Edit tour

Windows Analysis Report
ATT02683-1.pdf

Overview

General Information

Sample name:	ATT02683-1.pdf
Analysis ID:	1651325
MD5:	a4a6bf122a40c786167139ebbee00dd6
SHA1:	d63b4637e9c191a9d928d462f54bbd096dd04506
SHA256:	0c524d9172f76c24e1b447b45bfe9b6247747d5da4d54617bf799169040559b4
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Suspicious PDF detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 2124 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ATT02683-1.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7468 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1568 --field-trial-handle=1592,i,12400266079713897631,14009047620774179367,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 3272 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2084,i,4870177890477679022,12051313417838869628,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR*~*QDbCTYpyf7Kpg76m37bziMOmf7Su4H/og75AU8ZcfMW5hMR*~*OYOLOYOL416mf1Bzf1W9fLcy4X/ogDZDWrRqRp4qXsiKi5BCY5OIW0KGY5Sz46uOY2Ski6iLW709Y0Wf310n12SSi6SYZX56Rq3DYolyisSAi04IT2J6X6V/g0qHfZKH08WtZ7Wv31i*~*W1/y3pcq12WtRriI075DTJxCfJt/g6SGWrmfRIOyh5KCjsmw1p0RfsSMi7SwX0SH0L9/iJWx1rC/gMWCSYSw28mNX0O6V2Go1o3DT2SRhs4ojpWpRsKNX5mGYKm*~*TLRDZMJ7T24NjYq7SE0pS0t5i1CO38ioZJWvXoSrR0cYT0cKjoWJVZKJ26bCRJcTYpJr4Y6B0qWr07msSKhB0qWf0Zb/RZuBYomshEqZR76v48370n4o41Zc10iXfLO0Vsuf1J3C10iwi1OzgE5=d/GK8798a6JI5Hb98G7cc6KHJ*~*c7HI*~*8cIG9*~*HH5cG9H7ca/J97/b8J7IFb8JbGIG?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzo0MWYxYjc0YzQ1OTdmZDNkNjQ4YWYwYjFkYTdjMDZjNjo3OjM5YWE6M2U0NTliZTExYzhiZDAxZWU2ZTQ2NTIyNTJiYzg4NGUzYzEwMGRmNGM2YTg1ZDVjNDQ3MjgwZjBlNjZmYjhlMTpoOlQ6VA" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'REVIEW DOCUMENT & READ MESSAGE' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'review document & read message'

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: Docusign You have a new document available for cmordas@pierceatwood.com REVIEW DOCUMENT & READ MESSAGE Approval Status All parties have completed and Docu-Signed all pending documents. File Name:Action required Message Confidentiality Agreement executed.pdf Status: (2/3) Completed (Sign where necessary) Please review the attached document, sign pages 4-5, and initial all pages before the next payment run. Thank you for your support. Your organization uses DocuSign to electronically sign documents. After signing, you can download PDF copies of the signed documents. This is an automated electronic communication. Do not reply to this mailbox. I Copyright 0 2025 DocuSign Corporation and/or its subsidiaries or affiliates. All Rights Reserved. I Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 DocuSign To stop receiving this notification for this document, click here.

Source: https://199-kadomaco.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRuApcZ629sLrvczDd2qHKHALXz8c2Pq69vHy9v75d5Z4ulIcwcPDjJ3f1_S9_Ez4DAAD__10ONNA&e=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V&cee=YWRhbUBzZXF1YWkubno=	HTTP Parser: No favicon
Source: https://office.promedlhs.com/VqbmPWicBXOHJW	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 142.251.40.196:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.102.114:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.102.114:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.66:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.12:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.49:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.73.226:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.73.226:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.150:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.254.174:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.150:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.187.31:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.254.174:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.180.34:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.180.34:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.146.54:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.6:49758 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: protect.checkpoint.com to https://lsems.gravityzone.bitdefender.com/scan/ahr0chm6ly8xotkta2fkb21hy28udhjha2npzc5jb20vp3u9ahr0chm6jtjgjtjgzw1hawwuawr4ag9tzs5jbyuyrmmlmkzlsndfd0wxt0jdrvfbt0nuz1pjtxnfd1dgr2v4tvraywviwxnnd1ntus01mlyytjgtdnnvdvzdoxe1s1q5bvlcaufcv3rou2rqywd6rw5tyk9lwxrommddv20yoesxaeo5b1nbrmhamdjtc0fxenhrwkvmannhd2nrsvncvg45derswmx5bhrxntnrx3hisvj1qxbjwjyyoxnmcnzjekrkmnfis0hbtfh6ogmyuhe2oxzietl2nzvknvo0dwxjy3djuerqsjnmmv9tov9fejrequfex18xme9otkemzt1wvlrmv2hnnfcwvlravu85mupwtjhnczlum21qz3y2vizjzwu9wvdsagjvqnpaweyxwvdrdwjubz0=/5bf324371ed0c843b2991fce692cd639db46cc09b4c2975e42583e2da83e8bdb?c=1&i=1&docs=1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: email.idxhome.co to https://office.promedlhs.com/vqbmpwicbxohjw

Source: Joe Sandbox View	IP Address: 104.18.187.31 104.18.187.31
Source: Joe Sandbox View	IP Address: 172.66.43.150 172.66.43.150
Source: Joe Sandbox View	IP Address: 13.249.91.19 13.249.91.19
Source: Joe Sandbox View	IP Address: 23.216.136.238 23.216.136.238
Source: Joe Sandbox View	IP Address: 23.216.136.238 23.216.136.238

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.131
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.131
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 20.191.45.158
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDbCTYpyf7Kpg76m37bziMOmf7Su4H/og75AU8ZcfMW5hMR~OYOLOYOL416mf1Bzf1W9fLcy4X/ogDZDWrRqRp4qXsiKi5BCY5OIW0KGY5Sz46uOY2Ski6iLW709Y0Wf310n12SSi6SYZX56Rq3DYolyisSAi04IT2J6X6V/g0qHfZKH08WtZ7Wv31i~W1/y3pcq12WtRriI075DTJxCfJt/g6SGWrmfRIOyh5KCjsmw1p0RfsSMi7SwX0SH0L9/iJWx1rC/gMWCSYSw28mNX0O6V2Go1o3DT2SRhs4ojpWpRsKNX5mGYKm~TLRDZMJ7T24NjYq7SE0pS0t5i1CO38ioZJWvXoSrR0cYT0cKjoWJVZKJ26bCRJcTYpJr4Y6B0qWr07msSKhB0qWf0Zb/RZuBYomshEqZR76v48370n4o41Zc10iXfLO0Vsuf1J3C10iwi1OzgE5=d/GK8798a6JI5Hb98G7cc6KHJ~c7HI~8cIG9~HH5cG9H7ca/J97/b8J7IFb8JbGIG?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzo0MWYxYjc0YzQ1OTdmZDNkNjQ4YWYwYjFkYTdjMDZjNjo3OjM5YWE6M2U0NTliZTExYzhiZDAxZWU2ZTQ2NTIyNTJiYzg4NGUzYzEwMGRmNGM2YTg1ZDVjNDQ3MjgwZjBlNjZmYjhlMTpoOlQ6VA HTTP/1.1Host: protect.checkpoint.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1 HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index.css HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main.3dfe9f5e.css HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/main.d62e4927.js HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?i=0&docs=1&s=1 HTTP/1.1Host: api-bd.linkscan.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, /sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"X-Original-Referer: unknownsec-ch-ua-mobile: ?0Origin: https://lsems.gravityzone.bitdefender.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsems.gravityzone.bitdefender.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /manifest.json HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: lsems.gravityzone.bitdefender.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?i=0&docs=1&s=1 HTTP/1.1Host: api-bd.linkscan.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRuApcZ629sLrvczDd2qHKHALXz8c2Pq69vHy9v75d5Z4ulIcwcPDjJ3f1_S9_Ez4DAAD__10ONNA&e=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V&cee=YWRhbUBzZXF1YWkubno= HTTP/1.1Host: 199-kadomaco.trakcid.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://lsems.gravityzone.bitdefender.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /flare.js HTTP/1.1Host: track.salesflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://199-kadomaco.trakcid.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /token?email=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V HTTP/1.1Host: api.salesflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://199-kadomaco.trakcid.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://199-kadomaco.trakcid.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /flareprovider.js HTTP/1.1Host: track.salesflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://storage.googleapis.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/@sentry/browser@5.29.2/build/bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveOrigin: https://storage.googleapis.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://storage.googleapis.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /token?email=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V HTTP/1.1Host: api.salesflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 199-kadomaco.trakcid.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://199-kadomaco.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRuApcZ629sLrvczDd2qHKHALXz8c2Pq69vHy9v75d5Z4ulIcwcPDjJ3f1_S9_Ez4DAAD__10ONNA&e=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V&cee=YWRhbUBzZXF1YWkubno=Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/eJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRuApcZ629sLrvczDd2qHKHALXz8c2Pq69vHy9v75d5Z4ulIcwcPDjJ3f1_S9_Ez4DAAD__10ONNA HTTP/1.1Host: email.idxhome.coConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://199-kadomaco.trakcid.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /VqbmPWicBXOHJW HTTP/1.1Host: office.promedlhs.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://199-kadomaco.trakcid.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: office.promedlhs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://office.promedlhs.com/VqbmPWicBXOHJWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: protect.checkpoint.com
Source: global traffic	DNS traffic detected: DNS query: lsems.gravityzone.bitdefender.com
Source: global traffic	DNS traffic detected: DNS query: api-bd.linkscan.io
Source: global traffic	DNS traffic detected: DNS query: 199-kadomaco.trakcid.com
Source: global traffic	DNS traffic detected: DNS query: track.salesflare.com
Source: global traffic	DNS traffic detected: DNS query: api.salesflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: email.idxhome.co
Source: global traffic	DNS traffic detected: DNS query: office.promedlhs.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=et94G89Q6FOEL1uzIs5QFJo5MDuHeGfRVJilrnkzXsoaNAyxrRT8oMgkWCQ4V5eAHwHuLDs9ZLqa6c8pvneFOR4QUMKLtj2sIrPTUETuAKsTwh54aQFmqxhmz87x9YwKgYS3eteNWg%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 439Content-Type: application/reports+jsonOrigin: https://office.promedlhs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-guploader-uploadid: AKDAyIt6o5TQUlGqXIukHwLZl2j610oAI3MALXebnWEpuz4H6Qo3x3x-3hvxZPze4QTcOyYx-goog-generation: 1737365220799885x-goog-metageneration: 1x-goog-stored-content-encoding: identityx-goog-stored-content-length: 2016x-goog-hash: crc32c=Xo/u5A==x-goog-hash: md5=NbUJd4kMWd2HU2RHYB/z2Q==x-goog-storage-class: STANDARDaccept-ranges: bytesContent-Length: 2016server: UploadServervia: 1.1 googledate: Fri, 28 Mar 2025 15:39:38 GMTexpires: Fri, 28 Mar 2025 16:39:38 GMTCache-Control: public, max-age=3600Last-Modified: Mon, 20 Jan 2025 09:27:00 GMTETag: "35b50977890c59dd87536447601ff3d9"Content-Type: text/htmlAge: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service Unavailablecontent-type: text/plainx-cloud-trace-context: a088d5a31ed034ee35ecff122df2732bdate: Fri, 28 Mar 2025 15:39:50 GMTserver: Google FrontendContent-Length: 19Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service Unavailablecontent-type: text/plainx-cloud-trace-context: 449a2da73246ddf5cf7be5d9f716b459date: Fri, 28 Mar 2025 15:39:50 GMTserver: Google FrontendContent-Length: 19Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.4.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_198.10.dr	String found in binary or memory: https://199-kadomaco.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1OBCEQAOCngZIMs_wWFGexM
Source: chromecache_200.10.dr	String found in binary or memory: https://app.salesflare.com/#/signup/?campaign=
Source: chromecache_200.10.dr	String found in binary or memory: https://app.salesflare.com/#/signup/?campaign=-trackinglinks-landingpage
Source: chromecache_208.10.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/
Source: chromecache_199.10.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:100
Source: chromecache_200.10.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:400
Source: chromecache_199.10.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Raleway:400
Source: chromecache_199.10.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:100
Source: chromecache_196.10.dr, chromecache_210.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
Source: chromecache_196.10.dr, chromecache_210.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
Source: chromecache_196.10.dr, chromecache_210.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
Source: chromecache_196.10.dr, chromecache_210.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
Source: chromecache_196.10.dr, chromecache_210.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
Source: chromecache_192.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyC0ITw.woff2)
Source: chromecache_192.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCAIT5lu.woff2)
Source: chromecache_192.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCIIT5lu.woff2)
Source: chromecache_192.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCMIT5lu.woff2)
Source: chromecache_192.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCkIT5lu.woff2)
Source: chromecache_209.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBGEe.woff2)
Source: chromecache_209.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBGEe.woff2)
Source: chromecache_209.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBGEe.woff2)
Source: chromecache_209.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3KUBGEe.woff2)
Source: chromecache_209.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3OUBGEe.woff2)
Source: chromecache_209.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBGEe.woff2)
Source: chromecache_209.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2)
Source: chromecache_209.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBGEe.woff2)
Source: chromecache_209.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBGEe.woff2)
Source: chromecache_205.10.dr	String found in binary or memory: https://github.com/getsentry/sentry-javascript
Source: chromecache_200.10.dr	String found in binary or memory: https://github.com/sindresorhus/prepend-http/blob/040579fb1271df6232dd96a7600c9efb1510eb47/index.js
Source: ATT02683-1.pdf	String found in binary or memory: https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR
Source: chromecache_201.10.dr	String found in binary or memory: https://storage.googleapis.com/track.salesflare.com/actual_flare.js
Source: chromecache_198.10.dr	String found in binary or memory: https://storage.googleapis.com/track.salesflare.com/provider.html?xdm_e=https%3A%2F%2F199-kadomaco.t
Source: chromecache_200.10.dr	String found in binary or memory: https://track.salesflare.com/flare.js
Source: chromecache_208.10.dr	String found in binary or memory: https://track.salesflare.com/flareprovider.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.251.40.196:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.102.114:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.102.114:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.66:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.19:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.12:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.249.91.49:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.73.226:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.73.226:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.150:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.254.174:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.150:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.187.31:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.254.174:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.180.34:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.180.34:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.146.54:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.6:49758 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir3272_521996903

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir3272_521996903

Jump to behavior

Source: classification engine

Classification label: mal48.phis.winPDF@44/88@31/15

Source: ATT02683-1.pdf	Initial sample: https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfmw5hmr~qdbctypyf7kpg76m37bzimomf7su4h/og75au8zcfmw5hmr~oyoloyol416mf1bzf1w9flcy4x/ogdzdwrrqrp4qxsiki5bcy5oiw0kgy5sz46uoy2ski6ilw709y0wf310n12ssi6syzx56rq3dyolyissai04it2j6x6v/g0qhfzkh08wtz7wv31i~w1/y3pcq12wtrrii075dtjxcfjt/g6sgwrmfrioyh5kcjsmw1p0rfssmi7swx0sh0l9/ijwx1rc/gmwcsysw28mnx0o6v2go1o3dt2srhs4ojpwprsknx5mgykm~tlrdzmj7t24njyq7se0ps0t5i1co38iozjwvxosrr0cyt0ckjowjvzkj26bcrjctypjr4y6b0qwr07msskhb0qwf0zb/rzubyomsheqzr76v48370n4o41zc10ixflo0vsuf1j3c10iwi1ozge5=d/gk8798a6ji5hb98g7cc6khj~c7hi~8cig9~hh5cg9h7ca/j97/b8j7ifb8jbgig?h=6&fru;n=6&fru;ithx=6___.yzjlomdhbmdzdgvyomm6bzo0mwyxyjc0yzq1otdmzdnknjq4ywywyjfkytdjmdzjnjo3ojm5ywe6m2u0ntliztexyzhizdaxzwu2ztq2ntiyntjiyzg4nguzyzewmgrmngm2ytg1zdvjndq3mjgwzjblnjzmyjhlmtpoolq6va
Source: ATT02683-1.pdf	Initial sample: https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDbCTYpyf7Kpg76m37bziMOmf7Su4H/og75AU8ZcfMW5hMR~OYOLOYOL416mf1Bzf1W9fLcy4X/ogDZDWrRqRp4qXsiKi5BCY5OIW0KGY5Sz46uOY2Ski6iLW709Y0Wf310n12SSi6SYZX56Rq3DYolyisSAi04IT2J6X6V/g0qHfZKH08WtZ7Wv31i~W1/y3pcq12WtRriI075DTJxCfJt/g6SGWrmfRIOyh5KCjsmw1p0RfsSMi7SwX0SH0L9/iJWx1rC/gMWCSYSw28mNX0O6V2Go1o3DT2SRhs4ojpWpRsKNX5mGYKm~TLRDZMJ7T24NjYq7SE0pS0t5i1CO38ioZJWvXoSrR0cYT0cKjoWJVZKJ26bCRJcTYpJr4Y6B0qWr07msSKhB0qWf0Zb/RZuBYomshEqZR76v48370n4o41Zc10iXfLO0Vsuf1J3C10iwi1OzgE5=d/GK8798a6JI5Hb98G7cc6KHJ~c7HI~8cIG9~HH5cG9H7ca/J97/b8J7IFb8JbGIG?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzo0MWYxYjc0YzQ1OTdmZDNkNjQ4YWYwYjFkYTdjMDZjNjo3OjM5YWE6M2U0NTliZTExYzhiZDAxZWU2ZTQ2NTIyNTJiYzg4NGUzYzEwMGRmNGM2YTg1ZDVjNDQ3MjgwZjBlNjZmYjhlMTpoOlQ6VA

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-28 11-39-00-824.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ATT02683-1.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1568 --field-trial-handle=1592,i,12400266079713897631,14009047620774179367,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2084,i,4870177890477679022,12051313417838869628,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDbCTYpyf7Kpg76m37bziMOmf7Su4H/og75AU8ZcfMW5hMR~OYOLOYOL416mf1Bzf1W9fLcy4X/ogDZDWrRqRp4qXsiKi5BCY5OIW0KGY5Sz46uOY2Ski6iLW709Y0Wf310n12SSi6SYZX56Rq3DYolyisSAi04IT2J6X6V/g0qHfZKH08WtZ7Wv31i~W1/y3pcq12WtRriI075DTJxCfJt/g6SGWrmfRIOyh5KCjsmw1p0RfsSMi7SwX0SH0L9/iJWx1rC/gMWCSYSw28mNX0O6V2Go1o3DT2SRhs4ojpWpRsKNX5mGYKm~TLRDZMJ7T24NjYq7SE0pS0t5i1CO38ioZJWvXoSrR0cYT0cKjoWJVZKJ26bCRJcTYpJr4Y6B0qWr07msSKhB0qWf0Zb/RZuBYomshEqZR76v48370n4o41Zc10iXfLO0Vsuf1J3C10iwi1OzgE5=d/GK8798a6JI5Hb98G7cc6KHJ~c7HI~8cIG9~HH5cG9H7ca/J97/b8J7IFb8JbGIG?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzo0MWYxYjc0YzQ1OTdmZDNkNjQ4YWYwYjFkYTdjMDZjNjo3OjM5YWE6M2U0NTliZTExYzhiZDAxZWU2ZTQ2NTIyNTJiYzg4NGUzYzEwMGRmNGM2YTg1ZDVjNDQ3MjgwZjBlNjZmYjhlMTpoOlQ6VA"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1568 --field-trial-handle=1592,i,12400266079713897631,14009047620774179367,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2084,i,4870177890477679022,12051313417838869628,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ATT02683-1.pdf	Initial sample: PDF keyword /JS count = 0
Source: ATT02683-1.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9uo6tuv_oy92qr_k8.tmp.2.dr	Initial sample: PDF keyword /JS count = 0
Source: A9uo6tuv_oy92qr_k8.tmp.2.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: ATT02683-1.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: ATT02683-1.pdf

Initial sample: PDF keyword obj count = 70

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ATT02683-1.pdf	0%	Virustotal		Browse

Source	Detection	Scanner	Label
https://199-kadomaco.trakcid.com/favicon.ico	0%	Avira URL Cloud	safe
https://api-bd.linkscan.io/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?i=0&docs=1&s=1	0%	Avira URL Cloud	safe
https://app.salesflare.com/#/signup/?campaign=	0%	Avira URL Cloud	safe
https://email.idxhome.co/c/eJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRuApcZ629sLrvczDd2qHKHALXz8c2Pq69vHy9v75d5Z4ulIcwcPDjJ3f1_S9_Ez4DAAD__10ONNA	0%	Avira URL Cloud	safe
https://track.salesflare.com/flare.js	0%	Avira URL Cloud	safe
https://track.salesflare.com/flareprovider.js	0%	Avira URL Cloud	safe
https://199-kadomaco.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1OBCEQAOCngZIMs_wWFGexM	0%	Avira URL Cloud	safe
https://app.salesflare.com/#/signup/?campaign=-trackinglinks-landingpage	0%	Avira URL Cloud	safe
https://office.promedlhs.com/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
api-bd.linkscan.io	13.249.91.66	true	false	high
cdn.jsdelivr.net.cdn.cloudflare.net	104.18.187.31	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
e8652.dscx.akamaiedge.net	23.216.136.238	true	false	high
d3rb3qlp6ej74d.cloudfront.net	13.249.91.19	true	false	high
d2srg6h49ykvtq.cloudfront.net	3.168.102.114	true	false	unknown
mailgun.org	34.110.180.34	true	false	high
bg.microsoft.map.fastly.net	199.232.90.172	true	false	high
track.salesflare.com	172.66.43.150	true	false	high
www.google.com	142.251.40.196	true	false	high
office.promedlhs.com	172.67.146.54	true	false	unknown
199-kadomaco.trakcid.com	34.149.73.226	true	false	unknown
api.salesflare.com	35.186.254.174	true	false	high
email.idxhome.co	unknown	unknown	false	high
x1.i.lencr.org	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
protect.checkpoint.com	unknown	unknown	false	high
lsems.gravityzone.bitdefender.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	false		high
https://office.promedlhs.com/VqbmPWicBXOHJW	false		unknown
https://api-bd.linkscan.io/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?i=0&docs=1&s=1	false	Avira URL Cloud: safe	unknown
https://199-kadomaco.trakcid.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1	false		unknown
https://a.nel.cloudflare.com/report/v4?s=et94G89Q6FOEL1uzIs5QFJo5MDuHeGfRVJilrnkzXsoaNAyxrRT8oMgkWCQ4V5eAHwHuLDs9ZLqa6c8pvneFOR4QUMKLtj2sIrPTUETuAKsTwh54aQFmqxhmz87x9YwKgYS3eteNWg%3D%3D	false		high
http://c.pki.goog/r/r4.crl	false		high
https://email.idxhome.co/c/eJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRuApcZ629sLrvczDd2qHKHALXz8c2Pq69vHy9v75d5Z4ulIcwcPDjJ3f1_S9_Ez4DAAD__10ONNA	false	Avira URL Cloud: safe	unknown
https://track.salesflare.com/flareprovider.js	false	Avira URL Cloud: safe	unknown
https://track.salesflare.com/flare.js	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/@sentry/browser@5.29.2/build/bundle.min.js	false		high
https://lsems.gravityzone.bitdefender.com/index.css	false		high
https://lsems.gravityzone.bitdefender.com/manifest.json	false		high
https://api.salesflare.com/token?email=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V	false		high
https://office.promedlhs.com/favicon.ico	false	Avira URL Cloud: safe	unknown
http://c.pki.goog/r/gsr1.crl	false		high
https://199-kadomaco.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRuApcZ629sLrvczDd2qHKHALXz8c2Pq69vHy9v75d5Z4ulIcwcPDjJ3f1_S9_Ez4DAAD__10ONNA&e=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V&cee=YWRhbUBzZXF1YWkubno=	false		unknown
https://lsems.gravityzone.bitdefender.com/static/css/main.3dfe9f5e.css	false		high
https://lsems.gravityzone.bitdefender.com/favicon.ico	false		high
https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDbCTYpyf7Kpg76m37bziMOmf7Su4H/og75AU8ZcfMW5hMR~OYOLOYOL416mf1Bzf1W9fLcy4X/ogDZDWrRqRp4qXsiKi5BCY5OIW0KGY5Sz46uOY2Ski6iLW709Y0Wf310n12SSi6SYZX56Rq3DYolyisSAi04IT2J6X6V/g0qHfZKH08WtZ7Wv31i~W1/y3pcq12WtRriI075DTJxCfJt/g6SGWrmfRIOyh5KCjsmw1p0RfsSMi7SwX0SH0L9/iJWx1rC/gMWCSYSw28mNX0O6V2Go1o3DT2SRhs4ojpWpRsKNX5mGYKm~TLRDZMJ7T24NjYq7SE0pS0t5i1CO38ioZJWvXoSrR0cYT0cKjoWJVZKJ26bCRJcTYpJr4Y6B0qWr07msSKhB0qWf0Zb/RZuBYomshEqZR76v48370n4o41Zc10iXfLO0Vsuf1J3C10iwi1OzgE5=d/GK8798a6JI5Hb98G7cc6KHJ~c7HI~8cIG9~HH5cG9H7ca/J97/b8J7IFb8JbGIG?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzo0MWYxYjc0YzQ1OTdmZDNkNjQ4YWYwYjFkYTdjMDZjNjo3OjM5YWE6M2U0NTliZTExYzhiZDAxZWU2ZTQ2NTIyNTJiYzg4NGUzYzEwMGRmNGM2YTg1ZDVjNDQ3MjgwZjBlNjZmYjhlMTpoOlQ6VA	false		high
https://lsems.gravityzone.bitdefender.com/static/js/main.d62e4927.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.jsdelivr.net/npm/	chromecache_208.10.dr	false		high
https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR	ATT02683-1.pdf	false		high
https://app.salesflare.com/#/signup/?campaign=	chromecache_200.10.dr	false	Avira URL Cloud: safe	unknown
https://199-kadomaco.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1OBCEQAOCngZIMs_wWFGexM	chromecache_198.10.dr	false	Avira URL Cloud: safe	unknown
https://github.com/sindresorhus/prepend-http/blob/040579fb1271df6232dd96a7600c9efb1510eb47/index.js	chromecache_200.10.dr	false		high
https://app.salesflare.com/#/signup/?campaign=-trackinglinks-landingpage	chromecache_200.10.dr	false	Avira URL Cloud: safe	unknown
https://github.com/getsentry/sentry-javascript	chromecache_205.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.249.91.49	unknown	United States	16509	AMAZON-02US	false
34.110.180.34	mailgun.org	United States	15169	GOOGLEUS	false
104.18.187.31	cdn.jsdelivr.net.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
13.249.91.66	api-bd.linkscan.io	United States	16509	AMAZON-02US	false
142.251.40.196	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.66.43.150	track.salesflare.com	United States	13335	CLOUDFLARENETUS	false
13.249.91.19	d3rb3qlp6ej74d.cloudfront.net	United States	16509	AMAZON-02US	false
23.216.136.238	e8652.dscx.akamaiedge.net	United States	7016	CCCH-3US	false
3.168.102.114	d2srg6h49ykvtq.cloudfront.net	United States	16509	AMAZON-02US	false
13.249.91.12	unknown	United States	16509	AMAZON-02US	false
34.149.73.226	199-kadomaco.trakcid.com	United States	2686	ATGS-MMD-ASUS	false
35.186.254.174	api.salesflare.com	United States	15169	GOOGLEUS	false
172.67.146.54	office.promedlhs.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1651325
Start date and time:	2025-03-28 16:37:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ATT02683-1.pdf
Detection:	MAL
Classification:	mal48.phis.winPDF@44/88@31/15
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 23.9.183.29, 23.51.56.185, 162.159.61.3, 172.64.41.3, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 199.232.90.172, 23.215.0.48, 23.215.0.36, 142.250.65.227, 142.251.40.174, 172.253.62.84, 142.250.81.238, 142.251.40.106, 142.250.65.195, 142.251.40.219, 142.251.40.251, 142.251.41.27, 172.217.165.155, 142.250.65.187, 142.250.65.219, 142.250.65.251, 142.251.40.155, 142.251.40.187, 142.250.64.91, 142.250.64.123, 142.250.72.123, 142.250.80.59, 142.250.80.91, 142.250.80.123, 142.250.176.219, 142.250.64.99, 20.12.23.50, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, storage.googleapis.com, slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, acroipm2.adobe.com, clients2.google.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, prod.fs.microsoft.com.akadns.net, c.pki.goog, wu-b-net.trafficmanager.net, clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, fonts.gstatic.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, armmf.adobe.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:39:05	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.66.43.150	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om~VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc~Gb~b7F~2c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc~F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA	Get hash	malicious	Invisible JS, Tycoon2FA	Browse
	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJzYIFyRp4R0KWU0rWugMmJiYWAVpWKV1K4i6V8hIZ5SM0ZiLWEW1OmR5/DRLcQX0iG12ODR6m0Z2uCX54XhMGr31/03pyTfZ6rYZi~XpqUQYOHR1KUiJS11Z/0T2qVjY4XRZcYgpc9i5uJWYR7g20EjL0/YM46gJCqg7mLRrm6jJc4gn5DVr69X0OQV6WNfKt6Z1h7XJOYhqWIX20v3pR/S20XfZm6f1WH4qtBZKWOY6Wx4rKpZ0Onh80BSLOY4Mh83r/3ZsWx36GrQYOHS2SniIWZV507V1OzioqTfo0xY7S5jJhCSsiRhLiZZI4L35OUYZm~hJ/~js4tfpuWh5qOiIJ9fMm8gK0CTM04fsiv4555ipVyRpOyTY0xjK0AT1mQYYOfW5uUS842iqiCjr4qXIJ73o0Sg80RRoqYjI0~j0uN1qiWWpmz3sJBS6Z701OyRrSBfH5DWpWo3oSC02OW1JKCi5/DRsSt4KS/RImw1KZyRp49hsi~f6uZRsioj2uZR2mUg0KsQYOHiEK6RJ0/W8SoQYOHXZuJSoGRTMqP3rS2gr/t01xD4MF70sSmSLOOZ64Xh1/fi7bCW6G9f5OMVsGNgYW8XIqsSMq~TJR8RJxBgKq0XE09hr/5jqmJZ6mxR2STVryCZpC3WrcNf0JESsVDZM35QYOLRs0GRZc44pm4jYKUQYOLfM0xZ2W8X8iMf04SQYOLWIG7jpOt2EWBf1mNj1iTZ5NBhoqX4qhB4IV5Y5W7QYOHZZ/zgLb60KGB4sOxWZyqWqKnj1u01pWE3YOEiJms1MhB08uJjLiDZZBC00WSjMmq1ImDX6mPVYS0X0KYZ7yL4sKD3oGL4Jh912KMW2FDY0tBYEVE315DYZ65XZ4uTZiKXYixi6SOS5VDSZC5WsmSfKG5R53BjL6xfEKwSKuG12SX0KGAZ8W7R5WBSLl812iWf1Kq3r0vTLqHX5/LR50UWZ06TYKNRrcVd~FG88JcGJ/FGF88986aFHbKbb/JIIK/89KHGK8IHaG/I8KIcbba6c7cKI68GGKI7?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiMTVjN2QxOWQyYmUwNTY1NzUzNWNiMjU5MjdlZDQxYTo3OjBjYTc6YjUxOGI0N2MzNmJhYjUzNGU2MzNkZWE3MDBkNGExYmIwNzljNzhmMDU2MmNkNzkwZDBhMjM3MDE5NjU0YTZkNTpoOlQ6VA	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://protect.checkpoint.com/v2/r01/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJz0ZOA1YpCSoGOfZu2gE3yRpN701JyRpOm4ZZyRp4q0YpC41S1h5KD47KphMiO0J/ARo394ZuDi6WW41uA0ZCGZsV/hKq4hn5DVqi1SpSG0Iiq0YiNiZC33pyAQYOLfD5DVoOH4EWH45yy38iYhrWx0YiVg5yOT0VyRpOmZ1K2gpqsW5R/g5c81YGRQYOLV8umhLS2X6OG02WJ48S4XrSZhspDQYOHj0O/ZZO4YYpEY0i64ZCT0KSvgIWoXKR8hZi9SJ6HZ1WSYoWD07KS1LZBgs09XESu4KOBh0WJ1r02gq3CTL/54pS~WrB7gMqXfMGfR6WVW7iZWpyq45mYQYOHgoWvY6KEf1qKh5OXS2us02tyRp4vTYGnVYGm0Y4HX7SK0ZRyRpOuiEm/SKGC0si/irc90Z63XL9yRp36Z5KZYLlyRpOSWqSIQYOHXLW8X64mhKKzhEGBf0tBX24yV1utSEWG0ISpR7WMR0JDZ80OXrmQYsZyRp4G1suTX1tCYruxfYGJXr6O40SD056PXZOrREqxjZyAjpW7X1yrgYGuiJOUXJcUi50ORqOKTJ4LgJmWWrmJYJKJ0sSZVZuy08uNXK4G1LW5WEGWRYOST1SrY7KI400ERquY06iU32JCgLcxTZSX3EmVV0uCR8iWW2O9QYOHi8mrYLcRg5mPg5i9S0p5iqOo12G6i0ZyRp44TMh7RIqnV2iJX7/G4pK6j1BBWLC5R5qSg00pZJO2YqmTXZC2Zr/0310008uSX005S6Kt100zTKKDS2W2f0RBX7K/jolDfqqQWqSN31mHZr/4Ro4NXqm54p/VgLi01MKBTY3yRp35gLiTY76rW8OMZ5Z8j1uJWp6wR7uNi6GnjrOE4LuRRoRESZ4XjX5DVsqPW7/sfJi5V7c23pu3S1BCYZ/WYr0EV7J6h0mE1J4vV0WsQYSJQYSJWo0kXKb5hLqtXMqsYqSHRMN/Zr42RLV5SJcPfKS6WrmuZrCXiK4Rh2m~08WYXMSmg1q6Z1l5Z00~Y1WChJ0t0Ii6hES8XImMiM0QYryZ4EWO1KqsSZ0K00WfX5WS11C636i63Ep80qSYjo4mWE4111p6Y5tyRp4Y45c43py9fEqOV5351KGy1Km/R0S40H5DWqZC0JyGW1iAYIqCgMG7gZS~003CX1yMV0GDfsZyRp38f54wZJuS00O7R5cE1ol6jJ6XhMpD1p0vj0uXi0uZf6JyRp4GRZ6IgpC/0puyW0itV0JyR5VyR5V=dJ9a86J/5GGJ6/HFH867JHa95G57Ja897H65~G65b9/b7c9/a8J6JI56758~GFFJI?h=6&fru;n=6&fru;ithx=6___.YzJ1OnNlcXVhbGNvcnA6YzpvOjVjN2U0MGNlMGRhNDNkZDEwYjk3ODU0ZTRhMGNmYTFjOjc6MDQyMTpiZDMwNmQ3NDgyNWUwNmM1NzVmMTk0YTFiN2ZjZDQ3NWZjMzIzMTMzNjg2ZmY0ZTMyY2VmMDdmYWRhZDI0MTJjOmg6VDpU	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://email.friendbuy-mail.com/ls/click?upn=u001.cLv6DfAR7vFo5oY-2FqNn1ouEQnV2mDIj7j69roW5D9YFmBFwPhHpDSZmf-2B3Pr25NKH1kkrAtv-2FXYlYHDcjRTHmkWY1isyzqTHOYSV2VdQ1tT1G8-2FNMDl8wCw4SYq3K-2F-2FiCbQ7dDyP5dZoLD-2FOxtt8eFMBYOTS0pk89J8UmvCWjzbPwK2xEcw4XEiLFMCga6U0GFvQoOCb0P85sJVWK2Uml3XcdplD23kW-2FTxE-2BtGlDca1HjLRLdUKSNEAochyK-2BchY8B8vmew2v65f73My9ah-2BrdDnS6EIzE4TkvMhxdRHCCReZDVmaDqbPzw7053nhs23dod2YDSiaNB84g8YaMUKurnp9p1y-2B1nQpZebeALMEbnVDu6tTmFR7-2FHyGAHsZk61FyHh9uMQKB5L-2BtyOwTzWn7KvQSyyj3dH1rO4cxBBiWvhshRwgiYR7P05IvjezWCT32bX-2BjQB9JYGnHCuTnaAvsCLBHqTRV-2Bn2Hi3bm3nP1-2Baf7Epl-2FSvdYLY6KlQgLtPuXok3CXKypQBjPnRjTQJI-2BLeqRURlVbUeZHSlyws8Vwyao9B57spuIqsg93t3fmhWl9DmdgmDC4XLsl-2B3GEjzzUpMaNfhpwVuK0PSOtmvx-2F38AbYYESVomxnmKLL-2BOKderogjR3e-2Bpxu1MnWhQI-2Bw-3D-3DW0qv_4pihHygNSB0r9RfW0d44OGid9KPtmw14Y7-2FMHyDwcVW3HSjtuwGFBnBjiQG3-2Fb3urCctiPuIQjHAcBM1R6iFYpm7MuQ2WuMW6LagnpHoXYyjCGCl74vz-2FIqMsuMFvpwGAHIATwDXjaOGIaa8JZk1leLIY5Bb4cDMR5o0OowCLV1fOiEjRPd9ecLAxnTxFow1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	Play_VM-Now(Cwoods)ATTT0003.html	Get hash	malicious	Unknown	Browse
	http://email.friendbuy-mail.com/ls/click?upn=u001.-2BEKhayZu5jj3B279nN-2BW8NO-2BYIH8mB3-2BAXCut00ha3GPZSSeH6NimwZxz3Q58uUmBf32mnTQYg8Wgbh-2BZ8hZ-2FsP3awGQXklDw3iq-2Fjq8Fk-2FmwrU1qpoTD1s0L-2FOxZA1eRaO3Q3R-2Fk0-2FfNl-2FdhzdaIVA-2Fy5TUlo5ho1IlwvDQ77xnMlgQRVR0NpHFVhXpFFf9P1t-2B-2BOwziPtNjRGMkOa8x-2BPyq34DsdPC4tSiYMZXqWxNDX73v9kuQDd9soAphYgNbtSBzFELM8kdGDXxSTusZHwg-2FEdE4dHc6BMP9A5IiCSkzUk8hd4tlwcRapiW5O6nap3YQ-2BLRIKKchZvjJwuMm2PA3JLFG0Ny2DgXEUy00AH9QEPSH7zDbyemYc0hlZuacj2-2FcrD0E4XzqghdtOJQcw-3D-3DnhTp_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBKWYfWhq7Ea6Q9XzsTXv0bH9QpUU10cc6Ro-2B1YZXeORlGoxpxe9ay0-2BOZf09MbspRMJySREQ-2BErBlAhiGL9CAG-2FhC9SBWsKpT35eAZcXIDRdsU6BEbERoqj6rCLUVDz1Kg5EqC6bc1W5FLzK1sGk1qUD18l6VM8lx0XuUATkVgLg-3D-3D	Get hash	malicious	Unknown	Browse
	https://llink.to/?u=//khalidgroup.com.pk/samn//yrirlgnacazzdj7cbvflzpo5xszgkfcwjjmwnkd4aloqhvilzwhdsvcpkqfdnkrdgudv6cpfquidnff2ktzpuhxzzhgzi3hflya7lwe3gh3yb1525d4sfqohntrreh8fnenjsfkqu1auh38bamuqtfswsdlw21qm6zeclylfhxqujkcndbdeecgocf5kskxoe1szilce/dG9tLmZyb3N0QGJha2thdm9yLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	https://llink.to/?u=//enchantedlizard.com/3newly3/ditto/gfdoaq20bkvnh07widkk53bh0rvdh22tl8uth11say8ziltyrsdt6fzuhrdvqrlufb3ercsglhx2dwe7o0qhsvkywavooilbwyoy12adkstkifrplzwifghnqmmfq2jqtw6ineerki34emsfd6mvtlhbzkubrhuxz81ntsp4fdpymv8bsj6b04ezu4tz0k53mln2dxkl/YW5uZW1hcmllLm1pbmFpZGlzQGNoZW0ubHU=	Get hash	malicious	HTMLPhisher	Browse
	https://llink.to/?u=//enchantedlizard.com/3newly3/ditto/gfdoaq20bkvnh07widkk53bh0rvdh22tl8uth11say8ziltyrsdt6fzuhrdvqrlufb3ercsglhx2dwe7o0qhsvkywavooilbwyoy12adkstkifrplzwifghnqmmfq2jqtw6ineerki34emsfd6mvtlhbzkubrhuxz81ntsp4fdpymv8bsj6b04ezu4tz0k53mln2dxkl/YW5uZW1hcmllLm1pbmFpZGlzQGNoZW0ubHU=	Get hash	malicious	HTMLPhisher	Browse
13.249.91.49	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJzYIFyRp4R0KWU0rWugMmJiYWAVpWKV1K4i6V8hIZ5SM0ZiLWEW1OmR5/DRLcQX0iG12ODR6m0Z2uCX54XhMGr31/03pyTfZ6rYZi~XpqUQYOHR1KUiJS11Z/0T2qVjY4XRZcYgpc9i5uJWYR7g20EjL0/YM46gJCqg7mLRrm6jJc4gn5DVr69X0OQV6WNfKt6Z1h7XJOYhqWIX20v3pR/S20XfZm6f1WH4qtBZKWOY6Wx4rKpZ0Onh80BSLOY4Mh83r/3ZsWx36GrQYOHS2SniIWZV507V1OzioqTfo0xY7S5jJhCSsiRhLiZZI4L35OUYZm~hJ/~js4tfpuWh5qOiIJ9fMm8gK0CTM04fsiv4555ipVyRpOyTY0xjK0AT1mQYYOfW5uUS842iqiCjr4qXIJ73o0Sg80RRoqYjI0~j0uN1qiWWpmz3sJBS6Z701OyRrSBfH5DWpWo3oSC02OW1JKCi5/DRsSt4KS/RImw1KZyRp49hsi~f6uZRsioj2uZR2mUg0KsQYOHiEK6RJ0/W8SoQYOHXZuJSoGRTMqP3rS2gr/t01xD4MF70sSmSLOOZ64Xh1/fi7bCW6G9f5OMVsGNgYW8XIqsSMq~TJR8RJxBgKq0XE09hr/5jqmJZ6mxR2STVryCZpC3WrcNf0JESsVDZM35QYOLRs0GRZc44pm4jYKUQYOLfM0xZ2W8X8iMf04SQYOLWIG7jpOt2EWBf1mNj1iTZ5NBhoqX4qhB4IV5Y5W7QYOHZZ/zgLb60KGB4sOxWZyqWqKnj1u01pWE3YOEiJms1MhB08uJjLiDZZBC00WSjMmq1ImDX6mPVYS0X0KYZ7yL4sKD3oGL4Jh912KMW2FDY0tBYEVE315DYZ65XZ4uTZiKXYixi6SOS5VDSZC5WsmSfKG5R53BjL6xfEKwSKuG12SX0KGAZ8W7R5WBSLl812iWf1Kq3r0vTLqHX5/LR50UWZ06TYKNRrcVd~FG88JcGJ/FGF88986aFHbKbb/JIIK/89KHGK8IHaG/I8KIcbba6c7cKI68GGKI7?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiMTVjN2QxOWQyYmUwNTY1NzUzNWNiMjU5MjdlZDQxYTo3OjBjYTc6YjUxOGI0N2MzNmJhYjUzNGU2MzNkZWE3MDBkNGExYmIwNzljNzhmMDU2MmNkNzkwZDBhMjM3MDE5NjU0YTZkNTpoOlQ6VA	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
13.249.91.49	https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
13.249.91.19	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJzYIFyRp4R0KWU0rWugMmJiYWAVpWKV1K4i6V8hIZ5SM0ZiLWEW1OmR5/DRLcQX0iG12ODR6m0Z2uCX54XhMGr31/03pyTfZ6rYZi~XpqUQYOHR1KUiJS11Z/0T2qVjY4XRZcYgpc9i5uJWYR7g20EjL0/YM46gJCqg7mLRrm6jJc4gn5DVr69X0OQV6WNfKt6Z1h7XJOYhqWIX20v3pR/S20XfZm6f1WH4qtBZKWOY6Wx4rKpZ0Onh80BSLOY4Mh83r/3ZsWx36GrQYOHS2SniIWZV507V1OzioqTfo0xY7S5jJhCSsiRhLiZZI4L35OUYZm~hJ/~js4tfpuWh5qOiIJ9fMm8gK0CTM04fsiv4555ipVyRpOyTY0xjK0AT1mQYYOfW5uUS842iqiCjr4qXIJ73o0Sg80RRoqYjI0~j0uN1qiWWpmz3sJBS6Z701OyRrSBfH5DWpWo3oSC02OW1JKCi5/DRsSt4KS/RImw1KZyRp49hsi~f6uZRsioj2uZR2mUg0KsQYOHiEK6RJ0/W8SoQYOHXZuJSoGRTMqP3rS2gr/t01xD4MF70sSmSLOOZ64Xh1/fi7bCW6G9f5OMVsGNgYW8XIqsSMq~TJR8RJxBgKq0XE09hr/5jqmJZ6mxR2STVryCZpC3WrcNf0JESsVDZM35QYOLRs0GRZc44pm4jYKUQYOLfM0xZ2W8X8iMf04SQYOLWIG7jpOt2EWBf1mNj1iTZ5NBhoqX4qhB4IV5Y5W7QYOHZZ/zgLb60KGB4sOxWZyqWqKnj1u01pWE3YOEiJms1MhB08uJjLiDZZBC00WSjMmq1ImDX6mPVYS0X0KYZ7yL4sKD3oGL4Jh912KMW2FDY0tBYEVE315DYZ65XZ4uTZiKXYixi6SOS5VDSZC5WsmSfKG5R53BjL6xfEKwSKuG12SX0KGAZ8W7R5WBSLl812iWf1Kq3r0vTLqHX5/LR50UWZ06TYKNRrcVd~FG88JcGJ/FGF88986aFHbKbb/JIIK/89KHGK8IHaG/I8KIcbba6c7cKI68GGKI7?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiMTVjN2QxOWQyYmUwNTY1NzUzNWNiMjU5MjdlZDQxYTo3OjBjYTc6YjUxOGI0N2MzNmJhYjUzNGU2MzNkZWE3MDBkNGExYmIwNzljNzhmMDU2MmNkNzkwZDBhMjM3MDE5NjU0YTZkNTpoOlQ6VA	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://app.heptabase.com/w/9572b61a878f03208943512867a816847d4d23b4f7ccb0a7fe97bab5d1ad7da7	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	GopherSecurity-windows-0.0.2-35-amd64-release.msi	Get hash	malicious	Unknown	Browse
	https://www.powerflexweb.com/centers_redirect_log.php?idDivision=88&nameDivision=https://gamma.app/docs/SHAREPOINT-FILE-RECEIVED-v0g983lw02btb16mode=doc&idModule=m583&nameModule=myStrength&idElement=1137&nameElement=ProviderSearch&url=https://gamma.app/docs/SHAREPOINT-FILE-RECEIVED-v0g983lw02btb16	Get hash	malicious	Unknown	Browse
	https://nexxe.gep.com/NexxeProfileSwitch/RedirectToDocument?oloc=605&docUrl=//gamma.app/docs/AV-Stumpfl-Inc-dzm7t0catugjgqx?mode=present#card-c8xyv3fydgzow86	Get hash	malicious	Unknown	Browse
23.216.136.238	https://www.transfernow.net/en/bld?utm_source=20250321oYBy7zgb	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
	https://app.eraser.io/workspace/ISn1eLCg7dzDBCScfS1e?origin=share	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	345778.pdf	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
	MetroHealthNow.com.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	x1.i.lencr.org/
	windscribe.msi	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	https://www.transfernow.net/dl/20250327nEx48coZ	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	x1.i.lencr.org/
	taxCPAm.bat	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	220-002-1.pdf	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
	SecuriteInfo.com.Trojan.DownLoader45.42287.31043.2783.exe	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	SecuriteInfo.com.Trojan.MulDrop23.34226.30868.14577.exe	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
104.18.187.31	https://e23a311b.5f438d8b1fa34021ffea2c2f.workers.dev/&umid=ea64e973-4742-4a13-b7e6-f166cfb5aedf&auth=4c13a8eb8816953c02b02599c881676174c26b4b-2d2cb8f6bf763978670ab6e3d03aef460cd5c82c	Get hash	malicious	HTMLPhisher	Browse
	https://www.canva.com/design/DAGiRhhTm_M/1Wb1338QF_BEv0zYs4WfZQ/view?utm_content=DAGiRhhTm_M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h6159cd66cf&umid=b05be093-6f53-49ec-8a3b-87bea166f93e&auth=5175c0148660b71d9cf40f5d2581457ec88fc189-b6bc2ea861a256fc841ad8d60030f2289750b83	Get hash	malicious	HTMLPhisher	Browse
	https://force-page-8012.my.salesforce-sites.com/support	Get hash	malicious	Unknown	Browse
	https://e23a311b.5f438d8b1fa34021ffea2c2f.workers.dev/&umid=ea64e973-4742-4a13-b7e6-f166cfb5aedf&auth=4c13a8eb8816953c02b02599c881676174c26b4b-2d2cb8f6bf763978670ab6e3d03aef460cd5c82c	Get hash	malicious	HTMLPhisher	Browse
	https://we.tl/t-J9PcqXV8XE	Get hash	malicious	Unknown	Browse
	https://jainiklifesciences.com/proposals	Get hash	malicious	HTMLPhisher	Browse
	Paradigm-corp00990__098.html	Get hash	malicious	Unknown	Browse
	https://click-1928265.icptrack.com/icp/relay.php?r=337124&msgid=1059&act=L49B&c=1928265&pid=832&destination=https%3A%2F%2Fdemo.westendmediagroup.com%2F&cf=684&v=e3f6a2f915319d0568ea158e5869daa7ccbad45a51971e37ef8b11cd38f525f8	Get hash	malicious	HTMLPhisher	Browse
	https://w-si.link/LLddh9rL23sraRLUz	Get hash	malicious	HTMLPhisher	Browse
	https://www.xpressreg.net/EmailRedirect2.aspx?id=15&verify=1309283587&scheme=https://click.actmkt.com//s2/001-9d8b5995-11e2-4176-a44d-ac784ffff218/052-1f3d50c8-0ab2-42ca-9d57-414363d82282?enr=naahiaduabyaaoqaf4ac6adsabsqa5aameagsadmabsqa4qafyahgadqabsqa3qaoqagyadzaaxaayyan4ag2abpabjqa2aan4ahaadjabtaa6iaieag4adbaaxqataaneag4adlaaxqanqaheadaabxaa3aapyaomahiadpabzaaziahuagkadsabuqayyafuaggadiab2qa4qammagqabnab2qa4yaeyahiadzabyaaziahuafgaceaataa5iaoiagyab5abuaa5aaoqahaadtaa5aalyaf4agcadoab2aa2iamiag6aduaawqa4aameahiadjabsqa3qaoqac2adnabxqa5ianyahiadbabuqa3qafuadeadcaayqazqafyadaabvabraazqaguadsabvaa2aamaagmagkadgabsqamaaheagmabwaa3aanqamqadmadeaa2qamqafyahoadpabzaa2yamuaheadtaaxaazaamuahmabpab6aa4yanaag6adpab2aa3iamuadaabyaa4qaqaam4ag2adbabuqa3aafyaggadpabwqa7aagqahyad4aayaaniagiac2abrabtaamyamqadkabqabrqaoaafuadaadbabraamqafuadiabsabrqayiafuadsadeaa2qanyafuadiabraa2aamyagyadgadeaa4aamqagiadqabsab6aamaaguadsabnabsqanqammadsabwabraaoiagaac2absabrqanyageac2abuaazqanqamyac2adcaa2qaniagmac2adcaa3aanqamuadcadcabtaaoaag4aggabyabrqa7aagaadaabraawqaoiamqadqadcaa2qaoiaheadkabnaayqamiamuadeabnaa2aamiag4admabnabqqanaagqagiabnabqqayyag4adqabuabtaazqamyagmabsaayqaoaapqahyacbab6aa===&path=/barcode/barcodepage.asp&recId=119377774&query=P2RiPVNBVEUwMzIxJmI9MjE1NTExJmxvZ289aHR0cHM6Ly9jb252LWRhdGEtY2RuLnMzLmFtYXpvbmF3cy5jb20vZXZlbnRzL1NBVEUwMzIxL3NhdGUwMzIxLWVtYWlsLWhlYWRlcjIucG5n	Get hash	malicious	HTMLPhisher	Browse
13.249.91.66	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJzYIFyRp4R0KWU0rWugMmJiYWAVpWKV1K4i6V8hIZ5SM0ZiLWEW1OmR5/DRLcQX0iG12ODR6m0Z2uCX54XhMGr31/03pyTfZ6rYZi~XpqUQYOHR1KUiJS11Z/0T2qVjY4XRZcYgpc9i5uJWYR7g20EjL0/YM46gJCqg7mLRrm6jJc4gn5DVr69X0OQV6WNfKt6Z1h7XJOYhqWIX20v3pR/S20XfZm6f1WH4qtBZKWOY6Wx4rKpZ0Onh80BSLOY4Mh83r/3ZsWx36GrQYOHS2SniIWZV507V1OzioqTfo0xY7S5jJhCSsiRhLiZZI4L35OUYZm~hJ/~js4tfpuWh5qOiIJ9fMm8gK0CTM04fsiv4555ipVyRpOyTY0xjK0AT1mQYYOfW5uUS842iqiCjr4qXIJ73o0Sg80RRoqYjI0~j0uN1qiWWpmz3sJBS6Z701OyRrSBfH5DWpWo3oSC02OW1JKCi5/DRsSt4KS/RImw1KZyRp49hsi~f6uZRsioj2uZR2mUg0KsQYOHiEK6RJ0/W8SoQYOHXZuJSoGRTMqP3rS2gr/t01xD4MF70sSmSLOOZ64Xh1/fi7bCW6G9f5OMVsGNgYW8XIqsSMq~TJR8RJxBgKq0XE09hr/5jqmJZ6mxR2STVryCZpC3WrcNf0JESsVDZM35QYOLRs0GRZc44pm4jYKUQYOLfM0xZ2W8X8iMf04SQYOLWIG7jpOt2EWBf1mNj1iTZ5NBhoqX4qhB4IV5Y5W7QYOHZZ/zgLb60KGB4sOxWZyqWqKnj1u01pWE3YOEiJms1MhB08uJjLiDZZBC00WSjMmq1ImDX6mPVYS0X0KYZ7yL4sKD3oGL4Jh912KMW2FDY0tBYEVE315DYZ65XZ4uTZiKXYixi6SOS5VDSZC5WsmSfKG5R53BjL6xfEKwSKuG12SX0KGAZ8W7R5WBSLl812iWf1Kq3r0vTLqHX5/LR50UWZ06TYKNRrcVd~FG88JcGJ/FGF88986aFHbKbb/JIIK/89KHGK8IHaG/I8KIcbba6c7cKI68GGKI7?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiMTVjN2QxOWQyYmUwNTY1NzUzNWNiMjU5MjdlZDQxYTo3OjBjYTc6YjUxOGI0N2MzNmJhYjUzNGU2MzNkZWE3MDBkNGExYmIwNzljNzhmMDU2MmNkNzkwZDBhMjM3MDE5NjU0YTZkNTpoOlQ6VA	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api-bd.linkscan.io	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om~VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc~Gb~b7F~2c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc~F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	13.249.91.68
	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJzYIFyRp4R0KWU0rWugMmJiYWAVpWKV1K4i6V8hIZ5SM0ZiLWEW1OmR5/DRLcQX0iG12ODR6m0Z2uCX54XhMGr31/03pyTfZ6rYZi~XpqUQYOHR1KUiJS11Z/0T2qVjY4XRZcYgpc9i5uJWYR7g20EjL0/YM46gJCqg7mLRrm6jJc4gn5DVr69X0OQV6WNfKt6Z1h7XJOYhqWIX20v3pR/S20XfZm6f1WH4qtBZKWOY6Wx4rKpZ0Onh80BSLOY4Mh83r/3ZsWx36GrQYOHS2SniIWZV507V1OzioqTfo0xY7S5jJhCSsiRhLiZZI4L35OUYZm~hJ/~js4tfpuWh5qOiIJ9fMm8gK0CTM04fsiv4555ipVyRpOyTY0xjK0AT1mQYYOfW5uUS842iqiCjr4qXIJ73o0Sg80RRoqYjI0~j0uN1qiWWpmz3sJBS6Z701OyRrSBfH5DWpWo3oSC02OW1JKCi5/DRsSt4KS/RImw1KZyRp49hsi~f6uZRsioj2uZR2mUg0KsQYOHiEK6RJ0/W8SoQYOHXZuJSoGRTMqP3rS2gr/t01xD4MF70sSmSLOOZ64Xh1/fi7bCW6G9f5OMVsGNgYW8XIqsSMq~TJR8RJxBgKq0XE09hr/5jqmJZ6mxR2STVryCZpC3WrcNf0JESsVDZM35QYOLRs0GRZc44pm4jYKUQYOLfM0xZ2W8X8iMf04SQYOLWIG7jpOt2EWBf1mNj1iTZ5NBhoqX4qhB4IV5Y5W7QYOHZZ/zgLb60KGB4sOxWZyqWqKnj1u01pWE3YOEiJms1MhB08uJjLiDZZBC00WSjMmq1ImDX6mPVYS0X0KYZ7yL4sKD3oGL4Jh912KMW2FDY0tBYEVE315DYZ65XZ4uTZiKXYixi6SOS5VDSZC5WsmSfKG5R53BjL6xfEKwSKuG12SX0KGAZ8W7R5WBSLl812iWf1Kq3r0vTLqHX5/LR50UWZ06TYKNRrcVd~FG88JcGJ/FGF88986aFHbKbb/JIIK/89KHGK8IHaG/I8KIcbba6c7cKI68GGKI7?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiMTVjN2QxOWQyYmUwNTY1NzUzNWNiMjU5MjdlZDQxYTo3OjBjYTc6YjUxOGI0N2MzNmJhYjUzNGU2MzNkZWE3MDBkNGExYmIwNzljNzhmMDU2MmNkNzkwZDBhMjM3MDE5NjU0YTZkNTpoOlQ6VA	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.249.91.66
	https://protect.checkpoint.com/v2/r01/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJz0ZOA1YpCSoGOfZu2gE3yRpN701JyRpOm4ZZyRp4q0YpC41S1h5KD47KphMiO0J/ARo394ZuDi6WW41uA0ZCGZsV/hKq4hn5DVqi1SpSG0Iiq0YiNiZC33pyAQYOLfD5DVoOH4EWH45yy38iYhrWx0YiVg5yOT0VyRpOmZ1K2gpqsW5R/g5c81YGRQYOLV8umhLS2X6OG02WJ48S4XrSZhspDQYOHj0O/ZZO4YYpEY0i64ZCT0KSvgIWoXKR8hZi9SJ6HZ1WSYoWD07KS1LZBgs09XESu4KOBh0WJ1r02gq3CTL/54pS~WrB7gMqXfMGfR6WVW7iZWpyq45mYQYOHgoWvY6KEf1qKh5OXS2us02tyRp4vTYGnVYGm0Y4HX7SK0ZRyRpOuiEm/SKGC0si/irc90Z63XL9yRp36Z5KZYLlyRpOSWqSIQYOHXLW8X64mhKKzhEGBf0tBX24yV1utSEWG0ISpR7WMR0JDZ80OXrmQYsZyRp4G1suTX1tCYruxfYGJXr6O40SD056PXZOrREqxjZyAjpW7X1yrgYGuiJOUXJcUi50ORqOKTJ4LgJmWWrmJYJKJ0sSZVZuy08uNXK4G1LW5WEGWRYOST1SrY7KI400ERquY06iU32JCgLcxTZSX3EmVV0uCR8iWW2O9QYOHi8mrYLcRg5mPg5i9S0p5iqOo12G6i0ZyRp44TMh7RIqnV2iJX7/G4pK6j1BBWLC5R5qSg00pZJO2YqmTXZC2Zr/0310008uSX005S6Kt100zTKKDS2W2f0RBX7K/jolDfqqQWqSN31mHZr/4Ro4NXqm54p/VgLi01MKBTY3yRp35gLiTY76rW8OMZ5Z8j1uJWp6wR7uNi6GnjrOE4LuRRoRESZ4XjX5DVsqPW7/sfJi5V7c23pu3S1BCYZ/WYr0EV7J6h0mE1J4vV0WsQYSJQYSJWo0kXKb5hLqtXMqsYqSHRMN/Zr42RLV5SJcPfKS6WrmuZrCXiK4Rh2m~08WYXMSmg1q6Z1l5Z00~Y1WChJ0t0Ii6hES8XImMiM0QYryZ4EWO1KqsSZ0K00WfX5WS11C636i63Ep80qSYjo4mWE4111p6Y5tyRp4Y45c43py9fEqOV5351KGy1Km/R0S40H5DWqZC0JyGW1iAYIqCgMG7gZS~003CX1yMV0GDfsZyRp38f54wZJuS00O7R5cE1ol6jJ6XhMpD1p0vj0uXi0uZf6JyRp4GRZ6IgpC/0puyW0itV0JyR5VyR5V=dJ9a86J/5GGJ6/HFH867JHa95G57Ja897H65~G65b9/b7c9/a8J6JI56758~GFFJI?h=6&fru;n=6&fru;ithx=6___.YzJ1OnNlcXVhbGNvcnA6YzpvOjVjN2U0MGNlMGRhNDNkZDEwYjk3ODU0ZTRhMGNmYTFjOjc6MDQyMTpiZDMwNmQ3NDgyNWUwNmM1NzVmMTk0YTFiN2ZjZDQ3NWZjMzIzMTMzNjg2ZmY0ZTMyY2VmMDdmYWRhZDI0MTJjOmg6VDpU	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	18.245.31.83
	https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.249.91.49
cdn.jsdelivr.net.cdn.cloudflare.net	https://www.shenqixiangsu.com/api/misc/links/redirect?url=https://readymag.website/u67110811/5405049/	Get hash	malicious	HTMLPhisher	Browse	104.18.186.31
	http://gitmeidlaw.com/	Get hash	malicious	Unknown	Browse	104.18.186.31
	https://e23a311b.5f438d8b1fa34021ffea2c2f.workers.dev/&umid=ea64e973-4742-4a13-b7e6-f166cfb5aedf&auth=4c13a8eb8816953c02b02599c881676174c26b4b-2d2cb8f6bf763978670ab6e3d03aef460cd5c82c	Get hash	malicious	HTMLPhisher	Browse	104.18.187.31
	https://www.canva.com/design/DAGiRhhTm_M/1Wb1338QF_BEv0zYs4WfZQ/view?utm_content=DAGiRhhTm_M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h6159cd66cf&umid=b05be093-6f53-49ec-8a3b-87bea166f93e&auth=5175c0148660b71d9cf40f5d2581457ec88fc189-b6bc2ea861a256fc841ad8d60030f2289750b83	Get hash	malicious	HTMLPhisher	Browse	104.18.187.31
	https://force-page-8012.my.salesforce-sites.com/support	Get hash	malicious	Unknown	Browse	104.18.187.31
	https://u.to/JmY0Ig	Get hash	malicious	Unknown	Browse	104.18.186.31
	https://e23a311b.5f438d8b1fa34021ffea2c2f.workers.dev/&umid=ea64e973-4742-4a13-b7e6-f166cfb5aedf&auth=4c13a8eb8816953c02b02599c881676174c26b4b-2d2cb8f6bf763978670ab6e3d03aef460cd5c82c	Get hash	malicious	HTMLPhisher	Browse	104.18.187.31
	https://buildin.ai/share/3cb1e5fb-3724-474b-95f2-a37c9421e6d9?code=38HYMW&embed=true	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.18.186.31
	https://zhukovka72.ru/goto.php?url=https://ipfs.io/ipfs/bafkreiejuf3izvav3mevs6y6ip4rwctyd6k5yxouatdediqtrmgzfcvanu?eta=dpo@johnlewis.co.uk	Get hash	malicious	HTMLPhisher	Browse	104.18.186.31
	https://document-baol.b12sites.com/	Get hash	malicious	Unknown	Browse	104.18.186.31
d3rb3qlp6ej74d.cloudfront.net	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om~VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc~Gb~b7F~2c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc~F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	13.249.91.40
	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJzYIFyRp4R0KWU0rWugMmJiYWAVpWKV1K4i6V8hIZ5SM0ZiLWEW1OmR5/DRLcQX0iG12ODR6m0Z2uCX54XhMGr31/03pyTfZ6rYZi~XpqUQYOHR1KUiJS11Z/0T2qVjY4XRZcYgpc9i5uJWYR7g20EjL0/YM46gJCqg7mLRrm6jJc4gn5DVr69X0OQV6WNfKt6Z1h7XJOYhqWIX20v3pR/S20XfZm6f1WH4qtBZKWOY6Wx4rKpZ0Onh80BSLOY4Mh83r/3ZsWx36GrQYOHS2SniIWZV507V1OzioqTfo0xY7S5jJhCSsiRhLiZZI4L35OUYZm~hJ/~js4tfpuWh5qOiIJ9fMm8gK0CTM04fsiv4555ipVyRpOyTY0xjK0AT1mQYYOfW5uUS842iqiCjr4qXIJ73o0Sg80RRoqYjI0~j0uN1qiWWpmz3sJBS6Z701OyRrSBfH5DWpWo3oSC02OW1JKCi5/DRsSt4KS/RImw1KZyRp49hsi~f6uZRsioj2uZR2mUg0KsQYOHiEK6RJ0/W8SoQYOHXZuJSoGRTMqP3rS2gr/t01xD4MF70sSmSLOOZ64Xh1/fi7bCW6G9f5OMVsGNgYW8XIqsSMq~TJR8RJxBgKq0XE09hr/5jqmJZ6mxR2STVryCZpC3WrcNf0JESsVDZM35QYOLRs0GRZc44pm4jYKUQYOLfM0xZ2W8X8iMf04SQYOLWIG7jpOt2EWBf1mNj1iTZ5NBhoqX4qhB4IV5Y5W7QYOHZZ/zgLb60KGB4sOxWZyqWqKnj1u01pWE3YOEiJms1MhB08uJjLiDZZBC00WSjMmq1ImDX6mPVYS0X0KYZ7yL4sKD3oGL4Jh912KMW2FDY0tBYEVE315DYZ65XZ4uTZiKXYixi6SOS5VDSZC5WsmSfKG5R53BjL6xfEKwSKuG12SX0KGAZ8W7R5WBSLl812iWf1Kq3r0vTLqHX5/LR50UWZ06TYKNRrcVd~FG88JcGJ/FGF88986aFHbKbb/JIIK/89KHGK8IHaG/I8KIcbba6c7cKI68GGKI7?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiMTVjN2QxOWQyYmUwNTY1NzUzNWNiMjU5MjdlZDQxYTo3OjBjYTc6YjUxOGI0N2MzNmJhYjUzNGU2MzNkZWE3MDBkNGExYmIwNzljNzhmMDU2MmNkNzkwZDBhMjM3MDE5NjU0YTZkNTpoOlQ6VA	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.249.91.12
	https://protect.checkpoint.com/v2/r01/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJz0ZOA1YpCSoGOfZu2gE3yRpN701JyRpOm4ZZyRp4q0YpC41S1h5KD47KphMiO0J/ARo394ZuDi6WW41uA0ZCGZsV/hKq4hn5DVqi1SpSG0Iiq0YiNiZC33pyAQYOLfD5DVoOH4EWH45yy38iYhrWx0YiVg5yOT0VyRpOmZ1K2gpqsW5R/g5c81YGRQYOLV8umhLS2X6OG02WJ48S4XrSZhspDQYOHj0O/ZZO4YYpEY0i64ZCT0KSvgIWoXKR8hZi9SJ6HZ1WSYoWD07KS1LZBgs09XESu4KOBh0WJ1r02gq3CTL/54pS~WrB7gMqXfMGfR6WVW7iZWpyq45mYQYOHgoWvY6KEf1qKh5OXS2us02tyRp4vTYGnVYGm0Y4HX7SK0ZRyRpOuiEm/SKGC0si/irc90Z63XL9yRp36Z5KZYLlyRpOSWqSIQYOHXLW8X64mhKKzhEGBf0tBX24yV1utSEWG0ISpR7WMR0JDZ80OXrmQYsZyRp4G1suTX1tCYruxfYGJXr6O40SD056PXZOrREqxjZyAjpW7X1yrgYGuiJOUXJcUi50ORqOKTJ4LgJmWWrmJYJKJ0sSZVZuy08uNXK4G1LW5WEGWRYOST1SrY7KI400ERquY06iU32JCgLcxTZSX3EmVV0uCR8iWW2O9QYOHi8mrYLcRg5mPg5i9S0p5iqOo12G6i0ZyRp44TMh7RIqnV2iJX7/G4pK6j1BBWLC5R5qSg00pZJO2YqmTXZC2Zr/0310008uSX005S6Kt100zTKKDS2W2f0RBX7K/jolDfqqQWqSN31mHZr/4Ro4NXqm54p/VgLi01MKBTY3yRp35gLiTY76rW8OMZ5Z8j1uJWp6wR7uNi6GnjrOE4LuRRoRESZ4XjX5DVsqPW7/sfJi5V7c23pu3S1BCYZ/WYr0EV7J6h0mE1J4vV0WsQYSJQYSJWo0kXKb5hLqtXMqsYqSHRMN/Zr42RLV5SJcPfKS6WrmuZrCXiK4Rh2m~08WYXMSmg1q6Z1l5Z00~Y1WChJ0t0Ii6hES8XImMiM0QYryZ4EWO1KqsSZ0K00WfX5WS11C636i63Ep80qSYjo4mWE4111p6Y5tyRp4Y45c43py9fEqOV5351KGy1Km/R0S40H5DWqZC0JyGW1iAYIqCgMG7gZS~003CX1yMV0GDfsZyRp38f54wZJuS00O7R5cE1ol6jJ6XhMpD1p0vj0uXi0uZf6JyRp4GRZ6IgpC/0puyW0itV0JyR5VyR5V=dJ9a86J/5GGJ6/HFH867JHa95G57Ja897H65~G65b9/b7c9/a8J6JI56758~GFFJI?h=6&fru;n=6&fru;ithx=6___.YzJ1OnNlcXVhbGNvcnA6YzpvOjVjN2U0MGNlMGRhNDNkZDEwYjk3ODU0ZTRhMGNmYTFjOjc6MDQyMTpiZDMwNmQ3NDgyNWUwNmM1NzVmMTk0YTFiN2ZjZDQ3NWZjMzIzMTMzNjg2ZmY0ZTMyY2VmMDdmYWRhZDI0MTJjOmg6VDpU	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	18.66.122.107
	https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9lbWFpbC5mcmllbmRidXktbWFpbC5jb20vbHMvY2xpY2s!dXBuPXUwMDEuY0x2NkRmQVI3dkZvNW9ZLTJGcU5uMW91RVFuVjJtRElqN2o2OXJvVzVEOVlGbUJGd1BoSHBEU1ptZi0yQjNQcjI1TktIMWtrckF0di0yRlhZbFlIRGNqUlRIbWtXWTFpc3l6cVRIT1lTVjJWZFExdFQxRzgtMkZOTURsOHdDdzRTWXEzSy0yRi0yRmlDYlE3ZER5UDVkWm9MRC0yRk94dHQ4ZUZNQllPVFMwcGs4OUo4VW12Q1dqemJQd0syeEVjdzRYRWlMRk1DZ2E2VTBHRnZRb09DYjBQODVzSlZXSzJVbWwzWGNkcGxEMjNrVy0yRlR4RS0yQnRHbERjYTFIakxSTGRVS1NORUFvY2h5Sy0yQmNoWThCOHZtZXcydjY1ZjczTXk5YWgtMkJyZERuUzZFSXpFNFRrdk1oeGRSSENDUmVaRFZtYURxYlB6dzcwNTNuaHMyM2RvZDJZRFNpYU5CODRnOFlhTVVLdXJucDlwMXktMkIxblFwWmViZUFMTUViblZEdTZ0VG1GUjctMkZIeUdBSHNaazYxRnlIaDl1TVFLQjVMLTJCdHlPd1R6V243S3ZRU3l5ajNkSDFyTzRjeEJCaVd2aHNoUndnaVlSN1AwNUl2amV6V0NUMzJiWC0yQmpRQjlKWUduSEN1VG5hQXZzQ0xCSHFUUlYtMkJuMkhpM2JtM25QMS0yQmFmN0VwbC0yRlN2ZFlMWTZLbFFnTHRQdVhvazNDWEt5cFFCalBuUmpUUUpJLTJCTGVxUlVSbFZiVWVaSFNseXdzOFZ3eWFvOUI1N3NwdUlxc2c5M3QzZm1oV2w5RG1kZ21EQzRYTHNsLTJCM0dFanp6VXBNYU5maHB3VnVLMFBTT3RtdngtMkYzOEFiWVlFU1ZvbXhubUtMTC0yQk9LZGVyb2dqUjNlLTJCcHh1MU1uV2hRSS0yQnctM0QtM0RXMHF2XzRwaWhIeWdOU0IwcjlSZlcwZDQ0T0dpZDlLUHRtdzE0WTctMkZNSHlEd2NWVzNIU2p0dXdHRkJuQmppUUczLTJGYjN1ckNjdGlQdUlRakhBY0JNMVI2aUZZcG03TXVRMld1TVc2TGFnbnBIb1hZeWpDR0NsNzR2ei0yRklxTXN1TUZ2cHdHQUhJQVR3RFhqYU9HSWFhOEpaazFsZUxJWTVCYjRjRE1SNW8wT293Q0xWMWZPaUVqUlBkOWVjTEF4blR4Rm93MQ==/E4C0FDF07C14D7A4A615FBF328869660B9EADA1B585D41F5290A2FDB03201912?c=1&i=1&docs=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.249.91.19
	https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly9saW5rLm1haWwuYmVlaGlpdi5jb20vbHMvY2xpY2s!dXBuPXUwMDEudktEWkxxbXAtMkZPdEdwNnp1WVVjQ1dBcW1GbkpDbEwtMkJRS2hjblJHNmRaYXJ6TGUyUy0yRi0yRnRCLTJGdEJNWXoyRUEwQlE4NFg3UlRMcThPZlM4S1pIblpyTE9tbm1ycC0yRjlldGdyMmNoUDFueS0yRi0yRlB5b1dwODlLc1VxQlJzYmJYVDJRVC0yRkhPTnZoYy0yQk4zVklNVkJqbFlIcTNuMUNBZTZyeFREWlJjSXo3WDZYU0lIcWctM0RjOF9SX3ZydTlZYW0tMkZGY3F5LTJCVFlmc3JBOFNVNi0yQlMxZ25YT0VMSjlVNC0yQncxUFBQMjdaaVcyR0lQeVFucGNaNUh6WUxWdk5lci0yRk9yYXBzcjBSQlpZOEVVeTlUWDRoc2toRk5WcnFNRWYzYXRlV0dSNGRzZjJOUGFBNFRheXY5T3N1UWtkLTJCNVJPcGtXU2toOW5zRTJNZnVWSzh3dDFmalpzWjUtMkZ3LTJCSWNZNnZRZS0yRm9uek4wbUdXcFpaTEE1bC0yRlhrNmVuNkVZWGdlVDdGYjRxQkJDdkwtMkZWQWZ1Y2doalJNODgtMkJKSE9Pa0NoQU9nZVRCbE8tMkZoaXl3OWszRXJwdEpNc3ZZVThzYkNzUC0yRmZIbi0yRnBOQVgzV2RMWnhpNzBYRVZyT2hORXpkU20tMkZCcGk4YndkaU5XVTdTV3M4S1AtMkZ2SUh1Y2hqWjJqYjJFeTlWLTJCMUM3SkNzRWllaGM1SXR6OUlUQlA3MGttenNJUmZOUzhOZVFpeE5nMnpKWHgwU2IzVklCLTJGYTJ3Q2pQZ0tUQ3hsdVZ2ejdLQTJGa2pua3ZlQVhrYzBkWUxmbkR5YURScDVSV3VILTJCTGVyeVFlYndEc25STi0yQnFrbU9BNEo=/5E529FBDB555E5CB0022F86A444357270EF8189242DB873A4E2CC268E61E0709?c=1&i=1&docs=1&data=05%7C02%7CMTORRES@gocontec.com%7Cf259da6ab291465725fb08dc83d69f20%7C7de5bafb7e7d41e49ba10f46b89ecf86%7C0%7C0%7C638530205023361099%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0=%7C0%7C%7C%7C&sdata=pb7NjrGk1RIy6yDjv9JZpn5gJOkoDX3s1fUkBdNGGcg=&reserved=0	Get hash	malicious	Unknown	Browse	3.161.82.24
e8652.dscx.akamaiedge.net	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	23.197.253.105
	https://www.transfernow.net/en/bld?utm_source=20250321oYBy7zgb	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	https://app.eraser.io/workspace/ISn1eLCg7dzDBCScfS1e?origin=share	Get hash	malicious	Unknown	Browse	23.216.136.238
	345778.pdf	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	MetroHealthNow.com.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.216.136.238
	windscribe.msi	Get hash	malicious	Unknown	Browse	23.216.136.238
	https://www.transfernow.net/dl/20250327nEx48coZ	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.216.136.238
	taxCPAm.bat	Get hash	malicious	Unknown	Browse	23.216.136.238
	220-002-1.pdf	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	New Order_PO 354688976.pdf	Get hash	malicious	Unknown	Browse	23.197.253.105
d2srg6h49ykvtq.cloudfront.net	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om~VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc~Gb~b7F~2c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc~F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	3.168.102.38
	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJzYIFyRp4R0KWU0rWugMmJiYWAVpWKV1K4i6V8hIZ5SM0ZiLWEW1OmR5/DRLcQX0iG12ODR6m0Z2uCX54XhMGr31/03pyTfZ6rYZi~XpqUQYOHR1KUiJS11Z/0T2qVjY4XRZcYgpc9i5uJWYR7g20EjL0/YM46gJCqg7mLRrm6jJc4gn5DVr69X0OQV6WNfKt6Z1h7XJOYhqWIX20v3pR/S20XfZm6f1WH4qtBZKWOY6Wx4rKpZ0Onh80BSLOY4Mh83r/3ZsWx36GrQYOHS2SniIWZV507V1OzioqTfo0xY7S5jJhCSsiRhLiZZI4L35OUYZm~hJ/~js4tfpuWh5qOiIJ9fMm8gK0CTM04fsiv4555ipVyRpOyTY0xjK0AT1mQYYOfW5uUS842iqiCjr4qXIJ73o0Sg80RRoqYjI0~j0uN1qiWWpmz3sJBS6Z701OyRrSBfH5DWpWo3oSC02OW1JKCi5/DRsSt4KS/RImw1KZyRp49hsi~f6uZRsioj2uZR2mUg0KsQYOHiEK6RJ0/W8SoQYOHXZuJSoGRTMqP3rS2gr/t01xD4MF70sSmSLOOZ64Xh1/fi7bCW6G9f5OMVsGNgYW8XIqsSMq~TJR8RJxBgKq0XE09hr/5jqmJZ6mxR2STVryCZpC3WrcNf0JESsVDZM35QYOLRs0GRZc44pm4jYKUQYOLfM0xZ2W8X8iMf04SQYOLWIG7jpOt2EWBf1mNj1iTZ5NBhoqX4qhB4IV5Y5W7QYOHZZ/zgLb60KGB4sOxWZyqWqKnj1u01pWE3YOEiJms1MhB08uJjLiDZZBC00WSjMmq1ImDX6mPVYS0X0KYZ7yL4sKD3oGL4Jh912KMW2FDY0tBYEVE315DYZ65XZ4uTZiKXYixi6SOS5VDSZC5WsmSfKG5R53BjL6xfEKwSKuG12SX0KGAZ8W7R5WBSLl812iWf1Kq3r0vTLqHX5/LR50UWZ06TYKNRrcVd~FG88JcGJ/FGF88986aFHbKbb/JIIK/89KHGK8IHaG/I8KIcbba6c7cKI68GGKI7?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiMTVjN2QxOWQyYmUwNTY1NzUzNWNiMjU5MjdlZDQxYTo3OjBjYTc6YjUxOGI0N2MzNmJhYjUzNGU2MzNkZWE3MDBkNGExYmIwNzljNzhmMDU2MmNkNzkwZDBhMjM3MDE5NjU0YTZkNTpoOlQ6VA	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	3.168.102.96
	https://protect.checkpoint.com/v2/r01/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJz0ZOA1YpCSoGOfZu2gE3yRpN701JyRpOm4ZZyRp4q0YpC41S1h5KD47KphMiO0J/ARo394ZuDi6WW41uA0ZCGZsV/hKq4hn5DVqi1SpSG0Iiq0YiNiZC33pyAQYOLfD5DVoOH4EWH45yy38iYhrWx0YiVg5yOT0VyRpOmZ1K2gpqsW5R/g5c81YGRQYOLV8umhLS2X6OG02WJ48S4XrSZhspDQYOHj0O/ZZO4YYpEY0i64ZCT0KSvgIWoXKR8hZi9SJ6HZ1WSYoWD07KS1LZBgs09XESu4KOBh0WJ1r02gq3CTL/54pS~WrB7gMqXfMGfR6WVW7iZWpyq45mYQYOHgoWvY6KEf1qKh5OXS2us02tyRp4vTYGnVYGm0Y4HX7SK0ZRyRpOuiEm/SKGC0si/irc90Z63XL9yRp36Z5KZYLlyRpOSWqSIQYOHXLW8X64mhKKzhEGBf0tBX24yV1utSEWG0ISpR7WMR0JDZ80OXrmQYsZyRp4G1suTX1tCYruxfYGJXr6O40SD056PXZOrREqxjZyAjpW7X1yrgYGuiJOUXJcUi50ORqOKTJ4LgJmWWrmJYJKJ0sSZVZuy08uNXK4G1LW5WEGWRYOST1SrY7KI400ERquY06iU32JCgLcxTZSX3EmVV0uCR8iWW2O9QYOHi8mrYLcRg5mPg5i9S0p5iqOo12G6i0ZyRp44TMh7RIqnV2iJX7/G4pK6j1BBWLC5R5qSg00pZJO2YqmTXZC2Zr/0310008uSX005S6Kt100zTKKDS2W2f0RBX7K/jolDfqqQWqSN31mHZr/4Ro4NXqm54p/VgLi01MKBTY3yRp35gLiTY76rW8OMZ5Z8j1uJWp6wR7uNi6GnjrOE4LuRRoRESZ4XjX5DVsqPW7/sfJi5V7c23pu3S1BCYZ/WYr0EV7J6h0mE1J4vV0WsQYSJQYSJWo0kXKb5hLqtXMqsYqSHRMN/Zr42RLV5SJcPfKS6WrmuZrCXiK4Rh2m~08WYXMSmg1q6Z1l5Z00~Y1WChJ0t0Ii6hES8XImMiM0QYryZ4EWO1KqsSZ0K00WfX5WS11C636i63Ep80qSYjo4mWE4111p6Y5tyRp4Y45c43py9fEqOV5351KGy1Km/R0S40H5DWqZC0JyGW1iAYIqCgMG7gZS~003CX1yMV0GDfsZyRp38f54wZJuS00O7R5cE1ol6jJ6XhMpD1p0vj0uXi0uZf6JyRp4GRZ6IgpC/0puyW0itV0JyR5VyR5V=dJ9a86J/5GGJ6/HFH867JHa95G57Ja897H65~G65b9/b7c9/a8J6JI56758~GFFJI?h=6&fru;n=6&fru;ithx=6___.YzJ1OnNlcXVhbGNvcnA6YzpvOjVjN2U0MGNlMGRhNDNkZDEwYjk3ODU0ZTRhMGNmYTFjOjc6MDQyMTpiZDMwNmQ3NDgyNWUwNmM1NzVmMTk0YTFiN2ZjZDQ3NWZjMzIzMTMzNjg2ZmY0ZTMyY2VmMDdmYWRhZDI0MTJjOmg6VDpU	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.35.58.122
	https://protect.checkpoint.com/v2/r01/___https:/taibaubiquitousecosystem.com/Bu-nshqzijxdoxdovzjwDdzndithzxnls.myrq___.YzJ1OmthbnNhc2Nvcm5ncm93ZXJzYXNzb2NpYXRpb246YzpvOjU5ZDk3OWIwMjIyNGRiOTA2NWViY2M5MzNkOWIyOWZjOjc6MTk4MTphNWMyNzAwM2Y3YmNhM2I4ODM2YjUyZmMwNTY0NDY0OTI4ZWYyMDU2M2Q0MjExNDcwN2UzYTNjODQxZDMxZTAxOmg6VDpU	Get hash	malicious	Unknown	Browse	13.35.58.122
	https://protect.checkpoint.com/v2/r02/___https:/na4.docusign.net/signing/emails/v1-17bce9736d5c4a82a2f044a70e88a03e108cad8d215844a9bfa887f231478174?ensd=OlmiHSbJ0eI9ZkG%252fXULDauoKHvxO23F9a%252bPGq7hjoJp0HIFFAe1EFdJwPtqdo4OgJmPHfQvjt1%252fkl1g2rxyFyD%252bqjlqdzHjmj%252fRtMoM9SQ9%252fZeu31DYIZdTMwerNqs6R60vWNicq0LGe1I6s3%252fgihqnRyP6m4z%252bx5BPMT1vfgoihHu%252fR0U1keW2mq4dvGTTA___.YzJlOmdlcmZsb3JzcGE6YzpvOjZlMGI4MTE2ZjdiNzcyODUyMzQyZWM5M2VhMTM5ODEyOjc6YmI1NTo4YWM2MjkyNTQ3MzgwZjFiNTZlYjZjZGYzODRjM2RlZDc2YWVlNTczNTM0ZTYyYzhmYmZiYjk1MDFmOGE5YjJjOmg6VDpO	Get hash	malicious	Unknown	Browse	13.35.58.92
	https://protect.checkpoint.com/v2/r01/___https://link.edgepilot.com/xdg~fiaa57dVgx2DluRTp19jF8WMmYfWl?z=myyux:ddjrfnq.ynintwjuqD.htrdhdjOBhER6ylHFZFTGu9JoBlVNMIw79G-bMOgKn5Sf55EkuFm_s/LOKQ2pPEoswuEsuU2A7WKVctU0F0LxRir4fJPhZrPOzTgvHZltxJFSX/jFwCJW7F4BtO0gjUt6gM8NiU9g~uEaD_oE2wiDMlq2GDu8zhwYySQbzr0kVZGcn8s4Dk7cEDvSl6XRkaXaP7a5RqmSqgUx7-yk6g8/s-FxFFU__PNlcuV___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOmRkMGI4MjA2MTNmMjg1YzMyNTM2YjE2YzI0MjAzMGU1Ojc6MzQ1NjphZDU1ODAwMDRlN2FjYWY0Nzk3ODJmN2U3MjI1MmNkMTUyZWIyNWZlZjgyYTY4N2M3ZWVjN2E0NjVmZjU3M2E4Omg6VDpU	Get hash	malicious	Unknown	Browse	18.66.161.119
	https://protect.checkpoint.com/v2/r02/___https://url1251.popmenu.com/qxdhqnhp?zus=z556.WRHPCjsgt/tA51B6LI9w4BubTYwM5p/-7KrggkVEpmPU5/oVFKKM8Rk6rAnqtQtILc2Q2H_3u9DiXC41Sfynx8MyN~gGwOol/aO3BY~pgD37kbc4-7KGmCSO4DHGqcB~D2S053knP-7G~y37ScDgrX/lhFDF7r7h5Gwz-7GtvZLu~h33zX5RXwSF0oDJX34CSZAvVXm4AFQJ-7Gq-7KxI/mcm4qvQmbxushMLQI9uHWfHKaPI5mifSCu5iVBRcvqUxu7JB4CzzH~tp7hI~P2JxcRqKbjQDa1m4EV2vJju-7KXGYhKkA/NMg4b3nlprWADF7NLfLtJTf5xKVlxz1PBE~XIwKJANjSZxzJHsTEzwI07xTpBPmh9cjRp3bNxF-8I___.YzJlOm1zbm90aWZ5OmM6bzphNDQ0NjUwYTgwNjk4YzE1YzQzODY0NjgzZWZkNGFjNzo3Ojk1N2U6NjEyMTFiMTNiOTljZDFhYmUzOWRiNzM5NDE0NGE3NDNhMDJkZjlhMmI1NzgzMzhlZTAwMjhmZTBkODVlNWNmZDpoOlQ6VA	Get hash	malicious	Unknown	Browse	18.66.161.102
	https://docs.google.com/presentation/d/e/2PACX-1vTBMx4bSFDj_B_GCJTdTqUpVgpLXyQPR3uFGYP9j81KKHswOSbzMWDM5ZByYtVAwpACe-iOzHmzehje/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	18.66.161.102
	https://docs.google.com/presentation/d/e/2PACX-1vRMxSBYgTIj7bH-OYJSKudpxaekmSD6B-b603kyy-2ygb7TXyfRQC-hU8fjYDSrrObCUBq88ZmRswwh/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	18.66.161.9
	https://docs.google.com/presentation/d/e/2PACX-1vQdSuwONgWFnuoaK9jWkn4a4T1fFD4ixA3V2X7f5aWnD4sHxk2b10z2j2TMxkq3G15FQX3bbwReJ2PF/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	18.66.161.112

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	parm6-20250328-1527.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	pmips.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	54.169.144.97
	parm5.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	34.243.160.129
	i.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://zfrmz.com/RQfyz0GK9FXD9XfI9otC	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	3.168.73.40
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	arm7.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	https://app.eraser.io/workspace/ISn1eLCg7dzDBCScfS1e?origin=share	Get hash	malicious	Unknown	Browse	108.139.47.114
AMAZON-02US	parm6-20250328-1527.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	pmips.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	54.169.144.97
	parm5.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	34.243.160.129
	i.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://zfrmz.com/RQfyz0GK9FXD9XfI9otC	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	3.168.73.40
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	arm7.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	https://app.eraser.io/workspace/ISn1eLCg7dzDBCScfS1e?origin=share	Get hash	malicious	Unknown	Browse	108.139.47.114
CLOUDFLARENETUS	EFTRemittance_Scott.etheridge_WNDGZZABOH_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.80.248
	The_LauncherV1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	lnstall.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.50.200
	Loader.exe	Get hash	malicious	Dracula Stealer, SheetRat	Browse	104.16.185.241
	https://am.iagiwtbsaiv.es/6421gRYw/$	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.177.223
	build.msi	Get hash	malicious	Unknown	Browse	172.67.185.5
	lcnbktiaiortaaewdf.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.22.206
	bvnrfiseooo.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.175
	brityjaldjthjawr.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.25.9
	Vessel Details.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
CLOUDFLARENETUS	EFTRemittance_Scott.etheridge_WNDGZZABOH_attach.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.21.80.248
	The_LauncherV1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	lnstall.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.50.200
	Loader.exe	Get hash	malicious	Dracula Stealer, SheetRat	Browse	104.16.185.241
	https://am.iagiwtbsaiv.es/6421gRYw/$	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.177.223
	build.msi	Get hash	malicious	Unknown	Browse	172.67.185.5
	lcnbktiaiortaaewdf.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.22.206
	bvnrfiseooo.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.85.175
	brityjaldjthjawr.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.25.9
	Vessel Details.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.249269894663014
Encrypted:	false
SSDEEP:	6:iOlQ0iOq2PN72nKuAl9OmbnIFUtPQb0jZZmwJQb0jzkwON72nKuAl9OmbjLJ:7lQ0iOvVaHAahFUtPQg/JQI5OaHAaSJ
MD5:	7E54A3C7D781896B938768CD4A234FC0
SHA1:	AA18751114F69CD851D30BF232C830A46E043CBA
SHA-256:	7977085F25B43225E8AE112383128A091061416F3194F908C5662A3695D46659
SHA-512:	E7CD59CA8331612F6F9400868A3027EF2A43F3296FAB5E1E5D504FDCC994B6073D25121256B2E52E89C15F9B7910226E721F854967B3404B0A2B12D056E8B241
Malicious:	false
Reputation:	low
Preview:	2025/03/28-11:38:59.635 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/28-11:38:59.638 1c94 Recovering log #3.2025/03/28-11:38:59.638 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.4316235658474317
Encrypted:	false
SSDEEP:	3:QaFHJA:7pA
MD5:	C95AEC10BA314EA37A33CEA18CF8A412
SHA1:	FFBD0B77230D80BF8F0096BE43F46D9D117CDB3F
SHA-256:	F6FC3C777E463ECB2820493F3E7EE6242AB9700BE016014B07B25EA56901F51D
SHA-512:	74B521715EC386E4D2D7056D98933B2F612E969BB58E6B5DDA24DE0C98EFE741B00C9A77B1BA92C6A3B46B83D11D48D6055C62315248B8513D940A5C68B6D87D
Malicious:	false
Preview:	Service Unavailable

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.837071113996177
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	ATT02683-1.pdf
File size:	79'438 bytes
MD5:	a4a6bf122a40c786167139ebbee00dd6
SHA1:	d63b4637e9c191a9d928d462f54bbd096dd04506
SHA256:	0c524d9172f76c24e1b447b45bfe9b6247747d5da4d54617bf799169040559b4
SHA512:	9f753b0f9d0f509ff5f6b10be0150858eddf887b6db8149786ee417f7570ca2e183fa62b9816f13a76395f4e6049350d20117958a61658cd40ab076970823213
SSDEEP:	1536:4WcHIn+eAKIPNrnLE46pGW+qjESKp+/v0rMabWhUIV3O69Hta+q1f:fcI8FRY46p7nRwMp1ecHBy
TLSH:	F873AE61F589D84CF991FA0ACAAA30790B4CF4F7B5CC68490C3D1BDDB581A94DB172CA
File Content Preview:	%PDF-1.4.%.....1 0 obj.<</Creator (Chromium)./Producer (Skia/PDF m127)./CreationDate (D:20250327161026+00'00')./ModDate (D:20250327161026+00'00')>>.endobj.3 0 obj.<</CA 1./ca 1./LC 0./LJ 0./LW 1./ML 4./SA true./BM /Normal>>.endobj.4 0 obj.<</ca 1./BM /Nor

General
Header:	%PDF-1.4
Total Entropy:	7.837071
Total Bytes:	79438
Stream Entropy:	7.993658
Stream Bytes:	65123
Entropy outside Streams:	5.118012
Bytes outside Streams:	14315
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	70
endobj	70
stream	11
endstream	11
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2025 16:39:06.125847101 CET	65078	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:06.214937925 CET	53	65078	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:23.872765064 CET	53	54286	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:23.889925003 CET	53	55003	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:24.928517103 CET	53	53186	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:28.135445118 CET	63226	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:28.135662079 CET	61648	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:28.223627090 CET	53	63226	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:28.227533102 CET	53	61648	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:29.440610886 CET	64009	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:29.440763950 CET	60575	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:29.564960003 CET	53	64009	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:29.573924065 CET	53	60575	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:30.482904911 CET	56618	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:30.483057022 CET	57206	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:30.585028887 CET	53	56618	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:30.591965914 CET	53	57206	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:31.649882078 CET	53	49967	162.159.36.2	192.168.2.6
Mar 28, 2025 16:39:32.134372950 CET	53	58023	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:32.829968929 CET	65420	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:32.830179930 CET	60003	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:32.961539030 CET	53	65420	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:32.962974072 CET	53	60003	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:34.144840956 CET	58458	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:34.145050049 CET	51752	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:34.233257055 CET	53	58458	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:34.233289003 CET	53	51752	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:35.094192028 CET	61064	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:35.094369888 CET	50199	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:35.110251904 CET	61299	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:35.110466957 CET	55270	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:35.185519934 CET	53	61064	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:35.193917036 CET	53	50199	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:35.198363066 CET	53	61299	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:35.198658943 CET	53	55270	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:35.676076889 CET	53353	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:35.676220894 CET	61680	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:35.765085936 CET	53	53747	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:35.771049023 CET	53	53353	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:35.809869051 CET	53	61680	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:36.351366043 CET	53	58903	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:37.067651987 CET	53339	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:37.067918062 CET	62276	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:37.156569958 CET	53	58190	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:37.158570051 CET	53	53339	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:37.162085056 CET	53	62276	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:37.616893053 CET	56844	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:37.617399931 CET	50351	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:37.618464947 CET	64694	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:37.618680954 CET	52360	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:37.642734051 CET	55749	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:37.642905951 CET	63223	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:37.705152035 CET	53	56844	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:37.705485106 CET	53	50351	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:37.706664085 CET	53	64694	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:37.707251072 CET	53	52360	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:37.730957031 CET	53	55749	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:37.730976105 CET	53	63223	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:42.020286083 CET	53	53742	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:50.770682096 CET	61735	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:50.770915031 CET	58762	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:50.869856119 CET	53	58762	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:50.871659994 CET	53	61735	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:51.271648884 CET	63033	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:51.271851063 CET	59682	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:39:51.365941048 CET	53	63033	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:51.407768965 CET	53	59682	1.1.1.1	192.168.2.6
Mar 28, 2025 16:39:53.546530008 CET	138	138	192.168.2.6	192.168.2.255
Mar 28, 2025 16:40:01.113557100 CET	53	56158	1.1.1.1	192.168.2.6
Mar 28, 2025 16:40:23.381359100 CET	53	63754	1.1.1.1	192.168.2.6
Mar 28, 2025 16:40:23.407814980 CET	53	51639	1.1.1.1	192.168.2.6
Mar 28, 2025 16:40:53.472162962 CET	53	51436	1.1.1.1	192.168.2.6
Mar 28, 2025 16:41:09.113359928 CET	61942	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:41:09.113502979 CET	59383	53	192.168.2.6	1.1.1.1
Mar 28, 2025 16:41:09.201513052 CET	53	61942	1.1.1.1	192.168.2.6
Mar 28, 2025 16:41:09.201564074 CET	53	59383	1.1.1.1	192.168.2.6
Mar 28, 2025 16:41:37.832040071 CET	53	50384	1.1.1.1	192.168.2.6

Timestamp	Bytes transferred	Direction	Data
Mar 28, 2025 16:39:06.361279964 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 28, 2025 16:39:06.452265978 CET	1031	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=56795 Expires: Sat, 29 Mar 2025 07:25:41 GMT Date: Fri, 28 Mar 2025 15:39:06 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urI*Av5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt
Mar 28, 2025 16:39:06.452277899 CET	714	IN	Data Raw: 30 d4 5b 71 36 b4 07 ba c1 30 30 5c 48 b7 82 3b 98 a6 7d 60 8a a2 a3 29 82 cc ba bd 83 04 1b a2 83 03 41 a1 d6 05 f1 1b c2 b6 f0 a8 7c 86 3b 46 a8 48 2a 88 dc 76 9a 76 bf 1f 6a a5 3d 19 8f eb 38 f3 64 de c8 2b 0d 0a 28 ff f7 db e2 15 42 d4 22 d0 Data Ascii: 0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0HUXPi ')au\ni/VKsY!

Timestamp	Bytes transferred	Direction	Data
Mar 28, 2025 16:39:06.867110968 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 28, 2025 16:39:06.956684113 CET	223	IN	HTTP/1.1 304 Not Modified Date: Fri, 28 Mar 2025 15:09:48 GMT Expires: Fri, 28 Mar 2025 15:59:48 GMT Age: 1758 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 28, 2025 16:39:06.976548910 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 28, 2025 16:39:07.066800117 CET	223	IN	HTTP/1.1 304 Not Modified Date: Fri, 28 Mar 2025 15:00:24 GMT Expires: Fri, 28 Mar 2025 15:50:24 GMT Age: 2323 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:29 UTC	1473	OUT	GET /v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDbCTYpyf7Kpg76m37bziMOmf7Su4H/og75AU8ZcfMW5hMR~OYOLOYOL416mf1Bzf1W9fLcy4X/ogDZDWrRqRp4qXsiKi5BCY5OIW0KGY5Sz46uOY2Ski6iLW709Y0Wf310n12SSi6SYZX56Rq3DYolyisSAi04IT2J6X6V/g0qHfZKH08WtZ7Wv31i~W1/y3pcq12WtRriI075DTJxCfJt/g6SGWrmfRIOyh5KCjsmw1p0RfsSMi7SwX0SH0L9/iJWx1rC/gMWCSYSw28mNX0O6V2Go1o3DT2SRhs4ojpWpRsKNX5mGYKm~TLRDZMJ7T24NjYq7SE0pS0t5i1CO38ioZJWvXoSrR0cYT0cKjoWJVZKJ26bCRJcTYpJr4Y6B0qWr07msSKhB0qWf0Zb/RZuBYomshEqZR76v48370n4o41Zc10iXfLO0Vsuf1J3C10iwi1OzgE5=d/GK8798a6JI5Hb98G7cc6KHJ~c7HI~8cIG9~HH5cG9H7ca/J97/b8J7IFb8JbGIG?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzo0MWYxYjc0YzQ1OTdmZDNkNjQ4YWYwYjFkYTdjMDZjNjo3OjM5YWE6M2U0NTliZTExYzhiZDAxZWU2ZTQ2NTIyNTJiYzg4NGUzYzEwMGRmNGM2YTg1ZDVjNDQ3MjgwZjBlNjZmYjhlMTpoOlQ6VA HTTP/1.1 Host: protect.checkpoint.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:30 UTC	1064	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 28 Mar 2025 15:39:30 GMT set-cookie: x-cloud-sec-ctp = 7b6c5d81-a578-4c91-9454-7c0694df456c; Secure; HttpOnly; path=/; expires=28-Mar-2026 15:39:30 GMT location: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1 Apigw-Requestid: IJNb4inCjoEEMxg= X-Cache: Miss from cloudfront Via: 1.1 bcba63317be8c4e9a4e9a6f5ec2b6c14.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P6 X-Amz-Cf-Id: aIgs-djpQJBjfmEZAJmelTmceTcib-W_lCXvV0AofZlJXMDxl9l29Q==

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:31 UTC	1236	OUT	GET /scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1 HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:31 UTC	585	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 880 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 27 Mar 2025 16:57:26 GMT ETag: "eba76f3b62e097867c0b5d15cf4315af" Via: 1.1 e030eb9e2523dd8af200ce39f28ca642.cloudfront.net (CloudFront), 1.1 5c2a8f663f6fd9a0cb8424c72fd50e58.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: kOtHSFk27jJ54xbAyv0F6LkneST0aCiAmnGnyD4Zl3ABpsKPNgS3YQ== Age: 87126
2025-03-28 15:39:31 UTC	880	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 63 61 6e 22 2f 3e 3c 6c 69 6e Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><meta name="description" content="Scan"/><lin

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:32 UTC	1134	OUT	GET /index.css HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:32 UTC	602	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 134 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 7bac70c3c5deda2f56c0a3aff53deab0.cloudfront.net (CloudFront), 1.1 f42ef40059bf51d47e55bd92308816ba.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Date: Fri, 28 Mar 2025 15:39:33 GMT ETag: "6748fbbc7fb3b016e371219d605b1239" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: Fb49Uh6kO0x5n2N_iWcDR4iCC_7AYoVFZJQNblwY5F6Ls4_aAZlHoQ==
2025-03-28 15:39:32 UTC	134	IN	Data Raw: 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 32 32 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 61 6c 65 77 61 79 2c 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 0a 7d Data Ascii: body { background-color: #fff; color: #222; font-family: Raleway,HelveticaNeue,Helvetica Neue,Helvetica,Arial,sans-serif}

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:32 UTC	1153	OUT	GET /static/css/main.3dfe9f5e.css HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:32 UTC	603	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 4584 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 181a665d1a0b3047b4fa647eeabfb330.cloudfront.net (CloudFront), 1.1 bf1882b87be33343d40479518a081ae2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Date: Fri, 28 Mar 2025 15:39:33 GMT ETag: "8fc5a2f23a27198d9e865e74add2673c" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: lWdsN7Bovy7NbyXFY1A7zSiYl2d2e3ELPxtzmFrOh5N1RPLUrpG55w==
2025-03-28 15:39:32 UTC	3198	IN	Data Raw: 2e 73 63 61 6e 6e 65 72 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 65 72 2d 73 70 69 6e 20 31 2e 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 65 72 2d 73 70 69 6e 20 31 2e 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 62 6f 72 64 65 72 3a 32 70 78 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 37 65 6d 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 2e 35 65 6d 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 77 69 64 74 68 3a 37 65 6d 7d 2e 73 63 61 6e 2d 63 6c 65 61 6e 7b 64 69 73 70 6c 61 Data Ascii: .scanner{-webkit-animation:loader-spin 1.2s linear infinite;animation:loader-spin 1.2s linear infinite;border:2px solid;border-radius:50%;display:inline-block;height:7em;margin-bottom:3.5em;position:relative;vertical-align:top;width:7em}.scan-clean{displa
2025-03-28 15:39:32 UTC	1386	IN	Data Raw: 69 64 74 68 3a 33 70 78 7d 7d 2e 6c 69 6e 6b 73 63 61 6e 2d 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 4e 75 6e 69 74 6f 20 53 61 6e 73 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 7d 2e 6c 69 6e 6b 73 63 61 6e 2d 62 75 74 74 6f 6e 2d 2d 63 6c 65 61 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 63 62 38 35 63 3b 63 6f 6c 6f 72 3a 23 30 30 30 7d 2e 6c 69 6e 6b 73 63 61 6e Data Ascii: idth:3px}}.linkscan-button{border:0;border-radius:4px;cursor:pointer;display:inline-block;font-family:Nunito Sans,Helvetica Neue,Helvetica,Arial,sans-serif;font-weight:700;line-height:1}.linkscan-button--clean{background-color:#5cb85c;color:#000}.linkscan

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:32 UTC	1137	OUT	GET /static/js/main.d62e4927.js HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:32 UTC	624	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 266441 Connection: close Date: Thu, 27 Mar 2025 16:52:45 GMT Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT ETag: "f3dc5fda1f5ecbd5f39d4bf333d98130" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 44dd03c6d93a5b4e66aa5cea227acbb2.cloudfront.net (CloudFront), 1.1 5c2a8f663f6fd9a0cb8424c72fd50e58.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: CoAwlZHF88tdaXofLi9TV8XcjhhjA7gSYhDmmTkuYIS_8hLruUmW7w== Age: 82008
2025-03-28 15:39:32 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 61 69 6e 2e 64 36 32 65 34 39 32 37 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 38 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 34 37 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 7d 6f 2e 72 65 73 65 74 57 61 72 6e 69 6e 67 43 61 63 68 65 3d 61 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6e 2c 61 2c 6f 2c 69 29 7b 69 66 28 69 21 3d 3d 72 29 7b 76 61 72 20 6c 3d 6e 65 77 20 45 72 72 6f 72 Data Ascii: /! For license information please see main.d62e4927.js.LICENSE.txt /!function(){var e={888:function(e,t,n){"use strict";var r=n(47);function a(){}function o(){}o.resetWarningCache=a,e.exports=function(){function e(e,t,n,a,o,i){if(i!==r){var l=new Error
2025-03-28 15:39:32 UTC	16384	IN	Data Raw: 2c 33 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3a 65 7d 76 61 72 20 6b 65 3d 6e 75 6c 6c 2c 78 65 3d 6e 75 6c 6c 2c 45 65 3d 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 5f 65 28 65 29 7b 69 66 28 65 3d 62 61 28 65 29 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 3d 74 79 70 65 6f 66 20 6b 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 32 38 30 29 29 3b 76 61 72 20 74 3d 65 2e 73 74 61 74 65 4e 6f 64 65 3b 74 26 26 28 74 3d 53 61 28 74 29 2c 6b 65 28 65 2e 73 74 61 74 65 4e 6f 64 65 2c 65 2e 74 79 70 65 2c 74 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 43 65 28 65 29 7b 78 65 3f 45 65 3f 45 65 2e 70 75 73 68 28 65 29 3a 45 65 3d 5b 65 5d 3a 78 65 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 4f 65 28 29 7b 69 66 28 78 65 29 7b 76 Data Ascii: ,3===e.nodeType?e.parentNode:e}var ke=null,xe=null,Ee=null;function _e(e){if(e=ba(e)){if("function"!==typeof ke)throw Error(o(280));var t=e.stateNode;t&&(t=Sa(t),ke(e.stateNode,e.type,t))}}function Ce(e){xe?Ee?Ee.push(e):Ee=[e]:xe=e}function Oe(){if(xe){v
2025-03-28 15:39:32 UTC	16384	IN	Data Raw: 6e 28 74 29 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 77 69 6e 64 6f 77 2c 74 3d 51 28 29 3b 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 2e 48 54 4d 4c 49 46 72 61 6d 65 45 6c 65 6d 65 6e 74 3b 29 7b 74 72 79 7b 76 61 72 20 6e 3d 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 74 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 7d 63 61 74 63 68 28 72 29 7b 6e 3d 21 31 7d 69 66 28 21 6e 29 62 72 65 61 6b 3b 74 3d 51 28 28 65 3d 74 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 29 2e 64 6f 63 75 6d 65 6e 74 29 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 70 72 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 Data Ascii: n(t))))}function dr(){for(var e=window,t=Q();t instanceof e.HTMLIFrameElement;){try{var n="string"===typeof t.contentWindow.location.href}catch(r){n=!1}if(!n)break;t=Q((e=t.contentWindow).document)}return t}function pr(e){var t=e&&e.nodeName&&e.nodeName.t
2025-03-28 15:39:32 UTC	14808	IN	Data Raw: 65 2e 6d 6f 64 65 29 26 26 30 3d 3d 3d 28 31 32 38 26 65 2e 66 6c 61 67 73 29 7d 66 75 6e 63 74 69 6f 6e 20 73 6f 28 65 29 7b 69 66 28 61 6f 29 7b 76 61 72 20 74 3d 72 6f 3b 69 66 28 74 29 7b 76 61 72 20 6e 3d 74 3b 69 66 28 21 6c 6f 28 65 2c 74 29 29 7b 69 66 28 75 6f 28 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 34 31 38 29 29 3b 74 3d 73 61 28 6e 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 3b 76 61 72 20 72 3d 6e 6f 3b 74 26 26 6c 6f 28 65 2c 74 29 3f 69 6f 28 72 2c 6e 29 3a 28 65 2e 66 6c 61 67 73 3d 2d 34 30 39 37 26 65 2e 66 6c 61 67 73 7c 32 2c 61 6f 3d 21 31 2c 6e 6f 3d 65 29 7d 7d 65 6c 73 65 7b 69 66 28 75 6f 28 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 34 31 38 29 29 3b 65 2e 66 6c 61 67 73 3d 2d 34 30 39 37 26 65 2e 66 6c 61 67 73 Data Ascii: e.mode)&&0===(128&e.flags)}function so(e){if(ao){var t=ro;if(t){var n=t;if(!lo(e,t)){if(uo(e))throw Error(o(418));t=sa(n.nextSibling);var r=no;t&&lo(e,t)?io(r,n):(e.flags=-4097&e.flags\|2,ao=!1,no=e)}}else{if(uo(e))throw Error(o(418));e.flags=-4097&e.flags
2025-03-28 15:39:32 UTC	16384	IN	Data Raw: 74 3d 6e 75 6c 6c 3d 3d 3d 65 7c 7c 6e 75 6c 6c 3d 3d 3d 65 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 3f 6c 6c 3a 75 6c 2c 65 3d 6e 28 72 2c 61 29 2c 62 69 29 7b 69 3d 30 3b 64 6f 7b 69 66 28 62 69 3d 21 31 2c 77 69 3d 30 2c 32 35 3c 3d 69 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 33 30 31 29 29 3b 69 2b 3d 31 2c 76 69 3d 67 69 3d 6e 75 6c 6c 2c 74 2e 75 70 64 61 74 65 51 75 65 75 65 3d 6e 75 6c 6c 2c 64 69 2e 63 75 72 72 65 6e 74 3d 73 6c 2c 65 3d 6e 28 72 2c 61 29 7d 77 68 69 6c 65 28 62 69 29 7d 69 66 28 64 69 2e 63 75 72 72 65 6e 74 3d 69 6c 2c 74 3d 6e 75 6c 6c 21 3d 3d 67 69 26 26 6e 75 6c 6c 21 3d 3d 67 69 2e 6e 65 78 74 2c 68 69 3d 30 2c 76 69 3d 67 69 3d 6d 69 3d 6e 75 6c 6c 2c 79 69 3d 21 31 2c 74 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 Data Ascii: t=null===e\|\|null===e.memoizedState?ll:ul,e=n(r,a),bi){i=0;do{if(bi=!1,wi=0,25<=i)throw Error(o(301));i+=1,vi=gi=null,t.updateQueue=null,di.current=sl,e=n(r,a)}while(bi)}if(di.current=il,t=null!==gi&&null!==gi.next,hi=0,vi=gi=mi=null,yi=!1,t)throw Error(o(
2025-03-28 15:39:32 UTC	16384	IN	Data Raw: 69 29 3b 69 66 28 30 3d 3d 3d 28 31 26 74 2e 6d 6f 64 65 29 29 72 65 74 75 72 6e 20 55 6c 28 65 2c 74 2c 6c 2c 6e 75 6c 6c 29 3b 69 66 28 22 24 21 22 3d 3d 3d 61 2e 64 61 74 61 29 7b 69 66 28 72 3d 61 2e 6e 65 78 74 53 69 62 6c 69 6e 67 26 26 61 2e 6e 65 78 74 53 69 62 6c 69 6e 67 2e 64 61 74 61 73 65 74 29 76 61 72 20 75 3d 72 2e 64 67 73 74 3b 72 65 74 75 72 6e 20 72 3d 75 2c 55 6c 28 65 2c 74 2c 6c 2c 72 3d 66 6c 28 69 3d 45 72 72 6f 72 28 6f 28 34 31 39 29 29 2c 72 2c 76 6f 69 64 20 30 29 29 7d 69 66 28 75 3d 30 21 3d 3d 28 6c 26 65 2e 63 68 69 6c 64 4c 61 6e 65 73 29 2c 77 6c 7c 7c 75 29 7b 69 66 28 6e 75 6c 6c 21 3d 3d 28 72 3d 52 75 29 29 7b 73 77 69 74 63 68 28 6c 26 2d 6c 29 7b 63 61 73 65 20 34 3a 61 3d 32 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 Data Ascii: i);if(0===(1&t.mode))return Ul(e,t,l,null);if("$!"===a.data){if(r=a.nextSibling&&a.nextSibling.dataset)var u=r.dgst;return r=u,Ul(e,t,l,r=fl(i=Error(o(419)),r,void 0))}if(u=0!==(l&e.childLanes),wl\|\|u){if(null!==(r=Ru)){switch(l&-l){case 4:a=2;break;case 1
2025-03-28 15:39:32 UTC	16384	IN	Data Raw: 72 3d 72 2e 6e 65 78 74 3b 64 6f 7b 76 61 72 20 6f 3d 61 2c 69 3d 6f 2e 64 65 73 74 72 6f 79 3b 6f 3d 6f 2e 74 61 67 2c 76 6f 69 64 20 30 21 3d 3d 69 26 26 28 30 21 3d 3d 28 32 26 6f 29 7c 7c 30 21 3d 3d 28 34 26 6f 29 29 26 26 74 75 28 6e 2c 74 2c 69 29 2c 61 3d 61 2e 6e 65 78 74 7d 77 68 69 6c 65 28 61 21 3d 3d 72 29 7d 70 75 28 65 2c 74 2c 6e 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 3a 69 66 28 21 58 6c 26 26 28 65 75 28 6e 2c 74 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 28 72 3d 6e 2e 73 74 61 74 65 4e 6f 64 65 29 2e 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 6e 6d 6f 75 6e 74 29 29 74 72 79 7b 72 2e 70 72 6f 70 73 3d 6e 2e 6d 65 6d 6f 69 7a 65 64 50 72 6f 70 73 2c 72 2e 73 74 61 74 65 3d 6e 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 Data Ascii: r=r.next;do{var o=a,i=o.destroy;o=o.tag,void 0!==i&&(0!==(2&o)\|\|0!==(4&o))&&tu(n,t,i),a=a.next}while(a!==r)}pu(e,t,n);break;case 1:if(!Xl&&(eu(n,t),"function"===typeof(r=n.stateNode).componentWillUnmount))try{r.props=n.memoizedProps,r.state=n.memoizedStat
2025-03-28 15:39:32 UTC	16384	IN	Data Raw: 54 75 3d 75 2c 62 74 3d 6c 2c 50 75 2e 74 72 61 6e 73 69 74 69 6f 6e 3d 69 7d 65 6c 73 65 20 65 2e 63 75 72 72 65 6e 74 3d 6e 3b 69 66 28 51 75 26 26 28 51 75 3d 21 31 2c 59 75 3d 65 2c 47 75 3d 61 29 2c 69 3d 65 2e 70 65 6e 64 69 6e 67 4c 61 6e 65 73 2c 30 3d 3d 3d 69 26 26 28 71 75 3d 6e 75 6c 6c 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6f 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 6f 74 2e 6f 6e 43 6f 6d 6d 69 74 46 69 62 65 72 52 6f 6f 74 29 74 72 79 7b 6f 74 2e 6f 6e 43 6f 6d 6d 69 74 46 69 62 65 72 52 6f 6f 74 28 61 74 2c 65 2c 76 6f 69 64 20 30 2c 31 32 38 3d 3d 3d 28 31 32 38 26 65 2e 63 75 72 72 65 6e 74 2e 66 6c 61 67 73 29 29 7d 63 61 74 63 68 28 74 29 7b 7d 7d 28 6e 2e 73 74 61 74 65 4e 6f 64 65 29 2c 61 73 Data Ascii: Tu=u,bt=l,Pu.transition=i}else e.current=n;if(Qu&&(Qu=!1,Yu=e,Gu=a),i=e.pendingLanes,0===i&&(qu=null),function(e){if(ot&&"function"===typeof ot.onCommitFiberRoot)try{ot.onCommitFiberRoot(at,e,void 0,128===(128&e.current.flags))}catch(t){}}(n.stateNode),as
2025-03-28 15:39:32 UTC	351	IN	Data Raw: 6e 2e 68 79 64 72 61 74 65 64 53 6f 75 72 63 65 73 7c 7c 6e 75 6c 6c 2c 61 3d 21 31 2c 69 3d 22 22 2c 6c 3d 51 73 3b 69 66 28 6e 75 6c 6c 21 3d 3d 6e 26 26 76 6f 69 64 20 30 21 3d 3d 6e 26 26 28 21 30 3d 3d 3d 6e 2e 75 6e 73 74 61 62 6c 65 5f 73 74 72 69 63 74 4d 6f 64 65 26 26 28 61 3d 21 30 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 2e 69 64 65 6e 74 69 66 69 65 72 50 72 65 66 69 78 26 26 28 69 3d 6e 2e 69 64 65 6e 74 69 66 69 65 72 50 72 65 66 69 78 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 2e 6f 6e 52 65 63 6f 76 65 72 61 62 6c 65 45 72 72 6f 72 26 26 28 6c 3d 6e 2e 6f 6e 52 65 63 6f 76 65 72 61 62 6c 65 45 72 72 6f 72 29 29 2c 74 3d 24 73 28 74 2c 6e 75 6c 6c 2c 65 2c 31 2c 6e 75 6c 6c 21 3d 6e 3f 6e 3a 6e 75 6c 6c 2c 61 2c 30 2c 69 2c 6c 29 2c 65 5b 68 61 5d 3d Data Ascii: n.hydratedSources\|\|null,a=!1,i="",l=Qs;if(null!==n&&void 0!==n&&(!0===n.unstable_strictMode&&(a=!0),void 0!==n.identifierPrefix&&(i=n.identifierPrefix),void 0!==n.onRecoverableError&&(l=n.onRecoverableError)),t=$s(t,null,e,1,null!=n?n:null,a,0,i,l),e[ha]=
2025-03-28 15:39:32 UTC	16384	IN	Data Raw: 75 72 63 65 45 61 67 65 72 48 79 64 72 61 74 69 6f 6e 44 61 74 61 3f 74 2e 6d 75 74 61 62 6c 65 53 6f 75 72 63 65 45 61 67 65 72 48 79 64 72 61 74 69 6f 6e 44 61 74 61 3d 5b 6e 2c 61 5d 3a 74 2e 6d 75 74 61 62 6c 65 53 6f 75 72 63 65 45 61 67 65 72 48 79 64 72 61 74 69 6f 6e 44 61 74 61 2e 70 75 73 68 28 6e 2c 61 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 47 73 28 74 29 7d 2c 74 2e 72 65 6e 64 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 21 4a 73 28 74 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 32 30 30 29 29 3b 72 65 74 75 72 6e 20 65 63 28 6e 75 6c 6c 2c 65 2c 74 2c 21 31 2c 6e 29 7d 2c 74 2e 75 6e 6d 6f 75 6e 74 43 6f 6d 70 6f 6e 65 6e 74 41 74 4e 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 4a 73 28 65 29 29 74 68 Data Ascii: urceEagerHydrationData?t.mutableSourceEagerHydrationData=[n,a]:t.mutableSourceEagerHydrationData.push(n,a);return new Gs(t)},t.render=function(e,t,n){if(!Js(t))throw Error(o(200));return ec(null,e,t,!1,n)},t.unmountComponentAtNode=function(e){if(!Js(e))th

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:33 UTC	1103	OUT	OPTIONS /scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?i=0&docs=1&s=1 HTTP/1.1 Host: api-bd.linkscan.io Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-original-referer Origin: https://lsems.gravityzone.bitdefender.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://lsems.gravityzone.bitdefender.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:33 UTC	624	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 0 Connection: close Date: Fri, 28 Mar 2025 15:39:33 GMT Access-Control-Allow-Methods: OPTIONS,GET x-amzn-RequestId: d593f2e1-a2af-4059-979a-c57c395be762 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,X-Original-Referer x-amz-apigw-id: IJNcaGKLDoEEgnw= X-Cache: Miss from cloudfront Via: 1.1 06a2a91727cd0dfdaa1154422bcbc726.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: XfmZzfJ8XAS6F6PEQgJo7O8DZ1rFC4dFLDys_j700A4C0xpkPUlOYw==

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:33 UTC	1201	OUT	GET /scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?i=0&docs=1&s=1 HTTP/1.1 Host: api-bd.linkscan.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" X-Original-Referer: unknown sec-ch-ua-mobile: ?0 Origin: https://lsems.gravityzone.bitdefender.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://lsems.gravityzone.bitdefender.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:35 UTC	562	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1228 Connection: close Date: Fri, 28 Mar 2025 15:39:34 GMT X-Amzn-Trace-Id: Root=1-67e6c2b5-37bdbee64d45e687686aeaeb;Parent=313d6c7c71f0b048;Sampled=0;Lineage=1:92f4b973:0 x-amzn-RequestId: f4cbaf51-c511-4416-865d-3cd258c8f387 Access-Control-Allow-Origin: * x-amz-apigw-id: IJNcfF5xDoEEXCA= X-Cache: Miss from cloudfront Via: 1.1 de1b9ae25d558e06a3362166bd9d3342.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: OX5r2qB4CBbhrLkPiPtbuNiSN9zdRm_nT-lophvEMIH5jvJA5_ZQ4w==
2025-03-28 15:39:35 UTC	1228	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 64 61 74 61 22 3a 7b 22 6f 72 69 67 69 6e 61 6c 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 31 39 39 2d 6b 61 64 6f 6d 61 63 6f 2e 74 72 61 6b 63 69 64 2e 63 6f 6d 2f 3f 75 3d 68 74 74 70 73 3a 25 32 46 25 32 46 65 6d 61 69 6c 2e 69 64 78 68 6f 6d 65 2e 63 6f 25 32 46 63 25 32 46 65 4a 77 45 77 4c 31 4f 42 43 45 51 41 4f 43 6e 67 5a 49 4d 73 5f 77 57 46 47 65 78 4d 54 5a 61 65 62 59 73 4d 77 53 53 51 2d 35 32 56 32 4e 38 2d 76 73 6f 75 56 43 39 71 35 4b 54 39 6d 59 42 69 41 42 57 74 68 53 64 6a 61 67 7a 45 6e 6d 62 4f 65 59 74 68 32 67 43 57 6d 32 38 4b 31 68 4a 39 6f 53 41 46 68 5a 30 32 6d 73 41 71 7a 78 6b 5a 45 4c 6a 73 47 77 63 6b 49 53 42 54 6e 39 74 44 6c 5a 6c 79 6c 74 71 35 33 6b 5f 78 48 49 52 75 Data Ascii: {"success":true,"data":{"originalUrl":"https://199-kadomaco.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRu

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:33 UTC	1182	OUT	GET /favicon.ico HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:33 UTC	625	IN	HTTP/1.1 200 OK Content-Type: image/vnd.microsoft.icon Content-Length: 17542 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront), 1.1 983c7b4dc16774878ead1f5daf9bb81e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Date: Fri, 28 Mar 2025 15:00:50 GMT ETag: "fba58480381fefa10f97bd44c76c87c7" Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: X8HZFWF8zskbkqhuHCD3v2bGEjZQREwpxkOFd-zudXNr20O2CP8ZGA== Age: 56138
2025-03-28 15:39:33 UTC	15990	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 01 00 20 00 68 04 00 00 46 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 ae 04 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 0e 00 00 30 30 00 00 01 00 20 00 a8 25 00 00 de 1e 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 39 00 00 ff a4 00 00 ff e5 00 00 ff f9 00 00 ff fb 00 00 ff ec 00 00 ff b5 00 00 ff 52 00 00 ff 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 0a 00 00 ff 9d 00 00 ff fe 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff c0 00 00 ff 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 07 00 00 ff bf 00 00 ff ff 00 Data Ascii: hF 600 %( @9R
2025-03-28 15:39:33 UTC	1552	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 06 00 00 ff 8f 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff e9 00 00 ff 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 5c 00 00 ff Data Ascii: T\

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:33 UTC	1123	OUT	GET /manifest.json HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://lsems.gravityzone.bitdefender.com/scan/aHR0cHM6Ly8xOTkta2Fkb21hY28udHJha2NpZC5jb20vP3U9aHR0cHM6JTJGJTJGZW1haWwuaWR4aG9tZS5jbyUyRmMlMkZlSndFd0wxT0JDRVFBT0NuZ1pJTXNfd1dGR2V4TVRaYWViWXNNd1NTUS01MlYyTjgtdnNvdVZDOXE1S1Q5bVlCaUFCV3RoU2RqYWd6RW5tYk9lWXRoMmdDV20yOEsxaEo5b1NBRmhaMDJtc0FxenhrWkVManNHd2NrSVNCVG45dERsWmx5bHRxNTNrX3hISVJ1QXBjWjYyOXNMcnZjekRkMnFIS0hBTFh6OGMyUHE2OXZIeTl2NzVkNVo0dWxJY3djUERqSjNmMV9TOV9FejREQUFEX18xME9OTkEmZT1wVlRmV2hnNFcwVlRaVU85MUpwTjhnczlUM21qZ3Y2ViZjZWU9WVdSaGJVQnpaWEYxWVdrdWJubz0=/5BF324371ED0C843B2991FCE692CD639DB46CC09B4C2975E42583E2DA83E8BDB?c=1&i=1&docs=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:33 UTC	615	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 290 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 1b0f041f103652001e37f5806000d24a.cloudfront.net (CloudFront), 1.1 1b875a3a250909f255b3e40ca099587a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Date: Thu, 27 Mar 2025 16:52:47 GMT ETag: "b0efba333d201884ace7da8c274c50d6" Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: V4OSBDHpfJoF2pYh7sPh6zP9UDTwqsNSr-kNoVFTfTMc0P3P9yQLVA== Age: 82007
2025-03-28 15:39:33 UTC	290	IN	Data Raw: 7b 0a 20 20 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 20 22 4c 69 6e 6b 73 63 61 6e 22 2c 0a 20 20 22 6e 61 6d 65 22 3a 20 22 4c 69 6e 6b 73 63 61 6e 22 2c 0a 20 20 22 69 63 6f 6e 73 22 3a 20 5b 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 22 73 72 63 22 3a 20 22 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2c 0a 20 20 20 20 20 20 22 73 69 7a 65 73 22 3a 20 22 36 34 78 36 34 20 33 32 78 33 32 20 32 34 78 32 34 20 31 36 78 31 36 22 2c 0a 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 0a 20 20 20 20 7d 0a 20 20 5d 2c 0a 20 20 22 73 74 61 72 74 5f 75 72 6c 22 3a 20 22 2e 22 2c 0a 20 20 22 64 69 73 70 6c 61 79 22 3a 20 22 73 74 61 6e 64 61 6c 6f 6e 65 22 2c 0a 20 20 22 74 68 65 6d 65 5f 63 6f 6c 6f 72 22 3a 20 22 23 30 30 30 30 30 30 22 2c Data Ascii: { "short_name": "Linkscan", "name": "Linkscan", "icons": [ { "src": "favicon.ico", "sizes": "64x64 32x32 24x24 16x16", "type": "image/x-icon" } ], "start_url": ".", "display": "standalone", "theme_color": "#000000",

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:34 UTC	408	OUT	GET /favicon.ico HTTP/1.1 Host: lsems.gravityzone.bitdefender.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:34 UTC	625	IN	HTTP/1.1 200 OK Content-Type: image/vnd.microsoft.icon Content-Length: 17542 Connection: close Last-Modified: Wed, 19 Mar 2025 09:57:27 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 4ec656d2dfbb59cd7fab2ac94a540522.cloudfront.net (CloudFront), 1.1 9b0814f74b20835098fe6c38b6ceeac4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P3 Date: Fri, 28 Mar 2025 15:00:50 GMT ETag: "fba58480381fefa10f97bd44c76c87c7" Vary: Accept-Encoding X-Cache: Hit from cloudfront X-Amz-Cf-Pop: JFK52-P9 X-Amz-Cf-Id: K1F_r1MTCq0iDAJn20fLaUBGPkHyvzDoMc9nRjjFRyS0HHlC_pseng== Age: 56139
2025-03-28 15:39:34 UTC	16384	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 01 00 20 00 68 04 00 00 46 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 ae 04 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 0e 00 00 30 30 00 00 01 00 20 00 a8 25 00 00 de 1e 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 39 00 00 ff a4 00 00 ff e5 00 00 ff f9 00 00 ff fb 00 00 ff ec 00 00 ff b5 00 00 ff 52 00 00 ff 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 0a 00 00 ff 9d 00 00 ff fe 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff c0 00 00 ff 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 07 00 00 ff bf 00 00 ff ff 00 Data Ascii: hF 600 %( @9R
2025-03-28 15:39:34 UTC	1158	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 1a 00 00 ff 96 00 00 ff f4 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff dd 00 00 ff 67 00 00 ff 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 2e 00 Data Ascii: g.

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:35 UTC	1030	OUT	GET /?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRuApcZ629sLrvczDd2qHKHALXz8c2Pq69vHy9v75d5Z4ulIcwcPDjJ3f1_S9_Ez4DAAD__10ONNA&e=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V&cee=YWRhbUBzZXF1YWkubno= HTTP/1.1 Host: 199-kadomaco.trakcid.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://lsems.gravityzone.bitdefender.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:35 UTC	755	IN	HTTP/1.1 200 OK x-guploader-uploadid: AKDAyIsv8WWtF5jPw0hJJSP1R1kJGIMt4gP5pvNmqCz9Nz7aYbVjBkbSx4_TWllHGCL-ZTqT x-goog-generation: 1737365220556059 x-goog-metageneration: 1 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 6443 x-goog-hash: crc32c=tv1Ghg== x-goog-hash: md5=eId+PtOYRfdFsCoRmQDsSQ== x-goog-storage-class: STANDARD accept-ranges: bytes Content-Length: 6443 server: UploadServer via: 1.1 google date: Fri, 28 Mar 2025 15:39:35 GMT expires: Fri, 28 Mar 2025 16:39:35 GMT Cache-Control: public, max-age=3600 Last-Modified: Mon, 20 Jan 2025 09:27:00 GMT ETag: "78877e3ed39845f745b02a119900ec49" Content-Type: text/html Age: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-28 15:39:35 UTC	242	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 74 72 61 63 6b 2e 73 61 6c 65 73 66 6c 61 72 65 2e 63 6f 6d 2f 66 6c 61 72 65 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 0a 20 20 20 20 Data Ascii: <html> <head> <title>Redirecting...</title> <script src="https://track.salesflare.com/flare.js"></script> <link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet"> </head>
2025-03-28 15:39:35 UTC	997	IN	Data Raw: 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 22 3e 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 66 2d 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 66 2d 68 65 72 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 73 66 2d 68 65 61 64 69 6e 67 22 3e 57 61 6e 74 20 74 6f 20 74 72 61 63 6b 20 79 Data Ascii: <body style="visibility: hidden;"> <div class="sf-header"> <div class="sf-hero"> <div class="container"> <div class="header-container"> <h1 class="sf-heading">Want to track y
2025-03-28 15:39:35 UTC	997	IN	Data Raw: 69 2b 2b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 61 73 68 20 3d 20 68 61 73 68 65 73 5b 69 5d 2e 73 70 6c 69 74 28 27 3d 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 73 2e 70 75 73 68 28 68 61 73 68 5b 30 5d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 4d 61 6b 65 20 73 75 72 65 20 74 68 65 20 75 72 6c 20 69 73 20 70 72 65 66 69 78 65 64 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 68 61 73 68 5b 30 5d 20 3d 3d 3d 20 27 75 27 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 73 5b 68 61 73 68 5b 30 5d 5d 20 3d 20 73 61 6e 69 74 69 7a 65 55 52 4c 28 68 61 73 68 5b 31 5d 29 3b 0a 20 Data Ascii: i++) { hash = hashes[i].split('='); vars.push(hash[0]); // Make sure the url is prefixed if (hash[0] === 'u') { vars[hash[0]] = sanitizeURL(hash[1]);
2025-03-28 15:39:35 UTC	997	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 75 72 6c 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 2e 2a 5c 2f 2b 2f 2c 20 27 68 74 74 70 3a 2f 2f 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 75 72 6c 2e 72 65 70 6c 61 63 65 28 2f 5e 28 3f 21 28 3f 3a 5c 77 2b 3a 29 3f 5c 2f 5c 2f 29 2f 2c 20 27 68 74 74 70 3a 2f 2f 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 64 65 63 6f 64 65 28 73 74 72 69 6e 67 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 65 63 6f 64 65 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 57 65 Data Ascii: return url.replace(/^\.*\/+/, 'http://'); } return url.replace(/^(?!(?:\w+:)?\/\/)/, 'http://'); } function decode(string) { var decoded; // We
2025-03-28 15:39:35 UTC	997	IN	Data Raw: 61 6c 65 73 66 6c 61 72 65 2e 63 6f 6d 2f 23 2f 73 69 67 6e 75 70 2f 3f 63 61 6d 70 61 69 67 6e 3d 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 72 61 63 6b 69 6e 67 44 6f 6d 61 69 6e 73 20 3d 20 76 61 72 73 5b 30 5d 3f 2e 73 70 6c 69 74 28 27 68 74 74 70 73 3a 2f 2f 27 29 5b 31 5d 3f 2e 73 70 6c 69 74 28 27 2e 63 6f 6d 27 29 5b 30 5d 2e 73 70 6c 69 74 28 27 2e 74 6f 27 29 5b 30 5d 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 69 61 6c 55 72 6c 20 2b 3d 20 74 72 61 63 6b 69 6e 67 44 6f 6d 61 69 6e 73 20 3f 20 74 72 61 63 6b 69 6e 67 44 6f 6d 61 69 6e 73 20 3a 20 27 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 69 61 6c 55 72 Data Ascii: alesflare.com/#/signup/?campaign='; var trackingDomains = vars[0]?.split('https://')[1]?.split('.com')[0].split('.to')[0]; trialUrl += trackingDomains ? trackingDomains : ''; trialUr
2025-03-28 15:39:35 UTC	997	IN	Data Raw: 6d 61 69 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2e 73 74 61 72 74 73 57 69 74 68 28 27 2f 73 27 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 6d 61 69 6e 20 2b 3d 20 27 2f 73 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 64 6f 6d 61 69 6e 20 2b 20 22 2f 34 30 34 2e 68 74 6d 6c 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 66 6c 61 72 65 20 3d 20 6e 65 77 20 46 6c 61 72 65 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 61 72 65 2e 66 6f Data Ascii: main if (window.location.pathname.startsWith('/s')) { domain += '/s'; } window.location.href = domain + "/404.html" } var flare = new Flare(); flare.fo
2025-03-28 15:39:35 UTC	997	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 31 2e 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 6d 6f 6e 74 73 65 72 72 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2e 73 66 2d 62 75 74 Data Ascii: letter-spacing: -1.4px; font-family: montserrat; text-align: center; } } .sf-but
2025-03-28 15:39:35 UTC	219	IN	Data Raw: 73 3a 20 38 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: s: 80px; border-radius: 80px; display: inline-block; } } } } } </style></html>

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:36 UTC	577	OUT	GET /flare.js HTTP/1.1 Host: track.salesflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://199-kadomaco.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:36 UTC	1202	IN	HTTP/1.1 200 OK Date: Fri, 28 Mar 2025 15:39:36 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close x-guploader-uploadid: AKDAyIsEEhWAZQhlr3rjtluk5y32ovWrpdTNcshiAfickGtghtmS_qCeDJYocU0OqFH5AFdSNHclU04 x-goog-generation: 1721220840788064 x-goog-metageneration: 2 x-goog-stored-content-encoding: gzip x-goog-stored-content-length: 468 content-language: en x-goog-hash: crc32c=SndjCg== x-goog-hash: md5=uQ1qbcWz0Hk8yvnPYkH7uw== x-goog-storage-class: STANDARD expires: Fri, 28 Mar 2025 15:47:36 GMT Cache-Control: public, max-age=14400 last-modified: Wed, 17 Jul 2024 12:54:00 GMT vary: Accept-Encoding,Origin alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Age: 1027 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=apLoq%2BV5I%2BYu2oDF7mdpw7ekPNhnD%2FQeZv6iKVSwG3BfOhI7tAY5Nw30GpPAQhpLTk8L6%2BazKthl9yoFi5dVjNZ93tw8LNPyLAwSZL25aiae9eoxqN%2FAJJBXKlXxgotUflXOkwYY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15552000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 9278389f1f640f4d-EWR
2025-03-28 15:39:36 UTC	218	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 39 30 34 35 35 26 6d 69 6e 5f 72 74 74 3d 39 30 33 32 38 26 72 74 74 5f 76 61 72 3d 31 39 31 37 34 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 34 26 72 65 63 76 5f 62 79 74 65 73 3d 31 31 34 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 38 33 32 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 35 38 39 36 33 31 66 63 38 35 63 64 65 34 65 34 26 74 73 3d 32 34 35 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=90455&min_rtt=90328&rtt_var=19174&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1149&delivery_rate=33832&cwnd=252&unsent_bytes=0&cid=589631fc85cde4e4&ts=245&x=0"
2025-03-28 15:39:36 UTC	949	IN	Data Raw: 33 61 65 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 73 63 72 69 70 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 73 63 72 69 70 74 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 74 72 61 63 6b 2e 73 61 6c 65 73 66 6c 61 72 65 2e 63 6f 6d 2f 61 63 74 75 61 6c 5f 66 6c 61 72 65 2e 6a 73 22 3b 66 6f 72 28 76 61 72 20 6c 6f 61 64 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2c 73 63 72 69 70 74 45 6c 65 6d 65 6e 74 73 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 2c 69 3d 30 3b 69 3c 73 63 72 69 70 74 45 6c 65 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 69 2b 2b Data Ascii: 3ae"use strict";var script=document.createElement("script");script.src="https://storage.googleapis.com/track.salesflare.com/actual_flare.js";for(var loadScriptElement,scriptElements=document.getElementsByTagName("script"),i=0;i<scriptElements.length;i++
2025-03-28 15:39:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:37 UTC	615	OUT	GET /token?email=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V HTTP/1.1 Host: api.salesflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://199-kadomaco.trakcid.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://199-kadomaco.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:37 UTC	532	IN	HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin access-control-allow-origin: https://199-kadomaco.trakcid.com access-control-allow-credentials: true access-control-expose-headers: WWW-Authenticate,Server-Authorization cache-control: no-cache accept-ranges: bytes x-cloud-trace-context: 3dcaa628dc2c23411705a7202df60eaa date: Fri, 28 Mar 2025 15:39:37 GMT server: Google Frontend Content-Length: 66 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-28 15:39:37 UTC	66	IN	Data Raw: 7b 22 74 72 61 63 6b 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 49 35 39 30 79 78 79 6b 65 2d 5a 36 4f 30 4d 6a 5f 5f 75 77 77 78 36 31 6d 4c 62 74 77 58 6d 5a 46 76 31 37 77 78 7a 50 2d 4e 37 37 4d 22 7d Data Ascii: {"tracking_token":"I590yxyke-Z6O0Mj__uwwx61mLbtwXmZFv17wxzP-N77M"}

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ATT02683-1.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f3e7c43b-4388-495d-872c-e16bd97b57ae.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250328153903Z-207.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Windows Analysis Report
ATT02683-1.pdf

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:37 UTC	583	OUT	GET /flareprovider.js HTTP/1.1 Host: track.salesflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://storage.googleapis.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:38 UTC	1242	IN	HTTP/1.1 200 OK Date: Fri, 28 Mar 2025 15:39:38 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close x-guploader-uploadid: AFIdbgTF9Uk9z4RUlEKKKkl0w00CmzIRu8eduB51AeLLPUybQqXnwXq-dKEvJj2qtR8bNG7y Cache-Control: public, max-age=14400 expires: Fri, 28 Mar 2025 17:30:30 GMT last-modified: Wed, 17 Jul 2024 12:54:02 GMT etag: W/"20dc9361bafa4df7c9ec1bdddeb62d02" vary: Accept-Encoding vary: Origin x-goog-generation: 1721220842789364 x-goog-metageneration: 2 x-goog-stored-content-encoding: gzip x-goog-stored-content-length: 10695 content-language: en x-goog-hash: crc32c=tqZ19A== x-goog-hash: md5=INyTYbr6TffJ7Bvd3rYtAg== x-goog-storage-class: STANDARD alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Age: 7748 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mSiE2pgDO7jxM9U8GgaHGkc4FOE7C1I8qlJTXvwhot4p1eeeCq8Y0dwWGON8andfE%2BvEWAMC%2FZ9GTJXk0uWDi2xfmUkbUqV9scGdC86wgotPygbdd1UBTOBUZEZNsUnOfgDeM4n7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15552000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 927838aafffc49c1-EWR
2025-03-28 15:39:38 UTC	218	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 39 30 38 34 30 26 6d 69 6e 5f 72 74 74 3d 39 30 36 36 31 26 72 74 74 5f 76 61 72 3d 31 39 33 39 38 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 34 26 72 65 63 76 5f 62 79 74 65 73 3d 31 31 35 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 30 39 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 61 39 64 62 64 66 35 65 39 36 39 66 38 32 33 35 26 74 73 3d 32 33 38 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=90840&min_rtt=90661&rtt_var=19398&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1155&delivery_rate=33509&cwnd=252&unsent_bytes=0&cid=a9dbdf5e969f8235&ts=238&x=0"
2025-03-28 15:39:38 UTC	1278	IN	Data Raw: 37 39 37 32 0d 0a 76 61 72 20 72 70 63 3b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 65 72 72 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 22 55 6e 63 61 75 67 68 74 20 53 79 6e 74 61 78 45 72 72 6f 72 3a 20 46 61 69 6c 65 64 20 74 6f 20 65 78 65 63 75 74 65 20 27 70 6f 73 74 4d 65 73 73 61 67 65 27 20 6f 6e 20 27 57 69 6e 64 6f 77 27 3a 20 49 6e 76 61 6c 69 64 20 74 61 72 67 65 74 20 6f 72 69 67 69 6e 20 27 27 20 69 6e 20 61 20 63 61 6c 6c 20 74 6f 20 27 70 6f 73 74 4d 65 73 73 61 67 65 27 2e 22 3d 3d 3d 65 2e 6d 65 73 73 61 67 65 26 26 77 69 6e 64 6f 77 2e 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 59 6f 75 20 61 72 65 20 72 75 6e 6e 69 6e 67 20 66 6c 61 72 65 2e Data Ascii: 7972var rpc;window.addEventListener("error",function(e){e.preventDefault(),"Uncaught SyntaxError: Failed to execute 'postMessage' on 'Window': Invalid target origin '' in a call to 'postMessage'."===e.message&&window.console.warn("You are running flare.
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 74 29 7b 65 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 6e 2c 74 2c 21 31 29 7d 3b 65 6c 73 65 7b 69 66 28 21 6a 28 67 2c 22 61 74 74 61 63 68 45 76 65 6e 74 22 29 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 42 72 6f 77 73 65 72 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 29 3b 75 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 6e 2c 74 29 7d 2c 76 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 65 2e 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 6e 2c 74 29 7d 7d 76 61 72 20 65 2c 6f 2c 61 3d 21 31 2c 69 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 29 7b 69 66 28 21 61 29 7b 61 3d 21 30 3b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 69 2e 6c 65 6e 67 74 68 3b Data Ascii: t){e.removeEventListener(n,t,!1)};else{if(!j(g,"attachEvent"))throw new Error("Browser not supported");u=function(e,n,t){e.attachEvent("on"+n,t)},v=function(e,n,t){e.detachEvent("on"+n,t)}}var e,o,a=!1,i=[];function M(){if(!a){a=!0;for(var e=0;e<i.length;
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 69 64 20 68 28 6f 2c 31 29 7d 4d 28 29 7d 7d 29 28 29 29 2c 75 28 67 2c 22 6c 6f 61 64 22 2c 4d 29 29 3b 76 61 72 20 41 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 6e 2c 74 3d 7b 7d 2c 72 3d 28 65 3d 65 2e 73 75 62 73 74 72 69 6e 67 28 31 29 2e 73 70 6c 69 74 28 22 26 22 29 29 2e 6c 65 6e 67 74 68 3b 72 2d 2d 3b 29 74 5b 28 6e 3d 65 5b 72 5d 2e 73 70 6c 69 74 28 22 3d 22 29 29 5b 30 5d 5d 3d 70 28 6e 5b 31 5d 29 3b 72 65 74 75 72 6e 20 74 7d 28 2f 78 64 6d 5f 65 3d 2f 2e 74 65 73 74 28 66 2e 73 65 61 72 63 68 29 3f 66 2e 73 65 61 72 63 68 3a 66 2e 68 61 73 68 29 3b 66 75 6e 63 74 69 6f 6e 20 52 28 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 7d 76 61 72 20 44 2c 4a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b Data Ascii: id h(o,1)}M()}})()),u(g,"load",M));var A=function(e){for(var n,t={},r=(e=e.substring(1).split("&")).length;r--;)t[(n=e[r].split("="))[0]]=p(n[1]);return t}(/xdm_e=/.test(f.search)?f.search:f.hash);function R(e){return void 0===e}var D,J=function(){var e={
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 2c 65 2e 70 72 6f 70 73 29 2c 74 2e 62 6f 72 64 65 72 3d 74 2e 66 72 61 6d 65 42 6f 72 64 65 72 3d 30 2c 74 2e 61 6c 6c 6f 77 54 72 61 6e 73 70 61 72 65 6e 63 79 3d 21 30 2c 65 2e 63 6f 6e 74 61 69 6e 65 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 65 2e 6f 6e 4c 6f 61 64 26 26 75 28 74 2c 22 6c 6f 61 64 22 2c 65 2e 6f 6e 4c 6f 61 64 29 2c 65 2e 75 73 65 50 6f 73 74 29 7b 76 61 72 20 6f 2c 61 3d 65 2e 63 6f 6e 74 61 69 6e 65 72 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6c 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 66 6f 72 6d 22 29 29 3b 69 66 28 61 2e 74 61 72 67 65 74 3d 74 2e 6e 61 6d 65 2c 61 2e 61 63 74 69 6f 6e 3d 72 2c 61 2e 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 2e 75 73 65 50 6f 73 Data Ascii: ,e.props),t.border=t.frameBorder=0,t.allowTransparency=!0,e.container.appendChild(t),e.onLoad&&u(t,"load",e.onLoad),e.usePost){var o,a=e.container.appendChild(l.createElement("form"));if(a.target=t.name,a.action=r,a.method="POST","object"==typeof e.usePos
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 77 20 6e 65 77 20 45 72 72 6f 72 28 22 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 22 2b 65 2e 72 65 6d 6f 74 65 29 3b 73 77 69 74 63 68 28 65 2e 70 72 6f 74 6f 63 6f 6c 3d 74 29 7b 63 61 73 65 22 30 22 3a 69 66 28 49 28 65 2c 7b 69 6e 74 65 72 76 61 6c 3a 31 30 30 2c 64 65 6c 61 79 3a 32 65 33 2c 75 73 65 52 65 73 69 7a 65 3a 21 30 2c 75 73 65 50 61 72 65 6e 74 3a 21 31 2c 75 73 65 50 6f 6c 6c 69 6e 67 3a 21 31 7d 2c 21 30 29 2c 65 2e 69 73 48 6f 73 74 29 7b 69 66 28 21 65 2e 6c 6f 63 61 6c 29 7b 66 6f 72 28 76 61 72 20 72 2c 6f 3d 66 2e 70 72 6f 74 6f 63 6f 6c 2b 22 2f 2f 22 2b 66 2e 68 6f 73 74 2c 61 3d 6c 2e 62 6f 64 79 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 69 6d 67 22 29 2c 69 3d 61 2e 6c 65 6e 67 74 68 3b 69 Data Ascii: w new Error("Access denied for "+e.remote);switch(e.protocol=t){case"0":if(I(e,{interval:100,delay:2e3,useResize:!0,useParent:!1,usePolling:!1},!0),e.isHost){if(!e.local){for(var r,o=f.protocol+"//"+f.host,a=l.body.getElementsByTagName("img"),i=a.length;i
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 7b 66 6f 72 28 76 61 72 20 6e 2c 74 3d 7b 69 6e 63 6f 6d 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 74 68 69 73 2e 75 70 2e 69 6e 63 6f 6d 69 6e 67 28 65 2c 6e 29 7d 2c 6f 75 74 67 6f 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 74 68 69 73 2e 64 6f 77 6e 2e 6f 75 74 67 6f 69 6e 67 28 65 2c 6e 29 7d 2c 63 61 6c 6c 62 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 75 70 2e 63 61 6c 6c 62 61 63 6b 28 65 29 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 64 6f 77 6e 2e 69 6e 69 74 28 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 64 6f 77 6e 2e 64 65 73 74 72 6f 79 28 29 7d 7d 2c 72 3d 30 2c 6f 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 6f 3b 72 2b 2b 29 49 28 6e 3d 65 5b 72 Data Ascii: {for(var n,t={incoming:function(e,n){this.up.incoming(e,n)},outgoing:function(e,n){this.down.outgoing(e,n)},callback:function(e){this.up.callback(e)},init:function(){this.down.init()},destroy:function(){this.down.destroy()}},r=0,o=e.length;r<o;r++)I(n=e[r
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 2c 6f 2e 69 6e 69 74 28 29 7d 2c 53 2e 73 74 61 63 6b 2e 53 61 6d 65 4f 72 69 67 69 6e 54 72 61 6e 73 70 6f 72 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 2c 72 2c 6f 3b 72 65 74 75 72 6e 20 6e 3d 7b 6f 75 74 67 6f 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 72 28 65 29 2c 74 26 26 74 28 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 2c 74 3d 6e 75 6c 6c 29 7d 2c 6f 6e 44 4f 4d 52 65 61 64 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 3d 50 28 65 2e 72 65 6d 6f 74 65 29 2c 65 2e 69 73 48 6f 73 74 3f 28 49 28 65 2e 70 72 6f 70 73 2c 7b 73 72 63 3a 43 28 65 2e 72 65 6d 6f 74 65 2c 7b 78 64 6d 5f 65 3a 66 2e 70 72 6f Data Ascii: ,o.init()},S.stack.SameOriginTransport=function(e){var n,t,r,o;return n={outgoing:function(e,n,t){r(e),t&&t()},destroy:function(){t&&(t.parentNode.removeChild(t),t=null)},onDOMReady:function(){o=P(e.remote),e.isHost?(I(e.props,{src:C(e.remote,{xdm_e:f.pro
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 29 29 3b 76 61 72 20 72 3d 22 63 61 6c 6c 62 61 63 6b 3d 66 6c 61 73 68 5f 6c 6f 61 64 65 64 22 2b 64 28 74 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 2d 2e 5d 2f 67 2c 22 5f 22 29 29 2b 22 26 70 72 6f 74 6f 3d 22 2b 79 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2b 22 26 64 6f 6d 61 69 6e 3d 22 2b 64 28 4e 28 79 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 29 2b 22 26 70 6f 72 74 3d 22 2b 64 28 79 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 6d 61 74 63 68 28 5f 29 5b 34 5d 7c 7c 22 22 29 2b 22 26 6e 73 3d 22 2b 64 28 78 29 3b 63 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 6f 62 6a 65 63 74 20 68 65 69 67 68 74 3d 27 32 30 27 20 77 69 64 74 68 3d 27 32 30 27 20 74 79 70 65 3d 27 61 70 70 6c 69 63 61 74 69 Data Ascii: ody.appendChild(c));var r="callback=flash_loaded"+d(t.replace(/[\-.]/g,"_"))+"&proto="+y.location.protocol+"&domain="+d(N(y.location.href))+"&port="+d(y.location.href.match(_)[4]\|\|"")+"&ns="+d(x);c.innerHTML="<object height='20' width='20' type='applicati
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 7d 76 61 72 20 6e 3d 4e 28 6f 2e 73 77 66 29 3b 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 26 26 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 2e 69 6e 69 74 3f 65 28 29 3a 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 3f 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 2e 71 75 65 75 65 2e 70 75 73 68 28 65 29 3a 28 53 2e 73 74 61 63 6b 2e 46 6c 61 73 68 54 72 61 6e 73 70 6f 72 74 5b 6e 5d 3d 7b 71 75 65 75 65 3a 5b 65 5d 7d 2c 75 28 6e 29 29 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 46 28 74 2e 6f 6e 44 4f 4d 52 65 61 64 79 2c 74 29 7d 7d 7d 2c 53 2e 73 74 61 63 6b 2e 50 6f 73 74 4d 65 73 73 61 67 65 54 72 61 6e 73 70 6f 72 74 Data Ascii: }var n=N(o.swf);S.stack.FlashTransport[n]&&S.stack.FlashTransport[n].init?e():S.stack.FlashTransport[n]?S.stack.FlashTransport[n].queue.push(e):(S.stack.FlashTransport[n]={queue:[e]},u(n))},init:function(){F(t.onDOMReady,t)}}},S.stack.PostMessageTransport

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:37 UTC	612	OUT	GET /npm/@sentry/browser@5.29.2/build/bundle.min.js HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive Origin: https://storage.googleapis.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://storage.googleapis.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:38 UTC	1111	IN	HTTP/1.1 200 OK Date: Fri, 28 Mar 2025 15:39:38 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * access-control-expose-headers: * timing-allow-origin: * Cache-Control: public, max-age=31536000, s-maxage=31536000, immutable cross-origin-resource-policy: cross-origin x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains; preload x-jsd-version: 5.29.2 x-jsd-version-type: version etag: W/"ff1f-tqCXvFcJJITCoIIqq76zHuvUrxQ" Age: 2705093 x-served-by: cache-fra-etou8220037-FRA, cache-lga21993-LGA x-cache: HIT, HIT vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iau9g7NHKXxHUZgKtRBdRt%2FTN9himnDEZm2Ap5xT7irqPelECl%2FVHa9z%2BxM1LkENsp6yTeGZyhj0IkLl%2BGgNoqaTJ3wVhRg4qwhO81eabL6tfP7iGKpHZN62TKMe40luDEw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 927838aafd1d5e6d-EWR
2025-03-28 15:39:38 UTC	258	IN	Data Raw: 37 62 31 33 0d 0a 2f 2a 21 20 40 73 65 6e 74 72 79 2f 62 72 6f 77 73 65 72 20 35 2e 32 39 2e 32 20 28 36 62 34 66 33 30 34 29 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 67 65 74 73 65 6e 74 72 79 2f 73 65 6e 74 72 79 2d 6a 61 76 61 73 63 72 69 70 74 20 2a 2f 0a 76 61 72 20 53 65 6e 74 72 79 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 28 6e 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 6e 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 Data Ascii: 7b13/! @sentry/browser 5.29.2 (6b4f304) \| https://github.com/getsentry/sentry-javascript /var Sentry=function(t){var n=function(t,r){return(n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,n){t.__proto__=n}\|\|function(t,n){for(var r
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 20 6e 29 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 72 29 26 26 28 74 5b 72 5d 3d 6e 5b 72 5d 29 7d 29 28 74 2c 72 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 74 2c 72 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 74 7d 6e 28 74 2c 72 29 2c 74 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 75 6c 6c 3d 3d 3d 72 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 72 29 3a 28 65 2e 70 72 6f 74 6f 74 79 70 65 3d 72 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 65 77 20 65 29 7d 76 61 72 20 65 2c 69 2c 6f 2c 75 2c 73 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 63 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 6e 2c 72 3d 31 2c 65 3d 61 72 67 75 6d 65 6e Data Ascii: n)n.hasOwnProperty(r)&&(t[r]=n[r])})(t,r)};function r(t,r){function e(){this.constructor=t}n(t,r),t.prototype=null===r?Object.create(r):(e.prototype=r.prototype,new e)}var e,i,o,u,s,c=function(){return(c=Object.assign\|\|function(t){for(var n,r=1,e=argumen
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 66 20 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 74 29 7b 72 65 74 75 72 6e 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3d 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 74 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 45 76 65 6e 74 26 26 45 28 74 2c 45 76 65 6e 74 29 7d 66 75 6e 63 74 69 6f 6e 20 77 28 74 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 45 6c 65 6d 65 6e 74 26 26 45 28 74 2c 45 6c 65 6d 65 6e 74 29 7d 66 75 6e 63 74 69 6f 6e 20 67 28 74 29 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 28 74 26 26 74 2e 74 Data Ascii: f t&&"function"!=typeof t}function m(t){return"[object Object]"===Object.prototype.toString.call(t)}function b(t){return"undefined"!=typeof Event&&E(t,Event)}function w(t){return"undefined"!=typeof Element&&E(t,Element)}function g(t){return Boolean(t&&t.t
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 3a 63 61 73 65 22 77 61 72 6e 69 6e 67 22 3a 72 65 74 75 72 6e 20 74 2e 57 61 72 6e 69 6e 67 3b 63 61 73 65 22 65 72 72 6f 72 22 3a 72 65 74 75 72 6e 20 74 2e 45 72 72 6f 72 3b 63 61 73 65 22 66 61 74 61 6c 22 3a 72 65 74 75 72 6e 20 74 2e 46 61 74 61 6c 3b 63 61 73 65 22 63 72 69 74 69 63 61 6c 22 3a 72 65 74 75 72 6e 20 74 2e 43 72 69 74 69 63 61 6c 3b 63 61 73 65 22 6c 6f 67 22 3a 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 20 74 2e 4c 6f 67 7d 7d 7d 28 74 2e 53 65 76 65 72 69 74 79 7c 7c 28 74 2e 53 65 76 65 72 69 74 79 3d 7b 7d 29 29 2c 28 75 3d 74 2e 53 74 61 74 75 73 7c 7c 28 74 2e 53 74 61 74 75 73 3d 7b 7d 29 29 2e 55 6e 6b 6e 6f 77 6e 3d 22 75 6e 6b 6e 6f 77 6e 22 2c 75 2e 53 6b 69 70 70 65 64 3d 22 73 6b 69 70 70 65 64 22 2c 75 2e 53 75 63 63 65 Data Ascii: :case"warning":return t.Warning;case"error":return t.Error;case"fatal":return t.Fatal;case"critical":return t.Critical;case"log":default:return t.Log}}}(t.Severity\|\|(t.Severity={})),(u=t.Status\|\|(t.Status={})).Unknown="unknown",u.Skipped="skipped",u.Succe
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 74 68 72 6f 77 20 6e 65 77 20 6b 28 22 49 6e 76 61 6c 69 64 20 44 73 6e 22 29 3b 76 61 72 20 72 3d 66 28 6e 2e 73 6c 69 63 65 28 31 29 2c 36 29 2c 65 3d 72 5b 30 5d 2c 69 3d 72 5b 31 5d 2c 6f 3d 72 5b 32 5d 2c 75 3d 76 6f 69 64 20 30 3d 3d 3d 6f 3f 22 22 3a 6f 2c 73 3d 72 5b 33 5d 2c 63 3d 72 5b 34 5d 2c 61 3d 76 6f 69 64 20 30 3d 3d 3d 63 3f 22 22 3a 63 2c 68 3d 22 22 2c 76 3d 72 5b 35 5d 2c 6c 3d 76 2e 73 70 6c 69 74 28 22 2f 22 29 3b 69 66 28 6c 2e 6c 65 6e 67 74 68 3e 31 26 26 28 68 3d 6c 2e 73 6c 69 63 65 28 30 2c 2d 31 29 2e 6a 6f 69 6e 28 22 2f 22 29 2c 76 3d 6c 2e 70 6f 70 28 29 29 2c 76 29 7b 76 61 72 20 64 3d 76 2e 6d 61 74 63 68 28 2f 5e 5c 64 2b 2f 29 3b 64 26 26 28 76 3d 64 5b 30 5d 29 7d 74 68 69 73 2e 69 28 7b 68 6f 73 74 3a 73 2c 70 61 73 Data Ascii: throw new k("Invalid Dsn");var r=f(n.slice(1),6),e=r[0],i=r[1],o=r[2],u=void 0===o?"":o,s=r[3],c=r[4],a=void 0===c?"":c,h="",v=r[5],l=v.split("/");if(l.length>1&&(h=l.slice(0,-1).join("/"),v=l.pop()),v){var d=v.match(/^\d+/);d&&(v=d[0])}this.i({host:s,pas
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 52 28 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 6e 61 6d 65 7c 7c 44 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 20 44 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 30 29 2c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 7c 7c 30 3d 3d 3d 6e 3f 74 3a 74 2e 6c 65 6e 67 74 68 3c 3d 6e 3f 74 3a 74 2e 73 75 62 73 74 72 28 30 2c 6e 29 2b 22 2e 2e 2e 22 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 74 2c 6e 29 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 29 72 65 74 75 72 6e 22 22 3b 66 6f 72 28 76 61 72 20 72 3d 5b 5d 2c 65 3d 30 3b 65 3c 74 2e 6c 65 6e 67 74 68 3b Data Ascii: unction R(t){try{return t&&"function"==typeof t&&t.name\|\|D}catch(t){return D}}function I(t,n){return void 0===n&&(n=0),"string"!=typeof t\|\|0===n?t:t.length<=n?t:t.substr(0,n)+"..."}function N(t,n){if(!Array.isArray(t))return"";for(var r=[],e=0;e<t.length;
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 67 74 68 7d 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 66 75 6e 63 74 69 6f 6e 20 4c 28 74 2c 6e 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 33 29 2c 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 31 30 32 34 30 30 29 3b 76 61 72 20 65 3d 50 28 74 2c 6e 29 3b 72 65 74 75 72 6e 20 71 28 65 29 3e 72 3f 4c 28 74 2c 6e 2d 31 2c 72 29 3a 65 7d 66 75 6e 63 74 69 6f 6e 20 55 28 74 2c 6e 29 7b 72 65 74 75 72 6e 22 64 6f 6d 61 69 6e 22 3d 3d 3d 6e 26 26 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 68 3f 22 5b 44 6f 6d 61 69 6e 5d 22 3a 22 64 6f 6d 61 69 6e 45 6d 69 74 74 65 72 22 3d 3d 3d 6e 3f 22 5b 44 6f 6d 61 69 6e 45 6d 69 74 74 65 72 5d 22 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 Data Ascii: gth}(JSON.stringify(t))}function L(t,n,r){void 0===n&&(n=3),void 0===r&&(r=102400);var e=P(t,n);return q(e)>r?L(t,n-1,r):e}function U(t,n){return"domain"===n&&t&&"object"==typeof t&&t.h?"[Domain]":"domainEmitter"===n?"[DomainEmitter]":"undefined"!=typeof
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 6e 3d 34 30 29 3b 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 43 28 74 29 29 3b 69 66 28 72 2e 73 6f 72 74 28 29 2c 21 72 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 22 5b 6f 62 6a 65 63 74 20 68 61 73 20 6e 6f 20 6b 65 79 73 5d 22 3b 69 66 28 72 5b 30 5d 2e 6c 65 6e 67 74 68 3e 3d 6e 29 72 65 74 75 72 6e 20 49 28 72 5b 30 5d 2c 6e 29 3b 66 6f 72 28 76 61 72 20 65 3d 72 2e 6c 65 6e 67 74 68 3b 65 3e 30 3b 65 2d 2d 29 7b 76 61 72 20 69 3d 72 2e 73 6c 69 63 65 28 30 2c 65 29 2e 6a 6f 69 6e 28 22 2c 20 22 29 3b 69 66 28 21 28 69 2e 6c 65 6e 67 74 68 3e 6e 29 29 72 65 74 75 72 6e 20 65 3d 3d 3d 72 2e 6c 65 6e 67 74 68 3f 69 3a 49 28 69 2c 6e 29 7d 72 65 74 75 72 6e 22 22 7d 66 75 6e 63 74 69 6f 6e 20 58 28 74 29 7b 76 61 72 20 6e 2c 72 3b 69 66 28 6d Data Ascii: n=40);var r=Object.keys(C(t));if(r.sort(),!r.length)return"[object has no keys]";if(r[0].length>=n)return I(r[0],n);for(var e=r.length;e>0;e--){var i=r.slice(0,e).join(", ");if(!(i.length>n))return e===r.length?i:I(i,n)}return""}function X(t){var n,r;if(m
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 3a 6e 5b 32 5d 2c 72 65 6c 61 74 69 76 65 3a 6e 5b 35 5d 2b 72 2b 65 7d 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 74 29 7b 69 66 28 74 2e 6d 65 73 73 61 67 65 29 72 65 74 75 72 6e 20 74 2e 6d 65 73 73 61 67 65 3b 69 66 28 74 2e 65 78 63 65 70 74 69 6f 6e 26 26 74 2e 65 78 63 65 70 74 69 6f 6e 2e 76 61 6c 75 65 73 26 26 74 2e 65 78 63 65 70 74 69 6f 6e 2e 76 61 6c 75 65 73 5b 30 5d 29 7b 76 61 72 20 6e 3d 74 2e 65 78 63 65 70 74 69 6f 6e 2e 76 61 6c 75 65 73 5b 30 5d 3b 72 65 74 75 72 6e 20 6e 2e 74 79 70 65 26 26 6e 2e 76 61 6c 75 65 3f 6e 2e 74 79 70 65 2b 22 3a 20 22 2b 6e 2e 76 61 6c 75 65 3a 6e 2e 74 79 70 65 7c 7c 6e 2e 76 61 6c 75 65 7c 7c 74 2e 65 76 65 6e 74 5f 69 64 7c 7c 22 3c 75 6e 6b 6e 6f 77 6e 3e 22 7d 72 65 74 75 72 6e 20 74 2e 65 76 65 6e 74 5f Data Ascii: :n[2],relative:n[5]+r+e}}function z(t){if(t.message)return t.message;if(t.exception&&t.exception.values&&t.exception.values[0]){var n=t.exception.values[0];return n.type&&n.value?n.type+": "+n.value:n.type\|\|n.value\|\|t.event_id\|\|"<unknown>"}return t.event_
2025-03-28 15:39:38 UTC	1369	IN	Data Raw: 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 5b 6e 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 74 68 69 73 2e 76 26 26 56 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5a 2e 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 74 74 2b 22 5b 57 61 72 6e 5d 3a 20 22 2b 74 2e 6a 6f 69 6e 28 22 20 22 29 29 7d 29 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 5b 6e 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 74 68 69 73 2e 76 26 26 56 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5a 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 74 74 2b 22 5b 45 Data Ascii: {for(var t=[],n=0;n<arguments.length;n++)t[n]=arguments[n];this.v&&V(function(){Z.console.warn(tt+"[Warn]: "+t.join(" "))})},t.prototype.error=function(){for(var t=[],n=0;n<arguments.length;n++)t[n]=arguments[n];this.v&&V(function(){Z.console.error(tt+"[E

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:37 UTC	426	OUT	GET /token?email=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V HTTP/1.1 Host: api.salesflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:50 UTC	294	IN	HTTP/1.1 503 Service Unavailable content-type: text/plain x-cloud-trace-context: a088d5a31ed034ee35ecff122df2732b date: Fri, 28 Mar 2025 15:39:50 GMT server: Google Frontend Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-28 15:39:50 UTC	19	IN	Data Raw: 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 Data Ascii: Service Unavailable

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:38 UTC	928	OUT	GET /favicon.ico HTTP/1.1 Host: 199-kadomaco.trakcid.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://199-kadomaco.trakcid.com/?u=https:%2F%2Femail.idxhome.co%2Fc%2FeJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRuApcZ629sLrvczDd2qHKHALXz8c2Pq69vHy9v75d5Z4ulIcwcPDjJ3f1_S9_Ez4DAAD__10ONNA&e=pVTfWhg4W0VTZUO91JpN8gs9T3mjgv6V&cee=YWRhbUBzZXF1YWkubno= Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:38 UTC	761	IN	HTTP/1.1 404 Not Found x-guploader-uploadid: AKDAyIt6o5TQUlGqXIukHwLZl2j610oAI3MALXebnWEpuz4H6Qo3x3x-3hvxZPze4QTcOyY x-goog-generation: 1737365220799885 x-goog-metageneration: 1 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 2016 x-goog-hash: crc32c=Xo/u5A== x-goog-hash: md5=NbUJd4kMWd2HU2RHYB/z2Q== x-goog-storage-class: STANDARD accept-ranges: bytes Content-Length: 2016 server: UploadServer via: 1.1 google date: Fri, 28 Mar 2025 15:39:38 GMT expires: Fri, 28 Mar 2025 16:39:38 GMT Cache-Control: public, max-age=3600 Last-Modified: Mon, 20 Jan 2025 09:27:00 GMT ETag: "35b50977890c59dd87536447601ff3d9" Content-Type: text/html Age: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-28 15:39:38 UTC	236	IN	Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 73 74 79 6c 65 2d 73 72 63 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 69 6d 67 2d 73 72 63 20 64 61 74 61 3a 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 22 3e 0a 3c 74 Data Ascii: <!DOCTYPE html><html><head><meta http-equiv="Content-type" content="text/html; charset=utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'"><t
2025-03-28 15:39:38 UTC	997	IN	Data Raw: 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 6d 69 64 64 6f 74 3b 20 47 69 74 48 75 62 20 50 61 67 65 73 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 3e 0a 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 31 66 31 66 31 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 20 6d 61 Data Ascii: itle>Page not found · GitHub Pages</title><style type="text/css" media="screen"> body { background-color: #f1f1f1; margin: 0; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; } .container { ma
2025-03-28 15:39:38 UTC	783	IN	Data Raw: 2d 6d 6f 7a 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 20 32 29 2c 0a 20 20 20 20 20 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 20 20 20 20 20 2d 6f 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 20 32 2f 31 29 2c 0a 20 20 20 20 20 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 20 20 20 20 20 20 20 20 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 20 32 29 2c 0a 20 20 20 20 20 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 20 31 39 32 64 70 69 29 2c 0a 20 20 20 20 20 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e Data Ascii: -moz-device-pixel-ratio: 2), only screen and ( -o-min-device-pixel-ratio: 2/1), only screen and ( min-device-pixel-ratio: 2), only screen and ( min-resolution: 192dpi), only screen and ( min

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:38 UTC	535	OUT	OPTIONS /devices HTTP/1.1 Host: api.salesflare.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: authorization Origin: https://199-kadomaco.trakcid.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://199-kadomaco.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:50 UTC	294	IN	HTTP/1.1 503 Service Unavailable content-type: text/plain x-cloud-trace-context: 449a2da73246ddf5cf7be5d9f716b459 date: Fri, 28 Mar 2025 15:39:50 GMT server: Google Frontend Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-28 15:39:50 UTC	19	IN	Data Raw: 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 Data Ascii: Service Unavailable

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:51 UTC	917	OUT	GET /c/eJwEwL1OBCEQAOCngZIMs_wWFGexMTZaebYsMwSSQ-52V2N8-vsouVC9q5KT9mYBiABWthSdjagzEnmbOeYth2gCWm28K1hJ9oSAFhZ02msAqzxkZELjsGwckISBTn9tDlZlyltq53k_xHIRuApcZ629sLrvczDd2qHKHALXz8c2Pq69vHy9v75d5Z4ulIcwcPDjJ3f1_S9_Ez4DAAD__10ONNA HTTP/1.1 Host: email.idxhome.co Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://199-kadomaco.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:39:51 UTC	332	IN	HTTP/1.1 302 Found Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: no-store Content-Length: 436 Content-Type: text/html Date: Fri, 28 Mar 2025 15:39:51 GMT Location: https://office.promedlhs.com/VqbmPWicBXOHJW X-Robots-Tag: noindex X-Xss-Protection: 1; mode=block Connection: close
2025-03-28 15:39:51 UTC	436	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 73 68 6f 75 6c 64 20 62 65 20 72 65 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta name="robots" content="noindex"><meta charset="utf-8"></head><body><title>Redirecting...</title><h1>Redirecting...</h1><p>You should be re

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:39:51 UTC	714	OUT	GET /VqbmPWicBXOHJW HTTP/1.1 Host: office.promedlhs.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://199-kadomaco.trakcid.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:41:09 UTC	959	IN	HTTP/1.1 525 Date: Fri, 28 Mar 2025 15:41:09 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=et94G89Q6FOEL1uzIs5QFJo5MDuHeGfRVJilrnkzXsoaNAyxrRT8oMgkWCQ4V5eAHwHuLDs9ZLqa6c8pvneFOR4QUMKLtj2sIrPTUETuAKsTwh54aQFmqxhmz87x9YwKgYS3eteNWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 927839008c7ef78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=88621&min_rtt=88592&rtt_var=18734&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1286&delivery_rate=34467&cwnd=252&unsent_bytes=0&cid=7e167f76cd093c31&ts=77532&x=0"
2025-03-28 15:41:09 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 35 Data Ascii: error code: 525

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:41:09 UTC	551	OUT	OPTIONS /report/v4?s=et94G89Q6FOEL1uzIs5QFJo5MDuHeGfRVJilrnkzXsoaNAyxrRT8oMgkWCQ4V5eAHwHuLDs9ZLqa6c8pvneFOR4QUMKLtj2sIrPTUETuAKsTwh54aQFmqxhmz87x9YwKgYS3eteNWg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://office.promedlhs.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:41:09 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Fri, 28 Mar 2025 15:41:09 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-28 15:41:09 UTC	526	OUT	POST /report/v4?s=et94G89Q6FOEL1uzIs5QFJo5MDuHeGfRVJilrnkzXsoaNAyxrRT8oMgkWCQ4V5eAHwHuLDs9ZLqa6c8pvneFOR4QUMKLtj2sIrPTUETuAKsTwh54aQFmqxhmz87x9YwKgYS3eteNWg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 439 Content-Type: application/reports+json Origin: https://office.promedlhs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-28 15:41:09 UTC	439	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 37 37 38 34 31 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 31 39 39 2d 6b 61 64 6f 6d 61 63 6f 2e 74 72 61 6b 63 69 64 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 34 36 2e 35 34 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 35 32 35 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 Data Ascii: [{"age":0,"body":{"elapsed_time":77841,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://199-kadomaco.trakcid.com/","sampling_fraction":1.0,"server_ip":"172.67.146.54","status_code":525,"type":"http.error"},"type":"network-err
2025-03-28 15:41:10 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Fri, 28 Mar 2025 15:41:09 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	2
Start time:	11:38:56
Start date:	28/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ATT02683-1.pdf"
Imagebase:	0x7ff624810000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true