Edit tour

Windows Analysis Report
Filled-Summons Notice (2).docx

Overview

General Information

Sample name:	Filled-Summons Notice (2).docx
Analysis ID:	1648755
MD5:	380c1617aea96d8d60d45e9435a98578
SHA1:	9354133a938fc1eb8f0710ab2d7df07492c3de4a
SHA256:	2dab4e6a86dacc6123c4c5fd11669fb36a2372fd75439f9c6faf0104d594afcf
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

AI detected landing page (webpage, office document or email)

Performs DNS queries to domains with low reputation

Creates files inside the system directory

Deletes files inside the Windows folder

Form action URLs do not match main URL

HTML body contains low number of good links

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Unable to load, office file is protected or invalid

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 8172 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 8652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 8952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,15448483630826734966,4684573500086254227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2176 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://medpetroenergydmcc.com/court/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_136	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://medpetroenergydmcc.com/court/

Joe Sandbox AI: Score: 7 Reasons: The brand 'National Prosecuting Authority of South Africa' is a known governmental entity., The URL 'medpetroenergydmcc.com' does not match the legitimate domain 'npa.gov.za' associated with the National Prosecuting Authority of South Africa., The domain 'medpetroenergydmcc.com' appears unrelated to the brand and does not reflect any known association with the National Prosecuting Authority of South Africa., The presence of input fields for 'Email Address' and 'Password' on a site not matching the legitimate domain is suspicious and indicative of phishing. DOM: 0.0.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_136, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: Office document	Joe Sandbox AI: Page contains button: 'ACCESS YOUR DOCUMENT HERE' Source: 'Office document'
Source: Office document	Joe Sandbox AI: Office document contains prominent button: 'access your document here'
Source: Screenshot id: 7	Joe Sandbox AI: Page contains button: 'ACCESS YOUR DOCUMENT HERE' Source: 'Screenshot id: 7'
Source: Screenshot id: 7	Joe Sandbox AI: Screenshot id: 7 contains prominent button: 'access your document here'

Source: https://medpetroenergydmcc.com/court/

HTTP Parser: Form action: https://api.staticforms.xyz/submit medpetroenergydmcc staticforms

Source: https://medpetroenergydmcc.com/court/

HTTP Parser: Number of links: 0

Source: https://medpetroenergydmcc.com/court/

HTTP Parser: Title: court online - Secure Document Delivery Portal does not match URL

Source: https://medpetroenergydmcc.com/court/

HTTP Parser: <input type="password" .../> found

Source: https://usersharepoint.nicepage.io/

HTTP Parser: No favicon

Source: https://medpetroenergydmcc.com/court/

HTTP Parser: No <meta name="author".. found

Source: https://medpetroenergydmcc.com/court/

HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.100:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.250.234.26:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.250.234.26:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.250.234.26:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.132:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.132:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 79.127.206.208:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 79.127.206.234:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 79.127.206.207:443 -> 192.168.2.4:49774 version: TLS 1.2

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: api.staticforms.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: api.staticforms.xyz

Source: Joe Sandbox View	IP Address: 207.174.26.219 207.174.26.219
Source: Joe Sandbox View	IP Address: 79.127.206.207 79.127.206.207
Source: Joe Sandbox View	IP Address: 192.250.234.26 192.250.234.26
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.163
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /court/ HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/seedprod-coming-soon-pro-5/public/css/tailwind.min.css?ver=6.18.14 HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://medpetroenergydmcc.com/court/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/seedprod-coming-soon-pro-5/public/fontawesome/css/all.min.css?ver=6.18.14 HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://medpetroenergydmcc.com/court/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bjwfL99R/logo-dark-6.png HTTP/1.1Host: i.ibb.coConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://medpetroenergydmcc.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://medpetroenergydmcc.com/court/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://medpetroenergydmcc.com/court/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bjwfL99R/logo-dark-6.png HTTP/1.1Host: i.ibb.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/03/download-1.jpeg HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://medpetroenergydmcc.com/court/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/seedprod-coming-soon-pro-5/public/js/sp-scripts.min.js HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://medpetroenergydmcc.com/court/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/seedprod-coming-soon-pro-5/public/js/dynamic-text.js HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://medpetroenergydmcc.com/court/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/seedprod-coming-soon-pro-5/public/js/tsparticles.min.js HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://medpetroenergydmcc.com/court/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/03/download-1.jpeg HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=6.7.2 HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://medpetroenergydmcc.com/court/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/03/cropped-judiciary_logo-32x32.jpg HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://medpetroenergydmcc.com/court/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/03/cropped-judiciary_logo-32x32.jpg HTTP/1.1Host: medpetroenergydmcc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: usersharepoint.nicepage.ioConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://medpetroenergydmcc.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nicepage-site.css HTTP/1.1Host: usersharepoint.nicepage.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://usersharepoint.nicepage.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index.css HTTP/1.1Host: usersharepoint.nicepage.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://usersharepoint.nicepage.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d29e8cf1cf4d4fade598bc5c32341cd518073458/nicepage.css HTTP/1.1Host: capp.nicepage.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://usersharepoint.nicepage.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /eeff2eae/6366116/images/SharePoint-Symbol.webp HTTP/1.1Host: assets.nicepagecdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://usersharepoint.nicepage.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/jquery-3.5.1.min.js HTTP/1.1Host: capp.nicepage.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://usersharepoint.nicepage.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d29e8cf1cf4d4fade598bc5c32341cd518073458/nicepage.js HTTP/1.1Host: capp.nicepage.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://usersharepoint.nicepage.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /eeff2eae/6366116/images/SharePoint-Symbol.webp HTTP/1.1Host: assets.nicepagecdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /eeff2eae/6366116/images/11513839.png HTTP/1.1Host: assets.nicepagecdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://usersharepoint.nicepage.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /eeff2eae/6366116/images/11513839.png HTTP/1.1Host: assets.nicepagecdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: usersharepoint.nicepage.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usersharepoint.nicepage.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: sessionId=162bd15a-cb1e-4927-8931-6c20f64a4c89; userId=b8e39c14-ecc6-4445-b730-24b6a3d200bc
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: medpetroenergydmcc.com
Source: global traffic	DNS traffic detected: DNS query: i.ibb.co
Source: global traffic	DNS traffic detected: DNS query: api.staticforms.xyz
Source: global traffic	DNS traffic detected: DNS query: usersharepoint.nicepage.io
Source: global traffic	DNS traffic detected: DNS query: capp.nicepage.com
Source: global traffic	DNS traffic detected: DNS query: assets.nicepagecdn.com

Source: unknown

HTTP traffic detected: POST /submit HTTP/1.1Host: api.staticforms.xyzConnection: keep-aliveContent-Length: 154Cache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Origin: https://medpetroenergydmcc.comContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://medpetroenergydmcc.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 5034Server: nginx/1.19.2Content-Type: text/htmlLast-Modified: Mon, 01 Jul 2024 13:10:38 GMTx-amz-version-id: FT9qWE0BVhUpA2Q17BX6y15wtpUeS1FKETag: "e01836379a08fd6809bc20a9933f25ef"x-amz-error-code: NoSuchKeyx-amz-error-message: The specified key does not exist.x-amz-error-detail-Key: oi/nt/usersharepoint/favicon.icox-amz-request-id: JNKH5V23MFBZFJT4x-amz-id-2: K3J6IRL3IXRjvOkwmKYyDBAME+WduMYYywgl1fUfXezyb42FOjQ5HtMYYUf9BGcMUOjr4i+uZTs+OHUSGI0u3ZYnTvdc//WzPry4UTd86WA=Accept-Ranges: bytesAge: 120Date: Wed, 26 Mar 2025 06:20:15 GMTVia: 1.1 varnishX-Served-By: cache-lga21932-LGAX-Cache: HITX-Cache-Hits: 0X-Timer: S1742970016.521485,VS0,VE1Vary: Accept-Encoding

Source: chromecache_127.18.dr	String found in binary or memory: http://codepen.io/dimsemenov/pen/yyBWoR
Source: chromecache_127.18.dr	String found in binary or memory: http://daneden.me/animate
Source: chromecache_116.18.dr	String found in binary or memory: http://gilmoreorless.mit-license.org/
Source: chromecache_116.18.dr	String found in binary or memory: http://github.com/cferdinandi/gumshoe
Source: chromecache_127.18.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: chromecache_116.18.dr	String found in binary or memory: http://photoswipe.com
Source: chromecache_140.18.dr	String found in binary or memory: http://schema.org
Source: chromecache_136.18.dr	String found in binary or memory: https://api.seedprod.com/v4/
Source: chromecache_136.18.dr	String found in binary or memory: https://api.staticforms.xyz/submit
Source: chromecache_136.18.dr	String found in binary or memory: https://api.w.org/
Source: chromecache_129.18.dr	String found in binary or memory: https://assets.nicepagecdn.com/eeff2eae/6366116/images/11513839.png
Source: chromecache_140.18.dr	String found in binary or memory: https://assets.nicepagecdn.com/eeff2eae/6366116/images/SharePoint-Symbol.webp
Source: chromecache_127.18.dr	String found in binary or memory: https://blog.keanulee.com/2014/10/20/the-tale-of-three-spinners.html
Source: chromecache_128.18.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_128.18.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_136.18.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Lato:700
Source: chromecache_140.18.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:100
Source: chromecache_143.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/alegreya/v36/4UacrEBBsBhlBjvfkQjt71kZfyBzPgNG9hU4-6qj.woff2)
Source: chromecache_143.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/alegreya/v36/4UacrEBBsBhlBjvfkQjt71kZfyBzPgNG9hU4-KqjgSE.woff2)
Source: chromecache_143.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/alegreya/v36/4UacrEBBsBhlBjvfkQjt71kZfyBzPgNG9hU496qjgSE.woff2)
Source: chromecache_143.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/alegreya/v36/4UacrEBBsBhlBjvfkQjt71kZfyBzPgNG9hU49KqjgSE.woff2)
Source: chromecache_143.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/alegreya/v36/4UacrEBBsBhlBjvfkQjt71kZfyBzPgNG9hU49aqjgSE.woff2)
Source: chromecache_143.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/alegreya/v36/4UacrEBBsBhlBjvfkQjt71kZfyBzPgNG9hU49qqjgSE.woff2)
Source: chromecache_143.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/alegreya/v36/4UacrEBBsBhlBjvfkQjt71kZfyBzPgNG9hU4_6qjgSE.woff2)
Source: chromecache_143.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
Source: chromecache_143.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqW106F15M.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWt06F15M.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtE6F15M.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtU6F15M.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWtk6F15M.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWu06F15M.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuk6F15M.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWvU6F15M.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWxU6F15M.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkAnkaWzU.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkBXkaWzU.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkBnka.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkC3kaWzU.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCHkaWzU.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCXkaWzU.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCnkaWzU.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkaHkaWzU.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkenkaWzU.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBGEe.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBGEe.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBGEe.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3KUBGEe.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3OUBGEe.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBGEe.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBGEe.woff2)
Source: chromecache_142.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBGEe.woff2)
Source: chromecache_127.18.dr	String found in binary or memory: https://froala.com/wysiwyg-editor/terms/
Source: chromecache_116.18.dr	String found in binary or memory: https://github.com/Prinzhorn/skrollr
Source: chromecache_116.18.dr	String found in binary or memory: https://github.com/gilmoreorless/css-background-parser
Source: chromecache_116.18.dr	String found in binary or memory: https://github.com/imakewebthings/waypoints/blob/master/licenses.txt
Source: chromecache_116.18.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_127.18.dr	String found in binary or memory: https://github.com/nickpettit/glide
Source: chromecache_136.18.dr	String found in binary or memory: https://i.ibb.co/bjwfL99R/logo-dark-6.png
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/?p=61
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/comments/feed/
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/court/
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/feed/
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/css/tailwind.min
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/fontawesome/css/
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/dynamic-text.
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/sp-scripts.mi
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/tsparticles.m
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/archivo/archivo_wght.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/arsenal/arsenal-bold.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/arsenal/arsenal-regular.wof
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/baloo-tamma-2/baloo-tamma-2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/geom/geom-variable.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/gotu/gotu-regular.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/heebo/heebo-variable-wght.w
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/hind/hind-variable.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/ibm-plex-sans/ibm-plex-sans
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/inconsolata/inconsolata-var
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/inter/inter-variable.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/jost/jost-variable.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/karla/karla.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/koulen/Koulen-Regular.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/manrope/manrope.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/marcellus/marcellus_wght.wo
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/montserrat/montserrat.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/mulish/mulish.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/noto-serif-display/noto-ser
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/oswald/oswald.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/radio-canada/radio-canada.w
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/roboto-flex/roboto-flex.wof
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/rubik/rubik.woff2
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/source-serif-pro/source-ser
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/space-mono/space-mono-bold.
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/space-mono/space-mono-regul
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-180x180.jpg
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-192x192.jpg
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-270x270.jpg
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-32x32.jpg
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-content/uploads/2025/03/download-1.jpeg
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-json/
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fmedpetroenergydmcc.com%2Fc
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/wp-json/wp/v2/pages/61
Source: chromecache_136.18.dr	String found in binary or memory: https://medpetroenergydmcc.com/xmlrpc.php?rsd
Source: chromecache_132.18.dr	String found in binary or memory: https://nicepage.com
Source: chromecache_140.18.dr, chromecache_132.18.dr	String found in binary or memory: https://nicepage.com/
Source: chromecache_132.18.dr	String found in binary or memory: https://nicepage.com/Content/Images/logo-w.png
Source: chromecache_132.18.dr	String found in binary or memory: https://nicepage.com/Editor/Contact
Source: chromecache_136.18.dr	String found in binary or memory: https://schema.org
Source: chromecache_116.18.dr	String found in binary or memory: https://service.nicepagesrv.com/form-attachment/v1/form-upload-url
Source: chromecache_116.18.dr	String found in binary or memory: https://service.nicepagesrv.com/place-email-order/v1/place-email-order
Source: chromecache_116.18.dr	String found in binary or memory: https://service.nicepagesrv.com/site-search/v1/site-search
Source: chromecache_116.18.dr	String found in binary or memory: https://service.nicepagesrv.com/stripe/v1/stripe-checkout
Source: chromecache_136.18.dr	String found in binary or memory: https://usersharepoint.nicepage.io/
Source: chromecache_140.18.dr	String found in binary or memory: https://usersharepoint.nicepage.io/Userportal.html?version=85c318ef-cf50-59b0-e164-cf5b864ad8df
Source: chromecache_127.18.dr	String found in binary or memory: https://www.froala.com/wysiwyg-editor)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.100:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.250.234.26:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.250.234.26:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.250.234.26:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.132:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.132:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 79.127.206.208:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 79.127.206.234:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 79.127.206.207:443 -> 192.168.2.4:49774 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir8652_2006417299

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir8652_2006417299

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Window title found: save password for medpetroenergydmcc.com?

Source: classification engine

Classification label: mal64.phis.troj.winDOCX@26/64@20/9

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\Desktop\~$lled-Summons Notice (2).docx

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{D21F0A66-3080-4794-8924-F806DBB7E2DE} - OProcSessId.dat

Jump to behavior

Source: Filled-Summons Notice (2).docx

OLE indicator, Word Document stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,15448483630826734966,4684573500086254227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2176 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://medpetroenergydmcc.com/court/"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,15448483630826734966,4684573500086254227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2176 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Filled-Summons Notice (2).docx

Initial sample: OLE zip file path = word/media/image2.jpg

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: Filled-Summons Notice (2).docx

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Filled-Summons Notice (2).docx	0%	Virustotal		Browse
Filled-Summons Notice (2).docx	0%	ReversingLabs

Source	Detection	Scanner	Label
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/geom/geom-variable.woff2	0%	Avira URL Cloud	safe
https://usersharepoint.nicepage.io/Userportal.html?version=85c318ef-cf50-59b0-e164-cf5b864ad8df	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-192x192.jpg	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/baloo-tamma-2/baloo-tamma-2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/dynamic-text.	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/rubik/rubik.woff2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-json/wp/v2/pages/61	0%	Avira URL Cloud	safe
https://capp.nicepage.com/d29e8cf1cf4d4fade598bc5c32341cd518073458/nicepage.css	0%	Avira URL Cloud	safe
https://usersharepoint.nicepage.io/nicepage-site.css	0%	Avira URL Cloud	safe
https://api.staticforms.xyz/submit	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/feed/	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/fontawesome/css/	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/css/tailwind.min.css?ver=6.18.14	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/source-serif-pro/source-ser	0%	Avira URL Cloud	safe
https://api.seedprod.com/v4/	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-json/	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/radio-canada/radio-canada.w	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/heebo/heebo-variable-wght.w	0%	Avira URL Cloud	safe
https://assets.nicepagecdn.com/eeff2eae/6366116/images/11513839.png	0%	Avira URL Cloud	safe
https://service.nicepagesrv.com/place-email-order/v1/place-email-order	0%	Avira URL Cloud	safe
https://capp.nicepage.com/assets/jquery-3.5.1.min.js	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/sp-scripts.mi	0%	Avira URL Cloud	safe
http://gilmoreorless.mit-license.org/	0%	Avira URL Cloud	safe
https://usersharepoint.nicepage.io/index.css	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/roboto-flex/roboto-flex.wof	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/space-mono/space-mono-regul	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/arsenal/arsenal-bold.woff2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-32x32.jpg	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/noto-serif-display/noto-ser	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/dynamic-text.js	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/arsenal/arsenal-regular.wof	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/?p=61	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/space-mono/space-mono-bold.	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/marcellus/marcellus_wght.wo	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-includes/js/wp-emoji-release.min.js?ver=6.7.2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/archivo/archivo_wght.woff2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fmedpetroenergydmcc.com%2Fc	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/karla/karla.woff2	0%	Avira URL Cloud	safe
https://service.nicepagesrv.com/site-search/v1/site-search	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/gotu/gotu-regular.woff2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-180x180.jpg	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/oswald/oswald.woff2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/inter/inter-variable.woff2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/tsparticles.min.js	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/comments/feed/	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/jost/jost-variable.woff2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/fontawesome/css/all.min.css?ver=6.18.14	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/koulen/Koulen-Regular.woff2	0%	Avira URL Cloud	safe
https://service.nicepagesrv.com/stripe/v1/stripe-checkout	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/sp-scripts.min.js	0%	Avira URL Cloud	safe
https://capp.nicepage.com/d29e8cf1cf4d4fade598bc5c32341cd518073458/nicepage.js	0%	Avira URL Cloud	safe
https://usersharepoint.nicepage.io/favicon.ico	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/css/tailwind.min	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/hind/hind-variable.woff2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/xmlrpc.php?rsd	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/manrope/manrope.woff2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/ibm-plex-sans/ibm-plex-sans	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/inconsolata/inconsolata-var	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/montserrat/montserrat.woff2	0%	Avira URL Cloud	safe
https://service.nicepagesrv.com/form-attachment/v1/form-upload-url	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/tsparticles.m	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/uploads/2025/03/download-1.jpeg	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-270x270.jpg	0%	Avira URL Cloud	safe
https://assets.nicepagecdn.com/eeff2eae/6366116/images/SharePoint-Symbol.webp	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/mulish/mulish.woff2	0%	Avira URL Cloud	safe
https://medpetroenergydmcc.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
1071178158.rsc.cdn77.org	79.127.206.234	true	false	unknown
medpetroenergydmcc.com	192.250.234.26	true	false	high
j.sni.global.fastly.net	151.101.2.132	true	false	high
www.google.com	142.251.40.100	true	false	high
1156509985.rsc.cdn77.org	79.127.206.208	true	false	unknown
s-0005.dual-s-msedge.net	52.123.128.14	true	false	high
api.staticforms.xyz	104.21.16.1	true	false	high
i.ibb.co	207.174.26.219	true	false	high
capp.nicepage.com	unknown	unknown	false	high
usersharepoint.nicepage.io	unknown	unknown	false	high
assets.nicepagecdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://capp.nicepage.com/d29e8cf1cf4d4fade598bc5c32341cd518073458/nicepage.css	false	Avira URL Cloud: safe	unknown
https://usersharepoint.nicepage.io/nicepage-site.css	false	Avira URL Cloud: safe	unknown
https://usersharepoint.nicepage.io/	false		unknown
https://api.staticforms.xyz/submit	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/css/tailwind.min.css?ver=6.18.14	false	Avira URL Cloud: safe	unknown
https://i.ibb.co/bjwfL99R/logo-dark-6.png	false		high
https://assets.nicepagecdn.com/eeff2eae/6366116/images/11513839.png	false	Avira URL Cloud: safe	unknown
https://capp.nicepage.com/assets/jquery-3.5.1.min.js	false	Avira URL Cloud: safe	unknown
https://usersharepoint.nicepage.io/index.css	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-32x32.jpg	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/dynamic-text.js	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-includes/js/wp-emoji-release.min.js?ver=6.7.2	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/court/	true		unknown
https://medpetroenergydmcc.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/tsparticles.min.js	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/fontawesome/css/all.min.css?ver=6.18.14	false	Avira URL Cloud: safe	unknown
https://usersharepoint.nicepage.io/favicon.ico	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/sp-scripts.min.js	false	Avira URL Cloud: safe	unknown
https://capp.nicepage.com/d29e8cf1cf4d4fade598bc5c32341cd518073458/nicepage.js	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/uploads/2025/03/download-1.jpeg	false	Avira URL Cloud: safe	unknown
https://assets.nicepagecdn.com/eeff2eae/6366116/images/SharePoint-Symbol.webp	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://codepen.io/dimsemenov/pen/yyBWoR	chromecache_127.18.dr	false		high
https://usersharepoint.nicepage.io/Userportal.html?version=85c318ef-cf50-59b0-e164-cf5b864ad8df	chromecache_140.18.dr	false	Avira URL Cloud: safe	unknown
http://photoswipe.com	chromecache_116.18.dr	false		high
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/dynamic-text.	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/rubik/rubik.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-192x192.jpg	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-json/wp/v2/pages/61	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/baloo-tamma-2/baloo-tamma-2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/geom/geom-variable.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://api.seedprod.com/v4/	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/radio-canada/radio-canada.w	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/source-serif-pro/source-ser	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://www.froala.com/wysiwyg-editor)	chromecache_127.18.dr	false		high
https://blog.keanulee.com/2014/10/20/the-tale-of-three-spinners.html	chromecache_127.18.dr	false		high
https://medpetroenergydmcc.com/feed/	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://fontawesome.com/license/free	chromecache_128.18.dr	false		high
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/fontawesome/css/	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://fontawesome.com	chromecache_128.18.dr	false		high
http://schema.org	chromecache_140.18.dr	false		high
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/heebo/heebo-variable-wght.w	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-json/	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
http://daneden.me/animate	chromecache_127.18.dr	false		high
https://service.nicepagesrv.com/place-email-order/v1/place-email-order	chromecache_116.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/sp-scripts.mi	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/space-mono/space-mono-regul	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
http://gilmoreorless.mit-license.org/	chromecache_116.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/arsenal/arsenal-bold.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/roboto-flex/roboto-flex.wof	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
http://github.com/cferdinandi/gumshoe	chromecache_116.18.dr	false		high
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/noto-serif-display/noto-ser	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://github.com/nickpettit/glide	chromecache_127.18.dr	false		high
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/arsenal/arsenal-regular.wof	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/marcellus/marcellus_wght.wo	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/?p=61	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/archivo/archivo_wght.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://github.com/gilmoreorless/css-background-parser	chromecache_116.18.dr	false		high
https://nicepage.com/	chromecache_140.18.dr, chromecache_132.18.dr	false		high
https://github.com/imakewebthings/waypoints/blob/master/licenses.txt	chromecache_116.18.dr	false		high
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/space-mono/space-mono-bold.	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fmedpetroenergydmcc.com%2Fc	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://api.w.org/	chromecache_136.18.dr	false		high
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/karla/karla.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/gotu/gotu-regular.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://service.nicepagesrv.com/site-search/v1/site-search	chromecache_116.18.dr	false	Avira URL Cloud: safe	unknown
http://opensource.org/licenses/MIT	chromecache_127.18.dr	false		high
https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-180x180.jpg	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://schema.org	chromecache_136.18.dr	false		high
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/oswald/oswald.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/inter/inter-variable.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://nicepage.com	chromecache_132.18.dr	false		high
https://medpetroenergydmcc.com/comments/feed/	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/jost/jost-variable.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/koulen/Koulen-Regular.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/css/tailwind.min	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://service.nicepagesrv.com/stripe/v1/stripe-checkout	chromecache_116.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/hind/hind-variable.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/xmlrpc.php?rsd	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/manrope/manrope.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/ibm-plex-sans/ibm-plex-sans	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/inconsolata/inconsolata-var	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/js/tsparticles.m	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/montserrat/montserrat.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://service.nicepagesrv.com/form-attachment/v1/form-upload-url	chromecache_116.18.dr	false	Avira URL Cloud: safe	unknown
https://nicepage.com/Editor/Contact	chromecache_132.18.dr	false		high
https://github.com/Prinzhorn/skrollr	chromecache_116.18.dr	false		high
https://nicepage.com/Content/Images/logo-w.png	chromecache_132.18.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_116.18.dr	false		high
https://froala.com/wysiwyg-editor/terms/	chromecache_127.18.dr	false		high
https://medpetroenergydmcc.com/wp-content/uploads/2025/03/cropped-judiciary_logo-270x270.jpg	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown
https://medpetroenergydmcc.com/wp-content/themes/extendable/assets/fonts/mulish/mulish.woff2	chromecache_136.18.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
207.174.26.219	i.ibb.co	United States	6079	RCN-ASUS	false
79.127.206.207	unknown	Czech Republic	9080	GINCzechRepublicEUCZ	false
192.250.234.26	medpetroenergydmcc.com	United States	36454	CNSV-LLCUS	false
104.21.16.1	api.staticforms.xyz	United States	13335	CLOUDFLARENETUS	false
79.127.206.234	1071178158.rsc.cdn77.org	Czech Republic	9080	GINCzechRepublicEUCZ	false
142.251.40.100	www.google.com	United States	15169	GOOGLEUS	false
79.127.206.208	1156509985.rsc.cdn77.org	Czech Republic	9080	GINCzechRepublicEUCZ	false
151.101.2.132	j.sni.global.fastly.net	United States	54113	FASTLYUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648755
Start date and time:	2025-03-26 07:18:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Filled-Summons Notice (2).docx
Detection:	MAL
Classification:	mal64.phis.troj.winDOCX@26/64@20/9
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://medpetroenergydmcc.com/court/ Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.204.23.20, 52.109.20.38, 184.31.69.3, 199.232.214.172, 52.111.251.18, 52.111.251.19, 52.111.251.17, 52.111.251.16, 199.232.210.172, 23.203.176.221, 20.189.173.25, 104.126.116.65, 104.126.116.105, 52.109.8.36, 142.251.41.14, 142.250.65.163, 142.250.72.110, 172.253.115.84, 142.251.40.110, 142.250.80.46, 142.251.35.174, 142.251.41.10, 142.250.80.99, 142.250.65.202, 142.251.40.138, 142.250.176.202, 142.250.80.42, 142.251.40.202, 142.251.35.170, 142.251.40.234, 142.250.81.234, 142.250.80.106, 142.251.40.106, 142.250.65.234, 142.251.32.106, 142.250.80.74, 142.250.65.170, 172.217.165.138, 142.251.40.170, 142.250.65.227, 142.250.64.74, 142.250.64.106, 142.250.80.10, 142.250.72.106, 52.109.16.112, 142.250.65.238, 52.109.6.63, 142.251.40.195, 142.250.65.206, 142.251.40.206, 142.250.176.195, 142.251.40.238, 142.250.81.238, 52.123.128.14, 40.126.24.84, 4.175.87.197
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, e16604.dscf.akamaiedge.net, osiprod-ncus-buff-azsc-000.northcentralus.cloudapp.azure.com, osiprod-eus2-buff-azsc-000.eastus2.cloudapp.azure.com, ncus-azsc-000.roaming.officeapps.live.com, prod-canc-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, dual-s-0005-office.config.skype.com, clients2.google.com, ocsp.digicert.com, login.live.com, update.googleapis.com, officeclient.microsoft.com, templatesmetadata.office.net, ecs.office.com, fonts.googleapis.com, fs.microsoft.com, content-autofill.googleapis.com, prod.roaming1.live.com.akadns.net, us1.roaming1.live.com.akadns.net, nleditor.osi.office.net, edgedl.me.gvt1.com, us.configsvc1.live.com.akadns.net, onedscolprdwus20.westus.cloudapp.azure.com, metadata.templates.cdn.office.net, ecs.office.trafficmanager.net, clients.l.google.com, passwordsleakcheck-pa.googleapis.com, scus-azsc-config.officeapps.live.co
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
207.174.26.219	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://ossin7fot.pelosfilhos.com.br?hbyf=YW5nZWxhLm0ucm9lbGxAeGNlbGVuZXJneS5jb20=	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse
	https://drive.usercontent.google.com/download?id=1D-lVkrj-b014caeCIdakZBdw2yekeEO1&export=download	Get hash	malicious	HTMLPhisher	Browse
	https://medpetroenergydmcc.com/court/	Get hash	malicious	HTMLPhisher	Browse
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse
	WizClient.exe	Get hash	malicious	XWorm	Browse
	WizClient.exe	Get hash	malicious	XWorm	Browse
	Swift.Copy(21 Mar 2025).pdf.html	Get hash	malicious	HTMLPhisher	Browse
	Electronic_Invoice(20 Mar 2025).pdf.html	Get hash	malicious	HTMLPhisher	Browse
104.21.16.1	2023-20-03-5910184618-5910184618-fs#U00b7pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.dramavietsub.net/rcu7/
	http://104.21.16.1	Get hash	malicious	Unknown	Browse	104.21.16.1/favicon.ico
	https://t.co/6BJID9q49h	Get hash	malicious	HTMLPhisher	Browse	tcerfw.wittnng.sbs/favicon.ico
	J8bamK92a3.exe	Get hash	malicious	FormBook	Browse	www.play-vanguard-nirvana.xyz/egs9/?9r=2m/uVQwqKH2EIWlawszTKzvIepBfVH/HI19qzylF05nDLsWuBLn1pb4DiFDKEzYOkwPMwL8bVA==&vZR=H2MpG0p
	0t7MXNEfCg.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	g1V10ssekg.exe	Get hash	malicious	FormBook	Browse	www.sigaque.today/n61y/?UPV=BOlfS7N9ZWkGRIMRgNC6B6+WUTyM673eSjZAzliNIDKZHnAeT7/5dfTbZtimq+dx8K4CQjPcymznAMXPWSrBBYPYz0JSQDMkWzhvpNbFnW2/OcjAWw==&YrV=FlsDgRMx
	0IrTeguWM7.exe	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/ftbq/
	Shipping Document.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/6m32/
	Payment Record.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	Invoice Remittance ref27022558.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
192.250.234.26	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse
	https://medpetroenergydmcc.com/court/	Get hash	malicious	HTMLPhisher	Browse
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse
79.127.206.207	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse
	http://fliqlo.app	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
medpetroenergydmcc.com	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	192.250.234.26
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	192.250.234.26
	https://medpetroenergydmcc.com/court/	Get hash	malicious	HTMLPhisher	Browse	192.250.234.26
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse	192.250.234.26
1156509985.rsc.cdn77.org	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	79.127.206.234
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	79.127.206.208
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	79.127.206.234
	https://medpetroenergydmcc.com/court/	Get hash	malicious	HTMLPhisher	Browse	79.127.206.235
	FILLING SUMMON DOCUMENT.docx	Get hash	malicious	HTMLPhisher	Browse	207.211.211.26
	FILLING SUMMON DOCUMENT.docx	Get hash	malicious	HTMLPhisher	Browse	169.150.255.183
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse	79.127.206.208
	https://u48551708.ct.sendgrid.net/ls/click?upn=u001.ztPEaTmy8WofhPYJ48HDSCunUq5pm5yTGRhe-2B0bVSngC8hMYiy6PgMy1xJOG8JJZaOsK-2FG9SE7UmhEzeQSXDmEf7Z3nlXZDH-2BW1HSMP6c8uYUvXDTaJRyLbPDV6bI3nnDyIlM0OJKevMwAF04rpfLmQEYS641NQTMU227kkOtBQgQK-2FNlHeN6DpPMLDgH6kuMS3X_2vbC1nrAFjePip8HYuHYOlkYXiy7Z-2FrO9MQN7lNoEgxRkovUJGAEvKvTFyRmFsa9AQlcDpFhpJzgHajMOC0yWTZOc2DdmxhrlyPvteyXbl8nlhAtf2p-2FHw4RnlZ8cxDY-2BWJeBsszGnsrXuNOI8LpL5ZYI3ad04OdxC8tHHA5tO-2Be1xS3Z9Z3VrOTM-2FT5ptoYnx5N-2FTYKQ13RZ-2FookVMhAtJ6OV43Zayd1qOmHGLwUI8-3D	Get hash	malicious	Phisher	Browse	185.93.2.8
	https://app.jetadmin.io/public/ssw2evf3h0dnz648cv2yppi5ic4rr7md	Get hash	malicious	Unknown	Browse	138.199.20.249
	https://website16869056432.nicepage.io/Home.html	Get hash	malicious	HTMLPhisher	Browse	89.187.165.8
j.sni.global.fastly.net	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.2.132
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	151.101.2.132
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	151.101.2.132
	https://medpetroenergydmcc.com/court/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.132
	https://techresearchs.benchurl.com/c/l?u=12450653&e=199143A&c=163607&&t=0&l=12689B51E&email=VHWZIWwomIKWc0sY%2B8V5agif8GG0Zxj9&seq=1	Get hash	malicious	Unknown	Browse	151.101.2.132
	FILLING SUMMON DOCUMENT.docx	Get hash	malicious	HTMLPhisher	Browse	151.101.2.132
	FILLING SUMMON DOCUMENT.docx	Get hash	malicious	HTMLPhisher	Browse	151.101.2.132
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse	151.101.2.132
	http://pnay.883559.sravana.me/rd/4nYUAh5780Fukz463mpxganbsrg299LLSCJHSTUYUGFRY16077BOBH40813O12	Get hash	malicious	Unknown	Browse	151.101.2.132
	http://mvvx.364055.infolifestyleku.com/rd/4jCxrf5801vTpm700nbgngwwdyb7063ADZCSOTQLCDWSON63806GPPL40170Q13	Get hash	malicious	Unknown	Browse	151.101.130.132
1071178158.rsc.cdn77.org	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	79.127.206.208
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	79.127.206.235
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	79.127.206.208
	https://medpetroenergydmcc.com/court/	Get hash	malicious	HTMLPhisher	Browse	79.127.206.234
	FILLING SUMMON DOCUMENT.docx	Get hash	malicious	HTMLPhisher	Browse	169.150.255.183
	FILLING SUMMON DOCUMENT.docx	Get hash	malicious	HTMLPhisher	Browse	195.181.170.19
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse	79.127.206.207
	https://app.jetadmin.io/public/ssw2evf3h0dnz648cv2yppi5ic4rr7md	Get hash	malicious	Unknown	Browse	138.199.20.249

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://energy-innovation-4916.my.salesforce-sites.com/enr	Get hash	malicious	HTMLPhisher	Browse	104.16.123.96
	Request_For_Quote_Al Liusie Trading.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	https://www.google.com/url?q=https%3A%2F%2Fessaystoolkit.com%2Fsector&sa=D&sntz=1&usg=AOvVaw3ATSMSB0528phcgCi4pOKj&af6pbi8nqbgwu55cw518lklmc8rlvoy3529l3qOWAXRM0I9djvzki8kdrm19expwx==gXGKj7fHmzWdkj2fwKEGO6dPY7Z5PPVc3m4uU~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~LXGhAFK67Ngt8OgVyICJaqw7ha7==afV0FL0LY5RCvaMaS680fdF7POr	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	MV. KHARIS PEAGSUS V.SN2216.pdf.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	CONFIDENTIAL_PAYMENT_CONFIRMATION_TRANSACTION_DETAILS_032024.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	MV. ULTRA TBN Vessel Particulars.xlsx.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	AliyunWrap.dll.dll	Get hash	malicious	RHADAMANTHYS	Browse	104.21.96.1
	3yg2O1rA3l.exe	Get hash	malicious	Vidar	Browse	104.21.76.57
	AliyunWrap.dll.dll	Get hash	malicious	RHADAMANTHYS	Browse	104.16.248.249
GINCzechRepublicEUCZ	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	79.127.206.208
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	79.127.206.208
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	79.127.206.208
	https://medpetroenergydmcc.com/court/	Get hash	malicious	HTMLPhisher	Browse	79.127.206.235
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse	79.127.206.208
	Setup.exe	Get hash	malicious	Unknown	Browse	79.127.206.235
	http://4wdsupacentre.com.au	Get hash	malicious	Unknown	Browse	79.127.206.234
	http://fliqlo.app	Get hash	malicious	Unknown	Browse	79.127.206.235
	http://netflix.yallahsoft.com/	Get hash	malicious	Unknown	Browse	79.127.216.112
	Setup.exe	Get hash	malicious	Unknown	Browse	79.127.206.235
CNSV-LLCUS	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	192.250.234.26
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	192.250.234.26
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	192.250.234.26
	https://medpetroenergydmcc.com/court/	Get hash	malicious	HTMLPhisher	Browse	192.250.234.26
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse	192.250.234.26
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	192.250.241.6
	https://traveltechs.net/submit	Get hash	malicious	Unknown	Browse	192.250.227.149
	https://traveltechs.net/submit	Get hash	malicious	Unknown	Browse	192.250.227.149
	Cargo Arrival Notification BL -pdf.js	Get hash	malicious	FormBook	Browse	192.250.241.22
	INV-098575-SHIPPMENT.js	Get hash	malicious	FormBook	Browse	192.250.241.6
RCN-ASUS	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	https://ossin7fot.pelosfilhos.com.br?hbyf=YW5nZWxhLm0ucm9lbGxAeGNlbGVuZXJneS5jb20=	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	207.174.26.219
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	207.174.26.219
	https://drive.usercontent.google.com/download?id=1D-lVkrj-b014caeCIdakZBdw2yekeEO1&export=download	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	https://medpetroenergydmcc.com/court/	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	g4za.arm.elf	Get hash	malicious	Mirai	Browse	207.180.169.155
	WizClient.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	WizClient.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	Swift.Copy(21 Mar 2025).pdf.html	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	3yg2O1rA3l.exe	Get hash	malicious	Vidar	Browse	204.79.197.222
	92.255.85.2.exe	Get hash	malicious	XWorm	Browse	204.79.197.222
	https://gamma.app/docs/San-Francisco-Design-Center-yiak8m1tzv7kh6w?mode=present#card-zkdj2dw1roq630u	Get hash	malicious	Unknown	Browse	204.79.197.222
	file.exe	Get hash	malicious	CryptOne, LummaC Stealer, Socks5Systemz	Browse	204.79.197.222
	file.exe	Get hash	malicious	Vidar	Browse	204.79.197.222
	34201QB_EFT_Payment_Statemt2.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	204.79.197.222
	https://business.peppercontent.io/items/1EeoNExLmk9	Get hash	malicious	Unknown	Browse	204.79.197.222
	https://prapare.org/#	Get hash	malicious	Unknown	Browse	204.79.197.222
	PURCHASE ORDER 5172025.xla.xlsx	Get hash	malicious	Unknown	Browse	204.79.197.222
	34209QB_EFT_Payment_Statemt25.svg	Get hash	malicious	Invisible JS	Browse	204.79.197.222

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.62484256024855
Encrypted:	false
SSDEEP:	3:KVGl/lilKlRAGlo5F10YqlD8qx+xXbntEBfOPRRxwsZ:KVy/4KD0F1+8qkJtEVOPHZ
MD5:	E5C3AA3F36B0442FE6E7EE957D060D86
SHA1:	B0662A3DA00B0FE2750F217A355609F66731CFF0
SHA-256:	AE9F7BA01D1C80963AA505CB7B892A7EECF0A1D05B81931AFB8B301E381DBD40
SHA-512:	FC68258EF7216D69EAA923465B1B003DDF03819B1A0A4697054F6D1024968E2D16D93F5D5A67E0A15968A0A74A22226553AA25467FCCC403335DF827F2D66119
Malicious:	false
Reputation:	low
Preview:	.user..................................................j.o.n.e.s.....~.....\|;.+... ....wz..<.O.b@....Xm.......37..q.!.Q....~0..........r?..$..}.kj.........=)j

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (656)
Category:	downloaded
Size (bytes):	66794
Entropy (8bit):	5.016342990288886
Encrypted:	false
SSDEEP:	1536:I7ZTzKmaSIEpbOp720qzqD0sFTxLrg9P2y:IVTzKRiQ20qzATxLrg9P2y
MD5:	F12EB264A4580AFC7E443E4D4EF1E6B6
SHA1:	ED5572405B93D1ADC0AAB6C77897E56856583C62
SHA-256:	5CA03722FFF0CFB6365B691C7A65635ABA82D5366D22563975C01330617C0EFB
SHA-512:	B4D829E6DD7F68C14AF11FD3E4DD7C080A18F54229C9C41425F11F828244B87E951E543E60D716D0EA129D3BDC6326F2530B16F00830B287633EA2541EF94391
Malicious:	false
Reputation:	low
URL:	https://medpetroenergydmcc.com/wp-content/plugins/seedprod-coming-soon-pro-5/public/css/tailwind.min.css?ver=6.18.14
Preview:	/! normalize.css v8.0.1 \| MIT License \| github.com/necolas/normalize.css /html{line-height:1.15;-webkit-text-size-adjust:100%}.body{margin:0}.main{display:block}.h1{font-size:2em;margin:.67em 0}.hr{box-sizing:content-box;height:0;overflow:visible}.pre{font-family:monospace,monospace;font-size:1em}.a{background-color:transparent}.b,strong{font-weight:bolder}.code{font-family:monospace,monospace;font-size:1em}.small{font-size:80%}.sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}.sup{top:-0.5em}.img{border-style:none}.button,input,select{font-family:inherit;font-size:100%;line-height:1.15;margin:0}.button,input{overflow:visible}.button,select{text-transform:none}.button,[type="button"],[type="reset"],[type="submit"]{-webkit-appearance:button}.button::-moz-focus-inner,[type="button"]::-moz-focus-inner,[type="reset"]::-moz-focus-inner,[type="submit"]::-moz-focus-inner{border-style:none;padding:0}.button:-moz-focusring,[type="button"]:-moz-focusring,[type="reset"]

File type:	Microsoft Word 2007+
Entropy (8bit):	7.778433760952049
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	Filled-Summons Notice (2).docx
File size:	58'491 bytes
MD5:	380c1617aea96d8d60d45e9435a98578
SHA1:	9354133a938fc1eb8f0710ab2d7df07492c3de4a
SHA256:	2dab4e6a86dacc6123c4c5fd11669fb36a2372fd75439f9c6faf0104d594afcf
SHA512:	33f3a2e0d44c72fc46c8fd6566d9807a286d0f6a3fcd6d00fac86db62d73f9f32fd591f3da455add829e3738be624838852dbb0f56eeaa2b67b98225fb7f0db4
SSDEEP:	1536:zmrrJo6kD1EXtX6X98JO2XMd+398MSGr16S39XC6X5:zIFutX9Y38sfSGxh5
TLSH:	5D43E03BDE4A6ED7D44DE3FDBF9549D59F805A60E4027DCF04926F253708A8382829B8
File Content Preview:	PK..........!.-.b.i...........[Content_Types].xml ...(.........................................................................................................................................................................................................

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 07:19:46.264192104 CET	53	49203	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:46.265209913 CET	53	64040	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:46.875982046 CET	53	63220	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:47.013927937 CET	53	63998	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:50.507807970 CET	52035	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:19:50.507807970 CET	51903	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:19:50.606890917 CET	53	51903	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:50.607131958 CET	53	52035	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:51.855948925 CET	57333	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:19:51.856484890 CET	59425	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:19:51.974134922 CET	53	59425	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:51.975497007 CET	53	57333	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:53.067567110 CET	53	49733	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:53.301592112 CET	54576	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:19:53.301788092 CET	53005	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:19:53.398471117 CET	53	53005	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:53.398659945 CET	53	54576	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:53.936867952 CET	51855	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:19:53.936938047 CET	59928	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:19:54.034862041 CET	53	59928	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:54.035273075 CET	53	51855	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:55.169502974 CET	61591	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:19:55.169624090 CET	65107	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:19:55.276297092 CET	53	65107	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:55.287817001 CET	53	61591	1.1.1.1	192.168.2.4
Mar 26, 2025 07:19:55.717777967 CET	53	61774	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:04.092025042 CET	53	60790	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:07.264976025 CET	138	138	192.168.2.4	192.168.2.255
Mar 26, 2025 07:20:10.997149944 CET	57123	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:20:10.997405052 CET	64337	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:20:11.095493078 CET	53	57123	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:11.097409010 CET	53	64337	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:11.906563997 CET	53391	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:20:11.906738043 CET	54019	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:20:12.163352966 CET	53	54019	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:12.169672966 CET	53	53391	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:12.752500057 CET	54265	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:20:12.752688885 CET	59925	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:20:12.852447987 CET	53	58314	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:12.855021954 CET	53	59925	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:12.856405973 CET	53	54265	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:12.970998049 CET	64550	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:20:12.971179008 CET	52411	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:20:13.075737953 CET	53	64550	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:13.077485085 CET	53	52411	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:13.652167082 CET	59153	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:20:13.652323961 CET	56330	53	192.168.2.4	1.1.1.1
Mar 26, 2025 07:20:13.753541946 CET	53	56330	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:13.754137039 CET	53	59153	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:15.290204048 CET	53	50142	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:23.267404079 CET	53	62699	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:45.745198965 CET	53	60505	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:45.770602942 CET	53	51108	1.1.1.1	192.168.2.4
Mar 26, 2025 07:20:48.922590971 CET	53	52288	1.1.1.1	192.168.2.4
Mar 26, 2025 07:21:16.457252026 CET	53	52544	1.1.1.1	192.168.2.4
Mar 26, 2025 07:22:02.891910076 CET	53	54722	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 26, 2025 07:19:11.929040909 CET	1.1.1.1	192.168.2.4	0xff40	No error (0)	ecs-office.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 07:19:11.929040909 CET	1.1.1.1	192.168.2.4	0xff40	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:19:11.929040909 CET	1.1.1.1	192.168.2.4	0xff40	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:19:50.606890917 CET	1.1.1.1	192.168.2.4	0x9e55	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 26, 2025 07:19:50.607131958 CET	1.1.1.1	192.168.2.4	0x2c73	No error (0)	www.google.com		142.251.40.100	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:19:51.975497007 CET	1.1.1.1	192.168.2.4	0x506d	No error (0)	medpetroenergydmcc.com		192.250.234.26	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:19:53.398659945 CET	1.1.1.1	192.168.2.4	0xe8b5	No error (0)	i.ibb.co		207.174.26.219	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:19:54.035273075 CET	1.1.1.1	192.168.2.4	0x129f	No error (0)	i.ibb.co		207.174.26.219	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:19:55.287817001 CET	1.1.1.1	192.168.2.4	0xea6	No error (0)	medpetroenergydmcc.com		192.250.234.26	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:11.095493078 CET	1.1.1.1	192.168.2.4	0x2ac9	No error (0)	api.staticforms.xyz		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:11.095493078 CET	1.1.1.1	192.168.2.4	0x2ac9	No error (0)	api.staticforms.xyz		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:11.095493078 CET	1.1.1.1	192.168.2.4	0x2ac9	No error (0)	api.staticforms.xyz		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:11.095493078 CET	1.1.1.1	192.168.2.4	0x2ac9	No error (0)	api.staticforms.xyz		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:11.095493078 CET	1.1.1.1	192.168.2.4	0x2ac9	No error (0)	api.staticforms.xyz		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:11.095493078 CET	1.1.1.1	192.168.2.4	0x2ac9	No error (0)	api.staticforms.xyz		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:11.095493078 CET	1.1.1.1	192.168.2.4	0x2ac9	No error (0)	api.staticforms.xyz		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:11.097409010 CET	1.1.1.1	192.168.2.4	0x1ef6	No error (0)	api.staticforms.xyz			65	IN (0x0001)	false
Mar 26, 2025 07:20:12.163352966 CET	1.1.1.1	192.168.2.4	0xc8cc	No error (0)	usersharepoint.nicepage.io	j.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 07:20:12.169672966 CET	1.1.1.1	192.168.2.4	0x21e	No error (0)	usersharepoint.nicepage.io	j.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 07:20:12.169672966 CET	1.1.1.1	192.168.2.4	0x21e	No error (0)	j.sni.global.fastly.net		151.101.2.132	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:12.169672966 CET	1.1.1.1	192.168.2.4	0x21e	No error (0)	j.sni.global.fastly.net		151.101.66.132	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:12.169672966 CET	1.1.1.1	192.168.2.4	0x21e	No error (0)	j.sni.global.fastly.net		151.101.130.132	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:12.169672966 CET	1.1.1.1	192.168.2.4	0x21e	No error (0)	j.sni.global.fastly.net		151.101.194.132	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:12.855021954 CET	1.1.1.1	192.168.2.4	0x1609	No error (0)	capp.nicepage.com	1156509985.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 07:20:12.856405973 CET	1.1.1.1	192.168.2.4	0xcb0f	No error (0)	capp.nicepage.com	1156509985.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 07:20:12.856405973 CET	1.1.1.1	192.168.2.4	0xcb0f	No error (0)	1156509985.rsc.cdn77.org		79.127.206.208	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:12.856405973 CET	1.1.1.1	192.168.2.4	0xcb0f	No error (0)	1156509985.rsc.cdn77.org		79.127.206.235	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:13.075737953 CET	1.1.1.1	192.168.2.4	0xe6	No error (0)	assets.nicepagecdn.com	1071178158.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 07:20:13.075737953 CET	1.1.1.1	192.168.2.4	0xe6	No error (0)	1071178158.rsc.cdn77.org		79.127.206.234	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:13.075737953 CET	1.1.1.1	192.168.2.4	0xe6	No error (0)	1071178158.rsc.cdn77.org		79.127.206.208	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:13.077485085 CET	1.1.1.1	192.168.2.4	0xbd25	No error (0)	assets.nicepagecdn.com	1071178158.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 07:20:13.753541946 CET	1.1.1.1	192.168.2.4	0xe8d3	No error (0)	assets.nicepagecdn.com	1071178158.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 07:20:13.754137039 CET	1.1.1.1	192.168.2.4	0x209a	No error (0)	assets.nicepagecdn.com	1071178158.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 07:20:13.754137039 CET	1.1.1.1	192.168.2.4	0x209a	No error (0)	1071178158.rsc.cdn77.org		79.127.206.207	A (IP address)	IN (0x0001)	false
Mar 26, 2025 07:20:13.754137039 CET	1.1.1.1	192.168.2.4	0x209a	No error (0)	1071178158.rsc.cdn77.org		79.127.206.234	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Mar 26, 2025 07:19:17.383044004 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 26, 2025 07:19:17.477157116 CET	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 26 Mar 2025 05:39:48 GMT Expires: Wed, 26 Mar 2025 06:29:48 GMT Age: 2369 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 26, 2025 07:19:17.484697104 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 26, 2025 07:19:17.579952955 CET	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 26 Mar 2025 05:30:24 GMT Expires: Wed, 26 Mar 2025 06:20:24 GMT Age: 2933 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:19:52 UTC	678	OUT	GET /court/ HTTP/1.1 Host: medpetroenergydmcc.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:19:52 UTC	402	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:19:52 GMT Server: Apache Link: <https://medpetroenergydmcc.com/wp-json/>; rel="https://api.w.org/", <https://medpetroenergydmcc.com/wp-json/wp/v2/pages/61>; rel="alternate"; title="JSON"; type="application/json", <https://medpetroenergydmcc.com/?p=61>; rel=shortlink Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2025-03-26 06:19:52 UTC	7790	IN	Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 73 70 2d 68 74 6d 6c 20 0a 09 09 09 73 70 2d 73 65 65 64 70 72 6f 64 20 73 70 2d 68 2d 66 75 6c 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 09 09 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 21 2d 2d 20 44 65 66 61 75 6c 74 20 43 53 53 20 2d 2d 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 73 65 65 64 70 72 6f 64 2d 63 73 73 2d 63 73 73 27 Data Ascii: 4000<!DOCTYPE html><html class="sp-html sp-seedprod sp-h-full" lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">... Default CSS --><link rel='stylesheet' id='seedprod-css-css'
2025-03-26 06:19:53 UTC	8600	IN	Data Raw: 6c 6f 72 3a 23 37 61 30 30 64 66 3b 2d 2d 77 70 2d 62 6c 6f 63 6b 2d 73 79 6e 63 65 64 2d 63 6f 6c 6f 72 2d 2d 72 67 62 3a 31 32 32 2c 30 2c 32 32 33 3b 2d 2d 77 70 2d 62 6f 75 6e 64 2d 62 6c 6f 63 6b 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 77 70 2d 62 6c 6f 63 6b 2d 73 79 6e 63 65 64 2d 63 6f 6c 6f 72 29 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 3a 72 6f 6f 74 7b 2d 2d 77 70 2d 61 64 6d 69 6e 2d 62 6f 72 64 65 72 2d 77 69 64 74 68 2d 66 6f 63 75 73 3a 31 2e 35 70 78 7d 7d 2e 77 70 2d 65 6c 65 6d 65 6e 74 2d 62 75 74 74 6f 6e 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 3a 72 6f 6f 74 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6e 6f 72 6d 61 6c 3a 31 36 70 78 3b 2d Data Ascii: lor:#7a00df;--wp-block-synced-color--rgb:122,0,223;--wp-bound-block-color:var(--wp-block-synced-color)}@media (min-resolution:192dpi){:root{--wp-admin-border-width-focus:1.5px}}.wp-element-button{cursor:pointer}:root{--wp--preset--font-size--normal:16px;-
2025-03-26 06:19:53 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-03-26 06:19:53 UTC	8192	IN	Data Raw: 34 30 30 30 0d 0a 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 66 61 6d 69 6c 79 2d 2d 6d 61 6e 72 6f 70 65 3a 20 22 4d 61 6e 72 6f 70 65 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 66 61 6d 69 6c 79 2d 2d 6d 61 72 63 65 6c 6c 75 73 3a 20 27 4d 61 72 63 65 6c 6c 75 73 27 2c 20 73 65 72 69 66 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 66 61 6d 69 6c 79 2d 2d 6d 6f 6e 74 73 65 72 72 61 74 3a 20 22 4d 6f 6e 74 73 65 72 72 61 74 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 66 61 6d 69 6c 79 2d 2d 6d 75 6c 69 73 68 3a 20 22 4d 75 6c 69 73 68 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 66 61 Data Ascii: 4000reset--font-family--manrope: "Manrope", sans-serif;--wp--preset--font-family--marcellus: 'Marcellus', serif;--wp--preset--font-family--montserrat: "Montserrat", sans-serif;--wp--preset--font-family--mulish: "Mulish", sans-serif;--wp--preset--font-fa
2025-03-26 06:19:53 UTC	8198	IN	Data Raw: 20 31 2e 38 37 35 72 65 6d 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 63 75 73 74 6f 6d 2d 2d 74 79 70 6f 67 72 61 70 68 79 2d 2d 66 6f 6e 74 2d 77 65 69 67 68 74 2d 2d 73 65 6d 69 2d 62 6f 6c 64 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 63 75 73 74 6f 6d 2d 2d 74 79 70 6f 67 72 61 70 68 79 2d 2d 6c 69 6e 65 2d 68 65 69 67 68 74 2d 2d 74 69 6e 79 29 3b 7d 68 35 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 63 6c 61 6d 70 28 31 2e 32 35 72 65 6d 2c 20 31 2e 32 35 72 65 6d 20 2b 20 28 28 31 76 77 20 2d 20 30 2e 34 38 72 65 6d 29 20 2a 20 30 2e 37 32 31 29 2c 20 31 2e 35 72 65 6d 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 63 75 73 74 6f 6d 2d 2d 74 79 70 6f 67 72 61 70 68 Data Ascii: 1.875rem);font-weight: var(--wp--custom--typography--font-weight--semi-bold);line-height: var(--wp--custom--typography--line-height--tiny);}h5{font-size: clamp(1.25rem, 1.25rem + ((1vw - 0.48rem) * 0.721), 1.5rem);font-weight: var(--wp--custom--typograph
2025-03-26 06:19:53 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-03-26 06:19:53 UTC	8192	IN	Data Raw: 34 30 30 30 0d 0a 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 6d 69 64 6e 69 67 68 74 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6d 69 64 6e 69 67 68 74 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 65 72 74 69 63 61 6c 2d 73 65 63 6f 6e 64 61 72 79 2d 74 6f 2d 74 65 72 74 69 61 72 79 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 Data Ascii: 4000nt-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-vertical-secondary-to-tertiary-gradient-background{background: var
2025-03-26 06:19:53 UTC	8198	IN	Data Raw: 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 65 78 74 65 6e 64 61 62 6c 65 2f 61 73 73 65 74 73 2f 66 6f 6e 74 73 2f 69 62 6d 2d 70 6c 65 78 2d 73 61 6e 73 2f 69 62 6d 2d 70 6c 65 78 2d 73 61 6e 73 2d 74 68 69 6e 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 66 6f 6e 74 2d 73 74 72 65 74 63 68 3a 6e 6f 72 6d 61 6c 3b 7d 0a 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 49 42 4d 20 50 6c 65 78 20 53 61 6e 73 22 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 32 30 30 3b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 73 72 63 3a 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 6d 65 64 70 65 74 72 6f 65 6e 65 72 67 79 64 6d 63 63 2e 63 6f 6d 2f 77 70 2d 63 Data Ascii: -content/themes/extendable/assets/fonts/ibm-plex-sans/ibm-plex-sans-thin.woff2') format('woff2');font-stretch:normal;}@font-face{font-family:"IBM Plex Sans";font-style:normal;font-weight:200;font-display:block;src:url('https://medpetroenergydmcc.com/wp-c
2025-03-26 06:19:53 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-03-26 06:19:53 UTC	3199	IN	Data Raw: 63 37 33 0d 0a 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 75 62 6d 69 74 2d 62 74 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 30 30 37 42 46 46 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 20 31 35 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 70 Data Ascii: c73ft: auto; margin-right: auto; } .submit-btn { background-color: #007BFF; color: white; border: none; padding: 10px 15px; border-radius: 5px; cursor: p

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:19:52 UTC	641	OUT	GET /wp-content/plugins/seedprod-coming-soon-pro-5/public/css/tailwind.min.css?ver=6.18.14 HTTP/1.1 Host: medpetroenergydmcc.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://medpetroenergydmcc.com/court/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:19:53 UTC	206	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:19:53 GMT Server: Apache Last-Modified: Thu, 20 Mar 2025 06:16:33 GMT Accept-Ranges: bytes Content-Length: 66794 Connection: close Content-Type: text/css
2025-03-26 06:19:53 UTC	7986	IN	Data Raw: 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 38 2e 30 2e 31 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 68 75 62 2e 63 6f 6d 2f 6e 65 63 6f 6c 61 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 2a 2f 68 74 6d 6c 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 7d 0a 6d 61 69 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 3b 6d 61 72 67 69 6e 3a 2e 36 37 65 6d 20 30 7d 0a 68 72 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 68 65 69 67 68 74 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 0a 70 72 65 7b 66 Data Ascii: /! normalize.css v8.0.1 \| MIT License \| github.com/necolas/normalize.css /html{line-height:1.15;-webkit-text-size-adjust:100%}body{margin:0}main{display:block}h1{font-size:2em;margin:.67em 0}hr{box-sizing:content-box;height:0;overflow:visible}pre{f
2025-03-26 06:19:53 UTC	8000	IN	Data Raw: 6d 7d 0a 2e 73 70 2d 6d 72 2d 36 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 2e 35 72 65 6d 7d 0a 2e 73 70 2d 6d 62 2d 36 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 2e 35 72 65 6d 7d 0a 2e 73 70 2d 6d 6c 2d 36 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 2e 35 72 65 6d 7d 0a 2e 73 70 2d 6d 74 2d 38 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 72 65 6d 7d 0a 2e 73 70 2d 6f 62 6a 65 63 74 2d 63 6f 76 65 72 7b 2d 6f 2d 6f 62 6a 65 63 74 2d 66 69 74 3a 63 6f 76 65 72 3b 6f 62 6a 65 63 74 2d 66 69 74 3a 63 6f 76 65 72 7d 0a 2e 73 70 2d 6f 70 61 63 69 74 79 2d 32 35 7b 6f 70 61 63 69 74 79 3a 2e 32 35 7d 0a 2e 73 70 2d 6f 70 61 63 69 74 79 2d 35 30 7b 6f 70 61 63 69 74 79 3a 2e 35 7d 0a 2e 73 70 2d 6f 70 61 63 69 74 79 2d 37 35 7b 6f 70 61 63 69 74 79 3a 2e 37 35 Data Ascii: m}.sp-mr-6{margin-right:1.5rem}.sp-mb-6{margin-bottom:1.5rem}.sp-ml-6{margin-left:1.5rem}.sp-mt-8{margin-top:2rem}.sp-object-cover{-o-object-fit:cover;object-fit:cover}.sp-opacity-25{opacity:.25}.sp-opacity-50{opacity:.5}.sp-opacity-75{opacity:.75
2025-03-26 06:19:53 UTC	8000	IN	Data Raw: 6e 6f 6e 65 7d 0a 64 65 74 61 69 6c 73 3e 73 75 6d 6d 61 72 79 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 7b 6c 69 73 74 2d 73 74 79 6c 65 2d 74 79 70 65 3a 6e 6f 6e 65 7d 0a 64 65 74 61 69 6c 73 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 7d 0a 64 65 74 61 69 6c 73 20 2e 73 70 2d 61 63 63 2d 6f 70 65 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 0a 64 65 74 61 69 6c 73 5b 6f 70 65 6e 5d 20 2e 73 70 2d 61 63 63 2d 63 6c 6f 73 65 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 0a 64 65 74 61 69 6c 73 5b 6f 70 65 6e 5d 20 2e 73 70 2d 61 63 63 2d 6f 70 65 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 0a 73 75 6d 6d 61 72 79 7b 6f 75 74 6c 69 6e 65 3a 30 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 0a 2e 73 70 2d 61 63 63 6f 72 Data Ascii: none}details>summary:first-of-type{list-style-type:none}details{display:block;width:100%}details .sp-acc-open{display:none}details[open] .sp-acc-closed{display:none}details[open] .sp-acc-open{display:block}summary{outline:0;cursor:pointer}.sp-accor
2025-03-26 06:19:53 UTC	8000	IN	Data Raw: 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 2e 73 70 2d 77 63 63 75 73 74 6f 6d 70 72 6f 64 75 63 74 73 67 72 69 64 2d 77 72 61 70 70 65 72 20 6c 69 2e 70 72 6f 64 75 63 74 7b 66 6c 6f 61 74 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 77 69 64 74 68 3a 31 30 30 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 7d 23 63 73 70 69 6f 2d 62 79 70 61 73 73 2d 62 74 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 68 65 69 67 68 74 3a 32 37 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 31 34 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 7d 0a 69 6e 70 75 74 5b 74 79 70 65 3d 22 70 61 73 73 77 6f 72 64 22 5d 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 61 70 Data Ascii: ;margin-bottom:16px !important}.sp-wccustomproductsgrid-wrapper li.product{float:none !important;width:100% !important}}#cspio-bypass-btn{font-size:15px;height:27px;padding:0 14px;border-radius:4px}input[type="password"]{-webkit-appearance:none;-moz-ap
2025-03-26 06:19:53 UTC	8000	IN	Data Raw: 6d 2d 63 6f 6c 2d 73 70 61 6e 2d 33 7b 67 72 69 64 2d 63 6f 6c 75 6d 6e 3a 73 70 61 6e 20 33 20 2f 20 73 70 61 6e 20 33 7d 0a 2e 73 70 2d 63 75 73 74 6f 6d 2d 63 6f 6c 2d 73 70 61 6e 2d 34 7b 67 72 69 64 2d 63 6f 6c 75 6d 6e 3a 73 70 61 6e 20 34 20 2f 20 73 70 61 6e 20 34 7d 0a 2e 73 70 2d 63 75 73 74 6f 6d 2d 63 6f 6c 2d 73 70 61 6e 2d 35 7b 67 72 69 64 2d 63 6f 6c 75 6d 6e 3a 73 70 61 6e 20 35 20 2f 20 73 70 61 6e 20 35 7d 0a 2e 73 70 2d 63 75 73 74 6f 6d 2d 63 6f 6c 2d 73 70 61 6e 2d 36 7b 67 72 69 64 2d 63 6f 6c 75 6d 6e 3a 73 70 61 6e 20 36 20 2f 20 73 70 61 6e 20 36 7d 0a 2e 73 70 2d 63 75 73 74 6f 6d 2d 63 6f 6c 2d 73 70 61 6e 2d 37 7b 67 72 69 64 2d 63 6f 6c 75 6d 6e 3a 73 70 61 6e 20 37 20 2f 20 73 70 61 6e 20 37 7d 0a 2e 73 70 2d 63 75 73 74 6f Data Ascii: m-col-span-3{grid-column:span 3 / span 3}.sp-custom-col-span-4{grid-column:span 4 / span 4}.sp-custom-col-span-5{grid-column:span 5 / span 5}.sp-custom-col-span-6{grid-column:span 6 / span 6}.sp-custom-col-span-7{grid-column:span 7 / span 7}.sp-custo
2025-03-26 06:19:53 UTC	8000	IN	Data Raw: 74 3a 30 3b 64 69 72 65 63 74 69 6f 6e 3a 6c 74 72 7d 0a 2e 73 70 2d 73 65 63 74 69 6f 6e 2d 74 6f 70 2c 2e 73 70 2d 72 6f 77 2d 74 6f 70 2c 2e 73 70 2d 63 6f 6c 2d 74 6f 70 7b 74 6f 70 3a 30 7d 0a 2e 73 70 2d 73 65 63 74 69 6f 6e 2d 62 6f 74 74 6f 6d 2c 2e 73 70 2d 72 6f 77 2d 62 6f 74 74 6f 6d 2c 2e 73 70 2d 63 6f 6c 2d 62 6f 74 74 6f 6d 7b 62 6f 74 74 6f 6d 3a 30 7d 0a 2e 73 70 2d 73 65 63 74 69 6f 6e 2d 73 68 61 70 65 20 73 76 67 2c 2e 73 70 2d 72 6f 77 2d 73 68 61 70 65 20 73 76 67 2c 2e 73 70 2d 63 6f 6c 2d 73 68 61 70 65 20 73 76 67 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 6c 65 66 74 3a 35 30 25 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 2d 35 30 25 29 3b 74 72 61 Data Ascii: t:0;direction:ltr}.sp-section-top,.sp-row-top,.sp-col-top{top:0}.sp-section-bottom,.sp-row-bottom,.sp-col-bottom{bottom:0}.sp-section-shape svg,.sp-row-shape svg,.sp-col-shape svg{display:block;width:100%;left:50%;-webkit-transform:translateX(-50%);tra
2025-03-26 06:19:53 UTC	8000	IN	Data Raw: 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 63 68 65 63 6b 65 64 3a 3a 62 65 66 6f 72 65 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 31 30 30 25 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 31 30 30 25 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 7d 0a 2e 73 70 2d 63 6f 6e 74 65 6e 74 2d 74 6f 67 67 6c 65 2d 61 72 65 61 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 3a 63 68 65 63 6b 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 36 39 36 39 36 39 7d 0a 2e 73 70 2d 63 6f 6e 74 65 6e 74 74 6f 67 67 6c 65 2d 73 69 7a 65 2d 6c 61 72 67 65 20 2e 73 70 2d 63 6f 6e 74 65 6e 74 2d 74 6f 67 67 6c 65 2d 61 72 65 61 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 63 68 65 63 Data Ascii: ype="checkbox"]:checked::before{-webkit-transform:translateX(100%);transform:translateX(100%);background:#fff}.sp-content-toggle-area input[type="checkbox"]:checked{background:#696969}.sp-contenttoggle-size-large .sp-content-toggle-area input[type="chec
2025-03-26 06:19:53 UTC	8000	IN	Data Raw: 72 74 2d 77 72 61 70 70 65 72 20 2e 65 64 64 2d 63 61 72 74 2d 69 74 65 6d 20 2e 65 64 64 2d 63 61 72 74 2d 69 74 65 6d 2d 73 65 70 61 72 61 74 6f 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 2e 73 70 2d 65 64 64 2d 63 61 72 74 2d 77 72 61 70 70 65 72 20 6c 69 2e 65 64 64 2d 63 61 72 74 2d 6d 65 74 61 2e 65 64 64 5f 74 6f 74 61 6c 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 7d 0a 2e 73 70 2d 65 64 64 2d 63 61 72 74 2d 77 72 61 70 70 65 72 20 6c 69 2e 63 61 72 74 5f 69 74 65 6d 2e 65 64 64 5f 63 68 65 63 6b 6f 75 74 20 61 2e 73 70 2d 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 3a 36 70 78 20 31 32 70 78 7d 0a 2e 73 70 2d 65 64 64 2d 63 61 72 74 2d 77 72 61 70 Data Ascii: rt-wrapper .edd-cart-item .edd-cart-item-separator{display:none !important}.sp-edd-cart-wrapper li.edd-cart-meta.edd_total{margin-bottom:1rem;text-align:right}.sp-edd-cart-wrapper li.cart_item.edd_checkout a.sp-button{padding:6px 12px}.sp-edd-cart-wrap
2025-03-26 06:19:53 UTC	2808	IN	Data Raw: 65 2d 62 6c 6f 63 6b 2e 73 70 2d 6d 69 6e 69 6d 61 6c 2d 70 6f 73 74 73 7b 6d 61 72 67 69 6e 3a 30 20 31 30 70 78 7d 0a 2e 73 65 65 64 70 72 6f 64 2d 63 61 72 6f 75 73 65 6c 2d 70 6f 73 74 2d 62 6c 6f 63 6b 20 2e 73 70 2d 70 6f 73 74 73 2d 73 69 6e 67 6c 65 2d 62 6c 6f 63 6b 7b 6d 61 72 67 69 6e 3a 30 20 31 30 70 78 7d 0a 2e 73 70 2d 6c 61 79 6f 75 74 2d 67 72 69 64 6c 61 79 6f 75 74 2e 73 70 2d 73 6b 69 6e 2d 6d 69 6e 69 6d 61 6c 2e 73 70 2d 67 61 70 2d 34 7b 67 72 69 64 2d 67 61 70 3a 30 3b 67 61 70 3a 30 7d 0a 2e 73 70 2d 6c 61 79 6f 75 74 2d 67 72 69 64 6c 61 79 6f 75 74 20 2e 73 70 2d 70 6f 73 74 73 2d 73 69 6e 67 6c 65 2d 62 6c 6f 63 6b 2e 73 70 2d 6d 69 6e 69 6d 61 6c 2d 70 6f 73 74 73 7b 6d 61 72 67 69 6e 3a 30 20 31 30 70 78 7d 0a 2e 73 70 2d 66 Data Ascii: e-block.sp-minimal-posts{margin:0 10px}.seedprod-carousel-post-block .sp-posts-single-block{margin:0 10px}.sp-layout-gridlayout.sp-skin-minimal.sp-gap-4{grid-gap:0;gap:0}.sp-layout-gridlayout .sp-posts-single-block.sp-minimal-posts{margin:0 10px}.sp-f

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:19:53 UTC	639	OUT	GET /bjwfL99R/logo-dark-6.png HTTP/1.1 Host: i.ibb.co Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://medpetroenergydmcc.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:19:53 UTC	379	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 26 Mar 2025 06:19:53 GMT Content-Type: image/png Content-Length: 42949 Connection: close Last-Modified: Thu, 20 Mar 2025 05:49:56 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2025-03-26 06:19:53 UTC	3717	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 74 00 00 00 f0 08 06 00 00 00 89 d7 f9 28 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 05 ea 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 36 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 Data Ascii: PNGIHDRt(pHYs%%IR$iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:R
2025-03-26 06:19:53 UTC	4096	IN	Data Raw: dc 09 86 da a5 01 d8 19 d8 0d c5 78 18 c6 2e 49 e0 5f 19 7f 1f 5b ad 81 14 c1 65 84 4b ac 3a 00 38 a3 cc 63 01 b9 25 9f 25 3a 0f c4 7c e4 82 9d 17 b4 e2 18 e2 78 64 f9 8a 22 61 a5 0e 75 3b b9 13 98 11 c1 f6 00 da 90 20 9f 10 b0 5e 2e e6 a1 72 40 61 7a 0a bf 07 f8 1f 70 44 11 fb c9 c5 36 a8 7d 66 90 55 d7 60 28 0a f7 a4 6e c0 9b f5 af 05 6e ad ce 70 0c a5 62 59 16 c0 9b 51 9c cd cd 68 76 79 0b 5e e6 b2 61 6c f2 38 5e 61 d8 3d d1 43 6d ac f0 71 d4 6d 26 88 f3 28 de 25 16 96 93 89 3e 88 7f 06 70 41 c4 db ac 16 a7 50 bc 58 f2 e3 00 24 ea a2 88 09 f9 20 a5 fd 86 fb a1 f3 c0 8f 18 3a 16 cd 25 ec 27 17 6d a8 b4 8c c1 10 39 ae a0 9b 89 44 00 c0 d3 78 85 29 0d 63 08 db 66 4a 2a 9d 3a 0e b8 0a f5 83 7c 9b b3 f4 03 ff c6 c4 45 8e 65 d6 a0 80 73 90 8b 6f f7 ea 0d a5 Data Ascii: x.I_[eK:8c%%:\|xd"au; ^.r@azpD6}fU`(nnpbYQhvy^al8^a=Cmqm&(%>pAPX$ :%'m9Dx)cfJ*:\|Eeso
2025-03-26 06:19:53 UTC	4096	IN	Data Raw: e0 73 ee 3a 06 c3 08 2c 14 2f 71 12 3a b9 de 0b dc 50 a1 7d 37 a1 d8 b4 f5 e4 2e 29 70 06 b2 8a c4 80 0d 8d 0d 0d 3f 9a 3f 77 8b ad ad 98 75 67 3a 9d be 34 1e 8f b3 6a ed 1a 06 87 86 e8 eb 2b 5b 73 81 3d 90 e5 28 33 5e ea 61 14 67 e2 06 f6 9e 88 66 b2 2e b7 a2 d2 2c ff 65 74 4d b2 06 60 2f 94 35 f7 56 64 fd 0b c3 2a 24 26 5e 41 37 cb ff a1 56 5a d9 85 50 67 a1 9b ef bb 50 b2 c9 bc 90 db af 05 6e 46 56 93 7c 65 23 2a 4d 13 12 13 6f 76 fe 7e 15 38 9c 91 01 dd 13 d0 b9 91 ef 1c 2e 07 0b 90 78 dc 11 75 da 78 d9 b6 ed 28 1a d7 17 84 65 8d 9b b2 8c 13 d0 c4 71 7b 14 e2 51 8f ae ab c5 28 73 b9 52 bf 2b a8 28 ef 6e ce 58 26 a1 58 52 f0 26 70 cf a1 89 5b 35 5d fa f3 d1 18 b7 44 e3 8d a3 89 ea 2a 34 29 7b 9c f1 5b 8b 71 12 b2 a6 6e 8d bc 1f 71 74 ae bc 82 ce 95 5a Data Ascii: s:,/q:P}7.)p??wug:4j+[s=(3^agf.,etM`/5Vd$&^A7VZPgPnFV\|e#Mov~8.xux(eq{Q(sR+(nX&XR&p[5]D*4){[qnqtZ
2025-03-26 06:19:53 UTC	4096	IN	Data Raw: c3 78 27 74 e3 8f 9a fd 90 c0 78 0c 2f 96 cc 66 6c 0b ba a9 8c 14 1f 0f 01 37 3b ff ff 35 54 33 6f 10 6f f6 77 22 5e dc c5 33 45 ec 2f 8e 04 fc 95 28 20 77 9e f3 fa a5 e8 3c b8 04 cd 1a 8f 43 a2 ee 2f c0 e7 51 41 66 b7 73 43 23 12 7e 83 45 ec 3f 17 87 a3 d6 62 af 51 fc 84 02 24 7a 5d ab e5 21 28 ce cf 10 3d 5f 64 fc 97 00 32 18 2a c1 59 78 cf b2 5c dc 8c 6a aa 1a c6 18 d5 12 74 0b 91 bb 75 05 79 6a 7f 15 c0 bd c8 3c 3c 07 c5 44 45 cd 5e ce bf f7 e0 05 ea 43 ed d6 cf 1a 46 17 eb 7d a8 ee db 85 c8 ed b9 14 cd ce 40 82 fa 27 78 c7 cb 06 ae 71 fe ff 30 54 0c 19 f4 db d8 48 90 9d 85 66 8b 37 a3 b8 b6 62 68 06 be e4 6c f7 14 67 bb af 22 b1 b8 d0 19 e7 5e a8 d8 70 0c 15 1a 76 05 7f 13 5e 26 6d a9 c4 f0 26 14 77 a1 64 90 62 e9 c5 8b e5 3c 8e b1 1b 53 19 35 f7 a3 Data Ascii: x'tx/fl7;5T3oow"^3E/( w<C/QAfsC#~E?bQ$z]!(=_d2*Yx\jtuyj<<DE^CF}@'xq0THf7bhlg"^pv^&m&wdb<S5
2025-03-26 06:19:53 UTC	4096	IN	Data Raw: 27 55 e6 c3 7f 18 09 99 eb 51 0a f7 ef 9d e5 62 d4 f2 e6 49 34 c3 d8 05 59 20 ee 22 44 52 43 2a 95 0a 63 a9 bb 90 60 e1 15 86 18 12 c7 9f 40 1d 37 40 c1 d9 41 b1 44 7d c8 f2 e1 26 15 74 52 dc 8d 7b 47 24 e8 92 c0 4d 45 7c be 58 dc c9 cb 6e 6c 9e d9 ae 4f a1 e3 9e 6f d9 03 25 e1 4c 43 19 e4 07 a3 6c f1 3b c8 ef b6 2c 96 5e 8a 2f 61 b4 20 e0 fd 7b 28 bc 37 ea ed 21 d6 69 cf f1 da cd 14 1e 0e 51 8f 26 15 9f 43 f7 91 95 28 a3 3d 28 1e af 94 1e cc c5 30 3b c7 6b 5b e7 78 2d 9b 30 c7 d2 50 59 c2 3c e7 c3 9c c7 f9 9e db d9 15 13 b2 59 41 f8 c9 8f 4b 98 50 88 9a a7 dc 49 11 5b a3 a6 cd a0 1b 5f 25 4d de 77 a2 44 86 43 50 82 c4 93 45 6c e3 31 24 08 77 40 b3 ea bd 51 2c db 8f d0 0d a8 d0 e2 b4 eb c9 98 cd cf 99 35 8b 58 2c e6 5a e7 8e c7 73 2f ac 45 b1 3e b7 21 57 Data Ascii: 'UQbI4Y "DRC*c`@7@AD}&tR{G$ME\|XnlOo%LCl;,^/a {(7!iQ&C(=(0;k[x-0PY<YAKPI[_%MwDCPEl1$w@Q,5X,Zs/E>!W
2025-03-26 06:19:53 UTC	4096	IN	Data Raw: e2 dd 5c 74 3e f4 3a db 7c 84 d1 ed c3 82 e2 9a cb 9d 10 15 09 51 0a ba 59 78 69 fd 77 fa ac 17 9a 78 3c ce b4 29 53 fc 0a ef 16 42 df c6 de de 7b fa fa fa 4e 45 37 dd bd 29 de 6c ef 5a 94 32 85 c8 5a 74 53 7d 3f 12 35 4b 50 dc de 5a 64 29 73 6b 39 dd 1b 72 1f 36 ba 30 f6 42 f1 6f ed e8 84 fc 2b ba 91 3e 84 6e d8 ae 8b f7 20 f4 20 71 5b ad fd 0e 5d 34 af a2 04 95 a2 6f e4 69 db 26 e9 5f c2 24 93 af 22 6b e5 d9 19 af 35 e0 05 56 67 cf 2e b3 37 dc 84 e7 ca f6 cb f8 cb c5 21 e8 c2 5c 49 6d 66 87 3d 8a 6e b4 07 a3 12 3a 63 59 d0 3d 59 ed 01 64 90 ab fe 5a 25 b1 d1 43 a2 d2 25 9a 06 90 50 ba ab c2 fb cd 64 19 12 3d 97 55 71 0c 5d 28 96 f7 ea 32 6d 3f 85 c4 60 21 5e a7 a0 b6 86 a5 b0 1a 85 d6 04 15 7e ce 47 a9 63 7b ba 84 cf ba 0c 51 de 7b 48 1a dd 6b c3 26 94 Data Ascii: \t>:\|QYxiwx<)SB{NE7)lZ2ZtS}?5KPZd)sk9r60Bo+>n q[]4oi&_$"k5Vg.7!\Imf=n:cY=YdZ%C%Pd=Uq](2m?`!^~Gc{Q{Hk&
2025-03-26 06:19:53 UTC	4096	IN	Data Raw: 61 f3 46 f0 fd 84 18 1c bd a1 a7 e7 5f 69 db de 11 59 48 7a 50 ec 4f 4d a3 1a 5e 36 33 a7 cf 50 52 87 c7 13 a9 74 ea d9 c6 86 86 e3 a6 4c 9e fc f1 81 c1 81 d7 6d db de 06 b9 09 fd 44 c6 6a 94 b5 fa 69 14 ff 76 1b aa 49 97 69 71 4b 02 5f c1 13 73 20 37 eb 36 19 7f 2f 44 ee da e9 c8 d2 97 06 5e ed d9 b8 f1 19 d4 42 ad a6 02 bd 7c 88 91 bb e4 cb 6b c8 9a b9 1e 25 43 ec 8d b2 a1 2f 45 89 10 5b a1 89 41 a1 82 ce 42 c9 14 c4 ac d8 63 13 27 4c 58 6b 59 d6 55 69 db fe 9f 85 4a 7d d4 d7 d7 b3 be bb 8b c1 a1 a1 5a 4a 7e f0 63 2d b2 76 1f 64 db e9 77 ae 5b bf ee 17 cd 4d cd af 59 56 ec 6d b6 9d 7e ac 2e 51 97 6a 69 6a 8e c2 a2 5a 4b 58 c8 05 9f af 2a f8 c3 c0 03 95 1b 8e c1 50 34 13 51 51 da f7 31 32 09 ec 09 e0 fd c0 b3 d5 18 94 61 f3 23 94 cf ce 82 3d 6d d8 6e 38 Data Ascii: aF_iYHzPOM^63PRtLmDjivIiqK_s 76/D^B\|k%C/E[ABc'LXkYUiJ}ZJ~c-vdw[MYVm~.QjijZKX*P4QQ12a#=mn8
2025-03-26 06:19:53 UTC	4096	IN	Data Raw: f4 85 b0 25 6a 89 f5 0c 7a e0 97 e3 a4 8e 7a b9 86 c2 2c 86 17 e5 d8 c6 5a c2 3d 88 76 44 33 d2 cc cf 5e ce c8 cc cd 9c b4 cd db 82 05 f3 db a8 af ab 23 1e 2f ba 3b 1a 48 a8 5f 8e 84 6e d8 63 94 42 b1 75 2e 87 23 8b e5 75 68 16 78 01 2a a0 7a 02 85 b7 6e db 17 2f 33 da 46 02 e8 b3 44 db 7e ab 01 f5 63 fc 1e ca c2 1d 44 df a9 da e7 9e 8d ac 3d 99 d7 e5 58 13 74 0b 42 1c cb 33 9d 75 3f 12 e2 78 dc 58 c8 ce b3 38 33 c4 f6 c3 70 71 c0 36 3a 73 7c a6 33 c4 be 0b 5d 4e 2b f2 3b 6e c1 e8 fb 4c 98 a5 8f 60 0b 67 3e de 83 4a 03 95 fa 9d 5f 46 82 28 2c ad 21 b6 79 26 b2 8e 85 39 26 bb 17 b1 fd d3 b2 3e b3 30 82 e3 10 74 ee de 19 62 fd 93 f3 1f b6 51 cc 60 b4 61 27 7b f9 69 01 db 1b 17 54 5b c0 15 23 e8 32 67 2c af 20 17 54 a1 d4 21 97 c3 33 14 77 a2 56 73 79 00 b9 Data Ascii: %jzz,Z=vD3^#/;H_ncBu.#uhx*zn/3FD~cD=XtB3u?xX83pq6:s\|3]N+;nL`g>J_F(,!y&9&>0tbQ`a'{iT[#2g, T!3wVsy
2025-03-26 06:19:53 UTC	4096	IN	Data Raw: c8 5a 9b eb 98 2f 41 bf db 84 80 6d 9c 84 42 49 1e 74 d6 9f 8d ee 79 51 5b 7a c3 5c 0f 07 a0 8c f2 bf a1 09 41 1c 55 18 38 08 4d 9c 2f c9 ff d1 aa b1 1e 59 d3 bf 11 b0 de 04 74 1d 7f 1f 65 56 ae 44 df 6f 3e 85 75 b8 f9 3a e3 c3 05 d8 45 70 21 ed 9f a1 ba a3 b7 a2 e3 dc e2 7c e6 ed c8 68 12 86 e5 e8 99 7c 5a 11 63 bc a0 88 cf 18 2a 44 31 56 b2 4e 14 80 7c 2d 9e d0 fa 30 ba 08 bf 8e 17 b4 9f 49 12 ef e1 b7 0c 2f 0e 0c bc c2 b3 75 e8 62 b6 9c d7 dc 67 d8 34 67 7f 9f 26 f8 46 5c 0a ab 12 89 c4 47 16 6c 39 ff e9 ba ba ba 2f f6 f5 f7 9f 66 59 d6 47 70 3a 45 80 23 e6 d2 29 96 ad 5c c1 d0 70 45 4a 55 ed 8f dc d7 53 91 b0 9d 83 d7 97 b4 c5 59 2a 29 e8 ae a2 70 51 d6 80 67 49 8c 6a ac 3f 43 33 f8 cf 66 bc b6 2b ea 27 fb 29 94 24 72 0b ca 1c 75 eb 69 f5 3b cb 3a 24 Data Ascii: Z/AmBItyQ[z\AU8M/YteVDo>u:Ep!\|h\|ZcD1VN\|-0I/ubg4g&F\Gl9/fYGp:E#)\pEJUSY)pQgIj?C3f+')$rui;:$
2025-03-26 06:19:53 UTC	4096	IN	Data Raw: 3d 70 05 72 41 6e 8e b4 20 a1 11 24 76 ee 41 a2 2e 57 26 6b 13 f0 4b 46 8b e1 d7 91 a8 bb 23 e3 b5 06 67 9f 8d 94 66 a1 cb d7 11 62 71 9e f5 0f 74 f6 5b 6d f6 40 3d 62 ff 85 44 a6 c1 60 30 18 0c 35 4d 2d 0b ba f9 28 ae e9 06 e0 98 2a 8f a5 16 d8 0e a5 94 07 75 50 b8 0e d5 b1 cb b7 8d 9f 20 71 97 c9 1a d4 13 f5 26 e7 ef 39 40 37 f0 3c a5 59 e8 12 8c b6 d0 f5 a1 9e b3 d9 b4 a0 b2 33 b5 d4 8a ed 38 74 4c be 83 b2 c4 0c 06 83 c1 60 a8 49 6a 51 d0 25 80 53 91 75 e4 ab 94 d6 31 60 bc 71 30 e1 ea 04 fd 11 38 2b cf 7b ef cc f3 de 06 74 dc 6f 05 f6 02 1e 46 e2 af 94 5e 54 71 46 5b e8 ba 81 97 72 ac 7b 00 d5 75 b7 e6 63 1a ea 91 7b 3d 72 fb d7 e2 35 63 30 18 0c 86 cd 9c 5a 7b 38 6d 8f 6a a5 fd 8d f2 d5 22 1b eb bc 0b 75 71 08 e2 47 c0 39 79 de 3b 0b 75 d0 c8 66 23 Data Ascii: =prAn $vA.W&kKF#gfbqt[m@=bD`05M-(*uP q&9@7<Y38tL`IjQ%Su1`q08+{toF^TqF[r{uc{=r5c0Z{8mj"uqG9y;uf#

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:19:53 UTC	587	OUT	GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1 Host: medpetroenergydmcc.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://medpetroenergydmcc.com/court/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:19:53 UTC	213	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:19:53 GMT Server: Apache Last-Modified: Mon, 28 Aug 2023 16:14:24 GMT Accept-Ranges: bytes Content-Length: 87553 Connection: close Content-Type: text/javascript
2025-03-26 06:19:53 UTC	7979	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 74 79 70 65 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 5f 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 28 66 65 28 65 2c 22 69 6e 70 75 74 22 29 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 29 26 26 65 2e 74 79 70 65 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 6f 72 6d 22 69 6e 20 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 21 31 3d 3d 3d 65 2e 64 69 73 61 62 6c 65 64 3f 22 6c 61 62 65 6c 22 69 6e 20 65 3f 22 6c 61 62 65 6c 22 69 6e 20 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 3a 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 3a 65 2e 69 73 44 Data Ascii: type===t}}function _(t){return function(e){return(fe(e,"input")\|\|fe(e,"button"))&&e.type===t}}function z(t){return function(e){return"form"in e?e.parentNode&&!1===e.disabled?"label"in e?"label"in e.parentNode?e.parentNode.disabled===t:e.disabled===t:e.isD
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 62 6c 69 6e 67 29 69 66 28 65 2e 6e 6f 64 65 54 79 70 65 3c 36 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 70 61 72 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 62 2e 70 73 65 75 64 6f 73 2e 65 6d 70 74 79 28 65 29 7d 2c 68 65 61 64 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 71 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 Data Ascii: bling)if(e.nodeType<6)return!1;return!0},parent:function(e){return!b.pseudos.empty(e)},header:function(e){return q.test(e.nodeName)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},t
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 64 65 3b 72 65 74 75 72 6e 20 74 26 26 31 31 21 3d 3d 74 2e 6e 6f 64 65 54 79 70 65 3f 74 3a 6e 75 6c 6c 7d 2c 70 61 72 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 64 28 65 2c 22 70 61 72 65 6e 74 4e 6f 64 65 22 29 7d 2c 70 61 72 65 6e 74 73 55 6e 74 69 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 64 28 65 2c 22 70 61 72 65 6e 74 4e 6f 64 65 22 2c 6e 29 7d 2c 6e 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 41 28 65 2c 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 29 7d 2c 70 72 65 76 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 41 28 65 2c 22 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 22 29 7d 2c 6e 65 78 74 41 6c 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 Data Ascii: de;return t&&11!==t.nodeType?t:null},parents:function(e){return d(e,"parentNode")},parentsUntil:function(e,t,n){return d(e,"parentNode",n)},next:function(e){return A(e,"nextSibling")},prev:function(e){return A(e,"previousSibling")},nextAll:function(e){ret
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7a 2e 72 65 6d 6f 76 65 28 74 68 69 73 2c 65 29 7d 29 7d 7d 29 2c 63 65 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3b 69 66 28 65 29 72 65 74 75 72 6e 20 74 3d 28 74 7c 7c 22 66 78 22 29 2b 22 71 75 65 75 65 22 2c 72 3d 5f 2e 67 65 74 28 65 2c 74 29 2c 6e 26 26 28 21 72 7c 7c 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6e 29 3f 72 3d 5f 2e 61 63 63 65 73 73 28 65 2c 74 2c 63 65 2e 6d 61 6b 65 41 72 72 61 79 28 6e 29 29 3a 72 2e 70 75 73 68 28 6e 29 29 2c 72 7c 7c 5b 5d 7d 2c 64 65 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 3d 74 7c 7c 22 66 78 22 3b 76 61 72 20 6e 3d 63 65 2e 71 75 65 75 65 28 65 2c 74 29 2c 72 Data Ascii: this.each(function(){z.remove(this,e)})}}),ce.extend({queue:function(e,t,n){var r;if(e)return t=(t\|\|"fx")+"queue",r=_.get(e,t),n&&(!r\|\|Array.isArray(n)?r=_.access(e,t,ce.makeArray(n)):r.push(n)),r\|\|[]},dequeue:function(e,t){t=t\|\|"fx";var n=ce.queue(e,t),r
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 3d 3d 6f 2e 6e 61 6d 65 73 70 61 63 65 26 26 21 75 2e 72 6e 61 6d 65 73 70 61 63 65 2e 74 65 73 74 28 6f 2e 6e 61 6d 65 73 70 61 63 65 29 7c 7c 28 75 2e 68 61 6e 64 6c 65 4f 62 6a 3d 6f 2c 75 2e 64 61 74 61 3d 6f 2e 64 61 74 61 2c 76 6f 69 64 20 30 21 3d 3d 28 72 3d 28 28 63 65 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 5b 6f 2e 6f 72 69 67 54 79 70 65 5d 7c 7c 7b 7d 29 2e 68 61 6e 64 6c 65 7c 7c 6f 2e 68 61 6e 64 6c 65 72 29 2e 61 70 70 6c 79 28 69 2e 65 6c 65 6d 2c 73 29 29 26 26 21 31 3d 3d 3d 28 75 2e 72 65 73 75 6c 74 3d 72 29 26 26 28 75 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 75 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 29 29 7d 72 65 74 75 72 6e 20 63 2e 70 6f 73 74 44 69 73 70 61 74 63 68 26 26 63 2e 70 6f 73 74 44 69 73 Data Ascii: ==o.namespace&&!u.rnamespace.test(o.namespace)\|\|(u.handleObj=o,u.data=o.data,void 0!==(r=((ce.event.special[o.origType]\|\|{}).handle\|\|o.handler).apply(i.elem,s))&&!1===(u.result=r)&&(u.preventDefault(),u.stopPropagation()))}return c.postDispatch&&c.postDis
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 74 42 65 66 6f 72 65 28 65 2c 74 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 7d 29 7d 2c 62 65 66 6f 72 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 24 65 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 74 68 69 73 29 7d 29 7d 2c 61 66 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 24 65 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 74 68 69 73 2e 6e 65 78 74 53 69 62 6c Data Ascii: tBefore(e,t.firstChild)}})},before:function(){return $e(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this)})},after:function(){return $e(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this.nextSibl
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 72 6f 70 48 6f 6f 6b 73 2e 5f 64 65 66 61 75 6c 74 2e 67 65 74 28 74 68 69 73 29 7d 2c 72 75 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3d 61 74 2e 70 72 6f 70 48 6f 6f 6b 73 5b 74 68 69 73 2e 70 72 6f 70 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 72 61 74 69 6f 6e 3f 74 68 69 73 2e 70 6f 73 3d 74 3d 63 65 2e 65 61 73 69 6e 67 5b 74 68 69 73 2e 65 61 73 69 6e 67 5d 28 65 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 72 61 74 69 6f 6e 2a 65 2c 30 2c 31 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 72 61 74 69 6f 6e 29 3a 74 68 69 73 2e 70 6f 73 3d 74 3d 65 2c 74 68 69 73 2e 6e 6f 77 3d 28 74 68 69 73 2e 65 6e 64 2d 74 68 69 73 2e 73 74 61 72 74 29 2a 74 2b 74 68 69 73 2e 73 74 61 72 74 2c 74 68 69 73 2e Data Ascii: ropHooks._default.get(this)},run:function(e){var t,n=at.propHooks[this.prop];return this.options.duration?this.pos=t=ce.easing[this.easing](e,this.options.duratione,0,1,this.options.duration):this.pos=t=e,this.now=(this.end-this.start)t+this.start,this.
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 63 65 2e 72 65 6d 6f 76 65 41 74 74 72 28 65 2c 74 29 3a 69 26 26 22 73 65 74 22 69 6e 20 69 26 26 76 6f 69 64 20 30 21 3d 3d 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 28 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 2c 6e 2b 22 22 29 2c 6e 29 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 6e 75 6c 6c 3d 3d 28 72 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 74 29 29 3f 76 6f 69 64 20 30 3a 72 29 7d 2c 61 74 74 72 48 6f 6f 6b 73 3a 7b 74 79 70 65 3a 7b 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 6c 65 2e 72 61 64 69 6f 56 61 6c 75 65 26 26 22 72 61 64 69 6f 22 Data Ascii: 0)),void 0!==n?null===n?void ce.removeAttr(e,t):i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:(e.setAttribute(t,n+""),n):i&&"get"in i&&null!==(r=i.get(e,t))?r:null==(r=ce.find.attr(e,t))?void 0:r)},attrHooks:{type:{set:function(e,t){if(!le.radioValue&&"radio"
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 6d 61 70 28 6e 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 7b 6e 61 6d 65 3a 74 2e 6e 61 6d 65 2c 76 61 6c 75 65 3a 65 2e 72 65 70 6c 61 63 65 28 4c 74 2c 22 5c 72 5c 6e 22 29 7d 7d 29 3a 7b 6e 61 6d 65 3a 74 2e 6e 61 6d 65 2c 76 61 6c 75 65 3a 6e 2e 72 65 70 6c 61 63 65 28 4c 74 2c 22 5c 72 5c 6e 22 29 7d 7d 29 2e 67 65 74 28 29 7d 7d 29 3b 76 61 72 20 4d 74 3d 2f 25 32 30 2f 67 2c 52 74 3d 2f 23 2e 2a 24 2f 2c 49 74 3d 2f 28 5b 3f 26 5d 29 5f 3d 5b 5e 26 5d 2a 2f 2c 57 74 3d 2f 5e 28 2e 2a 3f 29 3a 5b 20 5c 74 5d 2a 28 5b 5e 5c 72 5c 6e 5d 2a 29 24 2f 67 6d 2c 46 74 3d 2f 5e 28 3f 3a 47 45 54 7c 48 45 41 44 29 24 2f 2c 24 74 3d 2f 5e 5c 2f 5c 2f 2f 2c 42 74 3d 7b 7d 2c 5f 74 3d 7b 7d 2c 7a 74 3d 22 2a 2f 22 2e 63 6f 6e 63 61 74 28 22 2a 22 Data Ascii: map(n,function(e){return{name:t.name,value:e.replace(Lt,"\r\n")}}):{name:t.name,value:n.replace(Lt,"\r\n")}}).get()}});var Mt=/%20/g,Rt=/#.$/,It=/([?&])_=[^&]/,Wt=/^(.?):[ \t]([^\r\n])$/gm,Ft=/^(?:GET\|HEAD)$/,$t=/^\/\//,Bt={},_t={},zt="/".concat("*"

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:19:53 UTC	595	OUT	GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1 Host: medpetroenergydmcc.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://medpetroenergydmcc.com/court/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:19:53 UTC	213	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:19:53 GMT Server: Apache Last-Modified: Fri, 09 Jun 2023 04:49:24 GMT Accept-Ranges: bytes Content-Length: 13577 Connection: close Content-Type: text/javascript
2025-03-26 06:19:53 UTC	7979	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 4d 69 67 72 61 74 65 20 76 33 2e 34 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 4d 75 74 65 26 26 28 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 4d 75 74 65 3d 21 30 29 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 Data Ascii: /! jQuery Migrate v3.4.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /"undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){r
2025-03-26 06:19:54 UTC	5598	IN	Data Raw: 48 2c 45 3d 73 2e 64 61 74 61 3b 69 28 73 2c 22 64 61 74 61 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 76 61 72 20 6e 2c 6f 2c 61 3b 69 66 28 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 32 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7b 66 6f 72 28 61 20 69 6e 20 6e 3d 73 2e 68 61 73 44 61 74 61 28 65 29 26 26 45 2e 63 61 6c 6c 28 74 68 69 73 2c 65 29 2c 6f 3d 7b 7d 2c 74 29 61 21 3d 3d 78 28 61 29 3f 28 75 28 22 64 61 74 61 2d 63 61 6d 65 6c 43 61 73 65 22 2c 22 6a 51 75 65 72 79 2e 64 61 74 61 28 29 20 61 6c 77 61 79 73 20 73 65 74 73 2f 67 65 74 73 20 63 61 6d 65 6c 43 61 73 65 64 20 6e 61 6d 65 73 3a 20 22 2b 61 29 2c 6e 5b 61 5d 3d 74 5b 61 5d 29 3a 6f 5b 61 5d 3d 74 5b 61 5d 3b 72 65 74 75 72 6e 20 Data Ascii: H,E=s.data;i(s,"data",function(e,t,r){var n,o,a;if(t&&"object"==typeof t&&2===arguments.length){for(a in n=s.hasData(e)&&E.call(this,e),o={},t)a!==x(a)?(u("data-camelCase","jQuery.data() always sets/gets camelCased names: "+a),n[a]=t[a]):o[a]=t[a];return

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:19:54 UTC	644	OUT	GET /wp-content/uploads/2025/03/download-1.jpeg HTTP/1.1 Host: medpetroenergydmcc.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://medpetroenergydmcc.com/court/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:19:54 UTC	208	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:19:54 GMT Server: Apache Last-Modified: Thu, 20 Mar 2025 07:21:44 GMT Accept-Ranges: bytes Content-Length: 48305 Connection: close Content-Type: image/jpeg
2025-03-26 06:19:54 UTC	7984	IN	Data Raw: ff d8 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c2 00 11 08 03 20 04 2e 03 01 11 00 02 11 01 03 11 01 ff c4 00 1d 00 01 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 06 07 08 09 ff c4 00 18 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 ff da 00 0c 03 01 00 02 10 03 10 00 00 01 fd 36 97 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: CC .6
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: a0 00 00 00 05 04 00 00 00 00 00 00 00 00 50 08 00 28 0a 05 e0 00 06 00 00 00 00 06 00 06 41 80 00 00 c8 00 00 01 83 20 18 32 00 00 00 60 0a cc 00 ac 00 00 00 19 8c 50 cc 60 19 00 56 00 8c 80 62 b3 18 a4 0c 98 32 0c 19 30 64 18 02 90 00 00 00 00 c8 00 00 60 03 20 00 62 80 f0 f3 36 80 0a 4c 1a eb 3c af 46 2a f4 cc b4 08 10 06 40 ac c6 05 00 8c 8a 05 00 80 64 20 05 c8 32 b8 42 29 28 00 61 72 80 00 a4 14 80 8a 40 00 2d 09 41 32 20 ab 30 8a 28 19 cc c9 8a c5 62 50 0d 60 ca 04 8a 52 30 d2 36 4c 26 2d 26 00 5c 19 00 c8 93 14 00 c1 93 00 05 66 17 14 a4 28 60 41 70 9f ff c4 00 33 10 00 01 04 01 03 03 02 04 05 04 03 01 01 00 00 00 02 00 01 03 04 05 11 12 13 06 14 15 07 32 10 21 40 50 16 20 22 60 70 23 31 34 36 17 30 33 24 41 ff da 00 08 01 01 00 01 05 02 ad ec fe Data Ascii: P(A 2`P`Vb20d` b6L<F*@d 2B)(ar@-A2 0(bP`R06L&-&\f(`Ap32!@P "`p#14603$A
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 68 cd 70 46 cc f1 06 a1 38 46 b5 03 77 00 75 c0 09 e1 8d 95 68 81 4e 22 8d 81 47 54 49 8a b4 69 a1 05 13 00 31 b0 48 f2 d6 11 41 b1 14 f1 b0 8f 1c 85 c1 1b 38 c8 02 3c 41 2a 96 11 17 08 40 93 d1 14 51 c6 28 76 33 c5 64 45 a7 e3 95 3d 70 74 55 c7 51 8c 54 75 c6 35 2b 89 b4 15 85 49 18 0a d9 1a db 1a e2 8d 18 86 a1 04 7a 08 46 8a 11 d9 67 6e ea f5 c5 d5 77 08 d4 b0 0c cd c4 00 9a 38 d7 20 08 9c 81 ab 71 92 18 a3 75 1d 31 76 b3 08 c4 9d c1 46 00 ee c1 1a e2 05 33 02 8d c0 10 4a c5 1c ec 0e 60 31 b3 30 c6 ef 0c 62 c3 38 01 10 84 4c 9a b8 9b 0b 8c 0e 66 12 2e 18 dd fb 00 d3 b5 06 70 e3 89 3d 88 c8 48 23 77 0a 41 2a 87 1c 31 b8 8e d6 f8 57 f6 fd 55 d8 dc d8 eb 1e b0 c2 6c 65 1b 94 72 55 3d 42 b9 ae 02 d0 ab 1b ae da 44 d0 13 23 80 dd 35 73 75 5e 37 01 94 1c 8a Data Ascii: hpF8FwuhN"GTIi1HA8<A@Q(v3dE=ptUQTu5+IzFgnw8 qu1vF3J`10b8Lf.p=H#wA1WUlerU=BD#5su^7
2025-03-26 06:19:54 UTC	8000	IN	Data Raw: 7a 6c e8 70 32 1d cc fb 18 a6 3f a2 f8 5b 64 49 47 b2 7c b1 c5 da c8 dc ba f9 62 e9 3b 46 36 ad 0f 14 72 be ba 4c e8 e4 28 e4 5d a6 3b a0 8b 64 a5 7b 52 7b ce 29 bf ff 00 19 37 21 db 11 74 de 82 cc 5a 0c 74 ed 45 dd b6 13 63 38 ad 19 26 02 9a 1d 96 1d 3f b5 69 fb 9a b4 38 09 92 b2 3b 34 59 a6 0e ab 4f 59 7d b1 4f dc 88 25 da 1d 39 21 38 32 4a aa ee cc f9 ba 85 e4 5c 19 e8 18 62 25 21 93 03 66 54 04 08 73 9c 80 71 5a fc 8b 77 3f c9 4c 23 6b 67 f5 5f 13 75 ad 04 00 b6 c3 43 64 f0 c4 73 ad 43 71 aa 4f 6c 6b 7c 36 51 ba 57 83 39 a0 19 16 11 93 51 c7 18 f6 2f b3 be 4a 55 80 71 53 0a 91 8d 8f 2c 22 d3 25 e4 cc a4 95 90 b6 30 6d 15 b5 46 64 4d 48 ae 6c ac 66 f1 5c 99 36 cb a8 2f b4 eb fb 93 10 9d 48 15 c5 16 61 b6 77 62 54 ac e0 68 07 c2 1d db c8 2d 49 a6 a9 5f Data Ascii: zlp2?[dIG\|b;F6rL(];d{R{)7!tZtEc8&?i8;4YOY}O%9!82J\b%!fTsqZw?L#kg_uCdsCqOlk\|6QW9Q/JUqS,"%0mFdMHlf\6/HawbTh-I_
2025-03-26 06:19:55 UTC	8000	IN	Data Raw: 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 90 09 24 92 49 24 92 49 24 92 48 00 02 01 04 82 48 04 90 09 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 82 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 20 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 49 24 92 48 24 92 49 24 92 49 24 92 49 24 92 00 04 80 09 00 90 40 20 12 01 20 00 41 20 90 08 00 92 00 04 92 48 20 12 40 24 92 49 24 92 49 24 92 49 24 92 49 24 92 09 24 92 49 24 92 49 24 92 41 00 12 40 00 10 49 04 00 01 04 10 40 04 82 41 20 80 08 04 10 49 00 00 41 Data Ascii: $I$I$I$I$I$I$$I$I$HH$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$H$I$I$I$@ A H @$I$I$I$I$$I$I$A@I@A IA
2025-03-26 06:19:55 UTC	8000	IN	Data Raw: 04 14 7f 68 33 7f 99 74 80 82 e5 9a a9 41 44 c4 01 47 da 1a 83 69 ab 02 05 86 41 1e 42 c7 12 e9 52 ee d0 99 ca c9 17 83 d8 82 60 cb 82 c0 8c 8d 5a d6 35 29 cc 45 b4 cc b0 71 c4 57 24 cb 8e a3 d2 d7 5b 43 94 68 72 c4 7b 5a fd 35 fd a1 f6 70 df e6 b4 d5 c6 ee b0 d3 04 01 b4 a3 c4 e2 94 45 76 4c 75 4a 80 e8 09 5a d0 95 f1 1d 50 60 4d 82 52 aa ae 29 b1 d4 e3 4e 34 e3 75 2f d4 3e d1 5b 6a 5a 00 30 2b fb 5b 9b ff 00 81 99 bf f8 19 9b fc d1 16 a8 82 35 5e e2 4b 9c e2 6a 2d 40 ee 02 b0 d7 99 6f 67 b8 ee 03 ef 1d 97 b9 59 7a 23 14 18 22 c6 e6 9c 12 c6 84 47 64 a7 51 dc d0 8b ef 35 63 dc 15 aa f7 05 da c1 14 18 87 06 e2 42 e5 61 37 eb 0a 6e b0 67 4c e0 41 b4 1d ce 0e 79 95 ed 87 8f dc 41 ac e6 96 be f3 04 82 f9 96 44 04 34 2b 73 52 04 b8 b2 0c f8 4e 34 40 c8 8a d0 Data Ascii: h3tADGiABR`Z5)EqW$[Chr{Z5pEvLuJZP`MR)N4u/>[jZ0+[5^Kj-@ogYz#"GdQ5cBa7ngLAyAD4+sRN4@
2025-03-26 06:19:55 UTC	321	IN	Data Raw: 64 52 ff 00 d4 b7 97 71 34 b7 71 ae ee e0 97 0b b8 a3 77 73 31 8c b7 30 ae 63 ba bb 98 e4 7d d2 9f fd cc 7f 09 fe 16 7f 0b 07 f8 5f f1 33 f8 58 84 5b f3 9c 8e e5 db fb 9c 9e e6 3d 5d c3 91 ef 28 dd dc 13 77 72 ad ef bc e4 47 cd ef e0 58 bf ea 5e 63 ef 9c fe e7 3f b8 f9 5d c0 37 f7 2d d1 77 0b 75 fb b0 63 4b b8 8e ab b9 c9 ee 78 94 e6 4b 78 3d 23 e6 be f3 9b dc ab 7f 73 9a 4e 6f ad cb 35 72 e6 f6 5b ce 5f ca 2f ca 5b ca 0b c9 9c ce e7 27 b9 cc ee 7e 52 73 3b 9c de e7 37 b9 cd ee 73 7b 9c de e7 e4 22 db fb 9c 9e e7 23 b9 e4 3b 9c de e7 f0 31 f2 3b f8 0b 9f fa 96 9b f9 4c df f7 02 75 f7 2c df dc 06 ee e7 2a bd 62 6d 0b b9 cf ee 79 57 72 8f fd c4 3a c9 8b fe e1 ff 00 95 82 6f ee 22 ff 00 d7 c2 df bf b8 8b af b9 66 b9 fa c1 79 77 16 63 f7 ce 6f 72 9c c3 82 df Data Ascii: dRq4qws10c}_3X[=](wrGX^c?]7-wucKxKx=#sNo5r[_/['~Rs;7s{"#;1;Lu,*bmyWr:o"fywcor

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:19:55 UTC	590	OUT	GET /wp-includes/js/wp-emoji-release.min.js?ver=6.7.2 HTTP/1.1 Host: medpetroenergydmcc.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://medpetroenergydmcc.com/court/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:19:56 UTC	213	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:19:56 GMT Server: Apache Last-Modified: Thu, 27 Jun 2024 11:55:22 GMT Accept-Ranges: bytes Content-Length: 18726 Connection: close Content-Type: text/javascript
2025-03-26 06:19:56 UTC	7979	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 2f 2f 20 53 6f 75 72 63 65 3a 20 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 74 77 65 6d 6f 6a 69 2e 6d 69 6e 2e 6a 73 0a 76 61 72 20 74 77 65 6d 6f 6a 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 68 3d 7b 62 61 73 65 3a 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 67 68 2f 6a 64 65 63 6b 65 64 2f 74 77 65 6d 6f 6a 69 40 31 35 2e 30 2e 33 2f 61 73 73 65 74 73 2f 22 2c 65 78 74 3a 22 2e 70 6e 67 22 2c 73 69 7a 65 3a 22 37 32 78 37 32 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 22 65 6d 6f 6a 69 22 2c 63 6f 6e 76 65 72 74 3a 7b 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 3a 66 75 6e 63 74 Data Ascii: /! This file is auto-generated /// Source: wp-includes/js/twemoji.min.jsvar twemoji=function(){"use strict";var h={base:"https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/",ext:".png",size:"72x72",className:"emoji",convert:{fromCodePoint:funct
2025-03-26 06:19:56 UTC	8000	IN	Data Raw: 5c 75 32 30 30 64 5c 75 64 38 33 65 5c 75 64 65 66 32 5c 75 64 38 33 63 5b 5c 75 64 66 66 62 2d 5c 75 64 66 66 64 5c 75 64 66 66 66 5d 7c 5c 75 64 38 33 65 5c 75 64 65 66 31 5c 75 64 38 33 63 5c 75 64 66 66 66 5c 75 32 30 30 64 5c 75 64 38 33 65 5c 75 64 65 66 32 5c 75 64 38 33 63 5b 5c 75 64 66 66 62 2d 5c 75 64 66 66 65 5d 7c 5c 75 64 38 33 64 5c 75 64 63 36 38 5c 75 32 30 30 64 5c 75 32 37 36 34 5c 75 66 65 30 66 5c 75 32 30 30 64 5c 75 64 38 33 64 5c 75 64 63 36 38 7c 5c 75 64 38 33 64 5c 75 64 63 36 39 5c 75 32 30 30 64 5c 75 32 37 36 34 5c 75 66 65 30 66 5c 75 32 30 30 64 5c 75 64 38 33 64 5b 5c 75 64 63 36 38 5c 75 64 63 36 39 5d 7c 5c 75 64 38 33 65 5c 75 64 64 64 31 5c 75 32 30 30 64 5c 75 64 38 33 65 5c 75 64 64 31 64 5c 75 32 30 30 64 5c 75 64 Data Ascii: \u200d\ud83e\udef2\ud83c[\udffb-\udffd\udfff]\|\ud83e\udef1\ud83c\udfff\u200d\ud83e\udef2\ud83c[\udffb-\udffe]\|\ud83d\udc68\u200d\u2764\ufe0f\u200d\ud83d\udc68\|\ud83d\udc69\u200d\u2764\ufe0f\u200d\ud83d[\udc68\udc69]\|\ud83e\uddd1\u200d\ud83e\udd1d\u200d\ud
2025-03-26 06:19:56 UTC	2747	IN	Data Raw: 72 7c 7c 63 2e 4d 6f 7a 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 2c 61 3d 63 2e 64 6f 63 75 6d 65 6e 74 2c 74 3d 21 31 2c 72 3d 30 2c 6f 3d 30 3c 63 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 69 6e 64 65 78 4f 66 28 22 54 72 69 64 65 6e 74 2f 37 2e 30 22 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 72 65 74 75 72 6e 21 61 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 2e 68 61 73 46 65 61 74 75 72 65 7c 7c 61 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 2e 68 61 73 46 65 61 74 75 72 65 28 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 53 56 47 31 31 2f 66 65 61 74 75 72 65 23 49 6d 61 67 65 22 2c 22 31 2e 31 22 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 29 7b 69 66 28 21 74 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d Data Ascii: r\|\|c.MozMutationObserver,a=c.document,t=!1,r=0,o=0<c.navigator.userAgent.indexOf("Trident/7.0");function i(){return!a.implementation.hasFeature\|\|a.implementation.hasFeature("http://www.w3.org/TR/SVG11/feature#Image","1.1")}function s(){if(!t){if(void 0===

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:19:56 UTC	661	OUT	GET /wp-content/uploads/2025/03/cropped-judiciary_logo-32x32.jpg HTTP/1.1 Host: medpetroenergydmcc.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://medpetroenergydmcc.com/court/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:19:57 UTC	207	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:19:57 GMT Server: Apache Last-Modified: Sun, 23 Mar 2025 04:51:34 GMT Accept-Ranges: bytes Content-Length: 1067 Connection: close Content-Type: image/jpeg
2025-03-26 06:19:57 UTC	1067	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 38 32 0a ff db 00 43 00 06 04 04 05 04 04 06 05 05 05 06 06 06 07 09 0e 09 09 08 08 09 12 0d 0d 0a 0e 15 12 16 16 15 12 14 14 17 1a 21 1c 17 18 1f 19 14 14 1d 27 1d 1f 22 23 25 25 25 16 1c 29 2c 28 24 2b 21 24 25 24 ff db 00 43 01 06 06 06 09 08 09 11 09 09 11 24 18 14 18 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 ff c0 00 11 08 00 20 00 20 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82C!'"#%%%),($+!$%$C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ "

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:20:11 UTC	860	OUT	POST /submit HTTP/1.1 Host: api.staticforms.xyz Connection: keep-alive Content-Length: 154 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: https://medpetroenergydmcc.com Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://medpetroenergydmcc.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:20:11 UTC	154	OUT	Data Raw: 61 63 63 65 73 73 4b 65 79 3d 32 38 31 36 37 32 63 31 2d 31 38 39 61 2d 34 39 31 62 2d 62 35 35 66 2d 33 36 63 31 63 36 38 30 37 66 33 66 26 72 65 64 69 72 65 63 74 54 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 75 73 65 72 73 68 61 72 65 70 6f 69 6e 74 2e 6e 69 63 65 70 61 67 65 2e 69 6f 25 32 46 26 65 6d 61 69 6c 3d 31 65 65 6e 72 30 25 34 30 6d 77 62 73 2e 63 6f 6d 26 6e 61 6d 65 3d 25 33 41 4f 25 32 43 25 35 42 64 59 6d 53 25 34 30 25 32 31 35 6c 4d Data Ascii: accessKey=281672c1-189a-491b-b55f-36c1c6807f3f&redirectTo=https%3A%2F%2Fusersharepoint.nicepage.io%2F&email=1eenr0%40mwbs.com&name=%3AO%2C%5BdYmS%40%215lM
2025-03-26 06:20:11 UTC	1226	IN	HTTP/1.1 303 See Other Date: Wed, 26 Mar 2025 06:20:11 GMT Content-Length: 0 Connection: close access-control-allow-headers: Content-Type, Authorization access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * Cache-Control: public, max-age=0, must-revalidate location: https://usersharepoint.nicepage.io/ strict-transport-security: max-age=63072000 vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch x-matched-path: /api/submit x-vercel-cache: MISS x-vercel-id: iad1::iad1::pdm9t-1742970011523-974ca7533035 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hf42snbkzTvbH6wZjCCXFCfRwudfmBRsn8EJYnTC2vii9prqavDk%2FFx3IFJIdk%2FzmMxKjgFm9T6x10CklPqNfGHGcGXd%2FwU4p13nJCIHMLEPW0IZTJ4J0n9eIMQOd2ff3tIheFWh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92648a6bce137ce8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=96646&min_rtt=96520&rtt_var=20553&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1608&delivery_rate=38442&cwnd=196&unsent_bytes=0&cid=8df3b5df4c2b47a8&ts=609&x=0"

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:20:12 UTC	750	OUT	GET / HTTP/1.1 Host: usersharepoint.nicepage.io Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://medpetroenergydmcc.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:20:12 UTC	707	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5496 Server: nginx/1.19.2 Content-Type: text/html x-amz-id-2: l8GDNGNBk3LZBljQ/BzbjgwPybNAa/rX/3hhXbEOLfnOrQrEwDuZ4K+4vJHp2u5lRWZg2grix5+/52/US2GyZ5Re+lE2k0gnFkvmZtHd6C0= x-amz-request-id: 4XMEV85R428HP9YG x-amz-version-id: rAEU3D_Ug5RycqhdR5loUjeu954VKudi Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: Content-Type Accept-Ranges: bytes Age: 120 Date: Wed, 26 Mar 2025 06:20:12 GMT Via: 1.1 varnish X-Served-By: cache-lga21987-LGA X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1742970013.631163,VS0,VE1 Vary: Accept-Encoding
2025-03-26 06:20:12 UTC	1378	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6d 69 6e 67 20 53 6f 6f 6e 2c 20 4f 75 72 20 43 75 73 74 6f 6d 65 72 73 2c 20 43 6f 75 6e 74 64 6f 77 6e 20 42 65 67 69 6e 73 2c 20 53 74 61 79 20 54 75 6e Data Ascii: <!DOCTYPE html><html style="font-size: 16px;" lang="en"><head> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta charset="utf-8"> <meta name="keywords" content="Coming Soon, Our Customers, Countdown Begins, Stay Tun
2025-03-26 06:20:12 UTC	1378	IN	Data Raw: 73 3a 2f 2f 61 73 73 65 74 73 2e 6e 69 63 65 70 61 67 65 63 64 6e 2e 63 6f 6d 2f 65 65 66 66 32 65 61 65 2f 36 33 36 36 31 31 36 2f 69 6d 61 67 65 73 2f 53 68 61 72 65 50 6f 69 6e 74 2d 53 79 6d 62 6f 6c 2e 77 65 62 70 22 0a 7d 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 34 37 38 61 63 39 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 55 73 65 72 70 6f 72 74 61 6c 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 Data Ascii: s://assets.nicepagecdn.com/eeff2eae/6366116/images/SharePoint-Symbol.webp"}</script> <meta name="theme-color" content="#478ac9"> <meta property="og:title" content="Userportal"> <meta property="og:type" content="website"> <link rel="canoni
2025-03-26 06:20:12 UTC	1378	IN	Data Raw: 6c 61 73 73 3d 22 75 2d 73 76 67 2d 63 6f 6e 74 65 6e 74 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 6d 65 6e 75 2d 68 61 6d 62 75 72 67 65 72 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 31 36 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 67 3e 3c 72 65 63 74 20 79 3d 22 31 22 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 32 22 3e 3c 2f 72 65 63 74 3e 3c 72 65 63 74 20 79 3d 22 37 22 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 32 22 3e 3c 2f 72 65 63 74 3e 3c Data Ascii: lass="u-svg-content" version="1.1" id="menu-hamburger" viewBox="0 0 16 16" x="0px" y="0px" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg"><g><rect y="1" width="16" height="2"></rect><rect y="7" width="16" height="2"></rect><
2025-03-26 06:20:12 UTC	1362	IN	Data Raw: 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 75 2d 63 6c 65 61 72 66 69 78 20 75 2d 73 68 65 65 74 20 75 2d 73 68 65 65 74 2d 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 75 2d 61 6c 69 67 6e 2d 63 65 6e 74 65 72 20 75 2d 62 6f 72 64 65 72 2d 32 20 75 2d 62 6f 72 64 65 72 2d 67 72 65 79 2d 37 35 20 75 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 74 79 6c 65 20 75 2d 67 72 6f 75 70 20 75 2d 73 68 61 70 65 2d 72 65 63 74 61 6e 67 6c 65 20 75 2d 77 68 69 74 65 20 75 2d 67 72 6f 75 70 2d 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 75 2d 63 6f 6e 74 61 69 6e 65 72 2d 6c 61 79 6f 75 74 20 75 2d 76 61 6c 69 67 6e 2d 74 6f 70 20 75 2d 63 6f 6e 74 61 69 6e 65 72 2d 6c 61 79 6f 75 74 2d 31 22 3e 0a 20 20 Data Ascii: <div class="u-clearfix u-sheet u-sheet-1"> <div class="u-align-center u-border-2 u-border-grey-75 u-container-style u-group u-shape-rectangle u-white u-group-1"> <div class="u-container-layout u-valign-top u-container-layout-1">

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:20:12 UTC	575	OUT	GET /nicepage-site.css HTTP/1.1 Host: usersharepoint.nicepage.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://usersharepoint.nicepage.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:20:12 UTC	796	IN	HTTP/1.1 200 OK Connection: close Content-Length: 823311 Server: nginx/1.19.2 Content-Type: text/css x-amz-id-2: RA3Zy96D2auycUgZ0xZpts4D4774X+qHr53Ak4wopnZSI0YiO5YVwH95qCtW++O6QBjeR17/VH9Lckk17PkQBd77kWyBAWpHvXTmok/blRg= x-amz-request-id: KJRQ83CZNBPPXWHJ Last-Modified: Wed, 16 Oct 2024 22:57:09 GMT x-amz-version-id: 7nKaCV23vTIimk2r3tvqmvLm0oCVyCBt ETag: "35c7cb057e2a604e5686389d4cdbb31f" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: Content-Type Accept-Ranges: bytes Date: Wed, 26 Mar 2025 06:20:12 GMT Via: 1.1 varnish Age: 119 X-Served-By: cache-lga21958-LGA X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1742970013.800117,VS0,VE1 Vary: Accept-Encoding
2025-03-26 06:20:12 UTC	16384	IN	Data Raw: 2f 2a 62 65 67 69 6e 2d 76 61 72 69 61 62 6c 65 73 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 2a 2f 0a 2e 75 2d 62 6f 64 79 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 4f 70 65 6e 20 53 61 6e 73 27 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 68 31 2c 0a 68 32 2c 0a 68 33 2c 0a 68 34 2c 0a 68 35 2c 0a 68 36 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 6f 62 6f 74 6f 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 2f 2a 65 6e 64 2d 76 61 72 69 61 62 6c 65 73 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 2a 2f 0a 2f 2a 62 65 67 69 6e 2d 76 61 72 69 61 62 6c 65 73 20 63 6f 6c 6f 72 2a 2f 0a 2e 75 2d 6f 76 65 72 6c 61 70 2e 75 2d 6f 76 65 72 6c 61 70 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 2e 75 2d 68 65 61 64 65 72 2c 0a 2e 75 2d 69 6d 61 67 65 2c 0a 2e Data Ascii: /begin-variables font-family/.u-body { font-family: 'Open Sans',sans-serif;}h1,h2,h3,h4,h5,h6 { font-family: Roboto,sans-serif;}/end-variables font-family//begin-variables color/.u-overlap.u-overlap-transparent .u-header,.u-image,.
2025-03-26 06:20:12 UTC	16384	IN	Data Raw: 2d 6c 61 79 6f 75 74 2e 75 2d 63 6f 6c 6f 72 2d 31 2d 6c 69 67 68 74 2d 32 3a 62 65 66 6f 72 65 2c 0a 2e 75 2d 74 61 62 6c 65 2d 61 6c 74 2d 63 6f 6c 6f 72 2d 31 2d 6c 69 67 68 74 2d 32 20 74 72 3a 6e 74 68 2d 63 68 69 6c 64 28 65 76 65 6e 29 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 31 31 31 31 31 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 61 64 63 63 65 39 3b 0a 7d 0a 2e 75 2d 69 6e 70 75 74 2e 75 2d 63 6f 6c 6f 72 2d 31 2d 6c 69 67 68 74 2d 32 2c 0a 2e 75 2d 66 69 65 6c 64 2d 69 6e 70 75 74 2e 75 2d 63 6f 6c 6f 72 2d 31 2d 6c 69 67 68 74 2d 32 2c 0a 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 63 6f 6c 6f 72 2d 31 2d 6c 69 67 68 74 2d 32 2c 0a 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 63 6f 6c 6f 72 2d 31 Data Ascii: -layout.u-color-1-light-2:before,.u-table-alt-color-1-light-2 tr:nth-child(even) { color: #111111; background-color: #adcce9;}.u-input.u-color-1-light-2,.u-field-input.u-color-1-light-2,.u-button-style.u-color-1-light-2,.u-button-style.u-color-1
2025-03-26 06:20:12 UTC	16384	IN	Data Raw: 2e 61 63 74 69 76 65 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 61 63 74 69 76 65 2d 63 6f 6c 6f 72 2d 32 2d 64 61 72 6b 2d 31 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 2e 61 63 74 69 76 65 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 61 63 74 69 76 65 20 3e 20 2e 75 2d 61 63 74 69 76 65 2d 63 6f 6c 6f 72 2d 32 2d 64 61 72 6b 2d 31 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 61 63 74 69 76 65 20 3e 20 2e 75 2d 61 63 74 69 76 65 2d 63 6f 6c 6f 72 2d 32 2d 64 61 72 6b 2d 31 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 2c 0a 6c 69 2e 61 63 74 69 76 Data Ascii: .active,a.u-button-style.u-button-style.u-active-color-2-dark-1[class="u-border-"].active,a.u-button-style.u-button-style.active > .u-active-color-2-dark-1,a.u-button-style.u-button-style.active > .u-active-color-2-dark-1[class="u-border-"],li.activ
2025-03-26 06:20:12 UTC	16384	IN	Data Raw: 76 65 72 2d 63 6f 6c 6f 72 2d 33 2d 64 61 72 6b 2d 33 3a 68 6f 76 65 72 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 2d 33 2d 64 61 72 6b 2d 33 2e 68 6f 76 65 72 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 2d 33 2d 64 61 72 6b 2d 33 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 3a 68 6f 76 65 72 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 2d 33 2d 64 61 72 6b 2d 33 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 2e 68 6f 76 65 72 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 3a 68 6f 76 65 72 20 3e 20 2e 75 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 2d 33 2d 64 61 72 6b 2d 33 Data Ascii: ver-color-3-dark-3:hover,a.u-button-style.u-hover-color-3-dark-3.hover,a.u-button-style.u-hover-color-3-dark-3[class="u-border-"]:hover,a.u-button-style.u-hover-color-3-dark-3[class="u-border-"].hover,a.u-button-style:hover > .u-hover-color-3-dark-3
2025-03-26 06:20:12 UTC	16384	IN	Data Raw: 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 63 6f 6c 6f 72 2d 33 2d 6c 69 67 68 74 2d 33 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 3a 61 63 74 69 76 65 2c 0a 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 63 6f 6c 6f 72 2d 33 2d 6c 69 67 68 74 2d 33 2e 61 63 74 69 76 65 2c 0a 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 63 6f 6c 6f 72 2d 33 2d 6c 69 67 68 74 2d 33 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 2e 61 63 74 69 76 65 2c 0a 6c 69 2e 61 63 74 69 76 65 20 3e 20 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 63 6f 6c 6f 72 Data Ascii: ton-style.u-button-style.u-color-3-light-3[class="u-border-"]:active,.u-button-style.u-button-style.u-color-3-light-3.active,.u-button-style.u-button-style.u-color-3-light-3[class="u-border-"].active,li.active > .u-button-style.u-button-style.u-color
2025-03-26 06:20:12 UTC	16384	IN	Data Raw: 64 28 65 76 65 6e 29 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 31 31 31 31 31 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 37 32 65 66 65 39 3b 0a 7d 0a 2e 75 2d 69 6e 70 75 74 2e 75 2d 63 6f 6c 6f 72 2d 34 2d 6c 69 67 68 74 2d 31 2c 0a 2e 75 2d 66 69 65 6c 64 2d 69 6e 70 75 74 2e 75 2d 63 6f 6c 6f 72 2d 34 2d 6c 69 67 68 74 2d 31 2c 0a 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 63 6f 6c 6f 72 2d 34 2d 6c 69 67 68 74 2d 31 2c 0a 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 63 6f 6c 6f 72 2d 34 2d 6c 69 67 68 74 2d 31 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 31 31 31 31 31 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 Data Ascii: d(even) { color: #111111; background-color: #72efe9;}.u-input.u-color-4-light-1,.u-field-input.u-color-4-light-1,.u-button-style.u-color-4-light-1,.u-button-style.u-color-4-light-1[class*="u-border-"] { color: #111111 !important; background-c
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 61 63 74 69 76 65 2d 63 6f 6c 6f 72 2d 35 2d 64 61 72 6b 2d 32 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 2e 61 63 74 69 76 65 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 61 63 74 69 76 65 20 3e 20 2e 75 2d 61 63 74 69 76 65 2d 63 6f 6c 6f 72 2d 35 2d 64 61 72 6b 2d 32 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 61 63 74 69 76 65 20 3e 20 2e 75 2d 61 63 74 69 76 65 2d 63 6f 6c 6f 72 2d 35 2d 64 61 72 6b 2d 32 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 2c 0a 6c 69 2e 61 63 74 69 76 65 20 3e 20 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 Data Ascii: -button-style.u-active-color-5-dark-2[class="u-border-"].active,a.u-button-style.u-button-style.active > .u-active-color-5-dark-2,a.u-button-style.u-button-style.active > .u-active-color-5-dark-2[class="u-border-"],li.active > a.u-button-style.u-butt
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 74 79 6c 65 2e 75 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 2d 35 2d 62 61 73 65 3a 68 6f 76 65 72 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 2d 35 2d 62 61 73 65 2e 68 6f 76 65 72 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 2d 35 2d 62 61 73 65 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 3a 68 6f 76 65 72 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 2d 35 2d 62 61 73 65 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 2e 68 6f 76 65 72 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 3a 68 6f 76 65 72 20 3e 20 2e 75 2d 68 6f 76 65 72 2d 63 6f 6c 6f 72 2d 35 2d 62 61 73 65 2c Data Ascii: tyle.u-hover-color-5-base:hover,a.u-button-style.u-hover-color-5-base.hover,a.u-button-style.u-hover-color-5-base[class="u-border-"]:hover,a.u-button-style.u-hover-color-5-base[class="u-border-"].hover,a.u-button-style:hover > .u-hover-color-5-base,
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 74 79 6c 65 2e 75 2d 70 61 6c 65 74 74 65 2d 31 2d 6c 69 67 68 74 2d 32 2c 0a 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 70 61 6c 65 74 74 65 2d 31 2d 6c 69 67 68 74 2d 32 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 31 31 31 31 31 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 61 64 63 63 65 39 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 70 61 6c 65 74 74 65 2d 31 2d 6c 69 67 68 74 2d 32 3a 68 6f 76 65 72 2c 0a 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 70 61 6c 65 74 74 65 2d 31 2d 6c 69 67 68 74 2d 32 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 3a 68 Data Ascii: tyle.u-palette-1-light-2,.u-button-style.u-palette-1-light-2[class="u-border-"] { color: #111111 !important; background-color: #adcce9 !important;}.u-button-style.u-palette-1-light-2:hover,.u-button-style.u-palette-1-light-2[class="u-border-"]:h
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 68 6f 76 65 72 2d 70 61 6c 65 74 74 65 2d 32 2d 64 61 72 6b 2d 31 3a 66 6f 63 75 73 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 68 6f 76 65 72 2d 70 61 6c 65 74 74 65 2d 32 2d 64 61 72 6b 2d 31 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 5d 3a 66 6f 63 75 73 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 61 63 74 69 76 65 2d 70 61 6c 65 74 74 65 2d 32 2d 64 61 72 6b 2d 31 3a 61 63 74 69 76 65 2c 0a 61 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 62 75 74 74 6f 6e 2d 73 74 79 6c 65 2e 75 2d 61 63 74 69 76 65 2d 70 61 6c 65 74 74 65 2d 32 2d 64 61 72 6b 2d 31 5b 63 6c 61 73 73 2a 3d 22 75 2d 62 6f 72 64 65 72 2d 22 Data Ascii: utton-style.u-hover-palette-2-dark-1:focus,a.u-button-style.u-hover-palette-2-dark-1[class="u-border-"]:focus,a.u-button-style.u-button-style.u-active-palette-2-dark-1:active,a.u-button-style.u-button-style.u-active-palette-2-dark-1[class="u-border-"

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:20:12 UTC	567	OUT	GET /index.css HTTP/1.1 Host: usersharepoint.nicepage.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://usersharepoint.nicepage.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:20:13 UTC	774	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1370 Server: nginx/1.19.2 Content-Type: text/css x-amz-id-2: 5kuw0OWCasht68CoMl3ykgcsl+6E8S7JzSZ34iV4BCrBtxL3C18EfSeHKdzx8MNfiCJqV+3AoEmeuHBPm/nQ2w== x-amz-request-id: KJRN5N8K0WP6CQJM Last-Modified: Wed, 16 Oct 2024 22:57:09 GMT x-amz-version-id: 5yxXi7QC.VqFEOuo6p1Eb.fkSFD3bhl6 ETag: "9a392f19d7a81b4768f27c7826a916c8" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: Content-Type Accept-Ranges: bytes Age: 120 Date: Wed, 26 Mar 2025 06:20:13 GMT Via: 1.1 varnish X-Served-By: cache-lga21929-LGA X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1742970013.079828,VS0,VE1 Vary: Accept-Encoding
2025-03-26 06:20:13 UTC	1370	IN	Data Raw: 20 2e 75 2d 73 65 63 74 69 6f 6e 2d 31 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 6e 6f 6e 65 3b 0a 7d 0a 0a 2e 75 2d 73 65 63 74 69 6f 6e 2d 31 20 2e 75 2d 73 68 65 65 74 2d 31 20 7b 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 31 31 70 78 3b 0a 7d 0a 0a 2e 75 2d 73 65 63 74 69 6f 6e 2d 31 20 2e 75 2d 67 72 6f 75 70 2d 31 20 7b 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 34 30 30 70 78 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 6e 6f 6e 65 3b 0a 20 20 68 65 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 77 69 64 74 68 3a 20 35 30 30 70 78 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 36 30 70 78 20 61 75 74 6f 3b 0a 7d 0a 0a 2e 75 2d 73 65 63 74 69 6f 6e 2d 31 20 2e 75 2d 63 6f 6e 74 61 69 6e 65 72 2d 6c 61 79 6f 75 Data Ascii: .u-section-1 { background-image: none;}.u-section-1 .u-sheet-1 { min-height: 611px;}.u-section-1 .u-group-1 { min-height: 400px; background-image: none; height: auto; width: 500px; margin: 60px auto;}.u-section-1 .u-container-layou

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:20:13 UTC	635	OUT	GET /d29e8cf1cf4d4fade598bc5c32341cd518073458/nicepage.css HTTP/1.1 Host: capp.nicepage.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Referer: https://usersharepoint.nicepage.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:20:13 UTC	666	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:20:13 GMT Content-Type: text/css Content-Length: 1494697 Connection: close x-amz-id-2: eyaInCv0lvqf5O6+yxoYV3/peZoS813eNUdfV47VXuMsj4JutKsKBF8tCm2rmlUN48lYBvDwohyP0Og5W3Cyngay2kjbPsCDCgNefIeChAg= x-amz-request-id: XP6V9WP6R0XPEYZX Cache-Control: max-age=2592000 Last-Modified: Tue, 15 Oct 2024 15:42:51 GMT x-amz-version-id: I0ZrTZKKNcojU8JNp2NBfzrUhQ5Hu0Ns ETag: "6ba971cd887dec0e9ffc8b1a2ee3e90b" X-77-NZT: EggBT3/OzgFBDAGckjviAbeCXAIA X-77-NZT-Ray: 8705ec346fe82fdb9d9ce3675208330c X-77-Cache: HIT X-77-Age: 154754 Vary: Accept-Encoding Server: CDN77-Turbo X-77-POP: newyorkUSNY Accept-Ranges: bytes
2025-03-26 06:20:13 UTC	15718	IN	Data Raw: 2f 2a 62 65 67 69 6e 2d 63 6f 6d 6d 6f 6e 73 74 79 6c 65 73 20 6c 69 62 72 61 72 79 2a 2f 2f 2a 21 0a 20 2a 20 66 72 6f 61 6c 61 5f 65 64 69 74 6f 72 20 76 34 2e 30 2e 36 20 28 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 72 6f 61 6c 61 2e 63 6f 6d 2f 77 79 73 69 77 79 67 2d 65 64 69 74 6f 72 29 0a 20 2a 20 4c 69 63 65 6e 73 65 20 68 74 74 70 73 3a 2f 2f 66 72 6f 61 6c 61 2e 63 6f 6d 2f 77 79 73 69 77 79 67 2d 65 64 69 74 6f 72 2f 74 65 72 6d 73 2f 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 34 2d 32 30 32 31 20 46 72 6f 61 6c 61 20 4c 61 62 73 0a 20 2a 2f 0a 0a 2e 66 72 2d 63 6c 65 61 72 66 69 78 3a 3a 61 66 74 65 72 20 7b 0a 20 20 63 6c 65 61 72 3a 20 62 6f 74 68 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 63 6f 6e 74 65 6e 74 3a Data Ascii: /begin-commonstyles library//! froala_editor v4.0.6 (https://www.froala.com/wysiwyg-editor) * License https://froala.com/wysiwyg-editor/terms/ * Copyright 2014-2021 Froala Labs */.fr-clearfix::after { clear: both; display: block; content:
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 2e 75 2d 65 66 66 65 63 74 2d 61 63 74 69 76 65 20 2e 75 2d 6f 76 65 72 2d 73 6c 69 64 65 20 7b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 30 2c 20 30 29 3b 0a 7d 0a 2e 75 2d 65 66 66 65 63 74 2d 6f 76 65 72 2d 62 6f 74 74 6f 6d 6c 65 66 74 20 2e 75 2d 6f 76 65 72 2d 73 6c 69 64 65 20 7b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 31 30 30 25 2c 20 31 30 30 25 29 3b 0a 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 35 30 30 6d 73 20 65 61 73 65 3b 0a 7d 0a 2e 75 2d 65 66 66 65 63 74 2d 6f 76 65 72 2d 62 6f 74 74 6f 6d 6c 65 66 74 3a 68 6f 76 65 72 20 2e 75 2d 6f 76 65 72 2d 73 6c 69 64 65 2c 0a 2e 75 2d 65 66 66 65 63 74 2d 6f 76 65 72 2d 62 6f 74 74 6f 6d 6c 65 66 74 2e 75 2d 65 66 66 65 Data Ascii: .u-effect-active .u-over-slide { transform: translate(0, 0);}.u-effect-over-bottomleft .u-over-slide { transform: translate(-100%, 100%); transition: all 500ms ease;}.u-effect-over-bottomleft:hover .u-over-slide,.u-effect-over-bottomleft.u-effe
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 72 6d 3a 20 69 6e 68 65 72 69 74 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 69 6e 68 65 72 69 74 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 69 6e 68 65 72 69 74 3b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 62 6f 72 64 65 72 3a 20 30 20 6e 6f 6e 65 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 20 30 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 2d 73 6b 69 70 3a 20 6f 62 6a 65 63 74 73 3b 0a 7d 0a 2e 75 2d 69 6d 61 67 65 2e 75 2d 6c 6f 67 6f 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 74 61 Data Ascii: rm: inherit; font-style: inherit; font-weight: inherit; text-decoration: none; border: 0 none transparent; outline-width: 0; background-color: transparent; margin: 0; -webkit-text-decoration-skip: objects;}.u-image.u-logo { display: ta
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 32 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 2e 75 2d 66 6f 72 6d 2d 76 65 72 74 69 63 61 6c 2e 75 2d 66 6f 72 6d 2d 73 70 61 63 69 6e 67 2d 33 32 20 2e 75 2d 66 6f 72 6d 2d 67 72 6f 75 70 2e 75 2d 66 6f 72 6d 2d 6c 69 6e 65 2c 0a 2e 75 2d 66 6f 72 6d 2d 76 65 72 74 69 63 61 6c 2e 75 2d 66 6f 72 6d 2d 73 70 61 63 69 6e 67 2d 33 32 20 2e 75 2d 66 6f 72 6d 2d 73 74 65 70 20 2e 75 2d 66 6f 72 6d 2d 67 72 6f 75 70 2e 75 2d 66 6f 72 6d 2d 6c 69 6e 65 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 32 70 78 3b 0a 7d 0a 2e 75 2d 66 6f 72 6d 2d 76 65 72 74 69 63 61 6c 2e 75 2d 66 6f 72 6d 2d 73 70 61 63 69 6e 67 2d 33 31 2c 0a 2e 75 2d 66 6f 72 6d 2d 76 65 72 74 69 63 61 6c 2e 75 2d 66 6f 72 6d 2d 73 70 Data Ascii: margin-left: 32px !important;}.u-form-vertical.u-form-spacing-32 .u-form-group.u-form-line,.u-form-vertical.u-form-spacing-32 .u-form-step .u-form-group.u-form-line { margin-left: 32px;}.u-form-vertical.u-form-spacing-31,.u-form-vertical.u-form-sp
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 67 2d 31 32 20 2e 75 2d 66 6f 72 6d 2d 73 74 65 70 20 2e 75 2d 66 6f 72 6d 2d 67 72 6f 75 70 2e 75 2d 66 6f 72 6d 2d 6c 69 6e 65 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 32 70 78 3b 0a 7d 0a 2e 75 2d 66 6f 72 6d 2d 76 65 72 74 69 63 61 6c 2e 75 2d 66 6f 72 6d 2d 73 70 61 63 69 6e 67 2d 31 31 2c 0a 2e 75 2d 66 6f 72 6d 2d 76 65 72 74 69 63 61 6c 2e 75 2d 66 6f 72 6d 2d 73 70 61 63 69 6e 67 2d 31 31 20 2e 75 2d 66 6f 72 6d 2d 73 74 65 70 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 31 31 70 78 3b 0a 20 20 77 69 64 74 68 3a 20 63 61 6c 63 28 31 30 30 25 20 2b 20 20 31 31 70 78 29 3b 0a 7d 0a 2e 75 2d 66 6f 72 6d 2d 76 65 72 74 69 63 61 6c 2e 75 2d 66 6f 72 6d 2d 73 70 61 63 69 6e 67 2d 31 31 20 2e 75 2d 66 6f 72 6d 2d 67 72 6f 75 Data Ascii: g-12 .u-form-step .u-form-group.u-form-line { margin-left: 12px;}.u-form-vertical.u-form-spacing-11,.u-form-vertical.u-form-spacing-11 .u-form-step { margin-left: -11px; width: calc(100% + 11px);}.u-form-vertical.u-form-spacing-11 .u-form-grou
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 20 2e 75 2d 66 6f 72 6d 2d 67 72 6f 75 70 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 34 70 78 3b 0a 7d 0a 2e 75 2d 66 6f 72 6d 2d 68 6f 72 69 7a 6f 6e 74 61 6c 2e 75 2d 66 6f 72 6d 2d 73 70 61 63 69 6e 67 2d 33 20 2e 75 2d 66 6f 72 6d 2d 67 72 6f 75 70 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 33 70 78 3b 0a 7d 0a 2e 75 2d 66 6f 72 6d 2d 68 6f 72 69 7a 6f 6e 74 61 6c 2e 75 2d 66 6f 72 6d 2d 73 70 61 63 69 6e 67 2d 32 20 2e 75 2d 66 6f 72 6d 2d 67 72 6f 75 70 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 32 70 78 3b 0a 7d 0a 2e 75 2d 66 6f 72 6d 2d 68 6f 72 69 7a 6f 6e 74 61 6c 2e 75 2d 66 6f 72 6d 2d 73 70 61 63 69 6e 67 2d 31 20 2e 75 2d 66 6f 72 6d 2d 67 72 6f 75 70 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 Data Ascii: .u-form-group { margin-right: 4px;}.u-form-horizontal.u-form-spacing-3 .u-form-group { margin-right: 3px;}.u-form-horizontal.u-form-spacing-2 .u-form-group { margin-right: 2px;}.u-form-horizontal.u-form-spacing-1 .u-form-group { margin-righ
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 68 6f 76 65 72 2c 0a 2e 75 2d 74 65 78 74 6c 69 6e 6b 3a 66 6f 63 75 73 2c 0a 2e 75 2d 74 65 78 74 6c 69 6e 6b 3a 61 63 74 69 76 65 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 69 6e 68 65 72 69 74 3b 0a 7d 0a 2e 75 2d 73 70 61 63 69 6e 67 2d 31 30 30 2e 75 2d 6c 61 6e 67 75 61 67 65 2d 6c 61 79 6f 75 74 2d 64 72 6f 70 64 6f 77 6e 20 2e 75 2d 6c 61 6e 67 75 61 67 65 2d 75 72 6c 20 2b 20 2e 75 2d 6c 61 6e 67 75 61 67 65 2d 75 72 6c 2c 0a 2e 75 2d 66 6f 72 6d 2d 63 68 65 63 6b 73 2d 73 70 61 63 69 6e 67 2d 31 30 30 20 2e 75 2d 66 6f 72 6d 2d 63 68 65 63 6b 62 6f 78 2d 67 72 6f 75 70 20 2e 75 2d 69 6e 70 75 74 2d 72 6f 77 2c 0a 2e 75 2d 66 6f 72 6d 2d 72 61 64 69 6f 73 2d 73 70 61 63 69 6e 67 2d 31 30 30 20 2e 75 2d 66 6f 72 6d 2d 72 61 64 69 6f 62 75 74 74 6f 6e 20 Data Ascii: hover,.u-textlink:focus,.u-textlink:active { color: inherit;}.u-spacing-100.u-language-layout-dropdown .u-language-url + .u-language-url,.u-form-checks-spacing-100 .u-form-checkbox-group .u-input-row,.u-form-radios-spacing-100 .u-form-radiobutton
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 72 69 7a 6f 6e 74 61 6c 20 2e 75 2d 69 6e 70 75 74 2d 72 6f 77 2c 0a 2e 75 2d 66 6f 72 6d 2d 72 61 64 69 6f 73 2d 73 70 61 63 69 6e 67 2d 38 38 20 2e 75 2d 66 6f 72 6d 2d 72 61 64 69 6f 62 75 74 74 6f 6e 2e 75 2d 66 6f 72 6d 2d 69 6e 70 75 74 2d 6c 61 79 6f 75 74 2d 68 6f 72 69 7a 6f 6e 74 61 6c 20 2e 75 2d 69 6e 70 75 74 2d 72 6f 77 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 38 38 70 78 3b 0a 7d 0a 62 6c 6f 63 6b 71 75 6f 74 65 2e 75 2d 74 65 78 74 2e 75 2d 69 6e 64 65 6e 74 2d 38 38 20 7b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 38 38 70 78 3b 0a 7d 0a 2e 75 2d 74 65 78 74 2e 75 2d 69 6e 64 65 6e 74 2d 38 38 2c 0a 2e 75 2d 74 65 78 74 2e 75 2d 69 6e 64 65 6e 74 2d 38 38 20 75 6c 2c 0a 2e 75 2d 74 65 78 74 2e 75 2d 69 6e 64 65 6e Data Ascii: rizontal .u-input-row,.u-form-radios-spacing-88 .u-form-radiobutton.u-form-input-layout-horizontal .u-input-row { margin-right: 88px;}blockquote.u-text.u-indent-88 { padding-left: 88px;}.u-text.u-indent-88,.u-text.u-indent-88 ul,.u-text.u-inden
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 74 64 6f 77 6e 2d 77 72 61 70 70 65 72 20 3e 20 64 69 76 3a 6e 6f 74 28 2e 75 2d 68 69 64 64 65 6e 29 20 2b 20 64 69 76 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 37 2e 35 70 78 3b 0a 7d 0a 2e 75 2d 66 6f 72 6d 2d 76 65 72 74 69 63 61 6c 20 2e 75 2d 6c 61 62 65 6c 2d 6c 65 66 74 20 2e 75 2d 73 70 61 63 69 6e 67 2d 37 35 2e 75 2d 66 69 65 6c 64 2d 6c 61 62 65 6c 2c 0a 2e 75 2d 66 6f 72 6d 2d 76 65 72 74 69 63 61 6c 20 2e 75 2d 6c 61 62 65 6c 2d 6c 65 66 74 20 2e 75 2d 73 70 61 63 69 6e 67 2d 37 35 2e 75 2d 6c 61 62 65 6c 2c 0a 2e 75 2d 72 61 74 69 6e 67 2d 69 63 6f 6e 73 2e 75 2d 73 70 61 63 69 6e 67 2d 37 35 20 3e 20 2e 75 2d 66 6f 72 6d 2d 72 61 74 69 6e 67 2d 69 74 65 6d 2c 0a 2e 75 2d 66 6f 72 6d 2d 63 68 65 63 6b 73 2d 73 70 61 63 69 6e Data Ascii: tdown-wrapper > div:not(.u-hidden) + div { margin-left: 37.5px;}.u-form-vertical .u-label-left .u-spacing-75.u-field-label,.u-form-vertical .u-label-left .u-spacing-75.u-label,.u-rating-icons.u-spacing-75 > .u-form-rating-item,.u-form-checks-spacin
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 2e 75 2d 73 70 61 63 69 6e 67 2d 36 32 20 6c 69 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 36 32 70 78 3b 0a 7d 0a 2e 75 2d 73 70 61 63 69 6e 67 2d 36 32 2e 75 2d 63 6f 75 6e 74 64 6f 77 6e 2d 63 6f 75 6e 74 65 72 20 3e 20 64 69 76 20 2b 20 64 69 76 2c 0a 2e 75 2d 73 70 61 63 69 6e 67 2d 36 32 2e 75 2d 70 72 69 63 65 2d 77 72 61 70 70 65 72 20 3e 20 64 69 76 20 2b 20 64 69 76 2c 0a 2e 75 2d 73 70 61 63 69 6e 67 2d 36 32 2e 75 2d 6c 61 6e 67 75 61 67 65 2d 6c 61 79 6f 75 74 2d 69 63 6f 6e 73 20 2e 75 2d 6c 61 6e 67 75 61 67 65 2d 75 72 6c 20 2b 20 2e 75 2d 6c 61 6e 67 75 61 67 65 2d 75 72 6c 2c 0a 2e 75 2d 73 70 61 63 69 6e 67 2d 36 32 20 2e 75 2d 73 6f 63 69 61 6c 2d 75 72 6c 20 2b 20 2e 75 2d 73 6f 63 69 61 6c 2d 75 72 6c 20 7b 0a 20 20 Data Ascii: .u-spacing-62 li { margin-bottom: 62px;}.u-spacing-62.u-countdown-counter > div + div,.u-spacing-62.u-price-wrapper > div + div,.u-spacing-62.u-language-layout-icons .u-language-url + .u-language-url,.u-spacing-62 .u-social-url + .u-social-url {

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:20:13 UTC	679	OUT	GET /eeff2eae/6366116/images/SharePoint-Symbol.webp HTTP/1.1 Host: assets.nicepagecdn.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://usersharepoint.nicepage.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:20:13 UTC	611	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:20:13 GMT Content-Type: image/webp Content-Length: 40078 Connection: close x-amz-id-2: 2RQH0w4xwq+9BweoQkItqRrtnyzqoFu1PR8icjtgDLvE5szbpU6U2+1bivupn/iNTd8uHsbzqvE= x-amz-request-id: 31E8N5CKM5J50ZN1 Cache-Control: max-age=2592000 Last-Modified: Wed, 16 Oct 2024 22:51:32 GMT x-amz-version-id: 2uHxICa_fqjwFyYTZzOTr5KSBAw4adJS ETag: "768f79bffb5746f2b284e1dea9b72d37" X-77-NZT: EggBT3/O6QFBDAFZu7EMAbeIXQIA X-77-NZT-Ray: f03d06135cf22b919d9ce367b68aa61a X-77-Cache: HIT X-77-Age: 155016 Server: CDN77-Turbo X-77-POP: newyorkUSNY Accept-Ranges: bytes
2025-03-26 06:20:13 UTC	15773	IN	Data Raw: 52 49 46 46 86 9c 00 00 57 45 42 50 56 50 38 58 0a 00 00 00 18 00 00 00 3f 06 00 83 03 00 41 4c 50 48 82 4e 00 00 01 ff 27 24 48 f0 ff 78 6b 44 a4 ee 39 8a db b6 71 c2 fd d7 be de ef 17 11 13 10 1e 78 24 87 8a f5 33 de 1a 29 93 52 a0 38 17 e3 97 19 24 50 20 27 d9 ac b1 c8 13 01 fd 9a 1a 3b 31 32 a4 7c 5a 7f d8 b6 3d b3 d2 fc df 79 5d f7 d0 41 51 8a 62 47 c1 06 f6 de 03 12 12 5b 8c 35 51 ec be d6 d8 7b 17 d1 a8 69 f6 12 35 c6 92 58 13 4b 8c bd c5 d8 bb 22 2a a8 28 16 8a 8a d2 05 d6 9a fb ba ce 3f d6 62 9e 67 9e 67 9e 59 ac e5 64 7b 23 fa 3f 01 74 a4 6d 6f 6b 37 08 1c 54 6a 55 65 a9 55 ad 5e e4 d0 70 b6 7b 57 5e 59 4e e7 ae c1 e4 98 63 f2 78 6e 50 3a 61 05 ae bc 05 92 30 ff d2 37 41 1c c0 e1 8d e8 ff 04 e0 ff fd 8f ff f1 3f fe c7 ff f8 1f ff e3 7f fc 8f ff Data Ascii: RIFFWEBPVP8X?ALPHN'$HxkD9qx$3)R8$P ';12\|Z=y]AQbG[5Q{i5XK"*(?bggYd{#?tmok7TjUeU^p{W^YNcxnP:a07A?
2025-03-26 06:20:13 UTC	16384	IN	Data Raw: 5a a1 b6 75 99 44 4f 44 b7 b2 91 f4 6f 9f ff c3 de eb f7 15 a4 1c 96 5d ff 88 bf 7f d0 44 7a 74 a6 6a fc 74 39 68 4e e2 c8 02 41 09 07 d0 d2 a0 39 1f d9 32 00 a2 2a 15 88 06 15 08 96 39 7e 3c dd 58 d1 ae f8 49 7d 00 c5 7a 33 68 e9 44 e7 c2 7f 6c df 03 80 a8 4a 22 51 55 01 80 fe 7b fe 73 3a 69 91 15 d6 45 50 0c f8 88 31 0d 32 3a 67 dd b0 0e 00 a8 4a 0a a2 0a 08 56 39 73 22 3d 7a 32 37 8e 81 a2 6d 05 c1 1d 8c 89 18 79 57 7f 88 4a 65 aa 82 70 c9 a5 90 76 0f e7 81 50 d4 b2 ae 5f a6 d1 d2 2d 3a 49 da c7 4f fd f5 9c 83 46 0c 5d ba 4b 29 08 44 4b 9d ba 0f 18 32 e2 a0 73 6e 7e f6 f3 48 d2 a3 33 65 e7 fc 2d a0 c8 49 d3 b0 22 11 74 7d 99 96 06 dd d8 f4 c0 2f ba 20 c5 4e 9b 5f f1 39 dd 9c 15 1a 6f 55 6c 5b 27 40 b1 5f a4 a7 41 7a 74 da 1b e7 6c 10 90 fe 8a 47 dd 35 Data Ascii: ZuDODo]Dztjt9hNA92*9~<XI}z3hDlJ"QU{s:iEP12:gJV9s"=z27myWJepvP_-:IOF]K)DK2sn~H3e-I"t}/ N_9oUl['@_AztlG5
2025-03-26 06:20:13 UTC	7921	IN	Data Raw: c1 82 27 85 05 56 2f 93 9e d1 6f d9 63 e7 8f ae cc 14 c4 c2 3a 22 55 aa 19 cd 70 e6 df 45 c5 28 3a 83 10 bc 6b c9 48 02 b1 2b 0f 9e 7a e4 af eb e7 1a 6b 58 33 8c 20 99 06 18 16 1d 75 2c 08 28 01 c6 c5 ef d9 ae eb 3e f5 e7 6e eb b5 37 03 ff 5d b4 ae 6b 06 fa d0 c4 8e ba e5 85 af 74 67 36 74 63 44 b2 60 c3 a8 b0 ba d2 91 04 a6 ee f5 9e 60 4f 4b 81 90 96 20 b4 58 d0 8b 3c ba 28 da cc c7 03 a5 cd 17 88 da 17 28 ab 90 e9 6c 42 41 42 53 3a c7 36 fb 0c 1c ac ab a7 c4 03 a5 91 56 2f 74 c0 39 56 b7 8f e4 c8 96 00 00 99 51 ce 56 cc e7 7c d0 0d 9c f7 42 f5 9e 22 8c 4d 78 1d 64 5c 4a 1a 0d 0f 13 e4 44 25 99 2a cb 91 20 58 ce a0 99 eb da 35 40 98 64 5c ba 96 d9 3d e8 e9 c6 0c 4c ff aa 74 be 06 73 d7 2f 16 d8 b5 51 15 20 be 99 15 f1 5f c3 05 45 11 10 0c 3d b7 c7 bf 85 Data Ascii: 'V/oc:"UpE(:kH+zkX3 u,(>n7]ktg6tcD``OK X<((lBABS:6V/t9VQV\|B"Mxd\JD%* X5@d\=Lts/Q _E=

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Filled-Summons Notice (2).docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\~$lled-Summons Notice (2).docx

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Windows Analysis Report
Filled-Summons Notice (2).docx

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:20:13 UTC	594	OUT	GET /assets/jquery-3.5.1.min.js HTTP/1.1 Host: capp.nicepage.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://usersharepoint.nicepage.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:20:13 UTC	657	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:20:13 GMT Content-Type: application/javascript Content-Length: 89476 Connection: close x-amz-id-2: suu01hQRZ1AhtN5sFHyVEmyd1NSrDnhIMRiOHgx/LNnEDNcF5BqK3YN9DgoKcgrTOWMm14lo8PHqEJyP6ewPFA== x-amz-request-id: AEQB9QNN1523C7ZS Cache-Control: max-age=2592000 Last-Modified: Thu, 07 Dec 2023 15:48:10 GMT x-amz-version-id: BHUtVzyv1kQsOdZbxNDIMwhzK9g4em4e ETag: "dc5e7f18c8d36ac1d3d4753a87c98d0a" X-77-NZT: EggBT3/OzgFBDAFZu7EYAbdsYAAA X-77-NZT-Ray: 8705ec34fee009e99d9ce36730101136 X-77-Cache: HIT X-77-Age: 24684 Vary: Accept-Encoding Server: CDN77-Turbo X-77-POP: newyorkUSNY Accept-Ranges: bytes
2025-03-26 06:20:13 UTC	15727	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 35 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2025-03-26 06:20:14 UTC	16384	IN	Data Raw: 22 6e 74 68 22 21 3d 3d 68 2e 73 6c 69 63 65 28 30 2c 33 29 2c 6d 3d 22 6c 61 73 74 22 21 3d 3d 68 2e 73 6c 69 63 65 28 2d 34 29 2c 78 3d 22 6f 66 2d 74 79 70 65 22 3d 3d 3d 65 3b 72 65 74 75 72 6e 20 31 3d 3d 3d 67 26 26 30 3d 3d 3d 76 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 21 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 3d 79 21 3d 3d 6d 3f 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 3a 22 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 22 2c 63 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 66 3d 78 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 70 3d 21 6e 26 26 21 78 2c 64 3d 21 31 3b 69 66 28 63 29 7b 69 66 28 79 Data Ascii: "nth"!==h.slice(0,3),m="last"!==h.slice(-4),x="of-type"===e;return 1===g&&0===v?function(e){return!!e.parentNode}:function(e,t,n){var r,i,o,a,s,u,l=y!==m?"nextSibling":"previousSibling",c=e.parentNode,f=x&&e.nodeName.toLowerCase(),p=!n&&!x,d=!1;if(c){if(y
2025-03-26 06:20:14 UTC	16384	IN	Data Raw: 53 5d 29 7d 7d 29 2c 53 2e 72 65 61 64 79 2e 74 68 65 6e 3d 46 2e 74 68 65 6e 2c 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 45 2e 72 65 61 64 79 53 74 61 74 65 7c 7c 22 6c 6f 61 64 69 6e 67 22 21 3d 3d 45 2e 72 65 61 64 79 53 74 61 74 65 26 26 21 45 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 64 6f 53 63 72 6f 6c 6c 3f 43 2e 73 65 74 54 69 6d 65 6f 75 74 28 53 2e 72 65 61 64 79 29 3a 28 45 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 42 29 2c 43 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 42 29 29 3b 76 61 72 20 24 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 30 2c 75 3d 65 2e 6c 65 6e 67 74 68 2c 6c 3d 6e 75 Data Ascii: S])}}),S.ready.then=F.then,"complete"===E.readyState\|\|"loading"!==E.readyState&&!E.documentElement.doScroll?C.setTimeout(S.ready):(E.addEventListener("DOMContentLoaded",B),C.addEventListener("load",B));var $=function(e,t,n,r,i,o,a){var s=0,u=e.length,l=nu
2025-03-26 06:20:14 UTC	16384	IN	Data Raw: 26 22 6d 6f 64 75 6c 65 22 21 3d 3d 28 75 2e 74 79 70 65 7c 7c 22 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3f 53 2e 5f 65 76 61 6c 55 72 6c 26 26 21 75 2e 6e 6f 4d 6f 64 75 6c 65 26 26 53 2e 5f 65 76 61 6c 55 72 6c 28 75 2e 73 72 63 2c 7b 6e 6f 6e 63 65 3a 75 2e 6e 6f 6e 63 65 7c 7c 75 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 29 7d 2c 6c 29 3a 62 28 75 2e 74 65 78 74 43 6f 6e 74 65 6e 74 2e 72 65 70 6c 61 63 65 28 6a 65 2c 22 22 29 2c 75 2c 6c 29 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 52 65 28 65 2c 74 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 2c 69 3d 74 3f 53 2e 66 69 6c 74 65 72 28 74 2c 65 29 3a 65 2c 6f 3d 30 3b 6e 75 6c 6c 21 3d 28 72 3d 69 5b 6f 5d 29 3b 6f 2b 2b 29 6e 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 Data Ascii: &"module"!==(u.type\|\|"").toLowerCase()?S._evalUrl&&!u.noModule&&S._evalUrl(u.src,{nonce:u.nonce\|\|u.getAttribute("nonce")},l):b(u.textContent.replace(je,""),u,l))}return n}function Re(e,t,n){for(var r,i=t?S.filter(t,e):e,o=0;null!=(r=i[o]);o++)n\|\|1!==r.nod
2025-03-26 06:20:14 UTC	16384	IN	Data Raw: 69 6f 6e 28 29 7b 6e 74 3d 6e 75 6c 6c 7d 2c 53 2e 66 78 2e 73 70 65 65 64 73 3d 7b 73 6c 6f 77 3a 36 30 30 2c 66 61 73 74 3a 32 30 30 2c 5f 64 65 66 61 75 6c 74 3a 34 30 30 7d 2c 53 2e 66 6e 2e 64 65 6c 61 79 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 65 29 7b 72 65 74 75 72 6e 20 72 3d 53 2e 66 78 26 26 53 2e 66 78 2e 73 70 65 65 64 73 5b 72 5d 7c 7c 72 2c 65 3d 65 7c 7c 22 66 78 22 2c 74 68 69 73 2e 71 75 65 75 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 43 2e 73 65 74 54 69 6d 65 6f 75 74 28 65 2c 72 29 3b 74 2e 73 74 6f 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 43 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 6e 29 7d 7d 29 7d 2c 72 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 2c 69 74 3d 45 2e 63 72 65 Data Ascii: ion(){nt=null},S.fx.speeds={slow:600,fast:200,_default:400},S.fn.delay=function(r,e){return r=S.fx&&S.fx.speeds[r]\|\|r,e=e\|\|"fx",this.queue(e,function(e,t){var n=C.setTimeout(e,r);t.stop=function(){C.clearTimeout(n)}})},rt=E.createElement("input"),it=E.cre
2025-03-26 06:20:14 UTC	8213	IN	Data Raw: 28 74 68 69 73 2c 65 29 3a 74 29 7d 29 7d 2c 75 6e 77 72 61 70 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 28 65 29 2e 6e 6f 74 28 22 62 6f 64 79 22 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 53 28 74 68 69 73 29 2e 72 65 70 6c 61 63 65 57 69 74 68 28 74 68 69 73 2e 63 68 69 6c 64 4e 6f 64 65 73 29 7d 29 2c 74 68 69 73 7d 7d 29 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 68 69 64 64 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 28 65 29 7d 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 21 28 65 2e 6f 66 66 73 65 74 57 69 64 74 Data Ascii: (this,e):t)})},unwrap:function(e){return this.parent(e).not("body").each(function(){S(this).replaceWith(this.childNodes)}),this}}),S.expr.pseudos.hidden=function(e){return!S.expr.pseudos.visible(e)},S.expr.pseudos.visible=function(e){return!!(e.offsetWidt

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:20:14 UTC	669	OUT	GET /eeff2eae/6366116/images/11513839.png HTTP/1.1 Host: assets.nicepagecdn.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://usersharepoint.nicepage.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:20:14 UTC	642	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:20:14 GMT Content-Type: image/png Content-Length: 37600 Connection: close x-amz-id-2: wM7T9ydt3znycvL7RI1e1bPYJwIWzFb5HFn6DxBaDr4v04afm3z/WOxr+momE66uICer+HFn7a4NlNPv+OwgEOhXuD8R9hMpmQamU47Ji6g= x-amz-request-id: 0866H75XMW13C6Z9 Cache-Control: max-age=2592000 Last-Modified: Wed, 16 Oct 2024 22:45:10 GMT x-amz-version-id: XIyfTYUcBqHZT0veRFdcBIlj6tq9bxUO ETag: "67b3ea37be92d87c8c32f6eba672f654" X-77-NZT: EggBT3/O6QFBDAGckjvoAbeJXQIA X-77-NZT-Ray: f03d06138ae564a69e9ce367fef00e1f X-77-Cache: HIT X-77-Age: 155017 Server: CDN77-Turbo X-77-POP: newyorkUSNY Accept-Ranges: bytes
2025-03-26 06:20:14 UTC	15742	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 00 00 00 04 00 08 06 00 00 00 7f 1d 2b 83 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 20 00 49 44 41 54 78 9c ec dd 0f bc e4 67 5d 1f fa 93 20 04 9a 00 fe 85 0b 24 e7 37 73 76 c3 9f 08 de 5e 82 82 94 56 7b 6b af 01 8a 2d 20 08 2d d2 6b 2f 2f bc f6 a2 58 ab 2f 7a 2f 4a d4 ea ad 56 78 69 69 6f 5b b5 ad 8a 14 30 b5 90 40 48 76 cf d9 99 59 04 b1 d2 04 28 a0 86 a0 a0 12 a2 fc 49 20 7f 76 64 e7 37 c9 dc 39 cb 26 66 97 dd 9c 73 7e 73 e6 37 df ef f3 7b 3f af d7 bc 16 b2 7b de 7c ce 7c e6 79 78 9e 27 7b 66 d6 be ed db be f5 41 f3 c7 03 e7 8f b5 26 63 fb eb 4e 7e fd 83 ee f3 e0 f1 78 3c 1e 8f c7 e3 f1 78 3c 1e 8f 17 c9 4b 15 96 c7 e3 f1 78 3c 1e 8f c7 e3 f1 78 3c 5e 33 2f 55 58 1e 8f Data Ascii: PNGIHDR+pHYs IDATxg] $7sv^V{k- -k//X/z/JVxiio[0@HvY(I vd79&fs~s7{?{\|\|yx'{fA&cN~x<x<Kx<x<^3/UX
2025-03-26 06:20:14 UTC	16384	IN	Data Raw: 37 fb 3b 79 f7 77 01 50 42 bf 3c de e9 5e 49 f3 b7 89 17 ad 0f 1e 8f c7 eb 9a 97 2a 2c 8f c7 e3 95 e6 ed fa 02 20 e9 66 7f 27 ef 6c 17 00 a5 f4 cb e3 9d ee 95 34 7f 9b 78 d1 fa e0 f1 78 bc 2e 79 a9 c2 f2 78 3c 5e 89 de ae 2e 00 12 6f f6 77 fa da 33 5d 00 94 d4 2f 8f 77 ba 57 d2 fc 6d e2 45 eb 83 c7 e3 f1 ba e2 a5 0a cb e3 f1 78 a5 7a 3b 5e 00 24 df ec ef f5 02 60 d5 7d f0 78 cb f6 4a 9a bf 4d bc 68 7d f0 78 3c 5e 57 bc 54 61 79 3c 1e af 54 ef 7e 2f 00 0a d8 ec ef e5 02 20 42 1f 3c de b2 bd 92 e6 6f 13 2f 5a 1f 3c 1e 8f d7 15 2f 55 58 1e 8f c7 2b d5 3b eb 05 40 21 9b fd dd 5e 00 44 e9 83 c7 5b b6 57 d2 fc 6d e2 45 eb 83 c7 e3 f1 ba e2 a5 0a cb e3 f1 78 a5 7a 67 bc 00 28 68 b3 bf 9b 0b 80 48 7d f0 78 cb f6 4a 9a bf 4d bc 68 7d f0 78 3c 5e 57 bc 54 61 79 3c Data Ascii: 7;ywPB<^I*, f'l4xx.yx<^.ow3]/wWmExz;^$`}xJMh}x<^WTay<T~/ B<o/Z</UX+;@!^D[WmExzg(hH}xJMh}x<^WTay<
2025-03-26 06:20:14 UTC	5474	IN	Data Raw: f0 9a ae df f9 ee c7 72 8f a7 d5 7d 37 15 d5 fc 9b d1 d7 af fe 1f 50 9f 5c de a1 36 cf 1f af 3d 4f ff f4 4f ff f4 6f ac 9e fe e9 9f fe e9 5f 26 2f d5 b0 19 bc 37 be e3 a6 57 6c 55 c7 de 3f 2d 77 9f e8 3b 36 cf e1 3d b6 55 ed fc 9b 57 1d fe 9d 57 f6 b5 7e 51 62 d3 97 d7 74 fd 56 dd 8f e9 db 4f 1c a8 ff fb ff 75 fd f1 58 b8 f5 2b f7 9e a8 ff f3 a3 cb bf cc a6 ed f3 c7 6b d7 d3 3f fd d3 3f fd 1b ab a7 7f fa a7 7f fa 97 c1 4b 35 6c 36 ef 92 ed 2f bf 75 f9 2d 56 81 e2 75 fb fe 43 bf ff c6 be d7 af f7 d8 f4 ec 35 5d bf a6 fb 31 3d 74 f2 0d f5 1c bf 1b 65 fd 8a 72 fe 40 b1 7d ea bc 5f 3a 5b 0f c6 e6 e9 df 73 3f 7d df b7 be bd a6 eb d7 74 3f f4 8f d7 85 a7 7f cf fd f4 7d df fa f6 9a ae 5f d3 fd d0 3f 5e ba 61 b3 7a 2f db 3e b9 59 54 8b 0f d6 87 ff 3b 7d c5 ab fe Data Ascii: r}7P\6=OOo_&/7WlU?-w;6=UWW~QbtVOuX+k??K5l6/u-VuC5]1=ter@}_:[s?}t?}_?^az/>YT;}

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:20:15 UTC	422	OUT	GET /eeff2eae/6366116/images/11513839.png HTTP/1.1 Host: assets.nicepagecdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 06:20:15 UTC	642	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 06:20:15 GMT Content-Type: image/png Content-Length: 37600 Connection: close x-amz-id-2: wM7T9ydt3znycvL7RI1e1bPYJwIWzFb5HFn6DxBaDr4v04afm3z/WOxr+momE66uICer+HFn7a4NlNPv+OwgEOhXuD8R9hMpmQamU47Ji6g= x-amz-request-id: 0866H75XMW13C6Z9 Cache-Control: max-age=2592000 Last-Modified: Wed, 16 Oct 2024 22:45:10 GMT x-amz-version-id: XIyfTYUcBqHZT0veRFdcBIlj6tq9bxUO ETag: "67b3ea37be92d87c8c32f6eba672f654" X-77-NZT: EggBT3/OzgFBDAGckjvoAbeKXQIA X-77-NZT-Ray: 8705ec3404f061009f9ce3670e1d9a0e X-77-Cache: HIT X-77-Age: 155018 Server: CDN77-Turbo X-77-POP: newyorkUSNY Accept-Ranges: bytes
2025-03-26 06:20:15 UTC	15742	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 00 00 00 04 00 08 06 00 00 00 7f 1d 2b 83 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 20 00 49 44 41 54 78 9c ec dd 0f bc e4 67 5d 1f fa 93 20 04 9a 00 fe 85 0b 24 e7 37 73 76 c3 9f 08 de 5e 82 82 94 56 7b 6b af 01 8a 2d 20 08 2d d2 6b 2f 2f bc f6 a2 58 ab 2f 7a 2f 4a d4 ea ad 56 78 69 69 6f 5b b5 ad 8a 14 30 b5 90 40 48 76 cf d9 99 59 04 b1 d2 04 28 a0 86 a0 a0 12 a2 fc 49 20 7f 76 64 e7 37 c9 dc 39 cb 26 66 97 dd 9c 73 7e 73 e6 37 df ef f3 7b 3f af d7 bc 16 b2 7b de 7c ce 7c e6 79 78 9e 27 7b 66 d6 be ed db be f5 41 f3 c7 03 e7 8f b5 26 63 fb eb 4e 7e fd 83 ee f3 e0 f1 78 3c 1e 8f c7 e3 f1 78 3c 1e 8f 17 c9 4b 15 96 c7 e3 f1 78 3c 1e 8f c7 e3 f1 78 3c 5e 33 2f 55 58 1e 8f Data Ascii: PNGIHDR+pHYs IDATxg] $7sv^V{k- -k//X/z/JVxiio[0@HvY(I vd79&fs~s7{?{\|\|yx'{fA&cN~x<x<Kx<x<^3/UX
2025-03-26 06:20:15 UTC	16384	IN	Data Raw: 37 fb 3b 79 f7 77 01 50 42 bf 3c de e9 5e 49 f3 b7 89 17 ad 0f 1e 8f c7 eb 9a 97 2a 2c 8f c7 e3 95 e6 ed fa 02 20 e9 66 7f 27 ef 6c 17 00 a5 f4 cb e3 9d ee 95 34 7f 9b 78 d1 fa e0 f1 78 bc 2e 79 a9 c2 f2 78 3c 5e 89 de ae 2e 00 12 6f f6 77 fa da 33 5d 00 94 d4 2f 8f 77 ba 57 d2 fc 6d e2 45 eb 83 c7 e3 f1 ba e2 a5 0a cb e3 f1 78 a5 7a 3b 5e 00 24 df ec ef f5 02 60 d5 7d f0 78 cb f6 4a 9a bf 4d bc 68 7d f0 78 3c 5e 57 bc 54 61 79 3c 1e af 54 ef 7e 2f 00 0a d8 ec ef e5 02 20 42 1f 3c de b2 bd 92 e6 6f 13 2f 5a 1f 3c 1e 8f d7 15 2f 55 58 1e 8f c7 2b d5 3b eb 05 40 21 9b fd dd 5e 00 44 e9 83 c7 5b b6 57 d2 fc 6d e2 45 eb 83 c7 e3 f1 ba e2 a5 0a cb e3 f1 78 a5 7a 67 bc 00 28 68 b3 bf 9b 0b 80 48 7d f0 78 cb f6 4a 9a bf 4d bc 68 7d f0 78 3c 5e 57 bc 54 61 79 3c Data Ascii: 7;ywPB<^I*, f'l4xx.yx<^.ow3]/wWmExz;^$`}xJMh}x<^WTay<T~/ B<o/Z</UX+;@!^D[WmExzg(hH}xJMh}x<^WTay<
2025-03-26 06:20:15 UTC	5474	IN	Data Raw: f0 9a ae df f9 ee c7 72 8f a7 d5 7d 37 15 d5 fc 9b d1 d7 af fe 1f 50 9f 5c de a1 36 cf 1f af 3d 4f ff f4 4f ff f4 6f ac 9e fe e9 9f fe e9 5f 26 2f d5 b0 19 bc 37 be e3 a6 57 6c 55 c7 de 3f 2d 77 9f e8 3b 36 cf e1 3d b6 55 ed fc 9b 57 1d fe 9d 57 f6 b5 7e 51 62 d3 97 d7 74 fd 56 dd 8f e9 db 4f 1c a8 ff fb ff 75 fd f1 58 b8 f5 2b f7 9e a8 ff f3 a3 cb bf cc a6 ed f3 c7 6b d7 d3 3f fd d3 3f fd 1b ab a7 7f fa a7 7f fa 97 c1 4b 35 6c 36 ef 92 ed 2f bf 75 f9 2d 56 81 e2 75 fb fe 43 bf ff c6 be d7 af f7 d8 f4 ec 35 5d bf a6 fb 31 3d 74 f2 0d f5 1c bf 1b 65 fd 8a 72 fe 40 b1 7d ea bc 5f 3a 5b 0f c6 e6 e9 df 73 3f 7d df b7 be bd a6 eb d7 74 3f f4 8f d7 85 a7 7f cf fd f4 7d df fa f6 9a ae 5f d3 fd d0 3f 5e ba 61 b3 7a 2f db 3e b9 59 54 8b 0f d6 87 ff 3b 7d c5 ab fe Data Ascii: r}7P\6=OOo_&/7WlU?-w;6=UWW~QbtVOuX+k??K5l6/u-VuC5]1=ter@}_:[s?}t?}_?^az/>YT;}

Timestamp	Bytes transferred	Direction	Data
2025-03-26 06:20:15 UTC	716	OUT	GET /favicon.ico HTTP/1.1 Host: usersharepoint.nicepage.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://usersharepoint.nicepage.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: sessionId=162bd15a-cb1e-4927-8931-6c20f64a4c89; userId=b8e39c14-ecc6-4445-b730-24b6a3d200bc
2025-03-26 06:20:15 UTC	766	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 5034 Server: nginx/1.19.2 Content-Type: text/html Last-Modified: Mon, 01 Jul 2024 13:10:38 GMT x-amz-version-id: FT9qWE0BVhUpA2Q17BX6y15wtpUeS1FK ETag: "e01836379a08fd6809bc20a9933f25ef" x-amz-error-code: NoSuchKey x-amz-error-message: The specified key does not exist. x-amz-error-detail-Key: oi/nt/usersharepoint/favicon.ico x-amz-request-id: JNKH5V23MFBZFJT4 x-amz-id-2: K3J6IRL3IXRjvOkwmKYyDBAME+WduMYYywgl1fUfXezyb42FOjQ5HtMYYUf9BGcMUOjr4i+uZTs+OHUSGI0u3ZYnTvdc//WzPry4UTd86WA= Accept-Ranges: bytes Age: 120 Date: Wed, 26 Mar 2025 06:20:15 GMT Via: 1.1 varnish X-Served-By: cache-lga21932-LGA X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1742970016.521485,VS0,VE1 Vary: Accept-Encoding
2025-03-26 06:20:15 UTC	1378	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 44 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 42 75 69 6c 64 20 61 77 65 73 6f 6d 65 20 77 65 62 20 70 61 67 65 73 20 6f 6e 6c 69 6e 65 20 61 6e 64 20 6f 66 66 6c 69 6e 65 2c 20 66 6f 72 20 57 6f 72 64 50 72 65 73 73 20 61 6e 64 20 4a 6f 6f 6d 6c 61 21 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en-US"> <head> <title>Page Not Found</title> <meta name="Keywords" content=""> <meta name="Description" content="Build awesome web pages online and offline, for WordPress and Joomla!">
2025-03-26 06:20:15 UTC	1378	IN	Data Raw: 7d 0d 0a 09 09 09 68 33 2c 20 2e 68 33 20 7b 0d 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0d 0a 09 09 09 7d 0d 0a 09 09 09 68 31 2c 20 2e 68 31 2c 20 68 32 2c 20 2e 68 32 2c 20 68 33 2c 20 2e 68 33 20 7b 0d 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 30 70 78 3b 0d 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0d 0a 09 09 09 7d 0d 0a 09 09 09 68 31 2c 20 68 32 2c 20 68 33 2c 20 68 34 2c 20 68 35 2c 20 68 36 2c 20 2e 68 31 2c 20 2e 68 32 2c 20 2e 68 33 20 7b 0d 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 69 6e 68 65 72 69 74 3b 0d 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0d 0a 09 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 31 3b 0d 0a 09 09 09 09 63 6f Data Ascii: }h3, .h3 {font-size: 24px;}h1, .h1, h2, .h2, h3, .h3 {margin-top: 20px;margin-bottom: 10px;}h1, h2, h3, h4, h5, h6, .h1, .h2, .h3 {font-family: inherit;font-weight: 500;line-height: 1.1;co
2025-03-26 06:20:15 UTC	1378	IN	Data Raw: 09 09 09 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 32 30 30 70 78 29 20 7b 0d 0a 09 09 09 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0d 0a 09 09 09 09 77 69 64 74 68 3a 20 31 31 37 30 70 78 3b 0d 0a 09 09 09 20 20 7d 0d 0a 09 09 09 7d 0d 0a 0d 0a 09 09 09 75 6c 2c 20 6f 6c 20 7b 0d 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 3b 0d 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0d 0a 09 09 09 7d 0d 0a 0d 0a 09 09 09 61 20 7b 0d 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 33 33 37 61 62 37 3b 0d 0a 09 09 09 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0d 0a 09 09 09 7d 0d 0a 0d 0a 09 09 09 61 3a 68 6f 76 65 72 2c 20 61 3a 66 6f 63 75 73 20 7b 0d 0a 09 09 09 20 20 63 6f 6c 6f 72 3a 20 Data Ascii: @media (min-width: 1200px) { .container {width: 1170px; }}ul, ol {margin-top: 0;margin-bottom: 10px;}a {color: #337ab7;text-decoration: none;}a:hover, a:focus { color:
2025-03-26 06:20:15 UTC	900	IN	Data Raw: 27 3e 43 6f 6e 74 61 63 74 20 75 73 3c 2f 61 3e 20 61 6e 64 20 77 65 27 6c 6c 20 73 65 65 20 69 66 20 77 65 20 63 61 6e 20 70 6f 69 6e 74 20 79 6f 75 20 69 6e 20 74 68 65 20 72 69 67 68 74 20 64 69 72 65 63 74 69 6f 6e 2e 3c 2f 6c 69 3e 0d 0a 09 09 09 09 3c 2f 75 6c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: '>Contact us</a> and we'll see if we can point you in the right direction.</li></ul>

Target ID:	2
Start time:	02:19:07
Start date:	26/03/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0xc50000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	02:19:43
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	18
Start time:	02:19:44
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,15448483630826734966,4684573500086254227,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2176 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	20
Start time:	02:19:50
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://medpetroenergydmcc.com/court/"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre