192.168.2.16
Mar 24, 2025 20:27:06.685461044 CET	53	63137	1.1.1.1	192.168.2.16
Mar 24, 2025 20:27:15.543613911 CET	53	61980	1.1.1.1	192.168.2.16
Mar 24, 2025 20:27:25.663966894 CET	53	55996	1.1.1.1	192.168.2.16
Mar 24, 2025 20:27:35.448822975 CET	138	138	192.168.2.16	192.168.2.255
Mar 24, 2025 20:27:48.535661936 CET	53	59123	1.1.1.1	192.168.2.16
Mar 24, 2025 20:27:48.902761936 CET	53	58372	1.1.1.1	192.168.2.16
Mar 24, 2025 20:27:52.133765936 CET	53	55950	1.1.1.1	192.168.2.16
Mar 24, 2025 20:28:18.538244963 CET	53	58354	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 24, 2025 20:26:35.217142105 CET	1.1.1.1	192.168.2.16	0x6e2c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Mar 24, 2025 20:26:35.217142105 CET	1.1.1.1	192.168.2.16	0x6e2c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Mar 24, 2025 20:26:38.802974939 CET	1.1.1.1	192.168.2.16	0x3b09	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 24, 2025 20:26:38.802974939 CET	1.1.1.1	192.168.2.16	0x3b09	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 24, 2025 20:26:38.802974939 CET	1.1.1.1	192.168.2.16	0x3b09	No error (0)	e8652.dscx.akamaiedge.net		23.216.136.238	A (IP address)	IN (0x0001)	false
Mar 24, 2025 20:26:50.357556105 CET	1.1.1.1	192.168.2.16	0xc7e0	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Mar 24, 2025 20:26:50.357556105 CET	1.1.1.1	192.168.2.16	0xc7e0	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Mar 24, 2025 20:26:50.357628107 CET	1.1.1.1	192.168.2.16	0x182d	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Mar 24, 2025 20:26:51.529238939 CET	1.1.1.1	192.168.2.16	0xad90	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Mar 24, 2025 20:26:51.529238939 CET	1.1.1.1	192.168.2.16	0xad90	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Mar 24, 2025 20:26:51.531265974 CET	1.1.1.1	192.168.2.16	0xa261	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Mar 24, 2025 20:26:52.656007051 CET	1.1.1.1	192.168.2.16	0x9d1	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Mar 24, 2025 20:26:52.656830072 CET	1.1.1.1	192.168.2.16	0x70d	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Mar 24, 2025 20:26:52.656830072 CET	1.1.1.1	192.168.2.16	0x70d	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Mar 24, 2025 20:26:53.747836113 CET	1.1.1.1	192.168.2.16	0xe75a	No error (0)	www.google.com		142.251.40.132	A (IP address)	IN (0x0001)	false
Mar 24, 2025 20:26:53.748045921 CET	1.1.1.1	192.168.2.16	0x3716	No error (0)	www.google.com			65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Mar 24, 2025 20:26:38.903808117 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 24, 2025 20:26:39.002393007 CET	1254	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=43028 Expires: Tue, 25 Mar 2025 07:23:46 GMT Date: Mon, 24 Mar 2025 19:26:38 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUXPi ')au
Mar 24, 2025 20:26:39.002412081 CET	491	IN	Data Raw: 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 1b 45 f0 66 95 d2 7c 6f c2 ea 3b ef 1f cf cb d6 ae 27 Data Ascii: \ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj,_(.{q{

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:49 UTC	695	OUT	GET /securefile/email-template.html HTTP/1.1 Host: eyyaltynews.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:50 UTC	255	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:50 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 24 Mar 2025 14:39:19 GMT Accept-Ranges: bytes Content-Length: 4292 Vary: Accept-Encoding Content-Type: text/html
2025-03-24 19:26:50 UTC	4292	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 65 63 75 72 65 20 44 6f 63 75 6d 65 6e 74 20 41 63 63 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 50 6f 70 70 69 6e 73 3a 77 67 68 74 40 34 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Secure Document Access</title> <link href="https://fonts.googleapis.com/css2?family=Poppins:wght@4

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:50 UTC	584	OUT	GET /turnstile/v0/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://eyyaltynews.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:50 UTC	386	IN	HTTP/1.1 302 Found Date: Mon, 24 Mar 2025 19:26:50 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/708f7a809116/api.js Server: cloudflare CF-RAY: 92588fff48d67c7e-EWR alt-svc: h3=":443"; ma=86400

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:51 UTC	599	OUT	GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://eyyaltynews.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:51 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:51 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48123 Connection: close accept-ranges: bytes last-modified: Tue, 18 Mar 2025 12:36:20 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 925890024d19917b-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:51 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function jt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 7a 74 28 65 29 7c 7c 42 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 50 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Ie(e,t){return zt(e)\|\|Bt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Pe(e,t){var a={label:0,sent:function(){if(l[0
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var We=300030;var Ue=300031;var q;(fu
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 5a 7c 7c 28 5a 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 65 76 65 72 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 6c 77 61 79 73 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 78 65 63 75 74 65 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 6e 74 65 72 61 63 74 69 6f 6e 4f 6e 6c 79 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 6d 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 65 6e 64 65 72 3d 22 72 Data Ascii: anual",e.Auto="auto"})(Z\|\|(Z={}));var ce;(function(e){e.Never="never",e.Manual="manual",e.Auto="auto"})(ce\|\|(ce={}));var Q;(function(e){e.Always="always",e.Execute="execute",e.InteractionOnly="interaction-only"})(Q\|\|(Q={}));var me;(function(e){e.Render="r
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 4d 2e 4e 6f 72 6d 61 6c 2c 4d 2e 43 6f 6d 70 61 63 74 2c 4d 2e 49 6e 76 69 73 69 62 6c 65 2c 4d 2e 46 6c 65 78 69 62 6c 65 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 4e 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 Data Ascii: tion pt(e){return L([M.Normal,M.Compact,M.Invisible,M.Flexible],e)}function vt(e){return L(["auto","manual","never"],e)}function mt(e){return L(["auto","manual","never"],e)}var Nr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e){return e==="auto"\|\|Nr.test(e)
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 41 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 66 62 44 Data Ascii: "ro-ro"];function Tt(e,t){var a="https://challenges.cloudflare.com";if(t){var o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,v,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",A=a["feedback-enabled"]===!1?"fbD
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 65 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 72 69 74 Data Ascii: .setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},ee(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writ
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 65 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 7a 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 42 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 Data Ascii: nfigurable:!0}}),ee(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:ze(e)}function dr(e){var t=Be();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this,ar
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 62 22 2c 22 2f 22 29 2c 6c 2c 76 2c 68 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 76 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 76 21 3d 3d 76 6f 69 64 20 30 3f 76 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 61 29 3b Data Ascii: tion(e,t,a){var o=Tt(t.params,!1),c="h/".concat("b","/"),l,v,h="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((v=t.params.theme)!==null&&v!==void 0?v:t.theme,"/").concat(a);

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:51 UTC	840	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://eyyaltynews.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:51 UTC	1297	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 28103 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: default-src 'none'; script-src 'nonce-CidSyktlBW8fMyXB' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
2025-03-24 19:26:51 UTC	411	IN	Data Raw: 63 72 69 74 69 63 61 6c 2d 63 68 3a 20 53 65 63 2d 43 48 2d 55 41 2d 42 69 74 6e 65 73 73 2c 20 53 65 63 2d 43 48 2d 55 41 2d 41 72 63 68 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 62 69 6c 65 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 64 65 6c 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2d 4c 69 73 74 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2c 20 53 65 63 2d 43 48 2d 55 41 2c 20 55 41 2d 42 69 74 6e 65 73 73 2c 20 55 41 2d 41 72 63 68 2c 20 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 4d 6f 62 69 6c 65 2c 20 55 41 2d 4d 6f 64 65 6c 2c 20 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 50 Data Ascii: critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-P
2025-03-24 19:26:51 UTC	1030	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 26 23 78 32 37 3b 6e 6f 6e 65 26 23 78 32 37 3b 3b 20 73 63 72 69 70 74 2d 73 72 63 20 26 23 78 32 37 3b 6e 6f 6e 63 65 2d 43 69 64 53 79 6b 74 6c 42 57 38 66 4d 79 58 42 26 23 78 32 37 3b 20 26 23 78 32 37 3b 75 6e 73 61 66 65 2d Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="x-ua-compatible" content="IE=Edge,chrome=1"> <meta http-equiv="content-security-policy" content="default-src 'none'; script-src 'nonce-CidSyktlBW8fMyXB' 'unsafe-
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 6d 65 73 20 66 69 6c 6c 66 61 69 6c 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 33 30 70 78 20 30 20 30 20 23 64 65 31 33 30 33 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 33 30 70 78 20 23 32 33 32 33 32 33 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 2d 64 61 72 6b 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 33 30 70 78 20 23 66 66 66 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 30 31 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 Data Ascii: mes fillfail{to{box-shadow:inset 0 30px 0 0 #de1303}}@keyframes fillfail-offlabel{to{box-shadow:inset 0 0 0 30px #232323}}@keyframes fillfail-offlabel-dark{to{box-shadow:inset 0 0 0 30px #fff}}@keyframes scale-up-center{0%{transform:scale(.01)}to{transfor
2025-03-24 19:26:51 UTC	1369	IN	Data Raw: 61 6c 69 67 6e 3a 72 69 67 68 74 7d 23 6f 76 65 72 72 75 6e 2d 69 2c 23 73 70 69 6e 6e 65 72 2d 69 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 70 69 6e 20 35 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 68 65 69 67 68 74 3a 33 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 7d 23 66 61 69 6c 2d 69 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 35 35 2c 2e 30 38 35 2c 2e 36 38 2c 2e 35 33 29 20 62 6f 74 68 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 23 64 65 31 33 30 33 7d 23 66 61 69 6c 2d 69 2c 23 73 75 63 63 65 73 73 2d 69 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 64 69 73 70 6c 61 79 3a 66 Data Ascii: align:right}#overrun-i,#spinner-i{animation:spin 5s linear infinite;display:flex;height:30px;width:30px}#fail-i{animation:scale-up-center .6s cubic-bezier(.55,.085,.68,.53) both;box-shadow:inset 0 0 0 #de1303}#fail-i,#success-i{border-radius:50%;display:f
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 61 61 39 33 37 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 3a 23 30 61 61 39 33 37 3b 66 69 6c 6c 3a 23 30 61 61 39 33 37 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 78 70 69 72 65 64 2d 63 69 72 63 6c 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 74 69 6d 65 6f 75 74 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 39 39 39 3b 66 69 6c 6c 3a 23 39 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 65 78 70 Data Ascii: hadow:inset 0 0 0 #0aa937}.theme-dark .success-circle{stroke:#0aa937;fill:#0aa937}.theme-dark .expired-circle,.theme-dark .timeout-circle{stroke-dasharray:166;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#999;fill:#999}.theme-dark #exp
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 68 31 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 61 63 74 69 76 65 2c Data Ascii: }.theme-dark h1{color:#fff}.theme-dark #challenge-error-title{color:#ffa299}.theme-dark #challenge-error-title a,.theme-dark #challenge-error-title a:link,.theme-dark #challenge-error-title a:visited{color:#bbb}.theme-dark #challenge-error-title a:active,
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 65 73 68 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6f 76 65 72 6c 61 79 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 3b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 3a 6c 69 6e 6b Data Ascii: esh-link:active,.theme-dark #timeout-refresh-link:focus,.theme-dark #timeout-refresh-link:hover{color:#949494}.theme-dark .overlay{border-color:#ffa299;color:#ffa299}.theme-dark .error-message,.theme-dark .error-message a,.theme-dark .error-message a:link
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 3a 63 68 65 63 6b 65 64 7e 2e 63 62 2d 69 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 6f 70 61 63 69 74 79 3a 31 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 20 73 63 61 6c 65 28 31 29 7d 2e 63 62 2d 6c 62 20 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 7e 2e 63 62 2d 69 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 3a 73 6f 6c 69 64 20 23 63 34 34 64 30 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 30 20 34 70 78 20 34 70 78 20 30 3b 68 65 69 67 68 74 3a 31 32 70 78 3b 6c 65 66 74 3a 35 70 78 3b 74 6f 70 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 34 35 64 65 67 29 20 73 63 61 6c 65 28 31 29 3b 77 69 64 Data Ascii: :checked~.cb-i{background-color:#fff;border-radius:5px;opacity:1;transform:rotate(0deg) scale(1)}.cb-lb input:checked~.cb-i:after{border:solid #c44d0e;border-radius:0;border-width:0 4px 4px 0;height:12px;left:5px;top:0;transform:rotate(45deg) scale(1);wid
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 20 73 70 61 63 65 2d 65 76 65 6e 6c 79 3b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 65 78 70 69 72 65 64 2d 74 65 78 74 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 6f 76 65 72 72 75 6e 2d 74 65 78 74 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 69 6d 65 6f 75 74 2d 74 65 78 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 65 78 70 69 72 65 64 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 7b 6d 61 72 67 69 6e 3a 30 Data Ascii: ontent:center space-evenly;visibility:visible}.size-compact #expired-text,.size-compact #overrun-text,.size-compact #timeout-text{display:block}.size-compact #expired-refresh-link,.size-compact #timeout-refresh-link,.size-compact .error-message a{margin:0
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 36 70 78 7d 23 74 65 72 6d 73 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 38 70 78 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 30 70 78 7d 23 74 65 72 6d 73 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 3a 30 20 2e 32 72 65 6d 7d 23 74 65 72 6d 73 20 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 23 74 65 72 6d 73 20 61 2c 23 74 65 72 6d 73 20 61 3a 6c 69 6e 6b 2c 23 74 65 72 6d 73 20 61 3a 76 69 73 69 74 65 64 7b 63 6f Data Ascii: {margin-left:0;margin-right:16px}#terms{color:#232323;display:inline-flex;font-size:8px;font-style:normal;justify-content:flex-end;line-height:10px}#terms .link-spacer{margin:0 .2rem}#terms a{display:inline-block}#terms a,#terms a:link,#terms a:visited{co

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:52 UTC	772	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=925890068fec49aa&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/lqi8i/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:52 UTC	331	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:52 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 113697 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 92589009da510c92-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:52 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 43 75 55 53 37 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 Data Ascii: window._cf_chl_opt.CuUS7={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflar
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 74 65 64 2e 25 32 30 43 68 65 63 6b 25 32 30 79 6f 75 72 25 32 30 49 6e 74 65 72 6e 65 74 25 32 30 63 6f 6e 6e 65 63 74 69 6f 6e 25 32 30 61 6e 64 25 32 30 25 33 43 61 25 32 30 63 6c 61 73 73 25 33 44 25 32 32 72 65 66 72 65 73 68 5f 6c 69 6e 6b 25 32 32 25 33 45 72 65 66 72 65 73 68 25 32 30 74 68 65 25 32 30 70 61 67 65 25 33 43 25 32 46 61 25 33 45 25 32 30 69 66 25 32 30 74 68 65 25 32 30 69 73 73 75 65 25 32 30 70 65 72 73 69 73 74 73 2e 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 22 3a 22 48 61 76 69 6e 67 25 32 30 74 72 6f 75 62 6c 65 25 33 46 22 2c 22 69 6e 76 61 6c 69 64 5f 73 69 74 65 6b 65 79 22 3a 22 49 6e 76 61 6c 69 64 25 32 30 73 69 74 65 6b 65 79 2e 25 32 30 43 6f 6e 74 61 63 74 25 32 30 74 68 65 25 Data Ascii: ted.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","turnstile_feedback_report":"Having%20trouble%3F","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 25 32 30 61 25 32 30 43 6c 6f 75 64 66 6c 61 72 65 25 32 30 73 65 63 75 72 69 74 79 25 32 30 63 68 61 6c 6c 65 6e 67 65 22 7d 2c 22 70 6f 6c 79 66 69 6c 6c 73 22 3a 7b 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 67 75 69 64 65 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 61 75 78 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 7d 2c 22 72 74 6c 22 3a 66 61 6c 73 65 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 75 73 22 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 67 4a 2c 65 4d 2c 65 4e 2c 65 4f 2c 65 52 2c 65 55 2c 65 57 2c 65 58 2c 65 59 2c 66 61 2c 66 6d 2c 66 73 2c 66 74 2c 66 75 2c 66 45 2c 66 50 2c 66 Data Ascii: %20a%20Cloudflare%20security%20challenge"},"polyfills":{"feedback_report_output_subtitle":false,"feedback_report_guideline":false,"feedback_report_aux_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eO,eR,eU,eW,eX,eY,fa,fm,fs,ft,fu,fE,fP,f
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 73 74 4f 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 6c 6e 62 66 65 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 7c 68 7d 2c 27 62 70 69 4b 73 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 26 69 7d 2c 27 71 48 4c 6d 55 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 26 68 7d 2c 27 59 61 48 6f 6f 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 79 4a 72 55 70 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 6b 53 58 50 4f 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 3c 69 7d 2c 27 4e 4b 46 56 41 27 3a 66 75 6e 63 74 69 6f 6e 28 68 Data Ascii: stO':function(h,i){return h-i},'lnbfe':function(h,i){return i\|h},'bpiKs':function(h,i){return h&i},'qHLmU':function(h,i){return i&h},'YaHoo':function(h,i){return h(i)},'yJrUp':function(h,i){return h<i},'kSXPO':function(h,i){return h<<i},'NKFVA':function(h
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 5d 28 44 2c 4e 29 7c 7c 28 44 5b 4e 5d 3d 48 2b 2b 2c 45 5b 4e 5d 3d 21 30 29 2c 4f 3d 46 2b 4e 2c 4f 62 6a 65 63 74 5b 67 4e 28 38 30 35 29 5d 5b 67 4e 28 33 38 34 29 5d 5b 67 4e 28 34 38 33 29 5d 28 44 2c 4f 29 29 46 3d 4f 3b 65 6c 73 65 20 66 6f 72 28 50 3d 67 4e 28 31 35 36 37 29 5b 67 4e 28 31 33 39 37 29 5d 28 27 7c 27 29 2c 51 3d 30 3b 21 21 5b 5d 3b 29 7b 73 77 69 74 63 68 28 50 5b 51 2b 2b 5d 29 7b 63 61 73 65 27 30 27 3a 44 5b 4f 5d 3d 48 2b 2b 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 31 27 3a 47 2d 2d 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 32 27 3a 69 66 28 4f 62 6a 65 63 74 5b 67 4e 28 38 30 35 29 5d 5b 67 4e 28 33 38 34 29 5d 5b 67 4e 28 34 38 33 29 5d 28 45 2c 46 29 29 7b 69 66 28 64 5b 67 4e 28 33 38 30 29 5d 28 32 35 36 2c 46 5b Data Ascii: ](D,N)\|\|(D[N]=H++,E[N]=!0),O=F+N,Object[gN(805)][gN(384)][gN(483)](D,O))F=O;else for(P=gN(1567)[gN(1397)]('\|'),Q=0;!![];){switch(P[Q++]){case'0':D[O]=H++;continue;case'1':G--;continue;case'2':if(Object[gN(805)][gN(384)][gN(483)](E,F)){if(d[gN(380)](256,F[
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 4e 28 35 39 34 29 5d 28 6f 2c 31 29 29 3f 28 4c 3d 30 2c 4a 5b 67 4e 28 36 32 34 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 52 3e 3e 3d 31 2c 43 2b 2b 29 3b 7d 65 6c 73 65 20 69 66 28 67 4e 28 32 35 39 29 21 3d 3d 64 5b 67 4e 28 31 32 35 39 29 5d 29 7b 66 6f 72 28 52 3d 31 2c 43 3d 30 3b 64 5b 67 4e 28 31 35 33 36 29 5d 28 43 2c 49 29 3b 4b 3d 64 5b 67 4e 28 33 30 31 29 5d 28 4b 2c 31 29 7c 52 2c 64 5b 67 4e 28 36 37 33 29 5d 28 4c 2c 64 5b 67 4e 28 33 31 31 29 5d 28 6f 2c 31 29 29 3f 28 4c 3d 30 2c 4a 5b 67 4e 28 36 32 34 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 52 3d 30 2c 43 2b 2b 29 3b 66 6f 72 28 52 3d 46 5b 67 4e 28 31 30 35 36 29 5d 28 30 29 2c 43 3d 30 3b 31 36 3e 43 3b 4b 3d 64 5b 67 4e 28 39 38 32 29 5d 28 4b 3c 3c 31 2e Data Ascii: N(594)](o,1))?(L=0,J[gN(624)](s(K)),K=0):L++,R>>=1,C++);}else if(gN(259)!==d[gN(1259)]){for(R=1,C=0;d[gN(1536)](C,I);K=d[gN(301)](K,1)\|R,d[gN(673)](L,d[gN(311)](o,1))?(L=0,J[gN(624)](s(K)),K=0):L++,R=0,C++);for(R=F[gN(1056)](0),C=0;16>C;K=d[gN(982)](K<<1.
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 28 33 37 37 29 5d 28 32 2c 31 36 29 2c 46 3d 31 3b 46 21 3d 4b 3b 4c 3d 48 26 47 2c 48 3e 3e 3d 31 2c 30 3d 3d 48 26 26 28 48 3d 6a 2c 47 3d 64 5b 67 52 28 38 38 31 29 5d 28 6f 2c 49 2b 2b 29 29 2c 4a 7c 3d 64 5b 67 52 28 39 34 33 29 5d 28 30 3c 4c 3f 31 3a 30 2c 46 29 2c 46 3c 3c 3d 31 29 3b 4d 3d 65 28 4a 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 27 27 7d 66 6f 72 28 45 3d 73 5b 33 5d 3d 4d 2c 44 5b 67 52 28 36 32 34 29 5d 28 4d 29 3b 3b 29 7b 69 66 28 64 5b 67 52 28 38 36 37 29 5d 28 49 2c 69 29 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 67 52 28 33 37 37 29 5d 28 32 2c 43 29 2c 46 3d 31 3b 46 21 3d 4b 3b 4c 3d 64 5b 67 52 28 36 38 35 29 5d 28 47 2c 48 29 2c 48 3e 3e 3d 31 2c 64 5b 67 52 28 33 39 32 Data Ascii: (377)](2,16),F=1;F!=K;L=H&G,H>>=1,0==H&&(H=j,G=d[gR(881)](o,I++)),J\|=d[gR(943)](0<L?1:0,F),F<<=1);M=e(J);break;case 2:return''}for(E=s[3]=M,D[gR(624)](M);;){if(d[gR(867)](I,i))return'';for(J=0,K=Math[gR(377)](2,C),F=1;F!=K;L=d[gR(685)](G,H),H>>=1,d[gR(392
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 5b 67 54 28 31 35 35 30 29 5d 2c 27 63 6f 64 65 27 3a 67 54 28 31 34 34 39 29 2c 27 72 63 56 27 3a 65 4d 5b 67 54 28 39 36 35 29 5d 5b 67 54 28 33 33 32 29 5d 7d 2c 27 2a 27 29 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 6a 3d 66 5b 67 5d 2c 74 79 70 65 6f 66 20 6a 3d 3d 3d 65 5b 67 54 28 31 34 39 37 29 5d 3f 6a 3a 68 5b 67 54 28 39 36 35 29 5d 5b 67 54 28 33 31 34 29 5d 5b 67 54 28 37 35 37 29 5d 7d 2c 67 29 7d 2c 65 4d 5b 67 4a 28 31 36 31 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 67 2c 68 2c 67 55 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 2c 73 2c 76 29 7b 69 3d 28 67 55 3d 67 4a 2c 7b 27 6d 66 49 67 46 27 3a 66 75 6e 63 74 69 6f 6e 28 78 2c 42 2c 43 29 7b 72 65 74 75 72 6e 20 78 28 42 2c 43 29 7d 2c 27 64 66 71 4a 4f 27 3a 66 75 6e 63 74 69 6f 6e 28 Data Ascii: [gT(1550)],'code':gT(1449),'rcV':eM[gT(965)][gT(332)]},'*'));else return j=f[g],typeof j===e[gT(1497)]?j:h[gT(965)][gT(314)][gT(757)]},g)},eM[gJ(1618)]=function(f,g,h,gU,i,j,k,l,m,n,o,s,v){i=(gU=gJ,{'mfIgF':function(x,B,C){return x(B,C)},'dfqJO':function(
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 6e 26 26 28 69 3d 6e 5b 31 5d 2c 6a 3d 70 61 72 73 65 49 6e 74 28 6e 5b 32 5d 2c 31 30 29 2c 6b 3d 70 61 72 73 65 49 6e 74 28 6e 5b 33 5d 2c 31 30 29 29 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 7d 7d 65 6c 73 65 20 68 3d 4a 53 4f 4e 5b 67 56 28 31 35 38 31 29 5d 28 65 29 3b 72 65 74 75 72 6e 20 6f 3d 7b 7d 2c 6f 5b 67 56 28 31 32 31 34 29 5d 3d 68 2c 6f 5b 67 56 28 31 31 33 34 29 5d 3d 69 2c 6f 5b 67 56 28 31 31 31 38 29 5d 3d 6a 2c 6f 5b 67 56 28 33 39 35 29 5d 3d 6b 2c 6f 5b 67 56 28 37 39 37 29 5d 3d 65 2c 6f 7d 2c 65 4d 5b 67 4a 28 31 34 35 37 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 66 2c 67 2c 68 2c 69 2c 67 58 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 67 58 3d 67 4a 2c 6a 3d 7b 7d 2c 6a 5b 67 58 28 38 36 36 29 5d 3d 67 58 28 31 Data Ascii: n&&(i=n[1],j=parseInt(n[2],10),k=parseInt(n[3],10)));else return}}else h=JSON[gV(1581)](e);return o={},o[gV(1214)]=h,o[gV(1134)]=i,o[gV(1118)]=j,o[gV(395)]=k,o[gV(797)]=e,o},eM[gJ(1457)]=function(e,f,g,h,i,gX,j,k,l,m,n,o){return gX=gJ,j={},j[gX(866)]=gX(1
2025-03-24 19:26:52 UTC	1369	IN	Data Raw: 33 36 31 29 5d 3d 65 55 2c 65 57 3d 65 4d 5b 67 4a 28 39 36 35 29 5d 5b 67 4a 28 33 31 34 29 5d 5b 67 4a 28 31 34 37 30 29 5d 2c 65 58 3d 65 4d 5b 67 4a 28 39 36 35 29 5d 5b 67 4a 28 33 31 34 29 5d 5b 67 4a 28 31 35 38 30 29 5d 2c 65 59 3d 65 4d 5b 67 4a 28 39 36 35 29 5d 5b 67 4a 28 33 31 34 29 5d 5b 67 4a 28 35 39 33 29 5d 2c 66 61 3d 21 5b 5d 2c 66 6d 3d 75 6e 64 65 66 69 6e 65 64 2c 65 4d 5b 67 4a 28 34 32 37 29 5d 28 67 4a 28 33 38 38 29 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 68 48 2c 64 2c 65 2c 68 2c 69 2c 6a 29 7b 69 66 28 68 48 3d 67 4a 2c 64 3d 7b 27 75 6a 52 76 4a 27 3a 68 48 28 31 32 39 33 29 2c 27 56 78 6b 43 78 27 3a 68 48 28 31 34 34 32 29 2c 27 46 41 49 49 61 27 3a 68 48 28 33 30 35 29 2c 27 69 42 79 51 42 27 3a 68 48 28 35 36 38 29 2c 27 65 Data Ascii: 361)]=eU,eW=eM[gJ(965)][gJ(314)][gJ(1470)],eX=eM[gJ(965)][gJ(314)][gJ(1580)],eY=eM[gJ(965)][gJ(314)][gJ(593)],fa=![],fm=undefined,eM[gJ(427)](gJ(388),function(c,hH,d,e,h,i,j){if(hH=gJ,d={'ujRvJ':hH(1293),'VxkCx':hH(1442),'FAIIa':hH(305),'iByQB':hH(568),'e

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:52 UTC	784	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:52 UTC	240	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:52 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 9258900a0ea37611-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:52 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:52 UTC	425	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:53 UTC	240	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:53 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 9258900da97ce8a3-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:53 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:53 UTC	623	OUT	GET /favicon.ico HTTP/1.1 Host: eyyaltynews.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eyyaltynews.com/securefile/email-template.html Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:53 UTC	261	IN	HTTP/1.1 404 Not Found Date: Mon, 24 Mar 2025 19:26:53 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 22:06:31 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2025-03-24 19:26:53 UTC	583	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:53 UTC	1191	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1785170061:1742841052:UsQfaBa_zEUVpfW-ViWsHOf14Uigd-nkbFZh4vmrZfI/9258900688e658c1/TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3340 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:53 UTC	3340	OUT	Data Raw: 62 6d 4c 71 48 71 72 71 4e 71 4c 71 4b 43 75 2b 43 75 45 71 43 63 50 6e 57 5a 43 64 75 57 75 79 36 63 42 4a 73 75 44 6b 6e 71 76 73 50 6b 75 2d 75 46 73 57 6e 47 73 6a 72 65 47 75 64 73 42 47 75 34 75 62 68 71 75 48 6b 71 75 70 42 75 70 78 6d 6a 39 75 4e 4c 55 6b 6b 47 42 73 50 67 75 41 63 50 79 75 4e 77 41 55 55 75 39 71 43 70 6e 5a 54 37 34 43 75 57 62 35 33 5a 75 4f 71 42 70 6e 72 5a 6e 72 6b 64 54 75 32 72 53 74 37 65 4c 5a 36 76 42 75 43 46 46 42 36 6e 49 47 24 64 42 75 50 72 65 71 6d 6d 31 46 6d 71 75 2b 50 44 49 4d 43 68 41 47 44 65 64 75 50 77 6e 43 77 41 36 75 6a 76 46 42 73 64 50 71 6a 72 75 6b 6d 75 51 71 75 46 75 6a 35 75 41 71 30 43 39 6b 63 2d 64 64 6a 62 38 50 71 62 50 51 63 63 67 71 75 56 75 57 4c 75 71 71 73 75 6f 71 75 67 75 70 4c 75 79 Data Ascii: bmLqHqrqNqLqKCu+CuEqCcPnWZCduWuy6cBJsuDknqvsPku-uFsWnGsjreGudsBGu4ubhquHkqupBupxmj9uNLUkkGBsPguAcPyuNwAUUu9qCpnZT74CuWb53ZuOqBpnrZnrkdTu2rSt7eLZ6vBuCFFB6nIG$dBuPreqmm1Fmqu+PDIMChAGDeduPwnCwA6ujvFBsdPqjrukmuQquFuj5uAq0C9kc-ddjb8PqbPQccgquVuWLuqqsuoqugupLuy
2025-03-24 19:26:53 UTC	1091	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:53 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 231112 Connection: close cf-chl-gen: axvP5uJwipO8QlqRonKKishkXJQv3S+SL0nLX4rfcfawnUlASJUz+QUQ3lQ2EL2qSUq1btUo7lGmYFXsIZM6XfPoV15vElSKJc38CM2V3T3YdGD3w06JXFEgvfQGA9U98oTSYc7VoPeqmMuyo4gUDStjG7a7hSEsKt7u3uezT9HJAtoM9ca0BJp58C5yD5t2CvQMMVRe7zeQtfuaCiZnePEd/pxgpC2vs+5mzikMEGNlX+/tGHUCOSzvsfBt6gYB8xTPctQd1zsjlMu8Wkrn9ka0/EYIV8/4Mux5IGfymwpRp9zFp8/mzb1IyciNEpDHyU+9AyTFFPpfhTwyEgeUT0w76ehRFE9it2cQ7JP4BnO2qdAjUXPYXuj+AsCRsnC1ucm2N7Jy30J8v+mCYUW1twxn07Rp+RUDVXuKHB1qErlm0S694+H4f6wVX16C/QNZR8M6L6f/2rVta60plFj1cy4Fhadu3w3wZCFfqJjphoXji9QQ28KjYcaTwEKlnKCltkKoe7w1Xqu0sVU+KQUGo5KcoIGWgSFYz9TEZc1NIgJSWdMpKylv6gBgI76HQgKpI9tYJfjlMRBeAhSaSJXfZt3NGoEQkvQ6evF4MTlfGb4SK+0o7Xw8LBnGA+zvZ4M+H7IvLlhUTZfMYcUL+7ITIO/moNGvoDENzbOOYWICxvYt8+M7LXsj0ojR5QxuE+dHvg3HMwLTRg+x7eo/1/YWMiuV2Tjyo1Ysk02xAbU7zDKiUQysEcyhKHheYlHz58GQkKRNPd0Z6Hpi+yqBU3wdA3vMKgf7I3Bq1kD8Qhhj2L9Jba0DL8xOPfPd52SEEgVi$dmSPMvBvzcTjMdss5SFUAg== Server: cloudflare CF-RAY: 9258900dc98b8c06-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:53 UTC	278	IN	Data Raw: 65 35 79 67 6d 70 57 48 77 70 6e 4c 74 36 43 76 68 37 33 53 6f 36 43 73 72 4a 57 67 31 5a 43 33 70 62 32 39 6e 63 2b 37 6e 4a 75 79 31 38 48 6b 32 37 54 64 79 63 4b 38 33 39 71 2b 71 4d 4b 37 30 4c 44 67 78 2b 76 54 2b 63 7a 58 2f 4f 6a 4e 7a 2f 66 53 30 2f 63 47 42 62 6a 6c 2b 2f 66 4b 36 50 33 46 37 4f 76 49 43 65 48 74 39 42 54 56 43 42 6a 5a 37 66 67 50 37 75 38 52 2b 79 48 59 2f 42 62 64 39 77 55 71 36 66 6b 44 2b 51 38 41 49 67 77 78 38 51 63 52 4b 51 4d 4c 46 53 30 46 45 79 33 30 2f 68 34 30 49 78 51 32 4e 6b 59 61 47 54 74 46 4b 53 58 2b 48 79 73 51 54 6a 39 4e 4d 43 59 6b 57 45 34 7a 57 7a 46 4e 46 7a 73 75 59 45 46 43 49 6c 46 42 51 68 6b 2f 52 56 6b 2b 51 31 35 50 4f 55 67 70 5a 55 52 6d 4d 45 4a 4d 59 57 63 77 4d 7a 52 47 55 47 31 2f 51 56 4d Data Ascii: e5ygmpWHwpnLt6Cvh73So6CsrJWg1ZC3pb29nc+7nJuy18Hk27TdycK839q+qMK70LDgx+vT+czX/OjNz/fS0/cGBbjl+/fK6P3F7OvICeHt9BTVCBjZ7fgP7u8R+yHY/Bbd9wUq6fkD+Q8AIgwx8QcRKQMLFS0FEy30/h40IxQ2NkYaGTtFKSX+HysQTj9NMCYkWE4zWzFNFzsuYEFCIlFBQhk/RVk+Q15POUgpZURmMEJMYWcwMzRGUG1/QVM
2025-03-24 19:26:53 UTC	1369	IN	Data Raw: 75 45 58 6d 56 55 69 35 69 46 6c 5a 68 30 58 70 70 75 6c 46 70 2f 59 6e 57 44 6f 59 56 33 68 33 2b 44 70 48 71 46 61 48 32 55 73 32 75 33 67 59 4b 53 71 49 71 47 76 4a 36 4f 66 48 64 39 6b 6e 72 44 73 34 61 56 74 37 36 58 6f 35 33 42 6d 71 6d 65 77 61 61 72 6a 4d 4c 43 71 36 32 6e 72 4c 50 62 30 73 44 66 75 4f 4f 31 73 62 32 36 74 62 58 58 75 72 7a 62 34 37 72 44 32 64 2f 6a 34 36 7a 42 36 73 50 50 79 65 33 46 31 62 54 54 7a 4e 6a 30 34 39 54 7a 2b 39 4c 62 38 66 66 37 2b 38 54 5a 41 39 33 6e 34 51 72 30 38 51 6e 71 79 66 48 51 45 2b 51 55 47 52 6f 42 49 42 38 6a 32 66 49 6a 33 51 6e 77 4b 51 76 32 34 68 73 74 41 53 41 7a 4d 75 6b 50 37 43 59 5a 45 42 58 32 47 78 6f 77 4b 6a 77 4d 38 77 34 68 48 79 59 6e 42 7a 6b 39 50 69 6f 70 54 77 73 66 4b 30 67 68 53 Data Ascii: uEXmVUi5iFlZh0XppulFp/YnWDoYV3h3+DpHqFaH2Us2u3gYKSqIqGvJ6OfHd9knrDs4aVt76Xo53BmqmewaarjMLCq62nrLPb0sDfuOO1sb26tbXXurzb47rD2d/j46zB6sPPye3F1bTTzNj049Tz+9Lb8ff7+8TZA93n4Qr08QnqyfHQE+QUGRoBIB8j2fIj3QnwKQv24hstASAzMukP7CYZEBX2GxowKjwM8w4hHyYnBzk9PiopTwsfK0ghS
2025-03-24 19:26:53 UTC	1369	IN	Data Raw: 53 66 48 5a 35 61 70 5a 36 66 57 79 61 66 6f 46 76 6e 6f 4b 45 61 36 4b 47 69 47 36 6d 69 6f 32 47 71 6f 36 52 69 61 36 53 6c 59 79 79 6c 70 6d 50 74 70 71 64 6b 72 71 65 6f 5a 57 2b 6f 71 57 58 78 73 47 35 70 36 53 38 71 71 36 75 6f 4e 62 4f 72 61 71 77 32 39 47 79 70 70 76 62 74 61 48 53 6e 4c 65 65 73 4d 57 7a 36 37 54 4a 75 4d 57 34 7a 62 7a 46 36 37 7a 32 34 63 65 78 34 2b 65 36 2f 4e 58 7a 38 4d 67 41 31 66 69 39 42 74 66 63 78 76 65 38 78 2b 62 63 44 75 41 46 34 66 37 6d 43 66 54 4f 31 67 6b 51 36 42 44 55 42 74 59 61 36 41 49 57 32 53 55 44 48 76 48 6f 4b 42 73 4e 4c 51 55 77 41 65 6f 4a 4c 52 45 43 4a 51 6f 67 43 53 7a 30 4e 77 63 52 4d 67 34 75 44 66 73 6a 4f 52 48 34 45 6a 6b 45 53 78 6f 36 52 44 73 77 43 79 77 38 48 43 35 48 44 69 34 6a 4d 6c Data Ascii: SfHZ5apZ6fWyafoFvnoKEa6KGiG6mio2Gqo6Ria6SlYyylpmPtpqdkrqeoZW+oqWXxsG5p6S8qq6uoNbOraqw29GyppvbtaHSnLeesMWz67TJuMW4zbzF67z24cex4+e6/NXz8MgA1fi9Btfcxve8x+bcDuAF4f7mCfTO1gkQ6BDUBtYa6AIW2SUDHvHoKBsNLQUwAeoJLRECJQogCSz0NwcRMg4uDfsjORH4EjkESxo6RDswCyw8HC5HDi4jMl
2025-03-24 19:26:53 UTC	1369	IN	Data Raw: 6b 49 35 37 6e 49 4e 35 6c 6d 61 54 67 36 57 4c 72 32 36 65 70 6d 69 47 63 36 74 76 63 4c 6c 76 72 59 6d 70 69 62 4b 67 6f 4a 47 54 73 37 65 34 76 70 6d 31 77 62 4f 30 68 4d 4b 64 77 74 47 5a 78 36 71 4c 74 4c 65 31 70 4d 48 58 78 64 54 4b 30 4b 65 62 7a 37 57 63 34 4f 48 63 73 72 6e 63 30 38 79 6a 6f 2b 36 68 76 64 2f 63 30 36 72 7a 7a 62 62 43 2b 4e 72 4b 32 39 66 5a 79 4e 76 63 76 2b 76 68 41 2f 44 58 2f 50 50 7a 79 67 33 6b 79 4d 37 5a 45 51 48 7a 79 75 34 46 36 41 6b 59 46 68 6a 6d 38 2b 6b 42 2b 67 50 32 34 68 4c 79 42 2b 66 33 47 2b 49 4a 42 75 55 64 4a 77 76 70 4a 67 4d 71 45 41 34 44 46 42 58 33 48 54 33 7a 51 41 73 50 47 6a 55 6b 44 55 55 39 4a 6b 6b 34 4e 53 77 62 4a 51 59 77 49 55 51 4e 44 53 41 55 55 43 67 36 55 46 46 45 4e 52 41 2f 4f 46 74 Data Ascii: kI57nIN5lmaTg6WLr26epmiGc6tvcLlvrYmpibKgoJGTs7e4vpm1wbO0hMKdwtGZx6qLtLe1pMHXxdTK0Kebz7Wc4OHcsrnc08yjo+6hvd/c06rzzbbC+NrK29fZyNvcv+vhA/DX/PPzyg3kyM7ZEQHzyu4F6AkYFhjm8+kB+gP24hLyB+f3G+IJBuUdJwvpJgMqEA4DFBX3HT3zQAsPGjUkDUU9Jkk4NSwbJQYwIUQNDSAUUCg6UFFENRA/OFt
2025-03-24 19:26:53 UTC	1369	IN	Data Raw: 61 4b 6a 6e 36 79 6b 68 36 53 52 70 5a 32 66 67 49 78 78 72 32 36 55 6a 34 35 31 70 37 4f 49 6e 4a 65 2b 74 36 4b 67 6d 4a 32 36 78 38 4f 6c 78 36 47 37 69 49 2b 4b 78 61 65 65 6c 49 79 31 78 64 65 36 74 4e 4f 76 71 74 7a 68 31 35 72 68 77 64 2f 61 73 39 62 42 6f 72 33 61 71 74 66 51 7a 75 50 42 35 38 4b 78 36 38 62 32 31 62 48 4e 36 72 72 6e 35 39 37 72 37 38 49 46 39 50 76 7a 77 2f 58 70 38 77 62 37 41 50 33 49 37 51 66 69 36 2b 54 56 41 2b 6b 4b 35 68 44 32 31 51 6e 61 38 42 49 66 46 67 49 41 4a 2f 30 62 4b 42 73 6d 48 65 54 75 44 51 6e 36 47 77 30 73 4c 67 4d 79 39 53 67 48 4d 42 73 2b 39 6a 63 4f 45 6a 72 31 49 7a 45 63 47 79 45 72 4a 42 30 64 4a 79 6f 67 52 79 73 75 49 30 73 76 4d 69 5a 50 4d 7a 59 6f 56 31 4a 4b 4f 44 56 4e 4f 7a 38 2f 4d 57 64 66 Data Ascii: aKjn6ykh6SRpZ2fgIxxr26Uj451p7OInJe+t6KgmJ26x8Olx6G7iI+KxaeelIy1xde6tNOvqtzh15rhwd/as9bBor3aqtfQzuPB58Kx68b21bHN6rrn597r78IF9Pvzw/Xp8wb7AP3I7Qfi6+TVA+kK5hD21Qna8BIfFgIAJ/0bKBsmHeTuDQn6Gw0sLgMy9SgHMBs+9jcOEjr1IzEcGyErJB0dJyogRysuI0svMiZPMzYoV1JKODVNOz8/MWdf
2025-03-24 19:26:53 UTC	1369	IN	Data Raw: 53 51 62 6e 35 6c 68 6f 32 51 64 6f 43 4e 72 6e 75 35 6b 71 65 4f 76 5a 61 71 74 38 47 76 75 36 62 46 69 4c 61 4b 68 4d 66 47 6d 63 66 4d 78 62 54 55 72 4e 65 71 6f 72 43 52 71 61 6a 62 31 71 6a 61 33 4c 36 74 7a 38 58 51 6f 4b 65 69 32 62 2b 32 72 4b 54 58 70 39 2f 53 7a 4f 76 77 39 75 57 31 35 4c 54 6c 76 50 6e 72 36 63 44 76 36 2b 37 42 38 76 50 30 78 4d 6b 4d 78 4d 6e 37 32 67 54 75 7a 64 2f 76 42 65 50 69 38 78 6a 57 35 76 63 63 46 2b 38 56 2b 53 50 78 41 4f 33 37 38 67 54 66 35 42 6e 71 4a 51 6b 4a 43 7a 45 53 43 2f 49 6a 4b 43 6e 33 45 41 63 63 43 78 51 4c 48 2f 63 5a 51 30 49 53 48 43 4d 6b 47 6a 63 48 4e 43 30 48 49 6b 45 6e 48 30 38 39 53 45 56 4e 51 6b 73 36 54 6b 5a 4d 4c 31 38 61 56 79 70 62 59 53 35 6c 54 79 41 6e 49 57 52 58 4b 79 56 6e 54 Data Ascii: SQbn5lho2QdoCNrnu5kqeOvZaqt8Gvu6bFiLaKhMfGmcfMxbTUrNeqorCRqajb1qja3L6tz8XQoKei2b+2rKTXp9/SzOvw9uW15LTlvPnr6cDv6+7B8vP0xMkMxMn72gTuzd/vBePi8xjW5vccF+8V+SPxAO378gTf5BnqJQkJCzESC/IjKCn3EAccCxQLH/cZQ0ISHCMkGjcHNC0HIkEnH089SEVNQks6TkZML18aVypbYS5lTyAnIWRXKyVnT
2025-03-24 19:26:53 UTC	1369	IN	Data Raw: 4c 68 34 2b 4c 72 48 4b 75 65 35 4a 2b 6c 4a 61 30 65 70 2b 43 6c 61 50 42 70 5a 65 6e 6e 36 47 62 71 36 53 51 6e 36 2b 6f 78 71 61 50 79 34 2f 53 6d 38 65 59 70 73 44 67 7a 75 4f 72 72 72 37 55 74 72 4c 6f 79 72 71 6f 6f 36 6d 2b 70 75 2f 66 73 73 48 77 39 37 50 43 32 73 36 36 37 64 6e 50 33 64 33 30 2b 74 76 78 35 4c 37 6b 35 65 62 6e 79 75 6e 75 41 73 37 6e 37 67 4c 67 41 76 59 48 41 41 30 52 45 74 76 36 2b 76 66 73 2b 67 49 4e 34 68 58 64 43 50 59 46 48 52 4d 58 2f 75 76 75 2f 67 6a 35 37 51 59 76 4c 50 44 79 4f 75 38 75 43 7a 33 39 39 54 55 2f 44 76 6e 35 44 79 63 38 47 50 34 65 48 79 30 57 54 54 68 4a 48 6b 45 7a 4e 42 31 55 52 54 63 6d 53 45 55 74 54 31 39 66 4d 6a 73 39 48 7a 64 44 51 31 6f 35 57 47 74 72 50 6a 31 49 58 6a 74 47 51 32 39 66 52 6e Data Ascii: Lh4+LrHKue5J+lJa0ep+ClaPBpZenn6Gbq6SQn6+oxqaPy4/Sm8eYpsDgzuOrrr7UtrLoyrqoo6m+pu/fssHw97PC2s667dnP3d30+tvx5L7k5ebnyunuAs7n7gLgAvYHAA0REtv6+vfs+gIN4hXdCPYFHRMX/uvu/gj57QYvLPDyOu8uCz399TU/Dvn5Dyc8GP4eHy0WTThJHkEzNB1URTcmSEUtT19fMjs9HzdDQ1o5WGtrPj1IXjtGQ29fRn
2025-03-24 19:26:53 UTC	1369	IN	Data Raw: 71 37 4b 4f 6c 35 47 39 6c 71 46 39 70 6f 65 78 74 37 75 35 68 4b 6e 46 68 63 75 51 6d 37 54 55 69 39 65 66 6f 72 4c 49 71 71 62 63 76 71 36 63 6c 35 32 79 6d 75 50 54 70 72 58 6b 36 36 65 32 7a 73 4b 75 34 63 33 44 30 64 48 6f 37 73 2f 6c 32 4c 4c 59 32 64 72 62 76 74 33 69 39 63 4c 62 34 76 58 55 39 65 72 36 38 77 45 46 42 73 2f 75 37 75 76 67 37 76 55 42 31 67 6a 6d 44 76 66 31 2f 74 55 58 48 76 33 2b 34 75 38 55 48 78 41 41 4a 78 58 7a 49 52 63 77 37 69 2f 35 4a 52 54 39 4e 44 45 57 41 75 73 6f 37 51 62 7a 2f 51 2f 32 43 79 77 75 39 68 34 37 46 79 41 61 41 78 59 71 51 54 41 34 51 79 45 4c 46 44 49 7a 4e 44 56 47 4a 7a 6b 39 53 69 6b 58 51 44 70 42 48 45 52 5a 58 56 39 51 56 6b 64 65 53 45 5a 4b 59 30 4a 49 51 6c 52 42 61 6c 42 33 4e 31 46 72 65 55 35 Data Ascii: q7KOl5G9lqF9poext7u5hKnFhcuQm7TUi9eforLIqqbcvq6cl52ymuPTprXk66e2zsKu4c3D0dHo7s/l2LLY2drbvt3i9cLb4vXU9er68wEFBs/u7uvg7vUB1gjmDvf1/tUXHv3+4u8UHxAAJxXzIRcw7i/5JRT9NDEWAuso7Qbz/Q/2Cywu9h47FyAaAxYqQTA4QyELFDIzNDVGJzk9SikXQDpBHERZXV9QVkdeSEZKY0JIQlRBalB3N1FreU5
2025-03-24 19:26:53 UTC	1369	IN	Data Raw: 72 75 45 6c 4b 4f 68 75 5a 61 6e 79 36 43 66 78 4b 79 63 6f 61 2b 67 6a 4d 53 57 30 4c 53 30 74 74 53 38 75 4b 2b 62 7a 4c 7a 67 76 4d 4b 2b 34 75 62 47 77 75 58 71 79 73 62 77 78 4f 4c 65 30 71 62 52 31 37 62 53 38 4f 37 6a 36 66 50 55 33 66 44 69 31 73 4c 7a 2b 73 50 79 32 74 33 66 32 2b 4d 4d 79 2f 41 52 36 42 54 6b 34 74 30 42 35 65 55 59 44 65 72 4f 39 68 62 75 2f 68 62 76 46 68 55 47 44 2f 44 7a 2b 75 45 6d 4b 2f 6b 50 37 76 6f 4b 4d 41 30 53 42 69 59 6e 42 67 34 6e 4b 77 6f 53 4a 79 38 4f 46 68 31 45 4a 76 30 50 52 77 45 54 49 42 77 6b 49 45 45 48 51 31 49 53 54 69 30 6f 53 67 39 4b 44 43 6f 34 56 6b 63 76 47 6c 52 69 4e 68 77 2b 55 55 41 7a 4f 32 6b 68 4b 43 31 41 57 44 6c 6b 50 6b 74 30 56 69 34 2f 64 7a 46 44 55 45 78 55 55 48 45 33 63 7a 70 4f Data Ascii: ruElKOhuZany6CfxKycoa+gjMSW0LS0ttS8uK+bzLzgvMK+4ubGwuXqysbwxOLe0qbR17bS8O7j6fPU3fDi1sLz+sPy2t3f2+MMy/AR6BTk4t0B5eUYDerO9hbu/hbvFhUGD/Dz+uEmK/kP7voKMA0SBiYnBg4nKwoSJy8OFh1EJv0PRwETIBwkIEEHQ1ISTi0oSg9KDCo4VkcvGlRiNhw+UUAzO2khKC1AWDlkPkt0Vi4/dzFDUExUUHE3czpO

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:53 UTC	639	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1785170061:1742841052:UsQfaBa_zEUVpfW-ViWsHOf14Uigd-nkbFZh4vmrZfI/9258900688e658c1/TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:54 UTC	442	IN	HTTP/1.1 400 Bad Request Date: Mon, 24 Mar 2025 19:26:53 GMT Content-Type: application/json Content-Length: 14 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: X6HMhx4f1r75/4tkv6X6T1GR4fLV+DD1M79ACYSqAQe8xPDScu/tJ7XjKSQhP4MCsW0ej3lxQNvk3hym/n/aqA==$Avbo5TFIyKnQMAPREPK9nQ== Server: cloudflare CF-RAY: 925890135b13c794-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:54 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 38 30 7d Data Ascii: {"err":100280}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:53 UTC	1189	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/90605971:1742840827:oID_OK0KPEBaFjrqV1VD9LXn4gNj1wLsREK3Hh32ooM/925890068fec49aa/OUH_lw1ZrO9k52HS7lu7RY6EJtTprXq0qXwNnTzjzEI-1742844411-1.1.1.1-d24Wj.MBIbD8_HS9LHTCYzl7lt.8hYXP7t_vSDYzoKHGH5pt6V16NYURJSlKIk1u HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3333 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: OUH_lw1ZrO9k52HS7lu7RY6EJtTprXq0qXwNnTzjzEI-1742844411-1.1.1.1-d24Wj.MBIbD8_HS9LHTCYzl7lt.8hYXP7t_vSDYzoKHGH5pt6V16NYURJSlKIk1u cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/lqi8i/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:53 UTC	3333	OUT	Data Raw: 46 6e 71 78 54 78 35 78 56 78 71 78 63 4a 42 49 4a 42 6d 78 4a 4f 75 55 68 52 4a 79 42 68 42 2d 50 4f 77 38 37 42 6a 4e 55 78 36 37 75 4e 42 32 42 74 37 68 55 39 37 6c 35 5a 39 42 79 37 77 39 42 76 42 46 58 78 42 54 4e 78 42 51 77 42 51 65 6e 6c 44 42 56 71 4b 4e 4e 39 77 37 75 45 42 64 4f 75 2d 42 56 41 37 6c 79 42 6c 6d 51 42 70 42 75 55 6d 77 50 32 36 4e 68 4b 77 44 78 75 5a 42 57 67 4e 34 67 4e 4b 6e 43 53 4a 5a 59 59 43 30 4b 2b 44 42 53 42 64 64 37 61 48 42 46 30 4a 78 6c 4c 44 2d 5a 5a 74 68 5a 37 76 2d 55 6e 31 37 51 6e 63 63 52 30 48 78 4f 42 5a 48 42 73 74 44 37 45 42 4a 4e 42 44 37 6c 6c 42 4e 6b 6a 78 4a 32 46 55 52 39 6c 74 78 45 35 36 45 5a 42 4a 37 6c 72 42 4a 46 67 76 54 6e 51 76 54 37 6a 41 53 42 77 42 79 4e 42 44 4f 45 66 76 78 42 46 70 Data Ascii: FnqxTx5xVxqxcJBIJBmxJOuUhRJyBhB-POw87BjNUx67uNB2Bt7hU97l5Z9By7w9BvBFXxBTNxBQwBQenlDBVqKNN9w7uEBdOu-BVA7lyBlmQBpBuUmwP26NhKwDxuZBWgN4gNKnCSJZYYC0K+DBSBdd7aHBF0JxlLD-ZZthZ7v-Un17QnccR0HxOBZHBstD7EBJNBD7llBNkjxJ2FUR9ltxE56EZBJ7lrBJFgvTnQvT7jASBwByNBDOEfvxBFp
2025-03-24 19:26:54 UTC	1051	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:54 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 228512 Connection: close cf-chl-gen: v3AMY/4YFwKKXJpmoJ2TdJMIICTow6yaU9w/kNubQNYaf4Pgn0WHma48fSE5BQM2UAvtrc42lubOpx8eu8EGohmN+mrH1EVJ377axpY5mPpjQBrMftgOvEpyjVjIUWHRKx01Wz6i3uzDAA2s87xUQMZgSKaOehq3MBzNoSmKsJvqUN4NZz6nV5JRZ81hm1h+tMIqLeJ2LbYaNEWvI3Da02P+PySR4uS4vgJLZhbHGpILxR1oiIQ2mxbbDWJrcI+jSDItE0qJ0M9hqqhOw/CdD3HeSNF5d156pGFD4XUC4AAo8RroHPuhzMUurVrEFK25wKbbcM4L8LT7GEjF0NN2sHqTCyV6MA3W20dOaleFL82vYlXzty/HMB+PogOFu0r1fHRrgwB16zzjmnLdQKEh8v51GNK0Fc6+/s0CvHk20DORzKwuB2tuxxfHP4vFLHSW+szTepup/4tqsiwAwsLaABPLo7baqAdorXoLxyvpDoLFnoKCytv7j2dgTfKUxoMfQq2blVWgid3c3B0RhACaT2mZ/Psa7qDKYJ6veQAYOBft6FKJg5kwnr4C807j62ndgaxAWxElOvT32YMpdLK9bpfDP57oqI5hM4VpKZbk2O0jzSumUXkflKsrrSiwGck4p85YfHxcHx6lul6KTfTA8fAcHmTWbxt97cm6WIdbgzQBk3N2uJjH004S/3h+NQgGer7TnqPD2zcWArltIRtCBpYvXQN+xSUZazxysp6SFFpMt+CxvQkYJDdsdj0e6nOp3gY2xp/tx82KmT73WEGgBQ==$rThtJA7SBkUuGMQTxjH2FA== Server: cloudflare CF-RAY: 925890136c001a5c-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:54 UTC	318	IN	Data Raw: 59 48 78 38 59 6b 2b 4b 6a 6b 57 51 61 47 78 76 68 58 64 4d 64 31 56 79 68 33 69 67 59 57 32 44 5a 48 65 4f 68 70 46 7a 70 4a 78 32 5a 48 61 61 6e 34 6d 7a 73 58 32 30 74 58 57 6b 71 33 71 6c 6d 4b 79 50 66 72 4b 70 72 58 6d 58 74 5a 65 52 6c 34 4b 4a 74 59 4e 2f 75 5a 71 37 69 36 2b 4f 76 6f 2f 46 32 4d 48 4f 78 71 57 37 71 64 33 55 33 64 7a 59 73 61 4f 62 6e 4e 48 44 78 39 65 31 74 4b 50 63 75 36 2f 75 36 4c 32 6d 34 73 33 68 30 2b 33 6d 72 62 66 37 35 77 48 49 2f 41 4c 61 35 63 54 56 31 39 48 52 32 64 76 56 35 4d 54 4e 45 65 67 45 7a 64 4d 55 7a 41 2f 6b 47 65 30 4f 46 41 34 64 46 76 6f 4b 41 2b 73 68 39 51 63 6d 41 67 45 6b 35 66 6a 36 39 77 4d 4c 2f 68 41 53 44 2f 41 4d 44 78 51 75 46 44 59 31 45 6a 45 31 4c 78 55 7a 45 68 6a 37 48 69 51 66 43 67 6f Data Ascii: YHx8Yk+KjkWQaGxvhXdMd1Vyh3igYW2DZHeOhpFzpJx2ZHaan4mzsX20tXWkq3qlmKyPfrKprXmXtZeRl4KJtYN/uZq7i6+Ovo/F2MHOxqW7qd3U3dzYsaObnNHDx9e1tKPcu6/u6L2m4s3h0+3mrbf75wHI/ALa5cTV19HR2dvV5MTNEegEzdMUzA/kGe0OFA4dFvoKA+sh9QcmAgEk5fj69wML/hASD/AMDxQuFDY1EjE1LxUzEhj7HiQfCgo
2025-03-24 19:26:54 UTC	1369	IN	Data Raw: 6c 49 4c 7a 52 70 58 31 35 51 59 46 35 69 65 6c 78 69 63 33 79 47 5a 6d 65 42 59 47 46 78 53 35 4f 4c 6c 45 36 56 68 47 6c 7a 64 35 42 72 6a 6e 43 57 62 46 6c 72 6e 48 32 61 66 59 52 69 6c 5a 57 70 6d 33 78 72 73 5a 39 72 63 34 69 64 70 4b 79 73 74 34 57 74 69 37 5a 39 6d 6e 79 42 77 4d 4b 62 6f 62 69 44 6f 4b 53 44 6f 4d 62 46 79 4d 48 45 76 36 58 48 6f 36 69 4e 73 70 57 5a 32 4a 76 4f 76 5a 61 62 73 37 33 61 75 4d 36 32 6f 62 50 69 75 39 7a 59 33 4f 43 71 33 38 7a 6d 36 63 6e 67 36 63 66 72 74 38 50 36 35 63 62 38 2b 4e 32 33 2f 64 55 41 42 51 44 46 32 76 62 31 33 75 59 4a 31 74 30 48 79 67 50 45 37 67 62 50 45 52 58 79 36 64 49 61 45 67 7a 34 48 68 6e 36 34 68 67 41 47 76 63 55 35 2f 50 6a 49 66 72 6f 2f 53 48 38 37 79 45 4e 38 53 48 78 37 53 76 30 2b Data Ascii: lILzRpX15QYF5ielxic3yGZmeBYGFxS5OLlE6VhGlzd5BrjnCWbFlrnH2afYRilZWpm3xrsZ9rc4idpKyst4Wti7Z9mnyBwMKbobiDoKSDoMbFyMHEv6XHo6iNspWZ2JvOvZabs73auM62obPiu9zY3OCq38zm6cng6cfrt8P65cb8+N23/dUABQDF2vb13uYJ1t0HygPE7gbPERXy6dIaEgz4Hhn64hgAGvcU5/PjIfro/SH87yEN8SHx7Sv0+
2025-03-24 19:26:54 UTC	1369	IN	Data Raw: 34 51 59 46 39 50 45 57 45 67 55 42 47 56 59 56 45 53 6c 69 4a 53 45 35 66 62 31 61 57 6b 49 46 55 57 47 5a 62 66 56 64 76 58 5a 53 56 6b 33 35 2f 69 48 36 71 6c 32 46 36 68 49 61 75 6a 71 61 61 62 57 32 55 6c 6f 64 78 63 35 4b 53 69 33 56 38 69 6e 6e 41 6d 63 42 2b 6b 4a 4f 67 78 4b 53 38 69 38 79 65 78 34 2b 47 75 5a 47 72 73 49 32 72 77 64 4c 49 75 61 79 56 7a 4b 7a 4f 31 39 2f 68 34 74 6d 34 35 39 66 6c 33 37 72 6a 33 4c 57 75 36 2b 7a 78 77 72 48 65 31 73 54 6a 74 37 4c 6c 35 50 71 38 73 4c 47 36 7a 41 4c 43 31 4d 48 6c 34 66 44 38 78 4e 54 57 35 75 77 47 44 75 59 44 42 68 62 6e 47 4f 6a 6c 39 2b 4c 75 44 4e 6b 4c 36 75 6f 67 34 65 7a 62 47 76 4d 69 35 76 67 5a 36 77 41 72 4a 2b 30 71 48 79 6b 41 4c 75 73 6c 41 6a 4c 76 4b 52 45 51 39 77 30 33 4f 69 Data Ascii: 4QYF9PEWEgUBGVYVESliJSE5fb1aWkIFUWGZbfVdvXZSVk35/iH6ql2F6hIaujqaabW2Ulodxc5KSi3V8innAmcB+kJOgxKS8i8yex4+GuZGrsI2rwdLIuayVzKzO19/h4tm459fl37rj3LWu6+zxwrHe1sTjt7Ll5Pq8sLG6zALC1MHl4fD8xNTW5uwGDuYDBhbnGOjl9+LuDNkL6uog4ezbGvMi5vgZ6wArJ+0qHykALuslAjLvKREQ9w03Oi
2025-03-24 19:26:54 UTC	1369	IN	Data Raw: 63 6d 5a 4c 69 57 32 4f 65 34 46 74 67 6e 39 64 68 6c 56 75 55 47 2b 50 64 58 71 50 62 46 57 55 59 47 78 69 6f 56 31 33 70 32 43 63 61 4a 65 56 5a 32 61 72 72 58 46 75 74 4a 36 50 68 4b 53 44 65 4c 69 4f 64 47 2b 37 66 58 79 4b 76 35 65 4f 74 5a 53 52 6b 4c 47 71 6e 34 71 4c 72 73 43 6d 78 71 62 4d 79 61 79 31 78 70 54 48 7a 37 69 55 79 61 32 38 79 73 4b 64 33 39 4b 58 77 73 47 79 32 4c 6e 61 70 74 2f 61 78 73 43 75 73 65 54 69 72 50 4c 57 72 37 48 32 31 74 62 35 30 75 76 78 38 65 72 58 75 39 49 47 39 4d 45 4a 33 65 62 5a 42 77 6e 38 32 39 48 51 35 75 45 56 2f 67 6e 6c 2b 4e 6a 4e 48 67 33 70 47 75 77 64 34 52 38 6d 45 39 30 54 2b 75 4d 70 47 66 59 64 4b 67 6b 5a 44 2b 2f 74 4d 66 49 6b 44 7a 6e 76 2b 53 30 38 4d 67 30 41 45 78 7a 37 46 45 41 47 47 45 45 Data Ascii: cmZLiW2Oe4Ftgn9dhlVuUG+PdXqPbFWUYGxioV13p2CcaJeVZ2arrXFutJ6PhKSDeLiOdG+7fXyKv5eOtZSRkLGqn4qLrsCmxqbMyay1xpTHz7iUya28ysKd39KXwsGy2Lnapt/axsCuseTirPLWr7H21tb50uvx8erXu9IG9MEJ3ebZBwn829HQ5uEV/gnl+NjNHg3pGuwd4R8mE90T+uMpGfYdKgkZD+/tMfIkDznv+S08Mg0AExz7FEAGGEE
2025-03-24 19:26:54 UTC	1369	IN	Data Raw: 55 5a 78 55 59 4e 76 58 35 61 45 6b 59 5a 58 5a 6e 31 72 6a 34 78 2b 6f 71 4b 4e 63 70 39 36 64 70 64 30 69 4a 6d 6c 61 6f 47 76 5a 33 2b 52 70 32 36 6a 63 6d 32 74 74 36 71 51 70 6f 35 35 69 37 71 54 65 62 65 35 6f 59 53 47 6c 37 2b 65 79 73 57 38 69 6f 57 35 6b 63 33 55 6a 4d 66 51 6e 35 53 69 72 4a 6d 6f 6a 35 54 4a 75 73 72 58 77 4c 72 46 74 63 53 68 30 71 47 68 78 71 32 6b 38 4f 2f 42 71 65 48 4d 72 4f 7a 6a 37 4f 37 4b 74 39 72 46 79 4e 48 4a 2b 76 66 2b 2f 74 71 2b 31 4e 67 4c 34 74 34 44 31 63 62 6f 38 41 62 49 45 41 45 48 31 52 54 4b 45 78 63 58 7a 67 7a 34 48 64 4c 70 39 43 48 57 37 64 30 6c 45 78 49 66 4a 39 34 63 4b 2b 66 77 43 2b 51 56 42 67 30 4a 42 6a 6e 32 4d 78 72 32 2b 7a 58 34 41 41 73 38 2f 42 72 39 50 67 49 54 43 6a 34 46 47 42 30 4d Data Ascii: UZxUYNvX5aEkYZXZn1rj4x+oqKNcp96dpd0iJmlaoGvZ3+Rp26jcm2tt6qQpo55i7qTebe5oYSGl7+eysW8ioW5kc3UjMfQn5SirJmoj5TJusrXwLrFtcSh0qGhxq2k8O/BqeHMrOzj7O7Kt9rFyNHJ+vf+/tq+1NgL4t4D1cbo8AbIEAEH1RTKExcXzgz4HdLp9CHW7d0lExIfJ94cK+fwC+QVBg0JBjn2Mxr2+zX4AAs8/Br9PgITCj4FGB0M
2025-03-24 19:26:54 UTC	1369	IN	Data Raw: 56 78 6c 56 6d 47 56 46 69 63 6c 32 31 53 6e 33 61 4c 70 61 46 35 68 6d 53 6c 61 5a 4e 6f 71 34 47 43 66 71 2b 47 68 57 74 6e 64 4a 47 6f 73 35 75 52 76 58 32 36 65 48 7a 41 75 35 46 32 77 35 71 76 79 63 57 64 71 6f 6a 4b 6a 62 65 49 7a 35 43 65 6f 74 44 41 71 63 72 56 72 64 43 6f 31 39 65 39 6d 4e 2f 62 32 4c 44 65 34 2b 53 79 35 4d 75 31 78 2b 71 6b 76 75 76 74 33 4e 76 7a 38 76 44 43 78 76 4f 34 36 37 53 76 36 4e 62 4b 2b 2b 76 42 30 41 54 39 41 64 49 47 42 50 76 45 42 77 77 4d 79 51 6b 4b 46 42 55 54 42 4f 6f 55 46 67 55 45 48 42 73 5a 36 75 34 63 34 42 54 63 31 78 44 35 33 79 67 6b 43 69 45 73 41 77 4c 73 4c 4f 38 74 35 76 4d 4c 4b 53 6f 43 37 44 49 48 4e 44 63 73 47 44 63 51 49 42 45 79 46 6a 51 6b 53 68 39 42 48 77 56 4c 4b 30 4d 4b 54 68 38 76 4e Data Ascii: VxlVmGVFicl21Sn3aLpaF5hmSlaZNoq4GCfq+GhWtndJGos5uRvX26eHzAu5F2w5qvycWdqojKjbeIz5CeotDAqcrVrdCo19e9mN/b2LDe4+Sy5Mu1x+qkvuvt3Nvz8vDCxvO467Sv6NbK++vB0AT9AdIGBPvEBwwMyQkKFBUTBOoUFgUEHBsZ6u4c4BTc1xD53ygkCiEsAwLsLO8t5vMLKSoC7DIHNDcsGDcQIBEyFjQkSh9BHwVLK0MKTh8vN
2025-03-24 19:26:54 UTC	1369	IN	Data Raw: 4f 58 5a 74 53 6d 70 36 65 56 70 4f 41 70 46 70 78 66 4b 68 65 64 57 57 73 6d 70 6d 6d 72 6d 61 6a 73 6d 39 34 6b 6d 79 63 6a 58 69 2f 73 5a 4b 64 73 35 2b 35 70 4c 5a 2b 73 71 72 48 68 61 48 41 76 59 65 61 76 4d 57 4d 6e 36 72 52 6a 71 44 55 31 5a 4b 6c 32 4e 6d 57 72 74 7a 64 6d 72 50 67 34 5a 36 30 33 5a 7a 59 31 4c 7a 47 70 62 6d 6a 38 2b 71 74 36 4f 37 66 37 2f 54 33 78 4d 54 46 75 39 54 57 33 38 76 2b 38 4e 38 46 41 72 72 62 2f 67 65 2b 39 75 67 4e 77 73 2f 6b 45 63 62 54 30 78 58 4b 31 78 4d 5a 7a 75 55 48 48 64 4c 70 39 43 48 57 37 64 30 6c 45 78 49 66 4a 39 34 63 4b 2b 66 77 43 2b 51 56 42 67 4d 44 47 44 59 43 4a 44 63 63 39 41 38 32 49 42 66 38 46 76 77 58 47 6a 55 71 46 30 74 4c 46 79 67 33 50 42 41 69 4d 55 67 56 53 79 30 6a 54 6a 4d 37 4e 52 Data Ascii: OXZtSmp6eVpOApFpxfKhedWWsmpmmrmajsm94kmycjXi/sZKds5+5pLZ+sqrHhaHAvYeavMWMn6rRjqDU1ZKl2NmWrtzdmrPg4Z603ZzY1LzGpbmj8+qt6O7f7/T3xMTFu9TW38v+8N8FArrb/ge+9ugNws/kEcbT0xXK1xMZzuUHHdLp9CHW7d0lExIfJ94cK+fwC+QVBgMDGDYCJDcc9A82IBf8FvwXGjUqF0tLFyg3PBAiMUgVSy0jTjM7NR
2025-03-24 19:26:54 UTC	1369	IN	Data Raw: 6a 5a 78 75 65 70 52 67 63 70 4f 4b 6e 6d 71 72 6f 6e 6d 74 63 59 78 2b 72 5a 2b 4f 75 6f 2b 6f 6e 48 57 54 66 5a 74 37 76 62 53 6c 74 72 4b 77 75 34 47 66 76 4c 57 45 79 61 62 41 77 71 66 4d 79 49 33 43 6f 73 53 53 75 39 54 46 6d 4e 71 75 75 39 4c 44 79 37 37 5a 78 71 54 48 32 75 43 70 79 61 6a 70 36 4d 4c 6f 75 73 62 67 72 4c 37 66 31 75 7a 30 2f 4f 2b 32 30 39 37 78 76 50 33 68 32 66 6a 6e 2b 2b 44 38 41 74 37 72 44 38 76 38 37 4d 72 6e 45 51 48 51 30 77 55 48 30 51 66 75 44 64 62 2b 49 51 44 64 48 2f 6f 57 33 79 49 64 46 78 73 4d 42 67 34 66 4a 65 55 51 4d 2b 30 31 48 66 45 79 46 79 66 7a 4e 6a 41 6c 39 76 41 54 4d 50 6a 39 2f 43 4d 35 4b 44 77 6e 50 54 59 35 4a 45 35 48 4b 42 73 4d 54 68 77 6a 53 55 34 33 4c 52 5a 47 54 54 6f 5a 45 54 4d 2b 55 30 52 Data Ascii: jZxuepRgcpOKnmqronmtcYx+rZ+Ouo+onHWTfZt7vbSltrKwu4GfvLWEyabAwqfMyI3CosSSu9TFmNquu9LDy77ZxqTH2uCpyajp6MLousbgrL7f1uz0/O+2097xvP3h2fjn++D8At7rD8v87MrnEQHQ0wUH0QfuDdb+IQDdH/oW3yIdFxsMBg4fJeUQM+01HfEyFyfzNjAl9vATMPj9/CM5KDwnPTY5JE5HKBsMThwjSU43LRZGTToZETM+U0R
2025-03-24 19:26:54 UTC	1369	IN	Data Raw: 36 53 48 5a 5a 71 59 6b 57 6d 49 67 70 52 74 6f 61 2b 4e 63 72 61 6b 6c 33 57 70 66 5a 65 32 66 72 65 66 74 36 65 6c 70 4c 32 47 73 36 32 2b 69 71 6d 71 78 4c 4f 74 76 63 6e 4e 79 37 48 4c 71 37 57 33 30 5a 72 54 74 39 54 5a 77 63 44 59 33 65 50 47 32 2b 48 58 31 64 37 6b 72 4e 48 6b 77 39 48 50 36 75 7a 34 31 37 4c 50 31 75 69 30 76 72 33 67 75 75 4b 39 2b 4d 48 78 34 75 6a 43 79 74 37 6e 79 41 55 52 2b 4d 30 4f 38 67 50 50 45 67 77 42 30 4e 6f 4e 2b 77 38 41 43 50 34 57 42 41 77 42 47 66 63 52 43 43 76 6c 4c 52 58 70 4b 67 38 66 36 79 34 6f 48 65 37 6f 43 79 6a 77 39 66 51 62 4d 53 41 30 48 7a 55 6b 4c 43 4c 39 42 76 6b 64 41 76 77 31 50 67 6b 50 44 6a 49 4e 49 77 30 77 53 6a 67 75 4d 30 77 58 4c 7a 78 66 47 6d 46 4b 48 56 38 7a 51 46 64 49 52 6b 56 62 Data Ascii: 6SHZZqYkWmIgpRtoa+Ncrakl3WpfZe2freft6elpL2Gs62+iqmqxLOtvcnNy7HLq7W30ZrTt9TZwcDY3ePG2+HX1d7krNHkw9HP6uz417LP1ui0vr3guuK9+MHx4ujCyt7nyAUR+M0O8gPPEgwB0NoN+w8ACP4WBAwBGfcRCCvlLRXpKg8f6y4oHe7oCyjw9fQbMSA0HzUkLCL9BvkdAvw1PgkPDjINIw0wSjguM0wXLzxfGmFKHV8zQFdIRkVb

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:54 UTC	827	OUT	GET /cdn-cgi/challenge-platform/h/b/d/9258900688e658c1/1742844413215/HG--9zQ253LJPkk HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:55 UTC	200	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:55 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 9258901a5de60f63-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:55 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4f 00 00 00 22 08 02 00 00 00 91 3c 13 55 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRO"<UIDAT$IENDB`

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ipsen USA RFP.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7942011d-b4dc-40b0-bd63-2af3d90de473.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF640960.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fcdc1f46-8396-42af-9537-74ce8ef943bf.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250324192630Z-172.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6956

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Windows Analysis Report
Ipsen USA RFP.pdf

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:55 UTC	856	OUT	GET /cdn-cgi/challenge-platform/h/b/pat/9258900688e658c1/1742844413224/062b52c2a80169cfb22a4fc6ea9486df20425347aac4beb3c0153ca0d14f45f7/BpFnN7xD3G-JtCR HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:56 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Mon, 24 Mar 2025 19:26:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 1 Connection: close
2025-03-24 19:26:56 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 42 69 74 53 77 71 67 42 61 63 2d 79 4b 6b 5f 47 36 70 53 47 33 79 42 43 55 30 65 71 78 4c 36 7a 77 42 55 38 6f 4e 46 50 52 66 63 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gBitSwqgBac-yKk_G6pSG3yBCU0eqxL6zwBU8oNFPRfcAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2025-03-24 19:26:56 UTC	1	IN	Data Raw: 4a Data Ascii: J

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:56 UTC	1192	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1785170061:1742841052:UsQfaBa_zEUVpfW-ViWsHOf14Uigd-nkbFZh4vmrZfI/9258900688e658c1/TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 38361 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:56 UTC	16384	OUT	Data Raw: 62 6d 4c 71 7a 43 6a 65 35 4e 4c 6b 6e 64 4a 6a 67 75 51 46 4c 43 77 75 34 75 50 71 68 73 57 65 6a 57 75 6a 71 57 6b 53 75 39 75 76 73 6b 70 70 6a 69 75 2b 77 68 75 6a 35 73 6d 75 41 75 64 73 4c 57 68 5a 75 32 63 43 72 75 68 61 6e 71 75 58 71 50 4a 75 49 55 73 43 46 75 62 4d 79 79 24 75 4e 31 31 6e 79 31 75 70 45 58 39 75 64 63 75 67 37 75 42 35 75 72 37 41 63 75 79 55 4c 71 43 65 75 64 72 47 71 47 39 4c 71 64 78 65 43 6b 44 43 75 44 50 42 7a 72 41 72 30 79 65 7a 4e 58 2d 24 63 75 72 4a 6d 75 45 49 7a 51 47 75 50 44 4c 43 4c 36 75 4b 73 75 67 4d 77 79 72 79 75 75 56 24 45 77 64 42 6d 72 75 43 30 6c 46 4e 58 39 31 77 6e 75 42 67 67 73 49 6a 45 6b 75 4c 4c 75 5a 71 43 56 75 42 6e 75 48 39 71 75 4a 71 50 54 75 42 78 36 41 47 44 5a 75 34 73 50 75 57 73 47 75 Data Ascii: bmLqzCje5NLkndJjguQFLCwu4uPqhsWejWujqWkSu9uvskppjiu+whuj5smuAudsLWhZu2cCruhanquXqPJuIUsCFubMyy$uN11ny1upEX9udcug7uB5ur7AcuyULqCeudrGqG9LqdxeCkDCuDPBzrAr0yezNX-$curJmuEIzQGuPDLCL6uKsugMwyryuuV$EwdBmruC0lFNX91wnuBggsIjEkuLLuZqCVuBnuH9quJqPTuBx6AGDZu4sPuWsGu
2025-03-24 19:26:56 UTC	16384	OUT	Data Raw: 37 64 70 32 4c 73 53 6b 5a 56 46 24 62 78 58 6b 69 72 75 71 35 72 70 34 6a 74 53 6d 72 34 74 45 66 24 62 71 37 48 51 71 24 37 74 57 41 71 72 71 75 75 53 4e 47 6a 78 69 6e 6b 75 4e 75 45 74 64 51 75 34 42 73 56 6d 6a 6e 42 66 73 73 63 4c 53 75 53 4e 2d 31 57 75 4e 2b 75 35 75 4a 75 46 43 6e 6f 64 4c 53 57 75 73 62 74 41 75 34 4a 49 70 75 49 75 39 39 49 5a 75 66 77 64 2b 4c 70 2d 68 64 71 44 4c 67 77 51 42 6a 67 4e 45 38 62 51 43 6b 71 37 72 34 77 42 63 71 65 35 50 78 7a 6d 71 39 68 79 4c 75 78 4c 45 35 75 73 4b 67 33 59 4c 34 77 43 62 68 37 44 57 46 75 47 43 50 4c 70 71 43 6b 73 42 4a 68 6e 64 74 71 6b 71 6a 6e 50 64 71 32 61 70 74 64 34 71 6c 4c 70 6e 6b 72 6a 33 71 79 6a 6a 36 24 41 63 62 6f 42 71 71 48 63 32 57 61 6b 43 53 31 50 38 24 31 43 38 63 38 6d Data Ascii: 7dp2LsSkZVF$bxXkiruq5rp4jtSmr4tEf$bq7HQq$7tWAqrquuSNGjxinkuNuEtdQu4BsVmjnBfsscLSuSN-1WuN+u5uJuFCnodLSWusbtAu4JIpuIu99IZufwd+Lp-hdqDLgwQBjgNE8bQCkq7r4wBcqe5Pxzmq9hyLuxLE5usKg3YL4wCbh7DWFuGCPLpqCksBJhndtqkqjnPdq2aptd4qlLpnkrj3qyjj6$AcboBqqHc2WakCS1P8$1C8c8m
2025-03-24 19:26:56 UTC	5593	OUT	Data Raw: 67 54 30 72 59 67 38 77 36 48 73 6a 4a 7a 4d 38 44 38 56 43 49 59 35 56 37 71 30 2d 71 30 55 78 6a 4e 4c 4a 6b 66 6e 56 6f 4f 77 68 68 56 56 64 2d 2d 35 43 62 59 44 63 69 4c 78 30 75 35 67 47 70 42 77 75 6b 71 64 64 39 70 71 34 75 44 39 58 4f 67 6c 4c 70 24 55 78 49 4f 75 6f 53 39 49 71 73 38 73 79 72 65 44 70 39 64 7a 6a 32 56 76 4a 32 39 74 6e 24 4a 30 7a 39 6d 63 6d 6c 4c 76 7a 55 37 7a 61 63 7a 6f 76 36 34 53 2d 74 72 33 5a 4b 45 4c 37 79 56 4c 6a 53 36 48 51 70 79 6e 41 58 36 58 6d 4d 48 54 4b 67 68 6e 38 48 6e 49 4d 77 6c 74 2b 6e 53 2b 66 6f 49 6a 74 2d 30 72 55 68 6a 4b 2d 33 54 58 6c 77 31 75 34 47 64 4e 48 71 32 72 6a 4c 4d 36 64 30 58 33 6f 2d 56 2d 62 56 58 58 4e 24 75 30 48 68 46 65 73 42 67 6d 36 42 75 6a 68 63 47 65 43 6f 6a 5a 75 37 76 57 Data Ascii: gT0rYg8w6HsjJzM8D8VCIY5V7q0-q0UxjNLJkfnVoOwhhVVd--5CbYDciLx0u5gGpBwukqdd9pq4uD9XOglLp$UxIOuoS9Iqs8syreDp9dzj2VvJ29tn$J0z9mcmlLvzU7zaczov64S-tr3ZKEL7yVLjS6HQpynAX6XmMHTKghn8HnIMwlt+nS+foIjt-0rUhjK-3TXlw1u4GdNHq2rjLM6d0X3o-V-bVXXN$u0HhFesBgm6BujhcGeCojZu7vW
2025-03-24 19:26:56 UTC	322	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:56 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 28216 Connection: close cf-chl-gen: DZ3SlA/77zLrpebiyNcBUD2cnDwTuVhKy/0lf1i1T1hT1cIbAUE6/H5UvWBPQo0j$HAvvuiD4ZjjcpWKZS2Tcrg== Server: cloudflare CF-RAY: 92589023accf19cb-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:56 UTC	1047	IN	Data Raw: 65 35 79 67 6d 70 57 79 71 4b 58 4d 6f 62 61 6a 7a 72 76 47 72 34 6d 6e 31 74 47 68 73 4c 54 56 70 62 53 77 6b 4a 33 4e 6d 4d 71 77 30 74 6e 45 76 72 6a 62 70 73 6a 66 33 4c 6e 47 76 4d 37 44 35 76 58 30 72 4e 44 70 73 63 76 59 2f 62 33 4e 31 73 33 69 30 2f 66 66 42 74 6a 6c 35 65 72 6c 34 76 37 34 33 77 51 53 45 75 58 74 33 38 33 6b 38 38 38 4f 37 76 4c 73 46 65 7a 33 49 51 30 4c 47 4e 73 61 2b 2f 37 34 48 42 66 36 35 50 37 33 44 65 77 64 42 43 59 51 4e 67 67 56 42 50 44 73 46 68 63 71 49 42 6f 69 45 67 49 30 49 41 45 41 46 7a 77 6d 53 55 41 6a 48 79 73 51 54 6a 39 4e 4d 43 59 6b 57 45 34 7a 57 7a 46 4e 46 7a 73 74 59 45 46 43 49 6c 46 42 51 68 6b 2f 52 56 6b 2b 51 31 35 50 4f 55 67 70 5a 55 52 6d 4d 45 4a 4d 59 57 63 77 4d 7a 52 47 55 47 31 2f 51 56 4d Data Ascii: e5ygmpWyqKXMobajzrvGr4mn1tGhsLTVpbSwkJ3NmMqw0tnEvrjbpsjf3LnGvM7D5vX0rNDpscvY/b3N1s3i0/ffBtjl5erl4v743wQSEuXt383k888O7vLsFez3IQ0LGNsa+/74HBf65P73DewdBCYQNggVBPDsFhcqIBoiEgI0IAEAFzwmSUAjHysQTj9NMCYkWE4zWzFNFzstYEFCIlFBQhk/RVk+Q15POUgpZURmMEJMYWcwMzRGUG1/QVM
2025-03-24 19:26:56 UTC	1369	IN	Data Raw: 67 75 4b 69 51 70 4d 57 56 70 70 58 65 72 35 69 38 77 4c 66 5a 34 4c 66 52 79 4e 58 64 72 4f 36 68 75 36 32 73 33 76 4c 48 35 4f 2f 68 31 74 6a 6c 37 62 7a 37 37 76 4c 66 30 4d 76 62 78 4d 2f 66 33 4e 58 57 77 38 4d 49 44 64 76 77 78 39 7a 50 43 75 54 4d 36 2b 6a 71 30 41 6b 62 2b 2b 66 56 48 77 44 69 2b 2f 76 6b 37 79 58 66 42 2f 51 68 35 53 33 6e 49 79 59 45 36 41 63 32 37 67 41 33 43 52 6a 32 38 54 73 50 39 42 67 68 45 52 45 4d 50 52 42 41 4d 7a 55 36 51 41 76 2b 4c 53 55 73 51 42 45 74 4e 45 41 56 52 7a 63 53 4b 45 6f 63 46 45 70 64 4c 45 45 59 4c 6c 74 61 4e 42 30 38 55 7a 74 64 62 57 30 2f 52 6d 4a 62 4d 55 78 52 56 6b 42 52 62 6c 64 32 65 47 39 79 57 54 56 55 64 6a 52 4d 4f 6f 4e 54 56 48 5a 5a 58 48 71 46 5a 30 42 74 65 55 74 62 62 6c 79 49 54 59 Data Ascii: guKiQpMWVppXer5i8wLfZ4LfRyNXdrO6hu62s3vLH5O/h1tjl7bz77vLf0MvbxM/f3NXWw8MIDdvwx9zPCuTM6+jq0Akb++fVHwDi+/vk7yXfB/Qh5S3nIyYE6Ac27gA3CRj28TsP9BghEREMPRBAMzU6QAv+LSUsQBEtNEAVRzcSKEocFEpdLEEYLltaNB08UztdbW0/RmJbMUxRVkBRbld2eG9yWTVUdjRMOoNTVHZZXHqFZ0BteUtbblyITY
2025-03-24 19:26:56 UTC	1369	IN	Data Raw: 73 38 75 34 77 63 79 38 76 2b 4c 55 78 4d 44 6b 36 4d 6a 45 35 2b 7a 4d 79 50 4c 77 30 4d 7a 31 73 2b 58 49 73 39 54 6d 38 63 32 30 30 2f 58 72 74 41 50 67 34 39 49 44 2f 76 6e 6c 39 2b 7a 6b 41 66 33 48 42 2b 77 4a 43 4f 45 45 34 74 48 6c 43 42 48 56 2b 76 58 5a 32 4f 41 53 33 78 55 47 34 41 49 53 38 51 51 64 34 77 54 34 4c 69 55 54 36 65 6f 77 2f 69 6f 45 4b 79 6b 49 45 43 30 74 44 42 51 74 4d 52 41 59 4c 54 55 55 48 43 4e 4b 4c 41 51 56 54 51 63 5a 4a 69 49 71 4a 6b 63 4e 53 56 59 6d 4e 69 30 77 4b 6a 6f 79 48 79 34 2b 4e 6b 34 79 51 6a 6f 38 4e 6b 59 2f 4b 7a 70 4b 51 32 6f 2b 54 6b 64 67 61 31 52 4d 4c 32 35 62 65 6c 4e 2b 55 45 64 59 55 49 4a 52 66 31 35 78 57 58 4e 69 58 47 4b 44 67 6d 6c 70 52 31 39 75 62 59 52 68 63 70 65 41 5a 58 61 62 62 6d 6c Data Ascii: s8u4wcy8v+LUxMDk6MjE5+zMyPLw0Mz1s+XIs9Tm8c200/XrtAPg49ID/vnl9+zkAf3HB+wJCOEE4tHlCBHV+vXZ2OAS3xUG4AIS8QQd4wT4LiUT6eow/ioEKykIEC0tDBQtMRAYLTUUHCNKLAQVTQcZJiIqJkcNSVYmNi0wKjoyHy4+Nk4yQjo8NkY/KzpKQ2o+Tkdga1RML25belN+UEdYUIJRf15xWXNiXGKDgmlpR19ubYRhcpeAZXabbml
2025-03-24 19:26:56 UTC	1369	IN	Data Raw: 4d 48 6d 70 4c 54 46 36 75 4f 34 79 65 37 58 76 4d 33 79 78 63 44 52 39 62 54 45 31 66 6e 7a 79 4e 6e 39 30 74 48 32 33 73 37 54 34 64 4b 2b 39 73 67 44 35 75 62 6f 42 77 6b 52 45 50 44 75 37 65 77 4e 41 2f 49 56 38 76 6a 30 47 42 33 38 2b 43 4d 68 41 66 77 6d 34 78 63 4a 34 77 55 58 49 76 76 6b 42 43 4d 4e 37 69 45 6a 42 51 44 33 4d 77 77 70 4a 43 59 6e 39 6a 51 63 4f 6b 51 4d 52 68 33 2b 53 43 55 59 46 7a 55 68 52 78 38 70 4c 43 4e 4a 4c 54 41 6d 54 54 45 30 4b 56 45 31 4f 43 78 56 4f 54 77 75 58 56 68 51 50 6a 74 54 51 55 56 46 4e 32 31 6c 52 45 46 47 59 6b 35 68 58 30 31 7a 56 46 70 44 66 46 78 31 53 48 5a 37 66 47 70 62 4e 6d 56 75 65 33 4a 32 53 59 68 43 54 47 5a 4c 66 47 79 49 55 4a 4a 77 67 46 52 56 65 6e 6c 75 62 46 70 35 61 5a 69 68 64 58 35 63 Data Ascii: MHmpLTF6uO4ye7XvM3yxcDR9bTE1fnzyNn90tH23s7T4dK+9sgD5uboBwkREPDu7ewNA/IV8vj0GB38+CMhAfwm4xcJ4wUXIvvkBCMN7iEjBQD3MwwpJCYn9jQcOkQMRh3+SCUYFzUhRx8pLCNJLTAmTTE0KVE1OCxVOTwuXVhQPjtTQUVFN21lREFGYk5hX01zVFpDfFx1SHZ7fGpbNmVue3J2SYhCTGZLfGyIUJJwgFRVenlubFp5aZihdX5c
2025-03-24 19:26:56 UTC	1369	IN	Data Raw: 62 73 35 4d 50 41 78 75 62 6a 77 62 7a 47 74 72 2b 34 36 4c 4c 4e 74 4d 62 62 79 51 4c 4b 33 38 37 62 7a 75 50 53 31 41 72 61 33 50 66 6e 32 39 72 78 38 73 6b 4a 41 50 62 78 30 51 7a 6c 43 4f 63 5a 36 77 2f 62 43 66 51 54 47 76 6f 61 33 77 55 65 2b 4f 41 41 4a 69 58 38 48 65 37 72 36 7a 49 74 2f 6a 48 33 4d 69 51 37 4f 76 73 61 46 55 41 71 47 7a 6f 2f 52 54 38 44 52 45 59 44 43 50 31 44 46 79 42 44 54 6a 4e 53 43 6c 59 6f 49 43 41 70 4a 41 31 58 56 7a 42 4e 48 6a 42 4b 47 31 6b 38 58 47 67 77 5a 6b 45 6a 4f 7a 5a 4d 52 57 51 72 51 6d 73 39 61 6b 51 74 54 48 4e 49 52 58 74 64 55 55 6c 32 55 33 59 38 50 48 70 68 50 56 78 2f 56 6c 4e 36 59 45 74 49 6a 6f 6c 64 6a 59 31 52 64 35 5a 4f 6d 6d 78 62 6d 5a 65 48 57 57 43 42 64 4a 61 64 66 49 36 69 66 59 4f 6a 70 Data Ascii: bs5MPAxubjwbzGtr+46LLNtMbbyQLK387bzuPS1Ara3Pfn29rx8skJAPbx0QzlCOcZ6w/bCfQTGvoa3wUe+OAAJiX8He7r6zIt/jH3MiQ7OvsaFUAqGzo/RT8DREYDCP1DFyBDTjNSClYoICApJA1XVzBNHjBKG1k8XGgwZkEjOzZMRWQrQms9akQtTHNIRXtdUUl2U3Y8PHphPVx/VlN6YEtIjoldjY1Rd5ZOmmxbmZeHWWCBdJadfI6ifYOjp
2025-03-24 19:26:56 UTC	1369	IN	Data Raw: 4c 37 2b 48 6b 38 50 53 30 2b 63 72 47 72 74 4b 34 39 63 7a 4f 75 4c 72 43 35 67 4c 65 43 63 6e 59 34 2f 62 72 7a 76 33 6e 78 39 76 4a 79 2f 54 6a 46 51 37 5a 38 78 33 55 31 76 6e 30 38 74 6e 5a 38 68 6a 33 48 65 51 57 42 51 51 6e 34 79 67 75 43 79 66 77 2f 44 49 68 4e 76 62 33 49 68 48 73 47 42 37 38 48 42 45 62 46 54 63 51 50 52 51 7a 4a 6a 51 41 4e 67 51 75 4a 55 45 73 53 41 34 2b 53 52 38 77 4e 43 55 6b 54 45 6b 56 55 45 78 4a 4f 6c 68 4d 4d 6c 4d 68 49 46 52 49 50 6c 68 4d 62 55 31 73 51 45 68 4a 55 44 46 4b 53 30 70 74 4e 32 35 44 4d 6d 52 32 61 48 52 34 58 32 35 52 62 30 42 58 55 55 5a 62 69 49 4a 73 5a 57 78 4e 5a 6d 64 6d 69 56 4f 4a 53 45 36 41 6b 6f 53 51 68 48 75 4b 61 35 74 67 66 48 42 38 67 32 47 68 65 6f 64 32 65 4b 69 75 6e 36 43 43 69 49 Data Ascii: L7+Hk8PS0+crGrtK49czOuLrC5gLeCcnY4/brzv3nx9vJy/TjFQ7Z8x3U1vn08tnZ8hj3HeQWBQQn4yguCyfw/DIhNvb3IhHsGB78HBEbFTcQPRQzJjQANgQuJUEsSA4+SR8wNCUkTEkVUExJOlhMMlMhIFRIPlhMbU1sQEhJUDFKS0ptN25DMmR2aHR4X25Rb0BXUUZbiIJsZWxNZmdmiVOJSE6AkoSQhHuKa5tgfHB8g2Gheod2eKiun6CCiI
2025-03-24 19:26:56 UTC	1369	IN	Data Raw: 74 2f 57 33 2f 50 33 35 35 39 59 42 74 4e 6e 78 76 73 61 39 2b 66 4d 44 43 65 63 4c 42 51 7a 72 79 38 7a 70 43 73 37 52 31 39 49 45 45 52 6e 6d 43 75 6a 63 39 79 48 69 2b 53 4c 67 48 78 59 5a 4a 2f 59 56 4b 65 73 72 37 51 76 74 4c 76 45 6c 37 6a 4d 78 43 79 59 33 2b 51 38 2f 4f 66 30 70 2b 6a 34 74 4c 66 35 44 42 41 59 47 52 30 55 31 54 30 73 35 51 51 35 4f 54 54 4d 55 54 46 46 4e 57 31 63 76 57 52 74 62 57 54 63 63 58 6b 31 5a 55 6d 45 6d 51 79 68 6c 4b 6a 38 6d 61 79 35 4c 4c 6d 68 74 63 54 42 7a 63 55 74 37 64 6d 56 31 66 33 6b 2b 64 57 35 2f 56 32 31 41 67 33 46 6a 52 6f 5a 4b 61 30 65 4a 68 30 35 4e 6a 59 31 7a 55 35 4b 42 63 31 61 58 62 34 31 63 6c 4a 6d 56 57 5a 39 33 6a 57 4b 68 6f 61 56 6e 70 61 57 6c 6d 71 75 5a 72 57 2b 75 63 6f 75 32 73 72 47 Data Ascii: t/W3/P3559YBtNnxvsa9+fMDCecLBQzry8zpCs7R19IEERnmCujc9yHi+SLgHxYZJ/YVKesr7QvtLvEl7jMxCyY3+Q8/Of0p+j4tLf5DBAYGR0U1T0s5QQ5OTTMUTFFNW1cvWRtbWTccXk1ZUmEmQyhlKj8may5LLmhtcTBzcUt7dmV1f3k+dW5/V21Ag3FjRoZKa0eJh05NjY1zU5KBc1aXb41clJmVWZ93jWKhoaVnpaWlmquZrW+ucou2srG

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:57 UTC	639	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1785170061:1742841052:UsQfaBa_zEUVpfW-ViWsHOf14Uigd-nkbFZh4vmrZfI/9258900688e658c1/TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:57 UTC	442	IN	HTTP/1.1 400 Bad Request Date: Mon, 24 Mar 2025 19:26:57 GMT Content-Type: application/json Content-Length: 14 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: 3e3I5Qot6IWSFRFwbkHuxtaAKFe0wUAjnilFQkUPEjXyyrVT5npcIE0IACXKN9aypEYRT4yTEMbta3E2Xo9r/Q==$lMpultq859K3gw/QP4UKCQ== Server: cloudflare CF-RAY: 925890282b914228-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:57 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 38 30 7d Data Ascii: {"err":100280}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:26:58 UTC	1190	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/90605971:1742840827:oID_OK0KPEBaFjrqV1VD9LXn4gNj1wLsREK3Hh32ooM/925890068fec49aa/OUH_lw1ZrO9k52HS7lu7RY6EJtTprXq0qXwNnTzjzEI-1742844411-1.1.1.1-d24Wj.MBIbD8_HS9LHTCYzl7lt.8hYXP7t_vSDYzoKHGH5pt6V16NYURJSlKIk1u HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 38641 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: OUH_lw1ZrO9k52HS7lu7RY6EJtTprXq0qXwNnTzjzEI-1742844411-1.1.1.1-d24Wj.MBIbD8_HS9LHTCYzl7lt.8hYXP7t_vSDYzoKHGH5pt6V16NYURJSlKIk1u cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/lqi8i/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:26:58 UTC	16384	OUT	Data Raw: 46 6e 71 78 67 4a 6c 5a 53 56 71 4e 55 79 38 6c 45 42 33 74 71 75 61 42 4d 42 4c 42 4e 37 42 38 4a 6c 66 76 63 42 55 4f 68 39 6c 58 42 51 4f 42 6e 6c 57 42 4a 73 53 4f 77 65 34 37 42 6a 4e 44 76 42 75 71 55 42 72 44 78 4a 36 42 73 4f 75 44 76 4e 42 68 73 42 70 78 4e 4b 74 42 64 37 6c 38 66 33 33 71 6c 74 45 78 74 71 42 79 74 42 4a 58 66 59 42 75 55 42 7a 71 37 4a 52 48 73 68 63 34 55 6c 75 42 71 65 55 42 79 35 39 41 68 36 4e 78 75 5a 6b 75 42 2b 53 4e 6c 52 42 5a 4f 42 76 33 4f 38 6f 36 2d 73 77 68 42 70 36 42 4e 32 76 5a 41 41 68 2d 42 6c 4b 4e 42 39 77 42 77 53 42 7a 37 6c 47 33 37 74 37 42 77 32 36 74 49 52 42 45 4f 42 49 73 56 64 24 63 75 39 54 42 39 32 71 5a 6d 42 43 42 4e 77 79 42 77 5a 42 74 4f 6c 33 70 79 53 42 36 4f 42 59 56 37 38 63 77 34 71 6d Data Ascii: FnqxgJlZSVqNUy8lEB3tquaBMBLBN7B8JlfvcBUOh9lXBQOBnlWBJsSOwe47BjNDvBuqUBrDxJ6BsOuDvNBhsBpxNKtBd7l8f33qltExtqBytBJXfYBuUBzq7JRHshc4UluBqeUBy59Ah6NxuZkuB+SNlRBZOBv3O8o6-swhBp6BN2vZAAh-BlKNB9wBwSBz7lG37t7Bw26tIRBEOBIsVd$cu9TB92qZmBCBNwyBwZBtOl3pySB6OBYV78cw4qm
2025-03-24 19:26:58 UTC	16384	OUT	Data Raw: 6b 79 47 64 68 53 5a 59 64 4e 42 33 46 74 2b 53 35 6a 76 4e 43 6b 24 6f 64 35 42 75 6b 37 42 72 6a 75 6b 58 55 35 2d 63 6d 4a 58 63 41 51 56 2b 35 6d 41 36 74 31 52 67 6b 43 54 44 75 4a 50 65 58 75 33 42 74 43 42 53 42 4b 42 56 78 75 70 79 6c 6a 68 78 4a 71 35 68 68 2b 57 78 78 42 32 42 74 54 2b 52 42 43 64 39 59 6c 4f 52 79 51 4e 59 42 33 41 49 44 47 68 2b 4b 4f 49 55 42 35 32 56 2b 55 56 4d 71 4a 6b 42 38 24 4f 71 4a 77 62 44 78 44 71 4a 64 4b 51 78 63 33 6d 77 50 42 63 73 59 42 34 6e 79 53 67 41 30 52 73 36 53 39 47 7a 30 55 2d 2d 75 62 58 64 71 4e 41 6c 74 78 59 35 73 2d 4e 77 47 4e 78 70 39 67 35 2b 65 42 4b 24 41 4a 2b 64 71 4e 32 2b 75 53 2d 53 70 37 76 51 2b 73 37 79 64 4a 33 6d 32 78 73 6c 68 71 42 7a 78 44 6a 42 6f 70 52 38 44 62 77 4e 2b 57 78 Data Ascii: kyGdhSZYdNB3Ft+S5jvNCk$od5Buk7BrjukXU5-cmJXcAQV+5mA6t1RgkCTDuJPeXu3BtCBSBKBVxupyljhxJq5hh+WxxB2BtT+RBCd9YlORyQNYB3AIDGh+KOIUB52V+UVMqJkB8$OqJwbDxDqJdKQxc3mwPBcsYB4nySgA0Rs6S9Gz0U--ubXdqNAltxY5s-NwGNxp9g5+eBK$AJ+dqN2+uS-Sp7vQ+s7ydJ3m2xslhqBzxDjBopR8DbwN+Wx
2025-03-24 19:26:58 UTC	5873	OUT	Data Raw: 63 65 71 5a 63 68 67 24 52 71 76 41 24 71 78 58 51 37 67 78 4e 6b 7a 2d 55 37 58 37 56 74 72 66 48 34 6e 50 37 62 39 76 58 75 52 56 71 57 59 47 75 66 35 30 57 59 44 71 2d 4b 36 52 76 70 75 24 37 30 2d 4f 77 54 53 4f 65 33 32 6c 64 2d 41 6c 59 4c 4c 75 24 77 59 59 67 33 71 76 74 45 76 33 55 37 44 4f 53 5a 76 4f 41 65 66 65 5a 44 43 54 30 4f 72 41 7a 52 53 54 6d 78 66 6c 34 6e 6e 57 71 43 33 63 50 6b 65 51 2d 74 33 45 52 4a 42 37 65 65 4e 39 4b 53 52 6a 64 78 56 53 54 4c 68 6a 42 2d 75 36 4c 79 55 4e 24 52 65 37 42 35 71 51 37 79 34 43 33 54 30 45 65 6a 2d 61 54 6e 4d 47 4c 41 35 39 32 51 6e 79 61 67 6b 45 35 57 79 59 34 43 51 6a 65 65 43 62 78 2d 6a 30 47 35 54 42 79 6a 6e 64 48 48 33 36 48 38 33 59 51 62 62 5a 64 33 34 41 33 30 6a 65 78 6c 46 54 6e 65 57 Data Ascii: ceqZchg$RqvA$qxXQ7gxNkz-U7X7VtrfH4nP7b9vXuRVqWYGuf50WYDq-K6Rvpu$70-OwTSOe32ld-AlYLLu$wYYg3qvtEv3U7DOSZvOAefeZDCT0OrAzRSTmxfl4nnWqC3cPkeQ-t3ERJB7eeN9KSRjdxVSTLhjB-u6LyUN$Re7B5qQ7y4C3T0Eej-aTnMGLA592QnyagkE5WyY4CQjeeCbx-j0G5TByjndHH36H83YQbbZd34A30jexlFTneW
2025-03-24 19:26:58 UTC	322	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:26:58 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 28328 Connection: close cf-chl-gen: XBwvhKbiDjjkMY36VZgMiYwxeLSO+Bc0H9XBYq/uQbSdQhigm9l3IMjSfzkfnOKe$LFYvyrpoTf2xot61I0U36w== Server: cloudflare CF-RAY: 9258902d583fd123-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 19:26:58 UTC	1047	IN	Data Raw: 59 48 78 38 59 6b 39 6b 6b 70 4f 50 66 55 68 4f 6c 57 70 6a 57 34 56 59 6b 47 65 68 64 5a 52 72 70 58 71 54 67 6e 42 2b 64 5a 68 6c 59 34 69 6a 6f 32 71 77 70 59 78 73 6b 72 4f 4b 6c 49 4b 50 65 34 57 6f 72 36 42 35 73 62 57 67 75 4c 32 33 70 71 61 66 69 72 36 31 75 59 57 6c 6e 4b 62 50 71 6f 79 6d 77 59 2b 4c 78 49 33 4c 76 4d 36 71 79 64 54 68 74 38 57 6a 70 62 4b 65 35 62 32 6c 35 2b 6a 74 78 4e 47 76 38 39 79 74 38 61 79 32 74 2f 4c 4e 35 64 66 78 36 72 36 2f 37 76 50 42 7a 64 76 59 76 73 4c 56 79 67 45 4b 35 41 7a 71 79 63 66 64 36 42 44 74 7a 41 2f 6b 47 65 30 4f 46 41 34 64 46 76 6f 4b 41 2b 73 68 39 51 63 6e 41 67 45 6b 35 66 6a 36 39 77 4d 4c 2f 68 41 53 44 2f 41 4d 44 78 51 75 46 44 59 31 45 6a 45 31 4c 78 55 7a 45 68 6a 37 48 69 51 66 43 67 6f Data Ascii: YHx8Yk9kkpOPfUhOlWpjW4VYkGehdZRrpXqTgnB+dZhlY4ijo2qwpYxskrOKlIKPe4Wor6B5sbWguL23pqafir61uYWlnKbPqoymwY+LxI3LvM6qydTht8WjpbKe5b2l5+jtxNGv89yt8ay2t/LN5dfx6r6/7vPBzdvYvsLVygEK5Azqycfd6BDtzA/kGe0OFA4dFvoKA+sh9QcnAgEk5fj69wML/hASD/AMDxQuFDY1EjE1LxUzEhj7HiQfCgo
2025-03-24 19:26:58 UTC	1369	IN	Data Raw: 38 64 61 4a 31 67 48 6d 55 65 70 69 62 71 33 31 34 64 58 6d 6b 6e 4a 70 36 63 59 69 51 68 5a 61 70 63 48 47 52 68 37 4b 5a 76 4b 36 74 6d 63 53 55 6e 35 57 39 69 4b 53 6c 67 37 65 4c 72 34 71 6c 6a 38 48 55 7a 4d 57 74 31 63 4b 34 70 4a 61 6c 75 4d 65 58 34 63 79 5a 79 37 4c 5a 73 64 48 63 33 62 58 4c 75 71 6e 6c 32 61 6e 68 75 76 48 7a 77 75 72 50 78 76 72 49 2b 72 58 4a 41 4d 2f 75 77 4e 33 62 38 2f 66 34 31 64 4c 64 2b 74 6a 33 34 38 44 4d 79 38 73 43 36 66 48 39 7a 77 44 74 47 77 6a 30 36 78 62 6e 44 66 44 71 34 42 41 55 38 41 50 6d 46 67 6b 72 48 69 45 47 36 77 58 76 4b 69 30 47 41 53 4d 68 4c 50 55 4d 48 44 49 4f 46 43 77 63 2f 69 38 35 4f 67 52 46 50 54 63 46 53 7a 51 48 53 45 4d 39 42 78 45 52 4c 69 59 7a 56 45 67 7a 4b 53 59 73 47 46 70 65 53 68 Data Ascii: 8daJ1gHmUepibq314dXmknJp6cYiQhZapcHGRh7KZvK6tmcSUn5W9iKSlg7eLr4qlj8HUzMWt1cK4pJaluMeX4cyZy7LZsdHc3bXLuqnl2anhuvHzwurPxvrI+rXJAM/uwN3b8/f41dLd+tj348DMy8sC6fH9zwDtGwj06xbnDfDq4BAU8APmFgkrHiEG6wXvKi0GASMhLPUMHDIOFCwc/i85OgRFPTcFSzQHSEM9BxERLiYzVEgzKSYsGFpeSh
2025-03-24 19:26:58 UTC	1369	IN	Data Raw: 58 56 39 31 68 49 57 6f 6a 47 69 6f 6e 6d 68 78 6f 71 31 75 69 32 2b 76 63 34 52 37 72 33 61 4a 6d 49 43 70 77 49 4f 44 6f 48 32 48 78 73 6a 42 75 73 43 57 76 36 37 51 76 59 6a 41 6a 36 79 69 6b 39 61 59 74 4a 50 53 74 70 72 4b 6e 4b 79 37 34 36 50 57 31 4e 66 69 32 72 75 69 36 4d 7a 68 36 38 54 44 34 65 72 63 76 63 43 2f 77 4d 32 78 79 64 48 35 76 4d 37 75 77 64 55 42 2f 4d 4d 41 39 50 37 56 42 4d 48 36 31 77 6a 46 2f 75 62 6c 7a 65 49 4e 45 41 55 50 37 42 59 4a 2b 41 73 54 2b 66 6b 43 44 76 59 61 42 78 49 52 4b 68 4d 57 36 51 41 58 47 75 30 61 47 78 37 37 4c 68 38 69 41 50 59 6a 4a 67 51 52 4b 78 77 36 47 43 38 50 39 54 49 77 48 69 4d 56 53 51 45 74 54 52 6f 4b 53 54 6b 6b 49 30 70 57 4c 6a 63 52 46 31 52 48 4a 79 6c 61 45 56 6b 54 58 52 56 4e 56 57 4d Data Ascii: XV91hIWojGionmhxoq1ui2+vc4R7r3aJmICpwIODoH2HxsjBusCWv67QvYjAj6yik9aYtJPStprKnKy746PW1Nfi2rui6Mzh68TD4ercvcC/wM2xydH5vM7uwdUB/MMA9P7VBMH61wjF/ublzeINEAUP7BYJ+AsT+fkCDvYaBxIRKhMW6QAXGu0aGx77Lh8iAPYjJgQRKxw6GC8P9TIwHiMVSQEtTRoKSTkkI0pWLjcRF1RHJylaEVkTXRVNVWM
2025-03-24 19:26:58 UTC	1369	IN	Data Raw: 32 43 43 6a 71 78 6b 6e 48 36 79 61 48 56 31 74 6d 78 35 74 4c 70 77 68 36 69 2b 64 49 75 57 77 6e 69 50 66 38 61 30 73 38 44 49 67 4c 33 4d 69 5a 4b 73 68 72 61 6e 31 39 53 34 6b 39 54 4b 6c 4a 54 4f 32 5a 71 32 6d 39 75 65 34 61 66 62 6f 72 54 41 35 36 53 35 37 72 44 50 38 4c 4f 7a 30 4c 4f 33 39 76 6a 6d 35 63 7a 61 32 4e 76 77 36 66 50 69 7a 76 48 50 2b 4d 66 59 79 4f 45 43 39 65 77 42 41 68 4c 4c 30 75 44 64 34 51 37 50 31 51 6a 70 31 4e 6e 30 36 53 4c 64 36 77 7a 65 34 75 37 35 33 75 54 31 42 75 77 74 4a 78 6a 71 37 76 7a 78 46 4f 30 47 38 79 73 74 39 41 2f 7a 45 66 55 68 44 44 6b 6b 4e 2f 30 64 4d 7a 39 48 46 7a 77 47 43 6a 67 58 53 52 74 4e 49 67 39 4f 55 68 46 4c 46 67 78 48 57 31 51 51 55 7a 42 63 50 56 41 62 51 54 77 33 48 32 67 36 4f 6a 31 63 Data Ascii: 2CCjqxknH6yaHV1tmx5tLpwh6i+dIuWwniPf8a0s8DIgL3MiZKshran19S4k9TKlJTO2Zq2m9ue4afborTA56S57rDP8LOz0LO39vjm5cza2Nvw6fPizvHP+MfYyOEC9ewBAhLL0uDd4Q7P1Qjp1Nn06SLd6wze4u753uT1BuwtJxjq7vzxFO0G8yst9A/zEfUhDDkkN/0dMz9HFzwGCjgXSRtNIg9OUhFLFgxHW1QQUzBcPVAbQTw3H2g6Oj1c
2025-03-24 19:26:58 UTC	1369	IN	Data Raw: 43 69 71 70 47 5a 61 34 4f 58 71 72 53 78 71 73 42 38 6c 35 71 55 72 59 61 34 73 37 47 31 79 63 6d 75 75 62 32 5a 67 36 61 70 7a 4d 43 53 7a 5a 65 78 6c 4a 75 5a 74 70 57 62 71 39 4f 63 35 4e 75 37 78 4e 32 6b 79 74 75 6c 71 64 65 34 36 4c 72 73 77 61 32 7a 7a 39 4c 72 74 73 7a 59 31 37 72 37 79 2f 58 4f 30 66 66 4d 41 72 7a 78 32 77 48 53 2b 75 62 4b 39 67 6a 4e 44 67 38 50 36 63 59 57 30 4d 37 35 47 2b 33 58 48 73 2f 6e 44 64 72 68 41 76 67 65 2f 4e 77 6e 4a 66 45 6f 38 77 41 64 36 2b 38 77 45 67 6a 79 43 42 38 43 39 2b 72 77 4e 6a 45 52 4e 7a 51 58 4e 78 67 52 4c 67 41 75 53 50 31 44 4e 7a 6f 39 49 7a 77 65 48 77 6f 66 51 44 4d 50 51 44 56 4b 57 67 77 6e 4c 42 52 64 57 45 38 64 47 47 51 6b 59 45 38 6b 57 6d 67 2b 4b 31 74 48 4e 6b 5a 5a 59 45 59 78 50 Data Ascii: CiqpGZa4OXqrSxqsB8l5qUrYa4s7G1ycmuub2Zg6apzMCSzZexlJuZtpWbq9Oc5Nu7xN2kytulqde46Lrswa2zz9LrtszY17r7y/XO0ffMArzx2wHS+ubK9gjNDg8P6cYW0M75G+3XHs/nDdrhAvge/NwnJfEo8wAd6+8wEgjyCB8C9+rwNjERNzQXNxgRLgAuSP1DNzo9IzweHwofQDMPQDVKWgwnLBRdWE8dGGQkYE8kWmg+K1tHNkZZYEYxP
2025-03-24 19:26:58 UTC	1369	IN	Data Raw: 33 74 36 32 51 6b 4c 57 74 72 4b 2b 7a 6b 4b 4b 47 6e 37 4c 4b 76 63 43 6c 79 61 53 51 6d 38 54 46 7a 4b 79 68 79 4d 37 52 74 4d 75 75 72 38 2b 75 7a 35 36 55 34 72 69 68 76 62 4b 6c 70 64 72 57 76 63 33 74 37 39 37 53 36 39 48 4b 71 37 61 78 7a 73 6a 43 39 4e 44 70 33 63 63 41 33 4d 36 31 41 75 2f 6e 35 2b 58 71 2f 64 6a 45 34 39 72 35 41 77 72 63 34 78 51 4e 41 65 54 54 38 2b 55 4a 2b 64 77 4f 37 76 72 54 49 4e 72 37 44 39 30 62 49 42 55 73 46 4f 50 39 2f 76 6f 68 36 44 4d 69 37 75 30 31 45 2b 72 79 46 54 63 71 4b 53 77 59 43 79 77 31 50 7a 34 78 49 69 51 56 52 52 63 57 54 69 59 49 4c 77 6b 4b 4b 7a 31 56 44 6a 46 44 4e 45 64 49 57 69 31 4f 55 56 74 61 54 54 74 41 4d 57 41 64 4d 6c 6f 71 4d 30 41 37 53 31 70 4d 50 7a 46 75 55 47 70 53 4d 54 49 34 52 45 Data Ascii: 3t62QkLWtrK+zkKKGn7LKvcClyaSQm8TFzKyhyM7RtMuur8+uz56U4rihvbKlpdrWvc3t797S69HKq7axzsjC9NDp3ccA3M61Au/n5+Xq/djE49r5Awrc4xQNAeTT8+UJ+dwO7vrTINr7D90bIBUsFOP9/voh6DMi7u01E+ryFTcqKSwYCyw1Pz4xIiQVRRcWTiYILwkKKz1VDjFDNEdIWi1OUVtaTTtAMWAdMloqM0A7S1pMPzFuUGpSMTI4RE
2025-03-24 19:26:58 UTC	1369	IN	Data Raw: 73 70 32 68 68 62 53 69 75 38 65 39 6c 37 79 68 76 71 43 6f 78 4c 47 6a 72 63 79 74 6f 37 4b 70 71 36 69 6d 73 62 53 70 71 4e 53 35 73 73 44 66 6e 38 4c 58 35 39 6d 34 33 4d 72 4e 78 4d 33 6e 73 64 54 6f 31 75 72 58 31 74 4c 71 33 4e 72 53 38 39 36 33 2f 50 62 69 76 4d 48 79 35 38 48 65 2b 4f 76 46 34 67 50 70 79 65 6f 49 38 38 7a 52 43 66 6a 32 38 67 7a 37 36 76 37 78 41 65 33 64 46 67 55 5a 45 52 77 48 48 66 6f 5a 44 66 67 70 47 78 41 50 45 78 38 54 37 66 34 72 47 42 63 54 44 68 30 78 44 7a 51 66 2b 50 30 78 4a 66 77 43 4d 79 6b 56 52 54 34 73 42 68 39 42 4d 43 38 72 51 7a 51 6a 4b 30 51 79 45 6a 64 49 50 43 74 4a 54 55 41 2f 4f 31 5a 46 51 30 63 36 53 54 63 33 58 6b 77 6d 52 31 78 52 5a 56 31 67 56 53 78 78 61 56 6c 74 5a 57 74 62 63 44 35 77 59 54 70 Data Ascii: sp2hhbSiu8e9l7yhvqCoxLGjrcyto7Kpq6imsbSpqNS5ssDfn8LX59m43MrNxM3nsdTo1urX1tLq3NrS8963/PbivMHy58He+OvF4gPpyeoI88zRCfj28gz76v7xAe3dFgUZERwHHfoZDfgpGxAPEx8T7f4rGBcTDh0xDzQf+P0xJfwCMykVRT4sBh9BMC8rQzQjK0QyEjdIPCtJTUA/O1ZFQ0c6STc3XkwmR1xRZV1gVSxxaVltZWtbcD5wYTp

Timestamp	Bytes transferred	Direction	Data
2025-03-24 19:27:01 UTC	1192	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1785170061:1742841052:UsQfaBa_zEUVpfW-ViWsHOf14Uigd-nkbFZh4vmrZfI/9258900688e658c1/TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 40855 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: TfGI2NTSZgCl8pxgICKfb6gYNN4_NjKiUs26IComktg-1742844411-1.1.1.1-toQ0g6CAl6Hp.duiMTzdk6OFEqNZdyG_jIM5W7OWM8OETH4oW8mnriWMQcegQg6X cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/rr02n/0x4AAAAAAA_X1sXBaVhyi7pF/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 19:27:01 UTC	16384	OUT	Data Raw: 62 6d 4c 71 7a 43 6a 65 35 4e 4c 6b 6e 64 4a 6a 67 75 51 46 4c 43 77 75 34 75 50 71 68 73 57 65 6a 57 75 6a 71 57 6b 53 75 39 75 76 73 6b 70 70 6a 69 75 2b 77 68 75 6a 35 73 6d 75 41 75 64 73 4c 57 68 5a 75 32 63 43 72 75 68 61 6e 71 75 58 71 50 4a 75 49 55 73 43 46 75 62 4d 79 79 24 75 4e 31 31 6e 79 31 75 70 45 58 39 75 64 63 75 67 37 75 42 35 75 72 37 41 63 75 79 55 4c 71 43 65 75 64 72 47 71 47 39 4c 71 64 78 65 43 6b 44 43 75 44 50 42 7a 72 41 72 30 79 65 7a 4e 58 2d 24 63 75 72 4a 6d 75 45 49 7a 51 47 75 50 44 4c 43 4c 36 75 4b 73 75 67 4d 77 79 72 79 75 75 56 24 45 77 64 42 6d 72 75 43 30 6c 46 4e 58 39 31 77 6e 75 42 67 67 73 49 6a 45 6b 75 4c 4c 75 5a 71 43 56 75 42 6e 75 48 39 71 75 4a 71 50 54 75 42 78 36 41 47 44 5a 75 34 73 50 75 57 73 47 75 Data Ascii: bmLqzCje5NLkndJjguQFLCwu4uPqhsWejWujqWkSu9uvskppjiu+whuj5smuAudsLWhZu2cCruhanquXqPJuIUsCFubMyy$uN11ny1upEX9udcug7uB5ur7AcuyULqCeudrGqG9LqdxeCkDCuDPBzrAr0yezNX-$curJmuEIzQGuPDLCL6uKsugMwyryuuV$EwdBmruC0lFNX91wnuBggsIjEkuLLuZqCVuBnuH9quJqPTuBx6AGDZu4sPuWsGu
2025-03-24 19:27:01 UTC	16384	OUT	Data Raw: 37 64 70 32 4c 73 53 6b 5a 56 46 24 62 78 58 6b 69 72 75 71 35 72 70 34 6a 74 53 6d 72 34 74 45 66 24 62 71 37 48 51 71 24 37 74 57 41 71 72 71 75 75 53 4e 47 6a 78 69 6e 6b 75 4e 75 45 74 64 51 75 34 42 73 56 6d 6a 6e 42 66 73 73 63 4c 53 75 53 4e 2d 31 57 75 4e 2b 75 35 75 4a 75 46 43 6e 6f 64 4c 53 57 75 73 62 74 41 75 34 4a 49 70 75 49 75 39 39 49 5a 75 66 77 64 2b 4c 70 2d 68 64 71 44 4c 67 77 51 42 6a 67 4e 45 38 62 51 43 6b 71 37 72 34 77 42 63 71 65 35 50 78 7a 6d 71 39 68 79 4c 75 78 4c 45 35 75 73 4b 67 33 59 4c 34 77 43 62 68 37 44 57 46 75 47 43 50 4c 70 71 43 6b 73 42 4a 68 6e 64 74 71 6b 71 6a 6e 50 64 71 32 61 70 74 64 34 71 6c 4c 70 6e 6b 72 6a 33 71 79 6a 6a 36 24 41 63 62 6f 42 71 71 48 63 32 57 61 6b 43 53 31 50 38 24 31 43 38 63 38 6d Data Ascii: 7dp2LsSkZVF$bxXkiruq5rp4jtSmr4tEf$bq7HQq$7tWAqrquuSNGjxinkuNuEtdQu4BsVmjnBfsscLSuSN-1WuN+u5uJuFCnodLSWusbtAu4JIpuIu99IZufwd+Lp-hdqDLgwQBjgNE8bQCkq7r4wBcqe5Pxzmq9hyLuxLE5usKg3YL4wCbh7DWFuGCPLpqCksBJhndtqkqjnPdq2aptd4qlLpnkrj3qyjj6$AcboBqqHc2WakCS1P8$1C8c8m
2025-03-24 19:27:01 UTC	8087	OUT	Data Raw: 67 54 30 72 59 67 38 77 36 48 73 6a 4a 7a 4d 38 44 38 56 43 49 59 35 56 37 71 30 2d 71 30 55 78 6a 4e 4c 4a 6b 66 6e 56 6f 4f 77 68 68 56 56 64 2d 2d 35 43 62 59 44 63 69 4c 78 30 75 35 67 47 70 42 77 75 6b 71 64 64 39 70 71 34 75 44 39 58 4f 67 6c 4c 70 24 55 78 49 4f 75 6f 53 39 49 71 73 38 73 79 72 65 44 70 39 64 7a 6a 32 56 76 4a 32 39 74 6e 24 4a 30 7a 39 6d 63 6d 6c 4c 76 7a 55 37 7a 61 63 7a 6f 76 36 34 53 2d 74 72 33 5a 4b 45 4c 37 79 56 4c 6a 53 36 48 51 70 79 6e 41 58 36 58 6d 4d 48 54 4b 67 68 6e 38 48 6e 49 4d 77 6c 74 2b 6e 53 2b 66 6f 49 6a 74 2d 30 72 55 68 6a 4b 2d 33 54 58 6c 77 31 75 34 47 64 4e 48 71 32 72 6a 4c 4d 36 64 30 58 33 6f 2d 56 2d 62 56 58 58 4e 24 75 30 48 68 46 65 73 42 67 6d 36 42 75 6a 68 63 47 65 43 6f 6a 5a 75 37 76 57 Data Ascii: gT0rYg8w6HsjJzM8D8VCIY5V7q0-q0UxjNLJkfnVoOwhhVVd--5CbYDciLx0u5gGpBwukqdd9pq4uD9XOglLp$UxIOuoS9Iqs8syreDp9dzj2VvJ29tn$J0z9mcmlLvzU7zaczov64S-tr3ZKEL7yVLjS6HQpynAX6XmMHTKghn8HnIMwlt+nS+foIjt-0rUhjK-3TXlw1u4GdNHq2rjLM6d0X3o-V-bVXXN$u0HhFesBgm6BujhcGeCojZu7vW
2025-03-24 19:27:02 UTC	1288	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 19:27:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4856 Connection: close cf-chl-out-s: G+xLiIUeS4+IgFCRVrQ7vpEH4TL0VDDfyEdfJy9NEE2Gjn6X+yivOa3KgUGZj+gBYyhzYIv7wvaHezF8dYsz0qd2s9uHaYHC5w/kr0kMdEMYM7W/D86mOMDPZ2Z2s0Lnvev+kUOvPSBtWeZTfNEiWKaaUeqGyh4Mxo2V5KeagIgzO823FTpC0KlTOKuhxMHTKyzuQD0oqCbBcypyTc35fhEKW+liBiquW2uGMm4Bs790ax74y1n6NtzVmscH77uaPtrpMoeocNwjSg1q7YDS3zMTpRIdBpWp2NL2SjvBEVUeA1XG204PsVVB6ySObJ4A74urVl2MCfuGtl9+Ju/KEOBq0Fqpi+cCxruEhd6qmwyruPfHnoDSWTe5UmovzCUX/jETxyzHyQ+l2wNImcv3Kxz0gXAmMkT10r/JxtxqCkYURuMQGvqrdXkM4Ztjc/ehSKSTpdSzxwakyIt3ouVe2cWBYZAd1E3kZ/yR+Cpl7ufK6r35Jo+3ozhjI6lbFkDTf7buIolH4t+3Tv09wcYlrXIiJwfBib/YZ+CwC4iD3YMBNOwyGf6GNu+g5gxYWcZZ2Q7CmZeIlH92rR4jLwTuwi5cK9C0EPh+gFjf3W15fz3bVog7CMMigzc1v8ZW2aP+2/kK+qr3FiXT6zUYoE/dwIekbKE9QVH/J2fxAOjwE+Qm6TLBeS+4qnfUcTSLfSVFt7lFPUGHKMhyo3JvXW7QJWzjVcBFdJFfkoJ7HsVrFFvFSbnl2jHKhBfkImms7rF328SztuKHzGgNDydbmBTPJE6HKrQbWQGlJoZrIKXJzSF/+LLJfIaxc73d82Zb2vxZSfc1tnWEMNG5bgA1lD1q77iipqj1cFSpviZZoWevdOBLEY+hXBf51dNpO05BKhdIdSdFbSDj/TR8+0gcStG/N6Z5SOyT5isH0C/Sbwhvn0izh8fxF+pOhLweTgezGU2tq+gd5fWDfJtXZW9UAOYFUabrLvBc0uWf7vyENQB49RnXNFPJ8z [TRUNCATED]
2025-03-24 19:27:02 UTC	229	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 37 76 61 6e 41 75 46 6e 62 61 62 50 4a 71 62 65 57 5a 61 79 49 37 33 7a 75 67 56 6e 62 70 79 66 68 51 43 73 71 46 73 72 5a 61 42 52 2b 6e 4f 35 2f 65 4f 6e 57 45 68 76 38 43 61 53 64 48 73 79 4a 66 71 43 44 33 75 45 45 6d 54 6d 2b 49 73 6c 72 39 65 37 6b 50 4a 63 69 4e 56 53 48 36 38 62 41 57 77 46 54 4f 52 2f 6f 65 45 3d 24 47 50 6a 72 67 73 4a 39 30 4a 65 38 65 64 77 6e 41 63 64 59 76 41 3d 3d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 39 32 35 38 39 30 34 35 66 63 64 38 37 36 31 31 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: cf-chl-out: 7vanAuFnbabPJqbeWZayI73zugVnbpyfhQCsqFsrZaBR+nO5/eOnWEhv8CaSdHsyJfqCD3uEEmTm+Islr9e7kPJciNVSH68bAWwFTOR/oeE=$GPjrgsJ90Je8edwnAcdYvA==Server: cloudflareCF-RAY: 92589045fcd87611-EWRalt-svc: h3=":443"; ma=86400
2025-03-24 19:27:02 UTC	1221	IN	Data Raw: 65 35 79 67 6d 70 57 79 71 4b 58 4d 6f 62 61 6a 7a 72 76 47 72 34 6d 6f 78 37 4b 4e 78 5a 53 72 6c 35 7a 50 72 39 4c 52 34 62 50 42 31 75 44 47 77 4f 6e 6f 79 4d 58 4e 31 36 33 63 75 71 6e 44 7a 4c 36 74 78 38 2f 70 74 50 58 53 32 66 54 63 32 65 48 7a 77 66 43 38 34 74 48 67 2b 75 62 5a 36 50 7a 69 33 4f 6e 78 44 4e 45 45 38 66 45 48 37 77 77 49 42 68 41 50 45 76 4c 32 38 42 6b 42 2b 67 48 79 39 66 37 30 48 67 41 44 2f 43 45 51 42 77 34 64 45 77 34 52 49 51 67 71 46 44 6e 36 47 68 6b 70 48 52 55 7a 46 76 67 64 52 76 30 6d 4a 54 73 2b 4a 53 4d 63 54 54 63 6e 4c 6b 55 78 49 77 78 42 4f 44 59 31 56 53 67 31 46 46 59 39 57 79 42 55 57 68 30 31 55 6a 6b 79 4f 43 46 46 5a 79 78 4b 49 55 6f 37 4b 31 45 2b 62 46 34 78 65 46 5a 76 53 54 4a 52 63 32 6f 36 57 46 35 Data Ascii: e5ygmpWyqKXMobajzrvGr4mox7KNxZSrl5zPr9LR4bPB1uDGwOnoyMXN163cuqnDzL6tx8/ptPXS2fTc2eHzwfC84tHg+ubZ6Pzi3OnxDNEE8fEH7wwIBhAPEvL28BkB+gHy9f70HgAD/CEQBw4dEw4RIQgqFDn6GhkpHRUzFvgdRv0mJTs+JSMcTTcnLkUxIwxBODY1VSg1FFY9WyBUWh01UjkyOCFFZyxKIUo7K1E+bF4xeFZvSTJRc2o6WF5
2025-03-24 19:27:02 UTC	1369	IN	Data Raw: 6a 64 4e 4c 7a 38 31 4b 31 4d 64 4f 54 56 54 5a 45 52 59 50 6b 4a 49 52 32 51 32 51 45 46 6a 4c 6b 4d 73 53 53 68 71 53 57 39 31 57 55 5a 4b 5a 6c 75 42 66 32 35 59 56 56 39 6a 59 33 39 6e 63 6e 2b 44 64 30 6c 6f 6b 58 75 54 61 46 43 48 6a 33 42 7a 55 49 5a 35 64 6f 39 5a 63 6e 79 50 6c 33 4a 2b 64 34 57 62 6d 61 4e 6b 65 34 65 4a 61 34 65 4b 72 49 47 48 67 4b 69 52 71 70 4b 30 68 4a 69 7a 72 37 79 57 69 70 32 78 6c 4d 57 6d 6d 5a 65 34 6c 70 6d 66 6c 37 79 74 70 74 43 37 78 61 72 44 6a 4d 79 31 70 4d 66 4b 73 4e 32 6d 70 74 4b 38 73 72 79 37 78 62 33 56 32 38 6e 6a 31 62 72 73 70 62 62 41 79 73 66 4d 30 66 58 4b 77 4d 76 44 34 64 6e 5a 78 2f 65 2b 31 74 48 74 34 2b 41 47 37 2f 58 5a 30 77 6a 44 34 66 30 49 2b 2b 4c 74 37 75 72 72 46 51 67 4b 36 76 50 75 Data Ascii: jdNLz81K1MdOTVTZERYPkJIR2Q2QEFjLkMsSShqSW91WUZKZluBf25YVV9jY39ncn+Dd0lokXuTaFCHj3BzUIZ5do9ZcnyPl3J+d4WbmaNke4eJa4eKrIGHgKiRqpK0hJizr7yWip2xlMWmmZe4lpmfl7ytptC7xarDjMy1pMfKsN2mptK8sry7xb3V28nj1brspbbAysfM0fXKwMvD4dnZx/e+1tHt4+AG7/XZ0wjD4f0I++Lt7urrFQgK6vPu
2025-03-24 19:27:02 UTC	1369	IN	Data Raw: 31 65 4c 54 6f 34 51 6b 46 66 55 53 52 72 53 57 49 36 4a 55 52 6a 54 53 39 68 59 30 56 41 4f 48 4e 4c 61 6d 30 35 65 6b 6c 57 56 46 35 64 65 6c 4e 41 68 32 57 41 61 45 70 6b 66 57 2b 4f 5a 35 4a 6b 53 59 46 31 59 56 64 74 63 6f 56 74 68 33 5a 77 64 70 65 59 61 32 4f 69 6d 59 36 45 70 58 56 36 6e 35 61 49 62 61 2b 74 61 33 46 75 5a 6f 53 57 6c 70 4b 75 6c 70 57 74 65 71 61 63 76 61 75 54 74 37 61 55 75 70 48 48 71 72 79 49 78 73 75 69 30 4a 43 77 68 4c 44 44 70 6f 2b 50 6c 63 75 58 32 5a 58 46 73 62 69 75 32 4f 47 33 6e 4f 4f 6b 7a 38 57 6c 31 64 61 6c 7a 75 44 4f 35 4f 79 74 31 50 4f 31 37 64 66 73 39 4f 62 61 38 4f 6a 6f 34 4e 37 73 32 50 53 2b 41 63 38 49 41 50 48 45 44 4f 6b 46 32 4d 76 2b 43 76 4d 55 36 78 66 66 34 66 44 73 7a 4e 67 63 46 4f 6e 66 2b Data Ascii: 1eLTo4QkFfUSRrSWI6JURjTS9hY0VAOHNLam05eklWVF5delNAh2WAaEpkfW+OZ5JkSYF1YVdtcoVth3ZwdpeYa2OimY6EpXV6n5aIba+ta3FuZoSWlpKulpWteqacvauTt7aUupHHqryIxsui0JCwhLDDpo+PlcuX2ZXFsbiu2OG3nOOkz8Wl1dalzuDO5Oyt1PO17dfs9Oba8Ojo4N7s2PS+Ac8IAPHEDOkF2Mv+CvMU6xff4fDszNgcFOnf+
2025-03-24 19:27:02 UTC	897	IN	Data Raw: 5a 5a 32 46 43 58 6a 39 4c 54 57 4e 4a 63 6b 38 39 4c 44 4a 48 56 48 52 57 55 46 55 38 63 6c 55 33 62 46 39 55 54 6a 78 39 58 46 4a 6a 5a 33 31 44 57 6c 31 6c 61 34 78 75 62 46 2b 51 5a 47 5a 30 61 33 74 74 55 33 31 64 65 4a 43 54 6d 58 68 67 66 6e 65 45 5a 49 4f 47 66 4b 4f 4b 6a 59 57 52 6d 35 2b 45 6a 36 43 44 6c 5a 57 6a 73 4b 36 76 73 5a 36 4f 6d 37 69 4e 6d 49 36 57 6b 5a 79 53 6e 59 53 69 68 6f 79 49 70 73 65 6e 73 71 4c 44 6a 62 2b 6d 74 4d 66 61 7a 35 53 32 71 36 36 59 7a 4d 75 33 35 4d 2f 5a 76 71 43 36 78 63 4c 49 7a 65 44 4e 38 4b 6e 54 7a 4e 48 4f 78 4d 72 53 30 61 7a 4b 78 74 58 78 33 4e 33 62 34 39 66 37 32 75 48 68 32 51 54 4a 32 75 62 70 78 51 54 70 7a 41 6e 69 42 65 72 65 37 65 50 52 35 4f 76 6e 33 41 30 55 2b 2f 6b 55 46 79 59 57 42 76 Data Ascii: ZZ2FCXj9LTWNJck89LDJHVHRWUFU8clU3bF9UTjx9XFJjZ31DWl1la4xubF+QZGZ0a3ttU31deJCTmXhgfneEZIOGfKOKjYWRm5+Ej6CDlZWjsK6vsZ6Om7iNmI6WkZySnYSihoyIpsensqLDjb+mtMfaz5S2q66YzMu35M/ZvqC6xcLIzeDN8KnTzNHOxMrS0azKxtXx3N3b49f72uHh2QTJ2ubpxQTpzAniBere7ePR5Ovn3A0U+/kUFyYWBv

Target ID:	0
Start time:	15:26:21
Start date:	24/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Ipsen USA RFP.pdf"
Imagebase:	0x7ff672610000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	1
Start time:	15:26:25
Start date:	24/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff757060000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	2
Start time:	15:26:26
Start date:	24/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1572,i,17589608329626494226,1086582052272382565,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff757060000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	15:26:47
Start date:	24/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://eyyaltynews.com/securefile/email-template.html
Imagebase:	0x7ff77eaf0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre