Edit tour

Windows Analysis Report
https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4E

Overview

General Information

Sample URL:	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZ
Analysis ID:	1649442
Infos:

Detection

Invisible JS, Tycoon2FA

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected AntiDebug via timestamp check

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected suspicious Javascript

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2068,i,1593697042007276937,9846109595266040094,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2184 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR*~*QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om*~*VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc*~*Gb*~*b7F*~2*c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc*~*F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
2.8.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.8.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.11.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.7.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.12..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.7.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.4.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.4.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.3.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.3.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
Click to see the 5 entries

HTTP traffic detected: POST /devices HTTP/1.1Host: api.salesflare.comConnection: keep-aliveContent-Length: 2sec-ch-ua-platform: "Windows"Authorization: Bearer I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://417-kadoma.trakcid.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://417-kadoma.trakcid.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-guploader-uploadid: AKDAyIsEIoe2cEqEKB8s307bIGhCEhZ36ENO5EHoIfor5ISIij6o4OWf8iGdPfG3DlP5gEEx-goog-generation: 1737365220799885x-goog-metageneration: 1x-goog-stored-content-encoding: identityx-goog-stored-content-length: 2016x-goog-hash: crc32c=Xo/u5A==x-goog-hash: md5=NbUJd4kMWd2HU2RHYB/z2Q==x-goog-storage-class: STANDARDaccept-ranges: bytesContent-Length: 2016server: UploadServervia: 1.1 googledate: Wed, 26 Mar 2025 18:31:16 GMTexpires: Wed, 26 Mar 2025 19:31:16 GMTCache-Control: public, max-age=3600Last-Modified: Mon, 20 Jan 2025 09:27:00 GMTETag: "35b50977890c59dd87536447601ff3d9"Content-Type: text/htmlAge: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: application/json; charset=utf-8vary: originaccess-control-allow-credentials: trueaccess-control-expose-headers: WWW-Authenticate,Server-Authorizationcache-control: no-cachex-cloud-trace-context: 081883811bc407f048fe7f94f5dd8ff0date: Wed, 26 Mar 2025 18:31:18 GMTserver: Google FrontendContent-Length: 60Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: application/json; charset=utf-8vary: originaccess-control-allow-credentials: trueaccess-control-expose-headers: WWW-Authenticate,Server-Authorizationcache-control: no-cachex-cloud-trace-context: 3a32ea514c049438a54c63d69f4ce3b3date: Wed, 26 Mar 2025 18:31:20 GMTserver: Google FrontendContent-Length: 60Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: application/json; charset=utf-8vary: originaccess-control-allow-credentials: trueaccess-control-expose-headers: WWW-Authenticate,Server-Authorizationcache-control: no-cachex-cloud-trace-context: d293cc10428f031b41149012ce3504e5date: Wed, 26 Mar 2025 18:31:21 GMTserver: Google FrontendContent-Length: 60Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 26 Mar 2025 18:31:25 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0RRVByyUY6YyOqmcb%2BlIKFNgl2eEMKmn0Xx4abgQLDo8A%2F2uSQe%2B6WYs74JNZM3oFRUhICrhvGFYaYMX6n6XFdymRVeMokuRRlJD6rhbTXCuePt3iNLMdEmoRxrh"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingserver-timing: cfL4;desc="?proto=TCP&rtt=28955&min_rtt=28890&rtt_var=10880&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2232&delivery_rate=98580&cwnd=45&unsent_bytes=0&cid=36b69fd2f8d0dc21&ts=422&x=0"Cache-Control: max-age=14400CF-Cache-Status: EXPIREDServer: cloudflareCF-RAY: 9268b98ac8010f8f-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=89180&min_rtt=88885&rtt_var=19045&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2825&recv_bytes=1895&delivery_rate=34379&cwnd=252&unsent_bytes=0&cid=4a69abf3a3ebe4c2&ts=854&x=0"

Source: chromecache_92.1.dr	String found in binary or memory: https://417-kadoma.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1SwCAMAOCngZFLwq8DQxfOV3B
Source: chromecache_70.1.dr	String found in binary or memory: https://app.salesflare.com/#/signup/?campaign=
Source: chromecache_70.1.dr	String found in binary or memory: https://app.salesflare.com/#/signup/?campaign=-trackinglinks-landingpage
Source: chromecache_89.1.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/
Source: chromecache_77.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:100
Source: chromecache_70.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:400
Source: chromecache_77.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Raleway:400
Source: chromecache_77.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:100
Source: chromecache_69.1.dr, chromecache_87.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
Source: chromecache_69.1.dr, chromecache_87.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
Source: chromecache_69.1.dr, chromecache_87.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
Source: chromecache_69.1.dr, chromecache_87.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
Source: chromecache_69.1.dr, chromecache_87.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
Source: chromecache_64.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyC0ITw.woff2)
Source: chromecache_64.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCAIT5lu.woff2)
Source: chromecache_64.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCIIT5lu.woff2)
Source: chromecache_64.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCMIT5lu.woff2)
Source: chromecache_64.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCkIT5lu.woff2)
Source: chromecache_84.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBGEe.woff2)
Source: chromecache_84.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBGEe.woff2)
Source: chromecache_84.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBGEe.woff2)
Source: chromecache_84.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3KUBGEe.woff2)
Source: chromecache_84.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3OUBGEe.woff2)
Source: chromecache_84.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBGEe.woff2)
Source: chromecache_84.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2)
Source: chromecache_84.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBGEe.woff2)
Source: chromecache_84.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBGEe.woff2)
Source: chromecache_81.1.dr	String found in binary or memory: https://github.com/getsentry/sentry-javascript
Source: chromecache_70.1.dr	String found in binary or memory: https://github.com/sindresorhus/prepend-http/blob/040579fb1271df6232dd96a7600c9efb1510eb47/index.js
Source: chromecache_78.1.dr	String found in binary or memory: https://storage.googleapis.com/track.salesflare.com/actual_flare.js
Source: chromecache_92.1.dr	String found in binary or memory: https://storage.googleapis.com/track.salesflare.com/provider.html?xdm_e=https%3A%2F%2F417-kadoma.tra
Source: chromecache_70.1.dr	String found in binary or memory: https://track.salesflare.com/flare.js
Source: chromecache_89.1.dr	String found in binary or memory: https://track.salesflare.com/flareprovider.js

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.251.40.228:443 -> 192.168.2.8:49691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.102.38:443 -> 192.168.2.8:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.102.38:443 -> 192.168.2.8:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.40:443 -> 192.168.2.8:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.40:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.68:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.64:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.73.226:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.73.226:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.68:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.150:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.254.174:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.89.229:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.150:443 -> 192.168.2.8:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.254.174:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.102.239.211:443 -> 192.168.2.8:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.102.239.211:443 -> 192.168.2.8:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.17.83:443 -> 192.168.2.8:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.8:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.8:49748 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5908_13705118

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5908_13705118

Jump to behavior

Source: classification engine

Classification label: mal76.phis.evad.win@26/52@32/14

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2068,i,1593697042007276937,9846109595266040094,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2184 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om~VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc~Gb~b7F~2c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc~F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2068,i,1593697042007276937,9846109595266040094,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2184 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Malware Analysis System Evasion

Yara detected AntiDebug via timestamp check

Source: Yara match

File source: 2.8.d.script.csv, type: HTML

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om~VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc~Gb~b7F~2c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc~F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://417-kadoma.trakcid.com/favicon.ico	0%	Avira URL Cloud	safe
https://track.salesflare.com/flareprovider.js	0%	Avira URL Cloud	safe
https://email.idxhome.co/c/eJwEwL1SwCAMAOCngZFLwq8DQxfOV3BMgRz1rLUtVc-n92s5JIlBdM8YHb2kBOD1yBFsSKuVFqFj99wEQYJgTALg2ektE5AHSwGRALwh4mQDeU5rRamsHGztdxx7N_XQH3nM-XUruygqisr9js388KznOqa5HkUlzrdXRUVfeWm8Kwd3Px_ezOef_s70HwAA__8Z8zBA	0%	Avira URL Cloud	safe
https://app.salesflare.com/#/signup/?campaign=-trackinglinks-landingpage	0%	Avira URL Cloud	safe
https://track.salesflare.com/flare.js	0%	Avira URL Cloud	safe
https://lsems.gravityzone.bitdefender.com/index.css	0%	Avira URL Cloud	safe
https://lsems.gravityzone.bitdefender.com/manifest.json	0%	Avira URL Cloud	safe
https://sj1d.watcqbht.ru/favicon.ico	0%	Avira URL Cloud	safe
https://lsems.gravityzone.bitdefender.com/static/css/main.3dfe9f5e.css	0%	Avira URL Cloud	safe
https://app.salesflare.com/#/signup/?campaign=	0%	Avira URL Cloud	safe
https://417-kadoma.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1SwCAMAOCngZFLwq8DQxfOV3B	0%	Avira URL Cloud	safe
https://lsems.gravityzone.bitdefender.com/favicon.ico	0%	Avira URL Cloud	safe
https://api-bd.linkscan.io/scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?i=0&docs=1&s=1	0%	Avira URL Cloud	safe
https://lsems.gravityzone.bitdefender.com/static/js/main.d62e4927.js	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	199.232.89.229	true	false	high
api-bd.linkscan.io	13.249.91.68	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.66.137	true	false	high
d3rb3qlp6ej74d.cloudfront.net	13.249.91.40	true	false	unknown
sj1d.watcqbht.ru	104.21.17.83	true	true	unknown
track.salesflare.com	172.66.43.150	true	false	high
www.google.com	142.251.40.228	true	false	high
d2srg6h49ykvtq.cloudfront.net	3.168.102.38	true	false	unknown
api.salesflare.com	35.186.254.174	true	false	high
mailgun.org	34.102.239.211	true	false	high
417-kadoma.trakcid.com	34.149.73.226	true	false	unknown
email.idxhome.co	unknown	unknown	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	high
protect.checkpoint.com	unknown	unknown	false	high
lsems.gravityzone.bitdefender.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://417-kadoma.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1SwCAMAOCngZFLwq8DQxfOV3BMgRz1rLUtVc-n92s5JIlBdM8YHb2kBOD1yBFsSKuVFqFj99wEQYJgTALg2ektE5AHSwGRALwh4mQDeU5rRamsHGztdxx7N_XQH3nM-XUruygqisr9js388KznOqa5HkUlzrdXRUVfeWm8Kwd3Px_ezOef_s70HwAA__8Z8zBA&e=-TZ78dFJrPrKb-ps20hKux8F-FHP-UXw&cee=dmJpcmRAbWxjbi5jYQ==	false		unknown
https://api.salesflare.com/devices/282134404	false		high
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://sj1d.watcqbht.ru/favicon.ico	false	Avira URL Cloud: safe	unknown
https://sj1d.watcqbht.ru/7tYH/	true		unknown
https://api.salesflare.com/token?email=-TZ78dFJrPrKb-ps20hKux8F-FHP-UXw	false		high
http://c.pki.goog/r/r4.crl	false		high
https://api.salesflare.com/interactions/forward?instant=true	false		high
https://track.salesflare.com/flareprovider.js	false	Avira URL Cloud: safe	unknown
https://email.idxhome.co/c/eJwEwL1SwCAMAOCngZFLwq8DQxfOV3BMgRz1rLUtVc-n92s5JIlBdM8YHb2kBOD1yBFsSKuVFqFj99wEQYJgTALg2ektE5AHSwGRALwh4mQDeU5rRamsHGztdxx7N_XQH3nM-XUruygqisr9js388KznOqa5HkUlzrdXRUVfeWm8Kwd3Px_ezOef_s70HwAA__8Z8zBA	false	Avira URL Cloud: safe	unknown
https://api.salesflare.com/devices	false		high
https://a.nel.cloudflare.com/report/v4?s=0RRVByyUY6YyOqmcb%2BlIKFNgl2eEMKmn0Xx4abgQLDo8A%2F2uSQe%2B6WYs74JNZM3oFRUhICrhvGFYaYMX6n6XFdymRVeMokuRRlJD6rhbTXCuePt3iNLMdEmoRxrh	false		high
https://417-kadoma.trakcid.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://track.salesflare.com/flare.js	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/@sentry/browser@5.29.2/build/bundle.min.js	false		high
https://lsems.gravityzone.bitdefender.com/index.css	false	Avira URL Cloud: safe	unknown
https://lsems.gravityzone.bitdefender.com/manifest.json	false	Avira URL Cloud: safe	unknown
https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?c=1&i=1&docs=1	false		unknown
http://c.pki.goog/r/gsr1.crl	false		high
https://lsems.gravityzone.bitdefender.com/static/css/main.3dfe9f5e.css	false	Avira URL Cloud: safe	unknown
https://api.salesflare.com/contacts	false		high
https://lsems.gravityzone.bitdefender.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://api-bd.linkscan.io/scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?i=0&docs=1&s=1	false	Avira URL Cloud: safe	unknown
https://lsems.gravityzone.bitdefender.com/static/js/main.d62e4927.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.jsdelivr.net/npm/	chromecache_89.1.dr	false		high
https://app.salesflare.com/#/signup/?campaign=	chromecache_70.1.dr	false	Avira URL Cloud: safe	unknown
https://github.com/sindresorhus/prepend-http/blob/040579fb1271df6232dd96a7600c9efb1510eb47/index.js	chromecache_70.1.dr	false		high
https://app.salesflare.com/#/signup/?campaign=-trackinglinks-landingpage	chromecache_70.1.dr	false	Avira URL Cloud: safe	unknown
https://github.com/getsentry/sentry-javascript	chromecache_81.1.dr	false		high
https://417-kadoma.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1SwCAMAOCngZFLwq8DQxfOV3B	chromecache_92.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.66.43.150	track.salesflare.com	United States	13335	CLOUDFLARENETUS	false
3.168.102.38	d2srg6h49ykvtq.cloudfront.net	United States	16509	AMAZON-02US	false
199.232.89.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
13.249.91.64	unknown	United States	16509	AMAZON-02US	false
142.251.40.228	www.google.com	United States	15169	GOOGLEUS	false
13.249.91.68	api-bd.linkscan.io	United States	16509	AMAZON-02US	false
34.149.73.226	417-kadoma.trakcid.com	United States	2686	ATGS-MMD-ASUS	false
35.186.254.174	api.salesflare.com	United States	15169	GOOGLEUS	false
13.249.91.40	d3rb3qlp6ej74d.cloudfront.net	United States	16509	AMAZON-02US	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
34.102.239.211	mailgun.org	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.21.17.83	sj1d.watcqbht.ru	United States	13335	CLOUDFLARENETUS	true

Private

IP
192.168.2.8

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649442
Start date and time:	2025-03-26 19:30:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om~VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc~Gb~b7F~2c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc~F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.evad.win@26/52@32/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.40.110, 142.250.65.227, 172.253.122.84, 142.250.80.78, 142.250.80.10, 142.250.65.195, 142.251.32.123, 142.251.35.187, 142.251.40.123, 142.251.40.155, 142.251.40.187, 142.250.64.91, 142.250.80.123, 142.250.176.219, 142.251.40.219, 142.251.40.251, 142.251.41.27, 172.217.165.155, 142.250.65.187, 142.250.65.219, 142.250.65.251, 142.250.81.251, 23.210.73.6, 142.250.64.106, 142.250.72.106, 142.250.80.42, 142.251.41.10, 172.217.165.138, 142.250.65.170, 142.250.65.202, 142.250.65.234, 142.250.81.234, 142.251.32.106, 142.251.35.170, 142.251.40.106, 142.251.40.138, 142.251.40.170, 142.250.64.74, 142.250.176.195, 20.12.23.50, 2.23.227.215, 23.9.183.29, 20.190.151.131, 23.44.203.182
Excluded domains from analysis (whitelisted): www.bing.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, storage.googleapis.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, login.live.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR*~*QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om*~*VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc*~*Gb*~*b7F*~2*c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc*~*F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5181
Entropy (8bit):	5.4308671023934885
Encrypted:	false
SSDEEP:	96:vOW/fOWBFZOGOW0xOW+Jc+uKOWVNaOL/fOLBFZOGOL0xOL+Jc+uKOLVNaOxT/fOh:3/H4+01ul//a4z00ukZ/44t0Gu2k
MD5:	455622883D1E301BE1EB53C2BDE3265E
SHA1:	66316EB506ACA70529090E179A561A30489F208B
SHA-256:	0B9666CBBFDF1EA9E4DD777F02FD7EAEA61B39155B3B75958468015E8582B8B7
SHA-512:	A505AE50D4D8ADD315AABB2185B3345253000A6CCB922B8E7628A4B387A189EB82398D02C5711512F6F5B8C1B86A47561FB9C8D44FEDFE583E0E85FDC24F8AB5
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Raleway:400,300,600"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Raleway';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCAIT5lu.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Raleway';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCkIT5lu.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ vietnamese /.@font-face {. font-family: 'Raleway';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCIIT5lu.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext */.@font-face {. font-family: 'Raleway';. font-style

Source: Yara match	File source: 2.7.d.script.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML

Source: 2.9..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://sj1d.watcqbht.ru/7tYH/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code/URLs. The script appears to be attempting to redirect the user to a suspicious domain and collect sensitive information, which is a clear indication of malicious intent.
Source: 2.12..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://sj1d.watcqbht.ru/7tYH/... This script demonstrates high-risk behavior, including dynamic code execution through the use of a Proxy object that evaluates decoded strings. The obfuscated nature of the code and the potential for remote code execution make this a high-risk script.

Source: https://417-kadoma.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1SwCAMAOCngZFLwq8DQxfOV3BMgRz1rLUtVc-n92s5JIlBdM8YHb2kBOD1yBFsSKuVFqFj99wEQYJgTALg2ektE5AHSwGRALwh4mQDeU5rRamsHGztdxx7N_XQH3nM-XUruygqisr9js388KznOqa5HkUlzrdXRUVfeWm8Kwd3Px_ezOef_s70HwAA__8Z8zBA&e=-TZ78dFJrPrKb-ps20hKux8F-FHP-UXw&cee=dmJpcmRAbWxjbi5jYQ==	HTTP Parser: No favicon
Source: https://sj1d.watcqbht.ru/7tYH/	HTTP Parser: No favicon
Source: https://sj1d.watcqbht.ru/7tYH/	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: protect.checkpoint.com to https://lsems.gravityzone.bitdefender.com/scan/ahr0chm6ly80mtcta2fkb21hlnryywtjawquy29tlz91pwh0dhbzoiuyriuyrmvtywlslmlkeghvbwuuy28lmkzjjtjgzup3rxdmmvn3q0fnqu9dbmdarkx3ctheuxhmt1yzqk1nunoxckxvdfzjlw45mnm1sklsqmrnofliyjjrqk9emxlcrnnts3vwrnfgajk5d0vrwupnvefmzzjla3rfnufiu3dhukfmd2g0bvfezvu1cljhbxnir3p0zhh4n05fwffim25nlvhvcnv5z3fpc3i5anmzodhlem5pcwe1sgtvbhpyzfhsvvzmzvdtoet3zdnqef9lek9lzl9znzbid0fbx184wjh6qkemzt0tvfo3ogrgsnjqcktilxbzmjbos3v4oeytrkhqlvvydyzjzwu9zg1kcgntukfiv3hqymk1allrpt0=/96b8682a669598c35a7c4c5ff5b8e7e5de0148a96a5ed8cbc72c352775b5f81d?c=1&i=1&docs=1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: email.idxhome.co to https://sj1d.watcqbht.ru/7tyh/

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.201.147
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.63
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.201.147
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.63
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.201.147
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.63
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.41
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: protect.checkpoint.com
Source: global traffic	DNS traffic detected: DNS query: lsems.gravityzone.bitdefender.com
Source: global traffic	DNS traffic detected: DNS query: api-bd.linkscan.io
Source: global traffic	DNS traffic detected: DNS query: 417-kadoma.trakcid.com
Source: global traffic	DNS traffic detected: DNS query: track.salesflare.com
Source: global traffic	DNS traffic detected: DNS query: api.salesflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: email.idxhome.co
Source: global traffic	DNS traffic detected: DNS query: sj1d.watcqbht.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 19:31:02.865225077 CET	53	62961	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:02.904211998 CET	53	64234	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:04.066453934 CET	53	49676	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:06.978909016 CET	60805	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:06.979285955 CET	54636	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:07.067442894 CET	53	60805	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:07.067550898 CET	53	54636	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:08.291153908 CET	52614	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:08.291536093 CET	65124	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:08.400228024 CET	53	52614	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:08.427495003 CET	53	65124	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:09.191688061 CET	64526	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:09.191817045 CET	59637	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:09.295932055 CET	53	64526	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:09.299762011 CET	53	59637	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:09.889688969 CET	53	57516	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:10.967894077 CET	63723	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:10.968244076 CET	62180	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:11.100286961 CET	53	63723	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:11.112768888 CET	53	62180	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:11.735778093 CET	51899	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:11.736233950 CET	53893	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:11.824167013 CET	53	51899	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:11.824645996 CET	53	53893	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:13.423713923 CET	58240	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:13.423923016 CET	60735	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:13.484137058 CET	61621	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:13.484395027 CET	64737	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:13.523365021 CET	53	60735	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:13.523900986 CET	53	58240	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:13.572246075 CET	53	61621	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:13.572834015 CET	53	64737	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:14.257067919 CET	49520	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:14.257069111 CET	51640	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:14.345913887 CET	53	55349	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:14.354712009 CET	53	51640	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:14.392990112 CET	53	49520	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:14.922080994 CET	53	55285	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:15.548623085 CET	52225	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:15.548825979 CET	53155	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:15.636982918 CET	53	65190	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:15.639283895 CET	53	52225	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:15.643909931 CET	53	53155	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:16.099781990 CET	64606	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:16.099991083 CET	55847	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:16.100279093 CET	65221	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:16.100353956 CET	60615	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:16.111154079 CET	58527	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:16.111630917 CET	53897	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:16.189644098 CET	53	64606	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:16.189697981 CET	53	55847	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:16.190437078 CET	53	65221	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:16.190469980 CET	53	60615	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:16.201690912 CET	53	58527	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:16.201725006 CET	53	53897	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:21.052793026 CET	54108	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:21.052793980 CET	64139	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:21.147113085 CET	53	64139	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:21.147185087 CET	53	64234	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:21.164290905 CET	53	54108	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:21.663193941 CET	61383	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:21.663394928 CET	55867	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:21.915831089 CET	53	61383	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:21.941039085 CET	53	55867	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:23.505163908 CET	61099	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:23.508157015 CET	55748	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:23.596327066 CET	53	61099	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:23.597099066 CET	53	55748	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:24.354825974 CET	53	49913	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:25.316147089 CET	56596	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:25.316452980 CET	64534	53	192.168.2.8	1.1.1.1
Mar 26, 2025 19:31:25.405143023 CET	53	56596	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:25.405163050 CET	53	64534	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:39.878947973 CET	53	51329	1.1.1.1	192.168.2.8
Mar 26, 2025 19:31:44.406656027 CET	53	54916	162.159.36.2	192.168.2.8
Mar 26, 2025 19:32:02.742737055 CET	53	54245	1.1.1.1	192.168.2.8
Mar 26, 2025 19:32:02.818481922 CET	53	62042	1.1.1.1	192.168.2.8

Timestamp	Bytes transferred	Direction	Data
Mar 26, 2025 19:31:19.806864023 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 26, 2025 19:31:19.897710085 CET	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 26 Mar 2025 18:03:27 GMT Expires: Wed, 26 Mar 2025 18:53:27 GMT Age: 1672 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 26, 2025 19:31:19.903063059 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 26, 2025 19:31:19.993027925 CET	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 26 Mar 2025 18:03:30 GMT Expires: Wed, 26 Mar 2025 18:53:30 GMT Age: 1669 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:08 UTC	1443	OUT	GET /v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om~VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc~Gb~b7F~2c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc~F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA HTTP/1.1 Host: protect.checkpoint.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:09 UTC	1036	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 26 Mar 2025 18:31:09 GMT set-cookie: x-cloud-sec-ctp = e01c96c6-4f15-44f2-90f7-34fc02f81cc9; Secure; HttpOnly; path=/; expires=26-Mar-2026 18:31:09 GMT location: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?c=1&i=1&docs=1 Apigw-Requestid: IDAtFg8YDoEEPcg= X-Cache: Miss from cloudfront Via: 1.1 09a970c514541c01d3b3e83903632062.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P6 X-Amz-Cf-Id: tXpFWDUQ-Es1g1JLtH7IVg3ceQ4vDewEhgFScU0ajXd2k1GMUG6TJw==

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:09 UTC	1208	OUT	GET /scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?c=1&i=1&docs=1 HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:09 UTC	585	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 880 Connection: close Date: Tue, 25 Mar 2025 15:23:35 GMT Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT ETag: "eba76f3b62e097867c0b5d15cf4315af" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 d4564d6809e10e731bfdfae814a717f8.cloudfront.net (CloudFront), 1.1 06a2a91727cd0dfdaa1154422bcbc726.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: a10vPPn08VTARn5ZfBMCtN_zOh_Pqg7-d81nBQcrLvREb38ICdqALw== Age: 97655
2025-03-26 18:31:09 UTC	880	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 63 61 6e 22 2f 3e 3c 6c 69 6e Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><meta name="description" content="Scan"/><lin

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:09 UTC	1106	OUT	GET /index.css HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?c=1&i=1&docs=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:10 UTC	584	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 134 Connection: close Date: Wed, 26 Mar 2025 11:48:27 GMT Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT ETag: "6748fbbc7fb3b016e371219d605b1239" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 7bac70c3c5deda2f56c0a3aff53deab0.cloudfront.net (CloudFront), 1.1 4b6b5023747759b0047c5cbc8d742cea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: xFOpmvIHZcehVPlScHpkBbrH-JwKwRqU1kiYlPsf7N6aMcwkcTdDbA== Age: 24164
2025-03-26 18:31:10 UTC	134	IN	Data Raw: 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 32 32 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 61 6c 65 77 61 79 2c 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 0a 7d Data Ascii: body { background-color: #fff; color: #222; font-family: Raleway,HelveticaNeue,Helvetica Neue,Helvetica,Arial,sans-serif}

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:09 UTC	1125	OUT	GET /static/css/main.3dfe9f5e.css HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?c=1&i=1&docs=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:10 UTC	608	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 4584 Connection: close Date: Wed, 26 Mar 2025 11:48:27 GMT Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT ETag: "8fc5a2f23a27198d9e865e74add2673c" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 181a665d1a0b3047b4fa647eeabfb330.cloudfront.net (CloudFront), 1.1 c49eddbbbee7a3b1464851f470bede1e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: y4Es2qLP_175YgORHfm21-CpNsku_3pyU5XfWOK1MQLo3giR0RipMg== Age: 24164
2025-03-26 18:31:10 UTC	4584	IN	Data Raw: 2e 73 63 61 6e 6e 65 72 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 65 72 2d 73 70 69 6e 20 31 2e 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 65 72 2d 73 70 69 6e 20 31 2e 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 62 6f 72 64 65 72 3a 32 70 78 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 37 65 6d 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 2e 35 65 6d 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 77 69 64 74 68 3a 37 65 6d 7d 2e 73 63 61 6e 2d 63 6c 65 61 6e 7b 64 69 73 70 6c 61 Data Ascii: .scanner{-webkit-animation:loader-spin 1.2s linear infinite;animation:loader-spin 1.2s linear infinite;border:2px solid;border-radius:50%;display:inline-block;height:7em;margin-bottom:3.5em;position:relative;vertical-align:top;width:7em}.scan-clean{displa

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:10 UTC	1109	OUT	GET /static/js/main.d62e4927.js HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?c=1&i=1&docs=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:10 UTC	624	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 266441 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 90ac509e6263ee9fa7bb3f1ed1f46118.cloudfront.net (CloudFront), 1.1 bc06e962b99bba0a18da728b3e764202.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Date: Wed, 26 Mar 2025 11:48:28 GMT ETag: "f3dc5fda1f5ecbd5f39d4bf333d98130" Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: 4bpEAmqNFTJecQV0gyBrd_-QzJJhY8hi2wdt64pLiS4LLrllm9VEeg== Age: 24163
2025-03-26 18:31:10 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 61 69 6e 2e 64 36 32 65 34 39 32 37 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 38 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 34 37 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 7d 6f 2e 72 65 73 65 74 57 61 72 6e 69 6e 67 43 61 63 68 65 3d 61 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6e 2c 61 2c 6f 2c 69 29 7b 69 66 28 69 21 3d 3d 72 29 7b 76 61 72 20 6c 3d 6e 65 77 20 45 72 72 6f 72 Data Ascii: /! For license information please see main.d62e4927.js.LICENSE.txt /!function(){var e={888:function(e,t,n){"use strict";var r=n(47);function a(){}function o(){}o.resetWarningCache=a,e.exports=function(){function e(e,t,n,a,o,i){if(i!==r){var l=new Error
2025-03-26 18:31:10 UTC	16384	IN	Data Raw: 2c 33 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3a 65 7d 76 61 72 20 6b 65 3d 6e 75 6c 6c 2c 78 65 3d 6e 75 6c 6c 2c 45 65 3d 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 5f 65 28 65 29 7b 69 66 28 65 3d 62 61 28 65 29 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 3d 74 79 70 65 6f 66 20 6b 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 32 38 30 29 29 3b 76 61 72 20 74 3d 65 2e 73 74 61 74 65 4e 6f 64 65 3b 74 26 26 28 74 3d 53 61 28 74 29 2c 6b 65 28 65 2e 73 74 61 74 65 4e 6f 64 65 2c 65 2e 74 79 70 65 2c 74 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 43 65 28 65 29 7b 78 65 3f 45 65 3f 45 65 2e 70 75 73 68 28 65 29 3a 45 65 3d 5b 65 5d 3a 78 65 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 4f 65 28 29 7b 69 66 28 78 65 29 7b 76 Data Ascii: ,3===e.nodeType?e.parentNode:e}var ke=null,xe=null,Ee=null;function _e(e){if(e=ba(e)){if("function"!==typeof ke)throw Error(o(280));var t=e.stateNode;t&&(t=Sa(t),ke(e.stateNode,e.type,t))}}function Ce(e){xe?Ee?Ee.push(e):Ee=[e]:xe=e}function Oe(){if(xe){v
2025-03-26 18:31:10 UTC	16384	IN	Data Raw: 6e 28 74 29 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 77 69 6e 64 6f 77 2c 74 3d 51 28 29 3b 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 2e 48 54 4d 4c 49 46 72 61 6d 65 45 6c 65 6d 65 6e 74 3b 29 7b 74 72 79 7b 76 61 72 20 6e 3d 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 74 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 7d 63 61 74 63 68 28 72 29 7b 6e 3d 21 31 7d 69 66 28 21 6e 29 62 72 65 61 6b 3b 74 3d 51 28 28 65 3d 74 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 29 2e 64 6f 63 75 6d 65 6e 74 29 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 70 72 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 Data Ascii: n(t))))}function dr(){for(var e=window,t=Q();t instanceof e.HTMLIFrameElement;){try{var n="string"===typeof t.contentWindow.location.href}catch(r){n=!1}if(!n)break;t=Q((e=t.contentWindow).document)}return t}function pr(e){var t=e&&e.nodeName&&e.nodeName.t
2025-03-26 18:31:10 UTC	16384	IN	Data Raw: 65 2e 6d 6f 64 65 29 26 26 30 3d 3d 3d 28 31 32 38 26 65 2e 66 6c 61 67 73 29 7d 66 75 6e 63 74 69 6f 6e 20 73 6f 28 65 29 7b 69 66 28 61 6f 29 7b 76 61 72 20 74 3d 72 6f 3b 69 66 28 74 29 7b 76 61 72 20 6e 3d 74 3b 69 66 28 21 6c 6f 28 65 2c 74 29 29 7b 69 66 28 75 6f 28 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 34 31 38 29 29 3b 74 3d 73 61 28 6e 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 3b 76 61 72 20 72 3d 6e 6f 3b 74 26 26 6c 6f 28 65 2c 74 29 3f 69 6f 28 72 2c 6e 29 3a 28 65 2e 66 6c 61 67 73 3d 2d 34 30 39 37 26 65 2e 66 6c 61 67 73 7c 32 2c 61 6f 3d 21 31 2c 6e 6f 3d 65 29 7d 7d 65 6c 73 65 7b 69 66 28 75 6f 28 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 34 31 38 29 29 3b 65 2e 66 6c 61 67 73 3d 2d 34 30 39 37 26 65 2e 66 6c 61 67 73 Data Ascii: e.mode)&&0===(128&e.flags)}function so(e){if(ao){var t=ro;if(t){var n=t;if(!lo(e,t)){if(uo(e))throw Error(o(418));t=sa(n.nextSibling);var r=no;t&&lo(e,t)?io(r,n):(e.flags=-4097&e.flags\|2,ao=!1,no=e)}}else{if(uo(e))throw Error(o(418));e.flags=-4097&e.flags
2025-03-26 18:31:10 UTC	16384	IN	Data Raw: 7a 65 64 53 74 61 74 65 3d 72 2c 74 2e 62 61 73 65 53 74 61 74 65 3d 6c 2c 74 2e 62 61 73 65 51 75 65 75 65 3d 73 2c 6e 2e 6c 61 73 74 52 65 6e 64 65 72 65 64 53 74 61 74 65 3d 72 7d 69 66 28 6e 75 6c 6c 21 3d 3d 28 65 3d 6e 2e 69 6e 74 65 72 6c 65 61 76 65 64 29 29 7b 61 3d 65 3b 64 6f 7b 69 3d 61 2e 6c 61 6e 65 2c 6d 69 2e 6c 61 6e 65 73 7c 3d 69 2c 44 75 7c 3d 69 2c 61 3d 61 2e 6e 65 78 74 7d 77 68 69 6c 65 28 61 21 3d 3d 65 29 7d 65 6c 73 65 20 6e 75 6c 6c 3d 3d 3d 61 26 26 28 6e 2e 6c 61 6e 65 73 3d 30 29 3b 72 65 74 75 72 6e 5b 74 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 2c 6e 2e 64 69 73 70 61 74 63 68 5d 7d 66 75 6e 63 74 69 6f 6e 20 52 69 28 65 29 7b 76 61 72 20 74 3d 4f 69 28 29 2c 6e 3d 74 2e 71 75 65 75 65 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 6e Data Ascii: zedState=r,t.baseState=l,t.baseQueue=s,n.lastRenderedState=r}if(null!==(e=n.interleaved)){a=e;do{i=a.lane,mi.lanes\|=i,Du\|=i,a=a.next}while(a!==e)}else null===a&&(n.lanes=0);return[t.memoizedState,n.dispatch]}function Ri(e){var t=Oi(),n=t.queue;if(null===n
2025-03-26 18:31:10 UTC	16384	IN	Data Raw: 28 61 2e 6c 61 6e 65 73 3d 6e 29 2c 61 2e 72 65 74 75 72 6e 3d 74 2c 61 2e 73 69 62 6c 69 6e 67 3d 6e 75 6c 6c 2c 6e 75 6c 6c 21 3d 3d 65 26 26 28 6e 75 6c 6c 3d 3d 3d 28 6e 3d 74 2e 64 65 6c 65 74 69 6f 6e 73 29 3f 28 74 2e 64 65 6c 65 74 69 6f 6e 73 3d 5b 65 5d 2c 74 2e 66 6c 61 67 73 7c 3d 31 36 29 3a 6e 2e 70 75 73 68 28 65 29 29 2c 74 2e 63 68 69 6c 64 3d 61 2c 74 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 3d 6e 75 6c 6c 2c 61 7d 66 75 6e 63 74 69 6f 6e 20 4d 6c 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 74 3d 44 73 28 7b 6d 6f 64 65 3a 22 76 69 73 69 62 6c 65 22 2c 63 68 69 6c 64 72 65 6e 3a 74 7d 2c 65 2e 6d 6f 64 65 2c 30 2c 6e 75 6c 6c 29 29 2e 72 65 74 75 72 6e 3d 65 2c 65 2e 63 68 69 6c 64 3d 74 7d 66 75 6e 63 74 69 6f 6e 20 55 6c 28 65 2c 74 2c 6e Data Ascii: (a.lanes=n),a.return=t,a.sibling=null,null!==e&&(null===(n=t.deletions)?(t.deletions=[e],t.flags\|=16):n.push(e)),t.child=a,t.memoizedState=null,a}function Ml(e,t){return(t=Ds({mode:"visible",children:t},e.mode,0,null)).return=e,e.child=t}function Ul(e,t,n
2025-03-26 18:31:10 UTC	16384	IN	Data Raw: 3a 69 2c 75 3d 65 2e 74 79 70 65 2c 73 3d 65 2e 75 70 64 61 74 65 51 75 65 75 65 3b 69 66 28 65 2e 75 70 64 61 74 65 51 75 65 75 65 3d 6e 75 6c 6c 2c 6e 75 6c 6c 21 3d 3d 73 29 74 72 79 7b 22 69 6e 70 75 74 22 3d 3d 3d 75 26 26 22 72 61 64 69 6f 22 3d 3d 3d 69 2e 74 79 70 65 26 26 6e 75 6c 6c 21 3d 69 2e 6e 61 6d 65 26 26 58 28 61 2c 69 29 2c 62 65 28 75 2c 6c 29 3b 76 61 72 20 63 3d 62 65 28 75 2c 69 29 3b 66 6f 72 28 6c 3d 30 3b 6c 3c 73 2e 6c 65 6e 67 74 68 3b 6c 2b 3d 32 29 7b 76 61 72 20 66 3d 73 5b 6c 5d 2c 64 3d 73 5b 6c 2b 31 5d 3b 22 73 74 79 6c 65 22 3d 3d 3d 66 3f 67 65 28 61 2c 64 29 3a 22 64 61 6e 67 65 72 6f 75 73 6c 79 53 65 74 49 6e 6e 65 72 48 54 4d 4c 22 3d 3d 3d 66 3f 66 65 28 61 2c 64 29 3a 22 63 68 69 6c 64 72 65 6e 22 3d 3d 3d 66 3f Data Ascii: :i,u=e.type,s=e.updateQueue;if(e.updateQueue=null,null!==s)try{"input"===u&&"radio"===i.type&&null!=i.name&&X(a,i),be(u,l);var c=be(u,i);for(l=0;l<s.length;l+=2){var f=s[l],d=s[l+1];"style"===f?ge(a,d):"dangerouslySetInnerHTML"===f?fe(a,d):"children"===f?
2025-03-26 18:31:10 UTC	13700	IN	Data Raw: 29 26 26 6e 75 6c 6c 21 3d 3d 77 29 77 2e 72 65 74 75 72 6e 3d 6c 2c 5a 6c 3d 77 3b 65 6c 73 65 20 65 3a 66 6f 72 28 6c 3d 62 3b 6e 75 6c 6c 21 3d 3d 5a 6c 3b 29 7b 69 66 28 30 21 3d 3d 28 32 30 34 38 26 28 75 3d 5a 6c 29 2e 66 6c 61 67 73 29 29 74 72 79 7b 73 77 69 74 63 68 28 75 2e 74 61 67 29 7b 63 61 73 65 20 30 3a 63 61 73 65 20 31 31 3a 63 61 73 65 20 31 35 3a 61 75 28 39 2c 75 29 7d 7d 63 61 74 63 68 28 6b 29 7b 5f 73 28 75 2c 75 2e 72 65 74 75 72 6e 2c 6b 29 7d 69 66 28 75 3d 3d 3d 6c 29 7b 5a 6c 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 65 7d 76 61 72 20 53 3d 75 2e 73 69 62 6c 69 6e 67 3b 69 66 28 6e 75 6c 6c 21 3d 3d 53 29 7b 53 2e 72 65 74 75 72 6e 3d 75 2e 72 65 74 75 72 6e 2c 5a 6c 3d 53 3b 62 72 65 61 6b 20 65 7d 5a 6c 3d 75 2e 72 65 74 75 72 6e Data Ascii: )&&null!==w)w.return=l,Zl=w;else e:for(l=b;null!==Zl;){if(0!==(2048&(u=Zl).flags))try{switch(u.tag){case 0:case 11:case 15:au(9,u)}}catch(k){_s(u,u.return,k)}if(u===l){Zl=null;break e}var S=u.sibling;if(null!==S){S.return=u.return,Zl=S;break e}Zl=u.return
2025-03-26 18:31:10 UTC	1576	IN	Data Raw: 2c 74 2e 63 72 65 61 74 65 50 6f 72 74 61 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3a 6e 75 6c 6c 3b 69 66 28 21 58 73 28 74 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 32 30 30 29 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 33 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 33 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 33 5d 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 24 24 74 79 70 65 6f 66 3a 6b 2c 6b 65 79 3a 6e 75 6c 6c 3d 3d 72 3f 6e 75 6c 6c 3a 22 22 2b 72 2c Data Ascii: ,t.createPortal=function(e,t){var n=2<arguments.length&&void 0!==arguments[2]?arguments[2]:null;if(!Xs(t))throw Error(o(200));return function(e,t,n){var r=3<arguments.length&&void 0!==arguments[3]?arguments[3]:null;return{$$typeof:k,key:null==r?null:""+r,
2025-03-26 18:31:10 UTC	16384	IN	Data Raw: 20 47 73 28 74 29 7d 2c 74 2e 72 65 6e 64 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 21 4a 73 28 74 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 32 30 30 29 29 3b 72 65 74 75 72 6e 20 65 63 28 6e 75 6c 6c 2c 65 2c 74 2c 21 31 2c 6e 29 7d 2c 74 2e 75 6e 6d 6f 75 6e 74 43 6f 6d 70 6f 6e 65 6e 74 41 74 4e 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 4a 73 28 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 34 30 29 29 3b 72 65 74 75 72 6e 21 21 65 2e 5f 72 65 61 63 74 52 6f 6f 74 43 6f 6e 74 61 69 6e 65 72 26 26 28 66 73 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 63 28 6e 75 6c 6c 2c 6e 75 6c 6c 2c 65 2c 21 31 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 5f 72 65 61 63 74 52 6f 6f 74 43 6f 6e 74 61 69 6e 65 72 3d 6e Data Ascii: Gs(t)},t.render=function(e,t,n){if(!Js(t))throw Error(o(200));return ec(null,e,t,!1,n)},t.unmountComponentAtNode=function(e){if(!Js(e))throw Error(o(40));return!!e._reactRootContainer&&(fs((function(){ec(null,null,e,!1,(function(){e._reactRootContainer=n

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:11 UTC	1154	OUT	GET /favicon.ico HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?c=1&i=1&docs=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:11 UTC	625	IN	HTTP/1.1 200 OK Content-Type: image/vnd.microsoft.icon Content-Length: 17542 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront), 1.1 06a2a91727cd0dfdaa1154422bcbc726.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Date: Wed, 26 Mar 2025 18:31:11 GMT ETag: "fba58480381fefa10f97bd44c76c87c7" Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: 4UE2j9v_OZ1aRzWMH0Jt39mpdQgggmEUtSyCkLF8AwqQpSonNSNo1w== Age: 66943
2025-03-26 18:31:11 UTC	16384	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 01 00 20 00 68 04 00 00 46 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 ae 04 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 0e 00 00 30 30 00 00 01 00 20 00 a8 25 00 00 de 1e 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 39 00 00 ff a4 00 00 ff e5 00 00 ff f9 00 00 ff fb 00 00 ff ec 00 00 ff b5 00 00 ff 52 00 00 ff 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 0a 00 00 ff 9d 00 00 ff fe 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff c0 00 00 ff 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 07 00 00 ff bf 00 00 ff ff 00 Data Ascii: hF 600 %( @9R
2025-03-26 18:31:11 UTC	1158	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 1a 00 00 ff 96 00 00 ff f4 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff dd 00 00 ff 67 00 00 ff 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 2e 00 Data Ascii: g.

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:11 UTC	1095	OUT	GET /manifest.json HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?c=1&i=1&docs=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:11 UTC	592	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 290 Connection: close Date: Wed, 26 Mar 2025 12:52:08 GMT Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT ETag: "b0efba333d201884ace7da8c274c50d6" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 1b0f041f103652001e37f5806000d24a.cloudfront.net (CloudFront), 1.1 de1b9ae25d558e06a3362166bd9d3342.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: JIzCxNKX0R0kVB7eKFJhJFU-XJTYAHmsuh65EV8-Ubmm1DvkshOZ1g== Age: 20344
2025-03-26 18:31:11 UTC	290	IN	Data Raw: 7b 0a 20 20 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 20 22 4c 69 6e 6b 73 63 61 6e 22 2c 0a 20 20 22 6e 61 6d 65 22 3a 20 22 4c 69 6e 6b 73 63 61 6e 22 2c 0a 20 20 22 69 63 6f 6e 73 22 3a 20 5b 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 22 73 72 63 22 3a 20 22 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2c 0a 20 20 20 20 20 20 22 73 69 7a 65 73 22 3a 20 22 36 34 78 36 34 20 33 32 78 33 32 20 32 34 78 32 34 20 31 36 78 31 36 22 2c 0a 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 0a 20 20 20 20 7d 0a 20 20 5d 2c 0a 20 20 22 73 74 61 72 74 5f 75 72 6c 22 3a 20 22 2e 22 2c 0a 20 20 22 64 69 73 70 6c 61 79 22 3a 20 22 73 74 61 6e 64 61 6c 6f 6e 65 22 2c 0a 20 20 22 74 68 65 6d 65 5f 63 6f 6c 6f 72 22 3a 20 22 23 30 30 30 30 30 30 22 2c Data Ascii: { "short_name": "Linkscan", "name": "Linkscan", "icons": [ { "src": "favicon.ico", "sizes": "64x64 32x32 24x24 16x16", "type": "image/x-icon" } ], "start_url": ".", "display": "standalone", "theme_color": "#000000",

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:11 UTC	1075	OUT	OPTIONS /scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?i=0&docs=1&s=1 HTTP/1.1 Host: api-bd.linkscan.io Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-original-referer Origin: https://lsems.gravityzone.bitdefender.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://lsems.gravityzone.bitdefender.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:11 UTC	624	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 0 Connection: close Date: Wed, 26 Mar 2025 18:31:11 GMT Access-Control-Allow-Methods: OPTIONS,GET x-amzn-RequestId: 6c07a4a9-b82d-4731-be1d-0893d87513c0 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,X-Original-Referer x-amz-apigw-id: IDAtfFPxjoEEadw= X-Cache: Miss from cloudfront Via: 1.1 32f22a5526f095115736b345c80e1c26.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: 8XowGspByeBrTVla-WhuaB1PVfZL3208_Eh4W1epUKjwY6l-TnEHwQ==

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:11 UTC	1173	OUT	GET /scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?i=0&docs=1&s=1 HTTP/1.1 Host: api-bd.linkscan.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" X-Original-Referer: unknown sec-ch-ua-mobile: ?0 Origin: https://lsems.gravityzone.bitdefender.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://lsems.gravityzone.bitdefender.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:13 UTC	562	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1186 Connection: close Date: Wed, 26 Mar 2025 18:31:13 GMT X-Amzn-Trace-Id: Root=1-67e447f0-71c58b00010b6383496dd42d;Parent=78c1d8bd25d226ba;Sampled=0;Lineage=1:92f4b973:0 x-amzn-RequestId: 746c4a84-fba2-4af3-ae1d-15e1106cfd18 Access-Control-Allow-Origin: * x-amz-apigw-id: IDAtlE2rjoEETLw= X-Cache: Miss from cloudfront Via: 1.1 d19251c56e7d3e047bfb531e418ce972.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: _LjwGSG4ka2oBvAFWuA_G4zki1kdSQsZsIFs7oGNgTiOIj6TK75mow==
2025-03-26 18:31:13 UTC	1186	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 64 61 74 61 22 3a 7b 22 6f 72 69 67 69 6e 61 6c 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 34 31 37 2d 6b 61 64 6f 6d 61 2e 74 72 61 6b 63 69 64 2e 63 6f 6d 2f 3f 75 3d 68 74 74 70 73 3a 25 32 46 25 32 46 65 6d 61 69 6c 2e 69 64 78 68 6f 6d 65 2e 63 6f 25 32 46 63 25 32 46 65 4a 77 45 77 4c 31 53 77 43 41 4d 41 4f 43 6e 67 5a 46 4c 77 71 38 44 51 78 66 4f 56 33 42 4d 67 52 7a 31 72 4c 55 74 56 63 2d 6e 39 32 73 35 4a 49 6c 42 64 4d 38 59 48 62 32 6b 42 4f 44 31 79 42 46 73 53 4b 75 56 46 71 46 6a 39 39 77 45 51 59 4a 67 54 41 4c 67 32 65 6b 74 45 35 41 48 53 77 47 52 41 4c 77 68 34 6d 51 44 65 55 35 72 52 61 6d 73 48 47 7a 74 64 78 78 37 4e 5f 58 51 48 33 6e 4d 2d 58 55 72 75 79 67 71 69 73 72 39 6a 73 33 Data Ascii: {"success":true,"data":{"originalUrl":"https://417-kadoma.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1SwCAMAOCngZFLwq8DQxfOV3BMgRz1rLUtVc-n92s5JIlBdM8YHb2kBOD1yBFsSKuVFqFj99wEQYJgTALg2ektE5AHSwGRALwh4mQDeU5rRamsHGztdxx7N_XQH3nM-XUruygqisr9js3

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:12 UTC	408	OUT	GET /favicon.ico HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:12 UTC	625	IN	HTTP/1.1 200 OK Content-Type: image/vnd.microsoft.icon Content-Length: 17542 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront), 1.1 9b0814f74b20835098fe6c38b6ceeac4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Date: Wed, 26 Mar 2025 18:31:11 GMT ETag: "fba58480381fefa10f97bd44c76c87c7" Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: 1vRIvJEvxHp4rsKzQmIsxg9Tqp4w2IdxffGeVUcbtm4R080WVs0zag== Age: 66944
2025-03-26 18:31:12 UTC	16384	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 01 00 20 00 68 04 00 00 46 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 ae 04 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 0e 00 00 30 30 00 00 01 00 20 00 a8 25 00 00 de 1e 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 39 00 00 ff a4 00 00 ff e5 00 00 ff f9 00 00 ff fb 00 00 ff ec 00 00 ff b5 00 00 ff 52 00 00 ff 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 0a 00 00 ff 9d 00 00 ff fe 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff c0 00 00 ff 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 07 00 00 ff bf 00 00 ff ff 00 Data Ascii: hF 600 %( @9R
2025-03-26 18:31:12 UTC	1158	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 1a 00 00 ff 96 00 00 ff f4 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff dd 00 00 ff 67 00 00 ff 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 2e 00 Data Ascii: g.

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:13 UTC	1009	OUT	GET /?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1SwCAMAOCngZFLwq8DQxfOV3BMgRz1rLUtVc-n92s5JIlBdM8YHb2kBOD1yBFsSKuVFqFj99wEQYJgTALg2ektE5AHSwGRALwh4mQDeU5rRamsHGztdxx7N_XQH3nM-XUruygqisr9js388KznOqa5HkUlzrdXRUVfeWm8Kwd3Px_ezOef_s70HwAA__8Z8zBA&e=-TZ78dFJrPrKb-ps20hKux8F-FHP-UXw&cee=dmJpcmRAbWxjbi5jYQ== HTTP/1.1 Host: 417-kadoma.trakcid.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://lsems.gravityzone.bitdefender.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:13 UTC	755	IN	HTTP/1.1 200 OK x-guploader-uploadid: AKDAyIuML5LpyJBxfoXJvWhcgdM80WPyUEt7mkxwmXaOoMs02nCdckiEEtHrnlsf1wBcrjxH x-goog-generation: 1737365220556059 x-goog-metageneration: 1 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 6443 x-goog-hash: crc32c=tv1Ghg== x-goog-hash: md5=eId+PtOYRfdFsCoRmQDsSQ== x-goog-storage-class: STANDARD accept-ranges: bytes Content-Length: 6443 server: UploadServer via: 1.1 google date: Wed, 26 Mar 2025 18:31:13 GMT expires: Wed, 26 Mar 2025 19:31:13 GMT Cache-Control: public, max-age=3600 Last-Modified: Mon, 20 Jan 2025 09:27:00 GMT ETag: "78877e3ed39845f745b02a119900ec49" Content-Type: text/html Age: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 18:31:13 UTC	242	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 74 72 61 63 6b 2e 73 61 6c 65 73 66 6c 61 72 65 2e 63 6f 6d 2f 66 6c 61 72 65 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 0a 20 20 20 20 Data Ascii: <html> <head> <title>Redirecting...</title> <script src="https://track.salesflare.com/flare.js"></script> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet"> </head>
2025-03-26 18:31:13 UTC	997	IN	Data Raw: 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 22 3e 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 66 2d 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 66 2d 68 65 72 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 73 66 2d 68 65 61 64 69 6e 67 22 3e 57 61 6e 74 20 74 6f 20 74 72 61 63 6b 20 79 Data Ascii: <body style="visibility: hidden;"> <div class="sf-header"> <div class="sf-hero"> <div class="container"> <div class="header-container"> <h1 class="sf-heading">Want to track y
2025-03-26 18:31:13 UTC	997	IN	Data Raw: 69 2b 2b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 61 73 68 20 3d 20 68 61 73 68 65 73 5b 69 5d 2e 73 70 6c 69 74 28 27 3d 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 73 2e 70 75 73 68 28 68 61 73 68 5b 30 5d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 4d 61 6b 65 20 73 75 72 65 20 74 68 65 20 75 72 6c 20 69 73 20 70 72 65 66 69 78 65 64 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 68 61 73 68 5b 30 5d 20 3d 3d 3d 20 27 75 27 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 73 5b 68 61 73 68 5b 30 5d 5d 20 3d 20 73 61 6e 69 74 69 7a 65 55 52 4c 28 68 61 73 68 5b 31 5d 29 3b 0a 20 Data Ascii: i++) { hash = hashes[i].split('='); vars.push(hash[0]); // Make sure the url is prefixed if (hash[0] === 'u') { vars[hash[0]] = sanitizeURL(hash[1]);
2025-03-26 18:31:13 UTC	997	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 75 72 6c 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 2e 2a 5c 2f 2b 2f 2c 20 27 68 74 74 70 3a 2f 2f 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 75 72 6c 2e 72 65 70 6c 61 63 65 28 2f 5e 28 3f 21 28 3f 3a 5c 77 2b 3a 29 3f 5c 2f 5c 2f 29 2f 2c 20 27 68 74 74 70 3a 2f 2f 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 64 65 63 6f 64 65 28 73 74 72 69 6e 67 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 65 63 6f 64 65 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 57 65 Data Ascii: return url.replace(/^\.*\/+/, 'http://'); } return url.replace(/^(?!(?:\w+:)?\/\/)/, 'http://'); } function decode(string) { var decoded; // We
2025-03-26 18:31:13 UTC	997	IN	Data Raw: 61 6c 65 73 66 6c 61 72 65 2e 63 6f 6d 2f 23 2f 73 69 67 6e 75 70 2f 3f 63 61 6d 70 61 69 67 6e 3d 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 72 61 63 6b 69 6e 67 44 6f 6d 61 69 6e 73 20 3d 20 76 61 72 73 5b 30 5d 3f 2e 73 70 6c 69 74 28 27 68 74 74 70 73 3a 2f 2f 27 29 5b 31 5d 3f 2e 73 70 6c 69 74 28 27 2e 63 6f 6d 27 29 5b 30 5d 2e 73 70 6c 69 74 28 27 2e 74 6f 27 29 5b 30 5d 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 69 61 6c 55 72 6c 20 2b 3d 20 74 72 61 63 6b 69 6e 67 44 6f 6d 61 69 6e 73 20 3f 20 74 72 61 63 6b 69 6e 67 44 6f 6d 61 69 6e 73 20 3a 20 27 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 69 61 6c 55 72 Data Ascii: alesflare.com/#/signup/?campaign='; var trackingDomains = vars[0]?.split('https://')[1]?.split('.com')[0].split('.to')[0]; trialUrl += trackingDomains ? trackingDomains : ''; trialUr
2025-03-26 18:31:13 UTC	997	IN	Data Raw: 6d 61 69 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2e 73 74 61 72 74 73 57 69 74 68 28 27 2f 73 27 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 6d 61 69 6e 20 2b 3d 20 27 2f 73 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 64 6f 6d 61 69 6e 20 2b 20 22 2f 34 30 34 2e 68 74 6d 6c 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 66 6c 61 72 65 20 3d 20 6e 65 77 20 46 6c 61 72 65 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 61 72 65 2e 66 6f Data Ascii: main if (window.location.pathname.startsWith('/s')) { domain += '/s'; } window.location.href = domain + "/404.html" } var flare = new Flare(); flare.fo
2025-03-26 18:31:13 UTC	997	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 31 2e 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 6d 6f 6e 74 73 65 72 72 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2e 73 66 2d 62 75 74 Data Ascii: letter-spacing: -1.4px; font-family: montserrat; text-align: center; } } .sf-but
2025-03-26 18:31:13 UTC	219	IN	Data Raw: 73 3a 20 38 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: s: 80px; border-radius: 80px; display: inline-block; } } } } } </style></html>

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:13 UTC	907	OUT	GET /scan/aHR0cHM6Ly80MTcta2Fkb21hLnRyYWtjaWQuY29tLz91PWh0dHBzOiUyRiUyRmVtYWlsLmlkeGhvbWUuY28lMkZjJTJGZUp3RXdMMVN3Q0FNQU9DbmdaRkx3cThEUXhmT1YzQk1nUnoxckxVdFZjLW45MnM1SklsQmRNOFlIYjJrQk9EMXlCRnNTS3VWRnFGajk5d0VRWUpnVEFMZzJla3RFNUFIU3dHUkFMd2g0bVFEZVU1clJhbXNIR3p0ZHh4N05fWFFIM25NLVhVcnV5Z3Fpc3I5anMzODhLem5PcWE1SGtVbHpyZFhSVVZmZVdtOEt3ZDNQeF9lek9lZl9zNzBId0FBX184Wjh6QkEmZT0tVFo3OGRGSnJQcktiLXBzMjBoS3V4OEYtRkhQLVVYdyZjZWU9ZG1KcGNtUkFiV3hqYmk1allRPT0=/96B8682A669598C35A7C4C5FF5B8E7E5DE0148A96A5ED8CBC72C352775B5F81D?i=0&docs=1&s=1 HTTP/1.1 Host: api-bd.linkscan.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:14 UTC	560	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 74 Connection: close Date: Wed, 26 Mar 2025 18:31:14 GMT X-Amzn-Trace-Id: Root=1-67e447f2-2772afcb2166c52f4d6dd37f;Parent=24144769880bd00c;Sampled=0;Lineage=1:92f4b973:0 x-amzn-RequestId: 38c3c8f5-f313-483d-a3bf-2679f9ef7eaa Access-Control-Allow-Origin: * x-amz-apigw-id: IDAt4GDrDoEEKkg= X-Cache: Miss from cloudfront Via: 1.1 983c7b4dc16774878ead1f5daf9bb81e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: Nqmt4FsnbrGMY4LaOdawko0UErr9y2SCXaoTH7idXQPsxXtFqIYjMg==
2025-03-26 18:31:14 UTC	74	IN	Data Raw: 7b 22 65 72 72 6f 72 54 79 70 65 22 3a 22 73 74 72 69 6e 67 22 2c 22 65 72 72 6f 72 4d 65 73 73 61 67 65 22 3a 22 49 6e 74 65 67 72 69 74 79 20 6d 61 74 63 68 20 66 61 69 6c 75 72 65 22 2c 22 74 72 61 63 65 22 3a 5b 5d 7d Data Ascii: {"errorType":"string","errorMessage":"Integrity match failure","trace":[]}

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:14 UTC	575	OUT	GET /flare.js HTTP/1.1 Host: track.salesflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://417-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:14 UTC	1197	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 18:31:14 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close x-guploader-uploadid: AKDAyIsEEhWAZQhlr3rjtluk5y32ovWrpdTNcshiAfickGtghtmS_qCeDJYocU0OqFH5AFdSNHclU04 x-goog-generation: 1721220840788064 x-goog-metageneration: 2 x-goog-stored-content-encoding: gzip x-goog-stored-content-length: 468 content-language: en x-goog-hash: crc32c=SndjCg== x-goog-hash: md5=uQ1qbcWz0Hk8yvnPYkH7uw== x-goog-storage-class: STANDARD expires: Wed, 26 Mar 2025 17:45:17 GMT Cache-Control: public, max-age=14400 last-modified: Wed, 17 Jul 2024 12:54:00 GMT vary: Accept-Encoding,Origin alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Age: 12553 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QQjfWrCjSHNiWHKO8EBEFu7GA1LHXM8Ji7sNohj%2FOxt7IyFouPtDnSFV0uPwibonu2Hqdk2%2FpIih6GiloIAdW7UnpZciOSjJ5475PoxOvVe3Dz6B62zYk10lLeRClJbtcMa4UYFS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15552000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 9268b94d4e3893b9-EWR
2025-03-26 18:31:14 UTC	218	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 39 32 31 35 37 26 6d 69 6e 5f 72 74 74 3d 39 30 31 35 39 26 72 74 74 5f 76 61 72 3d 32 31 30 38 38 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 33 26 72 65 63 76 5f 62 79 74 65 73 3d 31 31 34 37 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 38 38 34 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 65 64 33 38 38 66 63 34 65 64 61 33 35 31 64 38 26 74 73 3d 32 34 32 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=92157&min_rtt=90159&rtt_var=21088&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2833&recv_bytes=1147&delivery_rate=33884&cwnd=252&unsent_bytes=0&cid=ed388fc4eda351d8&ts=242&x=0"
2025-03-26 18:31:14 UTC	949	IN	Data Raw: 33 61 65 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 73 63 72 69 70 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 73 63 72 69 70 74 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 74 72 61 63 6b 2e 73 61 6c 65 73 66 6c 61 72 65 2e 63 6f 6d 2f 61 63 74 75 61 6c 5f 66 6c 61 72 65 2e 6a 73 22 3b 66 6f 72 28 76 61 72 20 6c 6f 61 64 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2c 73 63 72 69 70 74 45 6c 65 6d 65 6e 74 73 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 2c 69 3d 30 3b 69 3c 73 63 72 69 70 74 45 6c 65 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 69 2b 2b Data Ascii: 3ae"use strict";var script=document.createElement("script");script.src="https://storage.googleapis.com/track.salesflare.com/actual_flare.js";for(var loadScriptElement,scriptElements=document.getElementsByTagName("script"),i=0;i<scriptElements.length;i++
2025-03-26 18:31:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:15 UTC	611	OUT	GET /token?email=-TZ78dFJrPrKb-ps20hKux8F-FHP-UXw HTTP/1.1 Host: api.salesflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://417-kadoma.trakcid.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://417-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:16 UTC	530	IN	HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin access-control-allow-origin: https://417-kadoma.trakcid.com access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache accept-ranges: bytes x-cloud-trace-context: c1f6a2e0dd95fa6ccd10226f516f2f68 date: Wed, 26 Mar 2025 18:31:16 GMT server: Google Frontend Content-Length: 66 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 18:31:16 UTC	66	IN	Data Raw: 7b 22 74 72 61 63 6b 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 49 35 39 30 79 78 79 6b 65 2d 5a 36 4f 30 4d 6a 5f 5f 75 77 77 78 36 31 6d 4c 62 74 77 58 6d 5a 46 76 31 37 77 78 7a 50 2d 4e 37 37 4d 22 7d Data Ascii: {"tracking_token":"I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77M"}

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:16 UTC	612	OUT	GET /npm/@sentry/browser@5.29.2/build/bundle.min.js HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive Origin: https://storage.googleapis.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://storage.googleapis.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:16 UTC	776	IN	HTTP/1.1 200 OK Connection: close Content-Length: 65311 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=31536000, s-maxage=31536000, immutable Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: application/javascript; charset=utf-8 X-JSD-Version: 5.29.2 X-JSD-Version-Type: version ETag: W/"ff1f-tqCXvFcJJITCoIIqq76zHuvUrxQ" Accept-Ranges: bytes Age: 611481 Date: Wed, 26 Mar 2025 18:31:16 GMT X-Served-By: cache-fra-etou8220037-FRA, cache-ewr-kewr1740097-EWR X-Cache: HIT, MISS Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2025-03-26 18:31:16 UTC	1378	IN	Data Raw: 2f 2a 21 20 40 73 65 6e 74 72 79 2f 62 72 6f 77 73 65 72 20 35 2e 32 39 2e 32 20 28 36 62 34 66 33 30 34 29 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 67 65 74 73 65 6e 74 72 79 2f 73 65 6e 74 72 79 2d 6a 61 76 61 73 63 72 69 70 74 20 2a 2f 0a 76 61 72 20 53 65 6e 74 72 79 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 28 6e 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 6e 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 20 69 6e 20 6e 29 Data Ascii: /! @sentry/browser 5.29.2 (6b4f304) \| https://github.com/getsentry/sentry-javascript /var Sentry=function(t){var n=function(t,r){return(n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,n){t.__proto__=n}\|\|function(t,n){for(var r in n)
2025-03-26 18:31:16 UTC	1378	IN	Data Raw: 72 6f 72 45 76 65 6e 74 5d 22 3d 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 74 29 7b 72 65 74 75 72 6e 22 5b 6f 62 6a 65 63 74 20 44 4f 4d 45 72 72 6f 72 5d 22 3d 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 74 29 7b 72 65 74 75 72 6e 22 5b 6f 62 6a 65 63 74 20 53 74 72 69 6e 67 5d 22 3d 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 79 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 74 7c 7c 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 74 26 26 22 66 75 6e 63 74 69 Data Ascii: rorEvent]"===Object.prototype.toString.call(t)}function d(t){return"[object DOMError]"===Object.prototype.toString.call(t)}function p(t){return"[object String]"===Object.prototype.toString.call(t)}function y(t){return null===t\|\|"object"!=typeof t&&"functi
2025-03-26 18:31:16 UTC	1378	IN	Data Raw: 65 72 69 74 79 3d 7b 7d 29 29 2e 46 61 74 61 6c 3d 22 66 61 74 61 6c 22 2c 6f 2e 45 72 72 6f 72 3d 22 65 72 72 6f 72 22 2c 6f 2e 57 61 72 6e 69 6e 67 3d 22 77 61 72 6e 69 6e 67 22 2c 6f 2e 4c 6f 67 3d 22 6c 6f 67 22 2c 6f 2e 49 6e 66 6f 3d 22 69 6e 66 6f 22 2c 6f 2e 44 65 62 75 67 3d 22 64 65 62 75 67 22 2c 6f 2e 43 72 69 74 69 63 61 6c 3d 22 63 72 69 74 69 63 61 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 66 72 6f 6d 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 73 77 69 74 63 68 28 6e 29 7b 63 61 73 65 22 64 65 62 75 67 22 3a 72 65 74 75 72 6e 20 74 2e 44 65 62 75 67 3b 63 61 73 65 22 69 6e 66 6f 22 3a 72 65 74 75 72 6e 20 74 2e 49 6e 66 6f 3b 63 61 73 65 22 77 61 72 6e 22 3a 63 61 73 65 22 77 61 72 6e 69 6e 67 22 3a 72 65 74 75 72 6e Data Ascii: erity={})).Fatal="fatal",o.Error="error",o.Warning="warning",o.Log="log",o.Info="info",o.Debug="debug",o.Critical="critical",function(t){t.fromString=function(n){switch(n){case"debug":return t.Debug;case"info":return t.Info;case"warn":case"warning":return
2025-03-26 18:31:16 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 21 31 29 3b 76 61 72 20 6e 3d 74 68 69 73 2c 72 3d 6e 2e 68 6f 73 74 2c 65 3d 6e 2e 70 61 74 68 2c 69 3d 6e 2e 70 61 73 73 2c 6f 3d 6e 2e 70 6f 72 74 2c 75 3d 6e 2e 70 72 6f 6a 65 63 74 49 64 3b 72 65 74 75 72 6e 20 6e 2e 70 72 6f 74 6f 63 6f 6c 2b 22 3a 2f 2f 22 2b 6e 2e 75 73 65 72 2b 28 74 26 26 69 3f 22 3a 22 2b 69 3a 22 22 29 2b 22 40 22 2b 72 2b 28 6f 3f 22 3a 22 2b 6f 3a 22 22 29 2b 22 2f 22 2b 28 65 3f 65 2b 22 2f 22 3a 65 29 2b 75 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 53 2e 65 78 65 63 28 74 29 3b 69 66 28 21 6e 29 74 68 72 6f 77 20 6e 65 77 20 6b 28 22 49 6e 76 61 6c 69 64 20 44 73 6e 22 29 3b 76 61 72 Data Ascii: function(t){void 0===t&&(t=!1);var n=this,r=n.host,e=n.path,i=n.pass,o=n.port,u=n.projectId;return n.protocol+"://"+n.user+(t&&i?":"+i:"")+"@"+r+(o?":"+o:"")+"/"+(e?e+"/":e)+u},t.prototype.t=function(t){var n=S.exec(t);if(!n)throw new k("Invalid Dsn");var
2025-03-26 18:31:16 UTC	1378	IN	Data Raw: 66 28 74 68 69 73 2e 73 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 20 74 68 69 73 2e 73 2e 70 75 73 68 28 74 29 2c 21 31 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 75 6e 6d 65 6d 6f 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 68 69 73 2e 75 29 74 68 69 73 2e 73 2e 64 65 6c 65 74 65 28 74 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 74 68 69 73 2e 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 74 68 69 73 2e 73 5b 6e 5d 3d 3d 3d 74 29 7b 74 68 69 73 2e 73 2e 73 70 6c 69 63 65 28 6e 2c 31 29 3b 62 72 65 61 6b 7d 7d 2c 74 7d 28 29 2c 44 3d 22 3c 61 6e 6f 6e 79 6d 6f 75 73 3e 22 3b 66 75 6e 63 74 69 6f 6e 20 52 28 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d Data Ascii: f(this.s[n]===t)return!0}return this.s.push(t),!1},t.prototype.unmemoize=function(t){if(this.u)this.s.delete(t);else for(var n=0;n<this.s.length;n++)if(this.s[n]===t){this.s.splice(n,1);break}},t}(),D="<anonymous>";function R(t){try{return t&&"function"==
2025-03-26 18:31:16 UTC	1378	IN	Data Raw: 65 64 22 21 3d 74 79 70 65 6f 66 20 43 75 73 74 6f 6d 45 76 65 6e 74 26 26 45 28 74 2c 43 75 73 74 6f 6d 45 76 65 6e 74 29 26 26 28 6f 2e 64 65 74 61 69 6c 3d 69 2e 64 65 74 61 69 6c 29 2c 69 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 69 2c 65 29 26 26 28 6f 5b 65 5d 3d 69 29 3b 72 65 74 75 72 6e 20 6f 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 71 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 7e 2d 65 6e 63 6f 64 65 55 52 49 28 74 29 2e 73 70 6c 69 74 28 2f 25 2e 2e 7c 2e 2f 29 2e 6c 65 6e 67 74 68 7d 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 66 75 6e 63 74 69 6f 6e 20 4c 28 74 2c 6e 2c 72 29 7b 76 6f 69 64 20 30 Data Ascii: ed"!=typeof CustomEvent&&E(t,CustomEvent)&&(o.detail=i.detail),i)Object.prototype.hasOwnProperty.call(i,e)&&(o[e]=i);return o}return t}function q(t){return function(t){return~-encodeURI(t).split(/%..\|./).length}(JSON.stringify(t))}function L(t,n,r){void 0
2025-03-26 18:31:16 UTC	1378	IN	Data Raw: 3d 48 28 73 2c 6f 5b 73 5d 2c 72 2d 31 2c 65 29 29 3b 72 65 74 75 72 6e 20 65 2e 75 6e 6d 65 6d 6f 69 7a 65 28 6e 29 2c 75 7d 66 75 6e 63 74 69 6f 6e 20 50 28 74 2c 6e 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 70 61 72 73 65 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 48 28 74 2c 72 2c 6e 29 7d 29 29 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 22 2a 2a 6e 6f 6e 2d 73 65 72 69 61 6c 69 7a 61 62 6c 65 2a 2a 22 7d 7d 66 75 6e 63 74 69 6f 6e 20 46 28 74 2c 6e 29 7b 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 34 30 29 3b 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 43 28 74 29 29 3b 69 66 28 72 2e 73 6f 72 74 28 29 2c 21 72 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 Data Ascii: =H(s,o[s],r-1,e));return e.unmemoize(n),u}function P(t,n){try{return JSON.parse(JSON.stringify(t,function(t,r){return H(t,r,n)}))}catch(t){return"non-serializable"}}function F(t,n){void 0===n&&(n=40);var r=Object.keys(C(t));if(r.sort(),!r.length)retur
2025-03-26 18:31:16 UTC	1378	IN	Data Raw: 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 47 28 74 29 7b 69 66 28 21 74 29 72 65 74 75 72 6e 7b 7d 3b 76 61 72 20 6e 3d 74 2e 6d 61 74 63 68 28 2f 5e 28 28 5b 5e 3a 5c 2f 3f 23 5d 2b 29 3a 29 3f 28 5c 2f 5c 2f 28 5b 5e 5c 2f 3f 23 5d 2a 29 29 3f 28 5b 5e 3f 23 5d 2a 29 28 5c 3f 28 5b 5e 23 5d 2a 29 29 3f 28 23 28 2e 2a 29 29 3f 24 2f 29 3b 69 66 28 21 6e 29 72 65 74 75 72 6e 7b 7d 3b 76 61 72 20 72 3d 6e 5b 36 5d 7c 7c 22 22 2c 65 3d 6e 5b 38 5d 7c 7c 22 22 3b 72 65 74 75 72 6e 7b 68 6f 73 74 3a 6e 5b 34 5d 2c 70 61 74 68 3a 6e 5b 35 5d 2c 70 72 6f 74 6f 63 6f 6c 3a 6e 5b 32 5d 2c 72 65 6c 61 74 69 76 65 3a 6e 5b 35 5d 2b 72 2b 65 7d 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 74 29 7b 69 66 28 74 2e 6d 65 73 73 61 67 65 29 72 65 74 75 72 6e 20 74 2e 6d 65 73 73 61 Data Ascii: )})}function G(t){if(!t)return{};var n=t.match(/^(([^:\/?#]+):)?(\/\/([^\/?#]))?([^?#])(\?([^#]))?(#(.))?$/);if(!n)return{};var r=n[6]\|\|"",e=n[8]\|\|"";return{host:n[4],path:n[5],protocol:n[2],relative:n[5]+r+e}}function z(t){if(t.message)return t.messa
2025-03-26 18:31:16 UTC	1378	IN	Data Raw: 21 30 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 6f 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 5b 6e 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 74 68 69 73 2e 76 26 26 56 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5a 2e 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 74 74 2b 22 5b 4c 6f 67 5d 3a 20 22 2b 74 2e 6a 6f 69 6e 28 22 20 22 29 29 7d 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 77 61 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 5b 6e 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 74 68 69 73 2e 76 26 26 56 28 66 75 6e 63 74 69 Data Ascii: !0},t.prototype.log=function(){for(var t=[],n=0;n<arguments.length;n++)t[n]=arguments[n];this.v&&V(function(){Z.console.log(tt+"[Log]: "+t.join(" "))})},t.prototype.warn=function(){for(var t=[],n=0;n<arguments.length;n++)t[n]=arguments[n];this.v&&V(functi
2025-03-26 18:31:16 UTC	1378	IN	Data Raw: 2e 62 69 6e 64 28 6e 75 6c 6c 2c 22 64 6f 6d 22 29 29 2c 21 31 29 2c 73 74 2e 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6b 65 79 70 72 65 73 73 22 2c 67 74 28 76 74 2e 62 69 6e 64 28 6e 75 6c 6c 2c 22 64 6f 6d 22 29 29 2c 21 31 29 2c 5b 22 45 76 65 6e 74 54 61 72 67 65 74 22 2c 22 4e 6f 64 65 22 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 73 74 5b 74 5d 26 26 73 74 5b 74 5d 2e 70 72 6f 74 6f 74 79 70 65 3b 6e 26 26 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 26 26 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 29 26 26 28 41 28 6e 2c 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: .bind(null,"dom")),!1),st.document.addEventListener("keypress",gt(vt.bind(null,"dom")),!1),["EventTarget","Node"].forEach(function(t){var n=st[t]&&st[t].prototype;n&&n.hasOwnProperty&&n.hasOwnProperty("addEventListener")&&(A(n,"addEventListener",function(

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:16 UTC	583	OUT	GET /flareprovider.js HTTP/1.1 Host: track.salesflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://storage.googleapis.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:16 UTC	1245	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 18:31:16 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close x-guploader-uploadid: AFIdbgR48F_G8lQymEZqoKpBT52_72qcne_EcvXGvm8W_HUutlGpQZSP5Ex459PEtH0y0PiDjCtnjk8 Cache-Control: public, max-age=14400 expires: Wed, 26 Mar 2025 21:15:07 GMT last-modified: Wed, 17 Jul 2024 12:54:02 GMT etag: W/"20dc9361bafa4df7c9ec1bdddeb62d02" vary: Accept-Encoding vary: Origin x-goog-generation: 1721220842789364 x-goog-metageneration: 2 x-goog-stored-content-encoding: gzip x-goog-stored-content-length: 10695 content-language: en x-goog-hash: crc32c=tqZ19A== x-goog-hash: md5=INyTYbr6TffJ7Bvd3rYtAg== x-goog-storage-class: STANDARD alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Age: 4569 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sASlsnedsgc1s0kyDkQzsJHAXSM9mwAu8LSudjDIovXrVxzfU4Iwnv0wyT2lVw8OujD3lMLc8HPJnixLXuiq1WJWDuVPI5WMKE97gJyVFwrbvo6aV1fIc8MwSpEIC2RIEWUXh1cf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15552000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 9268b9588eef43ff-EWR
2025-03-26 18:31:16 UTC	218	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 38 39 31 38 30 26 6d 69 6e 5f 72 74 74 3d 38 38 39 32 37 26 72 74 74 5f 76 61 72 3d 31 38 39 39 31 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 34 26 72 65 63 76 5f 62 79 74 65 73 3d 31 31 35 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 34 33 35 34 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 33 38 39 38 32 65 30 30 63 64 65 64 31 62 39 39 26 74 73 3d 32 35 32 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=89180&min_rtt=88927&rtt_var=18991&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1155&delivery_rate=34354&cwnd=252&unsent_bytes=0&cid=38982e00cded1b99&ts=252&x=0"
2025-03-26 18:31:16 UTC	1275	IN	Data Raw: 37 39 37 32 0d 0a 76 61 72 20 72 70 63 3b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 65 72 72 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 22 55 6e 63 61 75 67 68 74 20 53 79 6e 74 61 78 45 72 72 6f 72 3a 20 46 61 69 6c 65 64 20 74 6f 20 65 78 65 63 75 74 65 20 27 70 6f 73 74 4d 65 73 73 61 67 65 27 20 6f 6e 20 27 57 69 6e 64 6f 77 27 3a 20 49 6e 76 61 6c 69 64 20 74 61 72 67 65 74 20 6f 72 69 67 69 6e 20 27 27 20 69 6e 20 61 20 63 61 6c 6c 20 74 6f 20 27 70 6f 73 74 4d 65 73 73 61 67 65 27 2e 22 3d 3d 3d 65 2e 6d 65 73 73 61 67 65 26 26 77 69 6e 64 6f 77 2e 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 59 6f 75 20 61 72 65 20 72 75 6e 6e 69 6e 67 20 66 6c 61 72 65 2e Data Ascii: 7972var rpc;window.addEventListener("error",function(e){e.preventDefault(),"Uncaught SyntaxError: Failed to execute 'postMessage' on 'Window': Invalid target origin '' in a call to 'postMessage'."===e.message&&window.console.warn("You are running flare.
2025-03-26 18:31:16 UTC	1369	IN	Data Raw: 2c 6e 2c 74 29 7b 65 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 6e 2c 74 2c 21 31 29 7d 3b 65 6c 73 65 7b 69 66 28 21 6a 28 67 2c 22 61 74 74 61 63 68 45 76 65 6e 74 22 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 42 72 6f 77 73 65 72 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 29 3b 75 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 6e 2c 74 29 7d 2c 76 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 65 2e 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 6e 2c 74 29 7d 7d 76 61 72 20 65 2c 6f 2c 61 3d 21 31 2c 69 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 29 7b 69 66 28 21 61 29 7b 61 3d 21 30 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 69 2e 6c 65 6e 67 Data Ascii: ,n,t){e.removeEventListener(n,t,!1)};else{if(!j(g,"attachEvent"))throw new Error("Browser not supported");u=function(e,n,t){e.attachEvent("on"+n,t)},v=function(e,n,t){e.detachEvent("on"+n,t)}}var e,o,a=!1,i=[];function M(){if(!a){a=!0;for(var e=0;e<i.leng
2025-03-26 18:31:16 UTC	1369	IN	Data Raw: 20 76 6f 69 64 20 68 28 6f 2c 31 29 7d 4d 28 29 7d 7d 29 28 29 29 2c 75 28 67 2c 22 6c 6f 61 64 22 2c 4d 29 29 3b 76 61 72 20 41 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 6e 2c 74 3d 7b 7d 2c 72 3d 28 65 3d 65 2e 73 75 62 73 74 72 69 6e 67 28 31 29 2e 73 70 6c 69 74 28 22 26 22 29 29 2e 6c 65 6e 67 74 68 3b 72 2d 2d 3b 29 74 5b 28 6e 3d 65 5b 72 5d 2e 73 70 6c 69 74 28 22 3d 22 29 29 5b 30 5d 5d 3d 70 28 6e 5b 31 5d 29 3b 72 65 74 75 72 6e 20 74 7d 28 2f 78 64 6d 5f 65 3d 2f 2e 74 65 73 74 28 66 2e 73 65 61 72 63 68 29 3f 66 2e 73 65 61 72 63 68 3a 66 2e 68 61 73 68 29 3b 66 75 6e 63 74 69 6f 6e 20 52 28 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 7d 76 61 72 20 44 2c 4a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 Data Ascii: void h(o,1)}M()}})()),u(g,"load",M));var A=function(e){for(var n,t={},r=(e=e.substring(1).split("&")).length;r--;)t[(n=e[r].split("="))[0]]=p(n[1]);return t}(/xdm_e=/.test(f.search)?f.search:f.hash);function R(e){return void 0===e}var D,J=function(){var
2025-03-26 18:31:16 UTC	1369	IN	Data Raw: 49 28 74 2c 65 2e 70 72 6f 70 73 29 2c 74 2e 62 6f 72 64 65 72 3d 74 2e 66 72 61 6d 65 42 6f 72 64 65 72 3d 30 2c 74 2e 61 6c 6c 6f 77 54 72 61 6e 73 70 61 72 65 6e 63 79 3d 21 30 2c 65 2e 63 6f 6e 74 61 69 6e 65 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 65 2e 6f 6e 4c 6f 61 64 26 26 75 28 74 2c 22 6c 6f 61 64 22 2c 65 2e 6f 6e 4c 6f 61 64 29 2c 65 2e 75 73 65 50 6f 73 74 29 7b 76 61 72 20 6f 2c 61 3d 65 2e 63 6f 6e 74 61 69 6e 65 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6c 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 66 6f 72 6d 22 29 29 3b 69 66 28 61 2e 74 61 72 67 65 74 3d 74 2e 6e 61 6d 65 2c 61 2e 61 63 74 69 6f 6e 3d 72 2c 61 2e 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 2e 75 73 65 Data Ascii: I(t,e.props),t.border=t.frameBorder=0,t.allowTransparency=!0,e.container.appendChild(t),e.onLoad&&u(t,"load",e.onLoad),e.usePost){var o,a=e.container.appendChild(l.createElement("form"));if(a.target=t.name,a.action=r,a.method="POST","object"==typeof e.use
2025-03-26 18:31:16 UTC	1369	IN	Data Raw: 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 22 2b 65 2e 72 65 6d 6f 74 65 29 3b 73 77 69 74 63 68 28 65 2e 70 72 6f 74 6f 63 6f 6c 3d 74 29 7b 63 61 73 65 22 30 22 3a 69 66 28 49 28 65 2c 7b 69 6e 74 65 72 76 61 6c 3a 31 30 30 2c 64 65 6c 61 79 3a 32 65 33 2c 75 73 65 52 65 73 69 7a 65 3a 21 30 2c 75 73 65 50 61 72 65 6e 74 3a 21 31 2c 75 73 65 50 6f 6c 6c 69 6e 67 3a 21 31 7d 2c 21 30 29 2c 65 2e 69 73 48 6f 73 74 29 7b 69 66 28 21 65 2e 6c 6f 63 61 6c 29 7b 66 6f 72 28 76 61 72 20 72 2c 6f 3d 66 2e 70 72 6f 74 6f 63 6f 6c 2b 22 2f 2f 22 2b 66 2e 68 6f 73 74 2c 61 3d 6c 2e 62 6f 64 79 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 69 6d 67 22 29 2c 69 3d 61 2e 6c 65 6e 67 74 Data Ascii: hrow new Error("Access denied for "+e.remote);switch(e.protocol=t){case"0":if(I(e,{interval:100,delay:2e3,useResize:!0,useParent:!1,usePolling:!1},!0),e.isHost){if(!e.local){for(var r,o=f.protocol+"//"+f.host,a=l.body.getElementsByTagName("img"),i=a.lengt
2025-03-26 18:31:16 UTC	1369	IN	Data Raw: 28 65 29 7b 66 6f 72 28 76 61 72 20 6e 2c 74 3d 7b 69 6e 63 6f 6d 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 74 68 69 73 2e 75 70 2e 69 6e 63 6f 6d 69 6e 67 28 65 2c 6e 29 7d 2c 6f 75 74 67 6f 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 74 68 69 73 2e 64 6f 77 6e 2e 6f 75 74 67 6f 69 6e 67 28 65 2c 6e 29 7d 2c 63 61 6c 6c 62 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 75 70 2e 63 61 6c 6c 62 61 63 6b 28 65 29 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 64 6f 77 6e 2e 69 6e 69 74 28 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 64 6f 77 6e 2e 64 65 73 74 72 6f 79 28 29 7d 7d 2c 72 3d 30 2c 6f 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 6f 3b 72 2b 2b 29 49 28 6e 3d Data Ascii: (e){for(var n,t={incoming:function(e,n){this.up.incoming(e,n)},outgoing:function(e,n){this.down.outgoing(e,n)},callback:function(e){this.up.callback(e)},init:function(){this.down.init()},destroy:function(){this.down.destroy()}},r=0,o=e.length;r<o;r++)I(n=
2025-03-26 18:31:16 UTC	1369	IN	Data Raw: 28 29 7d 2c 6f 2e 69 6e 69 74 28 29 7d 2c 53 2e 73 74 61 63 6b 2e 53 61 6d 65 4f 72 69 67 69 6e 54 72 61 6e 73 70 6f 72 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 2c 72 2c 6f 3b 72 65 74 75 72 6e 20 6e 3d 7b 6f 75 74 67 6f 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 72 28 65 29 2c 74 26 26 74 28 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 2c 74 3d 6e 75 6c 6c 29 7d 2c 6f 6e 44 4f 4d 52 65 61 64 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 3d 50 28 65 2e 72 65 6d 6f 74 65 29 2c 65 2e 69 73 48 6f 73 74 3f 28 49 28 65 2e 70 72 6f 70 73 2c 7b 73 72 63 3a 43 28 65 2e 72 65 6d 6f 74 65 2c 7b 78 64 6d 5f 65 3a 66 2e Data Ascii: ()},o.init()},S.stack.SameOriginTransport=function(e){var n,t,r,o;return n={outgoing:function(e,n,t){r(e),t&&t()},destroy:function(){t&&(t.parentNode.removeChild(t),t=null)},onDOMReady:function(){o=P(e.remote),e.isHost?(I(e.props,{src:C(e.remote,{xdm_e:f.
2025-03-26 18:31:16 UTC	1369	IN	Data Raw: 6c 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 29 29 3b 76 61 72 20 72 3d 22 63 61 6c 6c 62 61 63 6b 3d 66 6c 61 73 68 5f 6c 6f 61 64 65 64 22 2b 64 28 74 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 2d 2e 5d 2f 67 2c 22 5f 22 29 29 2b 22 26 70 72 6f 74 6f 3d 22 2b 79 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2b 22 26 64 6f 6d 61 69 6e 3d 22 2b 64 28 4e 28 79 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 29 2b 22 26 70 6f 72 74 3d 22 2b 64 28 79 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 6d 61 74 63 68 28 5f 29 5b 34 5d 7c 7c 22 22 29 2b 22 26 6e 73 3d 22 2b 64 28 78 29 3b 63 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 6f 62 6a 65 63 74 20 68 65 69 67 68 74 3d 27 32 30 27 20 77 69 64 74 68 3d 27 32 30 27 20 74 79 70 65 3d 27 61 70 70 6c 69 63 Data Ascii: l.body.appendChild(c));var r="callback=flash_loaded"+d(t.replace(/[\-.]/g,"_"))+"&proto="+y.location.protocol+"&domain="+d(N(y.location.href))+"&port="+d(y.location.href.match(_)[4]\|\|"")+"&ns="+d(x);c.innerHTML="<object height='20' width='20' type='applic
2025-03-26 18:31:16 UTC	1369	IN	Data Raw: 6f 29 29 7d 76 61 72 20 6e 3d 4e 28 6f 2e 73 77 66 29 3b 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 26 26 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 2e 69 6e 69 74 3f 65 28 29 3a 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 3f 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 2e 71 75 65 75 65 2e 70 75 73 68 28 65 29 3a 28 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 3d 7b 71 75 65 75 65 3a 5b 65 5d 7d 2c 75 28 6e 29 29 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 28 74 2e 6f 6e 44 4f 4d 52 65 61 64 79 2c 74 29 7d 7d 7d 2c 53 2e 73 74 61 63 6b 2e 50 6f 73 74 4d 65 73 73 61 67 65 54 72 61 6e 73 70 Data Ascii: o))}var n=N(o.swf);S.stack.FlashTransport[n]&&S.stack.FlashTransport[n].init?e():S.stack.FlashTransport[n]?S.stack.FlashTransport[n].queue.push(e):(S.stack.FlashTransport[n]={queue:[e]},u(n))},init:function(){F(t.onDOMReady,t)}}},S.stack.PostMessageTransp

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:16 UTC	905	OUT	GET /favicon.ico HTTP/1.1 Host: 417-kadoma.trakcid.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://417-kadoma.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1SwCAMAOCngZFLwq8DQxfOV3BMgRz1rLUtVc-n92s5JIlBdM8YHb2kBOD1yBFsSKuVFqFj99wEQYJgTALg2ektE5AHSwGRALwh4mQDeU5rRamsHGztdxx7N_XQH3nM-XUruygqisr9js388KznOqa5HkUlzrdXRUVfeWm8Kwd3Px_ezOef_s70HwAA__8Z8zBA&e=-TZ78dFJrPrKb-ps20hKux8F-FHP-UXw&cee=dmJpcmRAbWxjbi5jYQ== Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:17 UTC	761	IN	HTTP/1.1 404 Not Found x-guploader-uploadid: AKDAyIsEIoe2cEqEKB8s307bIGhCEhZ36ENO5EHoIfor5ISIij6o4OWf8iGdPfG3DlP5gEE x-goog-generation: 1737365220799885 x-goog-metageneration: 1 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 2016 x-goog-hash: crc32c=Xo/u5A== x-goog-hash: md5=NbUJd4kMWd2HU2RHYB/z2Q== x-goog-storage-class: STANDARD accept-ranges: bytes Content-Length: 2016 server: UploadServer via: 1.1 google date: Wed, 26 Mar 2025 18:31:16 GMT expires: Wed, 26 Mar 2025 19:31:16 GMT Cache-Control: public, max-age=3600 Last-Modified: Mon, 20 Jan 2025 09:27:00 GMT ETag: "35b50977890c59dd87536447601ff3d9" Content-Type: text/html Age: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 18:31:17 UTC	236	IN	Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 73 74 79 6c 65 2d 73 72 63 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 69 6d 67 2d 73 72 63 20 64 61 74 61 3a 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 22 3e 0a 3c 74 Data Ascii: <!DOCTYPE html><html><head><meta http-equiv="Content-type" content="text/html; charset=utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'"><t
2025-03-26 18:31:17 UTC	997	IN	Data Raw: 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 6d 69 64 64 6f 74 3b 20 47 69 74 48 75 62 20 50 61 67 65 73 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 3e 0a 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 31 66 31 66 31 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 20 6d 61 Data Ascii: itle>Page not found · GitHub Pages</title><style type="text/css" media="screen"> body { background-color: #f1f1f1; margin: 0; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; } .container { ma
2025-03-26 18:31:17 UTC	783	IN	Data Raw: 2d 6d 6f 7a 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 20 32 29 2c 0a 20 20 20 20 20 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 20 20 20 20 20 2d 6f 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 20 32 2f 31 29 2c 0a 20 20 20 20 20 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 20 20 20 20 20 20 20 20 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 20 32 29 2c 0a 20 20 20 20 20 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 20 31 39 32 64 70 69 29 2c 0a 20 20 20 20 20 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e Data Ascii: -moz-device-pixel-ratio: 2), only screen and ( -o-min-device-pixel-ratio: 2/1), only screen and ( min-device-pixel-ratio: 2), only screen and ( min-resolution: 192dpi), only screen and ( min

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:17 UTC	531	OUT	OPTIONS /devices HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: authorization Origin: https://417-kadoma.trakcid.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://417-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:17 UTC	660	IN	HTTP/1.1 204 No Content access-control-allow-origin: https://417-kadoma.trakcid.com access-control-allow-methods: POST access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-salesflare-client,x-result-count,x-salesflare-actor access-control-max-age: 86400 access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: 98e284b2ccacf7d4268551fb30cf68ac date: Wed, 26 Mar 2025 18:31:17 GMT content-type: text/html server: Google Frontend Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:17 UTC	703	OUT	POST /devices HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Content-Length: 2 sec-ch-ua-platform: "Windows" Authorization: Bearer I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://417-kadoma.trakcid.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://417-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:17 UTC	2	OUT	Data Raw: 7b 7d Data Ascii: {}
2025-03-26 18:31:17 UTC	508	IN	HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin access-control-allow-origin: https://417-kadoma.trakcid.com access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: 96a4021198e742f1f6a5cd6f0910ff10 date: Wed, 26 Mar 2025 18:31:17 GMT server: Google Frontend Content-Length: 16 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 18:31:17 UTC	16	IN	Data Raw: 7b 22 69 64 22 3a 32 38 32 31 33 34 34 30 34 7d Data Ascii: {"id":282134404}

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:18 UTC	532	OUT	OPTIONS /contacts HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: authorization Origin: https://417-kadoma.trakcid.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://417-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:18 UTC	660	IN	HTTP/1.1 204 No Content access-control-allow-origin: https://417-kadoma.trakcid.com access-control-allow-methods: POST access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,x-salesflare-client,x-result-count,x-salesflare-actor access-control-max-age: 86400 access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: c51a2dbb70dcf007ce10cd94a0491ae1 date: Wed, 26 Mar 2025 18:31:18 GMT content-type: text/html server: Google Frontend Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:18 UTC	389	OUT	GET /devices HTTP/1.1 Host: api.salesflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:18 UTC	454	IN	HTTP/1.1 404 Not Found content-type: application/json; charset=utf-8 vary: origin access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: 081883811bc407f048fe7f94f5dd8ff0 date: Wed, 26 Mar 2025 18:31:18 GMT server: Google Frontend Content-Length: 60 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 18:31:18 UTC	60	IN	Data Raw: 7b 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"statusCode":404,"error":"Not Found","message":"Not Found"}

Timestamp	Bytes transferred	Direction	Data
2025-03-26 18:31:18 UTC	705	OUT	POST /contacts HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Content-Length: 25 sec-ch-ua-platform: "Windows" Authorization: Bearer I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://417-kadoma.trakcid.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://417-kadoma.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 18:31:18 UTC	25	OUT	Data Raw: 7b 22 65 6d 61 69 6c 22 3a 22 76 62 69 72 64 40 6d 6c 63 6e 2e 63 61 22 7d Data Ascii: {"email":"vbird@mlcn.ca"}
2025-03-26 18:31:19 UTC	508	IN	HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin access-control-allow-origin: https://417-kadoma.trakcid.com access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache x-cloud-trace-context: cdedbbd7b061b6b280e1fdbed6f726d4 date: Wed, 26 Mar 2025 18:31:18 GMT server: Google Frontend Content-Length: 16 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-26 18:31:19 UTC	16	IN	Data Raw: 7b 22 69 64 22 3a 32 38 32 31 31 39 34 38 32 7d Data Ascii: {"id":282119482}