Edit tour

Windows Analysis Report
http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess

Overview

General Information

Sample URL:	http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess
Analysis ID:	1406556
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

HTML page contains hidden URLs or javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1952,i,10133788931452361943,7724165584998542537,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary
• Boot Survival

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://derekcotton.com/cgi-sys/images/f.png	Avira URL Cloud: Label: phishing
Source: https://derekcotton.com/cgi-sys/images/404mid.gif	Avira URL Cloud: Label: phishing
Source: https://derekcotton.com/cgi-sys/images/404bottom.gif	Avira URL Cloud: Label: phishing
Source: https://derekcotton.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://derekcotton.com/cgi-sys/images/404top_w.jpg	Avira URL Cloud: Label: phishing
Source: https://derekcotton.com/htaccess?CA=933697&PA=2445527	Avira URL Cloud: Label: phishing

Source: https://link.edgepilot.com/s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess

HTTP Parser: Base64 decoded: http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess

Source: https://derekcotton.com/htaccess/?CA=933697&PA=2445527	HTTP Parser: No favicon
Source: https://link.edgepilot.com/s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 96.7.140.109:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.140.109:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49731 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.51.145
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.140.109
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /htaccess?CA=933697&PA=2445527 HTTP/1.1Host: derekcotton.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /htaccess/?CA=933697&PA=2445527 HTTP/1.1Host: derekcotton.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/js/simple-expand.min.js HTTP/1.1Host: derekcotton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/f.png HTTP/1.1Host: derekcotton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404top_w.jpg HTTP/1.1Host: derekcotton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404mid.gif HTTP/1.1Host: derekcotton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404bottom.gif HTTP/1.1Host: derekcotton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/f.png HTTP/1.1Host: derekcotton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404top_w.jpg HTTP/1.1Host: derekcotton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404mid.gif HTTP/1.1Host: derekcotton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: derekcotton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-sys/images/404bottom.gif HTTP/1.1Host: derekcotton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: derekcotton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oNS+Dd6DFMcrUvW&MD=tOHPEbuV HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: derekcotton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: derekcotton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /htaccess/?CA=933697&PA=2445527 HTTP/1.1Host: derekcotton.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: derekcotton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: derekcotton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oNS+Dd6DFMcrUvW&MD=tOHPEbuV HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess HTTP/1.1Host: link.edgepilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/app.css?v=1 HTTP/1.1Host: link.edgepilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://link.edgepilot.com/s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccessAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://link.edgepilot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://link.edgepilot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.7/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://link.edgepilot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://link.edgepilot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://link.edgepilot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://link.edgepilot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: link.edgepilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://link.edgepilot.com/s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccessAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: link.edgepilot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /htaccess?CA=933697&PA=2445527 HTTP/1.1Host: derekcotton.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /htaccess/?CA=933697&PA=2445527 HTTP/1.1Host: derekcotton.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: derekcotton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: derekcotton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: derekcotton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: derekcotton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess HTTP/1.1Host: refer.ccbill.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess HTTP/1.1Host: refer.ccbill.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: 933697=CLICKS2U2FsdGVkX181Bh^vywgXLIIBb48B^pjj0Tw*; TS01121727=01c886b93cd3f20ae0e723d7ebf82af081b6487e915153c6a93494889b4116eca1ae1ec29f91d7a52bbc6b7e3cefb2714fed22cb81; TS0163356d=01c886b93cb69375f1120f4a793a17a4112aef484d5153c6a93494889b4116eca1ae1ec29fa7301fc6210280432c8489414d11692a89fc9121794aafea873a7bfcb4e3eeca
Source: global traffic	HTTP traffic detected: GET /cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess HTTP/1.1Host: refer.ccbill.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: TS01121727=01c886b93cd3f20ae0e723d7ebf82af081b6487e915153c6a93494889b4116eca1ae1ec29f91d7a52bbc6b7e3cefb2714fed22cb81; 933697=CLICKS2U2FsdGVkX1!lvHvGvrYVb^e3tey8ePeUTPY*; TS0163356d=01c886b93c03a9ce1cb1fa09ef0d351befeef456835153c6a93494889b4116eca1ae1ec29fa7301fc6210280432c8489414d11692abb06b244e93bf16a6b03feab1d9216f6

Source: unknown

DNS traffic detected: queries for: refer.ccbill.com

Source: unknown

HTTP traffic detected: POST /filter HTTP/1.1Host: link.edgepilot.comConnection: keep-aliveContent-Length: 351Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://link.edgepilot.comContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://link.edgepilot.com/s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccessAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 12:03:43 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Fri, 30 Sep 2022 16:13:41 GMTAccept-Ranges: bytesContent-Length: 17108Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 12:04:28 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Fri, 30 Sep 2022 16:13:41 GMTAccept-Ranges: bytesContent-Length: 17108Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 12:04:59 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Fri, 30 Sep 2022 16:13:41 GMTAccept-Ranges: bytesContent-Length: 17108Vary: Accept-EncodingContent-Type: text/html

Source: chromecache_79.1.dr	String found in binary or memory: http://code.jquery.com/jquery-3.3.1.min.js
Source: chromecache_74.1.dr, chromecache_80.1.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_79.1.dr	String found in binary or memory: http://gmpg.org/xfn/11
Source: chromecache_87.1.dr	String found in binary or memory: https://github.com/redhotsly/simple-expand
Source: chromecache_80.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_87.1.dr	String found in binary or memory: https://raw.github.com/redhotsly/simple-expand/master/licence-mit.txt

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 96.7.140.109:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.7.140.109:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49731 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@18/35@18/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1952,i,10133788931452361943,7724165584998542537,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1952,i,10133788931452361943,7724165584998542537,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://getbootstrap.com)	0%	Avira URL Cloud	safe
https://derekcotton.com/cgi-sys/images/f.png	100%	Avira URL Cloud	phishing
https://derekcotton.com/cgi-sys/images/404mid.gif	100%	Avira URL Cloud	phishing
https://derekcotton.com/cgi-sys/images/404bottom.gif	100%	Avira URL Cloud	phishing
https://derekcotton.com/favicon.ico	100%	Avira URL Cloud	phishing
https://derekcotton.com/cgi-sys/images/404top_w.jpg	100%	Avira URL Cloud	phishing
https://derekcotton.com/htaccess?CA=933697&PA=2445527	100%	Avira URL Cloud	phishing

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
link.edgepilot.com	199.30.234.133	true	false	high
refer.ccbill.com	64.38.240.20	true	false	high
code.jquery.com	151.101.130.137	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
www.google.com	142.251.2.104	true	false	high
derekcotton.com	192.185.84.70	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://link.edgepilot.com/s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess	false		high
https://derekcotton.com/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://derekcotton.com/htaccess/?CA=933697&PA=2445527#	false		unknown
https://derekcotton.com/htaccess?CA=933697&PA=2445527	false	Avira URL Cloud: phishing	unknown
https://code.jquery.com/jquery-3.2.1.min.js	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css	false		high
https://derekcotton.com/cgi-sys/images/404mid.gif	false	Avira URL Cloud: phishing	unknown
http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess	false		high
https://derekcotton.com/cgi-sys/images/f.png	false	Avira URL Cloud: phishing	unknown
https://derekcotton.com/cgi-sys/images/404top_w.jpg	false	Avira URL Cloud: phishing	unknown
https://link.edgepilot.com/css/app.css?v=1	false		high
https://derekcotton.com/htaccess/?CA=933697&PA=2445527	false		unknown
https://link.edgepilot.com/filter	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js	false		high
https://derekcotton.com/cgi-sys/images/404bottom.gif	false	Avira URL Cloud: phishing	unknown
https://link.edgepilot.com/favicon.ico	false		high
http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://getbootstrap.com)	chromecache_74.1.dr, chromecache_80.1.dr	false	Avira URL Cloud: safe	low
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_80.1.dr	false		high
http://code.jquery.com/jquery-3.3.1.min.js	chromecache_79.1.dr	false		high
http://gmpg.org/xfn/11	chromecache_79.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
199.30.234.133	link.edgepilot.com	United States	13380	ASN-CUSTUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
64.38.240.20	refer.ccbill.com	United States	32164	SECURED-SERVERSUS	false
142.251.2.104	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.185.84.70	derekcotton.com	United States	46606	UNIFIEDLAYER-AS-1US	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1406556
Start date and time:	2024-03-11 13:03:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@18/35@18/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.137.94, 142.251.2.139, 142.251.2.100, 142.251.2.138, 142.251.2.113, 142.251.2.102, 142.251.2.101, 142.251.2.84, 34.104.35.123, 23.45.12.153, 142.251.2.94, 142.250.101.139, 142.250.101.102, 142.250.101.138, 142.250.101.101, 142.250.101.113, 142.250.101.100
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 11 11:03:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9766397060643044
Encrypted:	false
SSDEEP:	48:8cBd1cTVAaGHAidAKZdA1FehwiZUklqehly+3:8c27l+y
MD5:	F1C3E3A9B999CC2CC2174F3815E009BB
SHA1:	1191EF9C444D14509E6F312F2B907B5BEDDB2078
SHA-256:	52FEC8991520FA7148592A82C0C2FBAE723B333D728B0FF647C6577924C0B07B
SHA-512:	9B44E4E06FF6C2150ED6B119C888FA2AC0B81323B1160A14F34E367C36910D597E2940467B06A0A04C829487FF9C4F538B56DCE189D3E31EC6C348778CE46E6A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....O.).s..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IkXm`....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkXt`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkXt`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkXt`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkXv`...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W.{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2024 13:03:40.628745079 CET	60902	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:03:40.629090071 CET	58603	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:03:40.783246994 CET	53	60289	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:40.861644983 CET	53	50154	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:40.953906059 CET	53	58603	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:40.954051971 CET	53	60902	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:41.307986975 CET	65479	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:03:41.308197975 CET	53637	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:03:41.575251102 CET	53	53637	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:41.575728893 CET	53	65479	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:41.857975960 CET	53	57241	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:44.283507109 CET	53478	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:03:44.283866882 CET	55526	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:03:44.438486099 CET	53	53478	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:44.438877106 CET	53	55526	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:45.381215096 CET	52350	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:03:45.381401062 CET	61631	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:03:45.535963058 CET	53	52350	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:45.536161900 CET	53	61631	1.1.1.1	192.168.2.16
Mar 11, 2024 13:03:58.796116114 CET	53	53121	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:17.763039112 CET	53	52950	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:40.293899059 CET	53	62537	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:40.671768904 CET	53	59283	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:51.375767946 CET	138	138	192.168.2.16	192.168.2.255
Mar 11, 2024 13:04:53.227317095 CET	61814	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:04:53.227602959 CET	56163	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:04:53.435235023 CET	53	61814	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:53.435370922 CET	53	56163	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:54.277266026 CET	55713	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:04:54.277617931 CET	58514	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:04:54.278300047 CET	61866	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:04:54.278647900 CET	56427	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:04:54.432069063 CET	53	55713	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:54.432801008 CET	53	58514	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:54.432885885 CET	53	61866	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:54.433298111 CET	53	56427	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:56.202656031 CET	49823	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:04:56.202874899 CET	58672	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:04:56.357903004 CET	53	49823	1.1.1.1	192.168.2.16
Mar 11, 2024 13:04:56.358072996 CET	53	58672	1.1.1.1	192.168.2.16
Mar 11, 2024 13:05:08.358043909 CET	53	58472	1.1.1.1	192.168.2.16
Mar 11, 2024 13:05:45.487641096 CET	51882	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:05:45.487786055 CET	62959	53	192.168.2.16	1.1.1.1
Mar 11, 2024 13:05:45.642930984 CET	53	62959	1.1.1.1	192.168.2.16
Mar 11, 2024 13:05:45.642976999 CET	53	51882	1.1.1.1	192.168.2.16

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 13:03:41.115477085 CET	508	OUT	GET /cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess HTTP/1.1 Host: refer.ccbill.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 11, 2024 13:03:41.302927017 CET	950	IN	HTTP/1.1 302 Found Date: Mon, 11 Mar 2024 12:03:41 GMT Set-Cookie: 933697=CLICKS2U2FsdGVkX181Bh^vywgXLIIBb48B^pjj0Tw*; expires=? 14-Mar-24 05:03:41 GMT; path=/; domain=.ccbill.com Location: https://derekcotton.com/htaccess?CA=933697&PA=2445527 Content-Length: 241 X-Cnection: close Content-Type: text/html; charset=iso-8859-1 X-Robots-Tag: noindex, nofollow, noarchive Set-Cookie: TS01121727=01c886b93cd3f20ae0e723d7ebf82af081b6487e915153c6a93494889b4116eca1ae1ec29f91d7a52bbc6b7e3cefb2714fed22cb81; Path=/ Set-Cookie: TS0163356d=01c886b93cb69375f1120f4a793a17a4112aef484d5153c6a93494889b4116eca1ae1ec29fa7301fc6210280432c8489414d11692a89fc9121794aafea873a7bfcb4e3eeca; path=/; domain=.ccbill.com Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 72 65 6b 63 6f 74 74 6f 6e 2e 63 6f 6d 2f 68 74 61 63 63 65 73 73 3f 43 41 3d 39 33 33 36 39 37 26 61 6d 70 3b 50 41 3d 32 34 34 35 35 32 37 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://derekcotton.com/htaccess?CA=933697&PA=2445527">here</a>.</p></body></html>
Mar 11, 2024 13:04:26.303569078 CET	6	OUT	Data Raw: 00 Data Ascii:
Mar 11, 2024 13:04:27.855828047 CET	842	OUT	GET /cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess HTTP/1.1 Host: refer.ccbill.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: 933697=CLICKS2U2FsdGVkX181Bh^vywgXLIIBb48B^pjj0Tw*; TS01121727=01c886b93cd3f20ae0e723d7ebf82af081b6487e915153c6a93494889b4116eca1ae1ec29f91d7a52bbc6b7e3cefb2714fed22cb81; TS0163356d=01c886b93cb69375f1120f4a793a17a4112aef484d5153c6a93494889b4116eca1ae1ec29fa7301fc6210280432c8489414d11692a89fc9121794aafea873a7bfcb4e3eeca
Mar 11, 2024 13:04:28.034950972 CET	950	IN	HTTP/1.1 302 Found Date: Mon, 11 Mar 2024 12:04:27 GMT Set-Cookie: 933697=CLICKS2U2FsdGVkX1!lvHvGvrYVb^e3tey8ePeUTPY*; expires=? 14-Mar-24 05:04:27 GMT; path=/; domain=.ccbill.com Location: https://derekcotton.com/htaccess?CA=933697&PA=2445527 Content-Length: 241 X-Cnection: close Content-Type: text/html; charset=iso-8859-1 X-Robots-Tag: noindex, nofollow, noarchive Set-Cookie: TS01121727=01c886b93cd3f20ae0e723d7ebf82af081b6487e915153c6a93494889b4116eca1ae1ec29f91d7a52bbc6b7e3cefb2714fed22cb81; Path=/ Set-Cookie: TS0163356d=01c886b93c03a9ce1cb1fa09ef0d351befeef456835153c6a93494889b4116eca1ae1ec29fa7301fc6210280432c8489414d11692abb06b244e93bf16a6b03feab1d9216f6; path=/; domain=.ccbill.com Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 72 65 6b 63 6f 74 74 6f 6e 2e 63 6f 6d 2f 68 74 61 63 63 65 73 73 3f 43 41 3d 39 33 33 36 39 37 26 61 6d 70 3b 50 41 3d 32 34 34 35 35 32 37 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://derekcotton.com/htaccess?CA=933697&PA=2445527">here</a>.</p></body></html>
Mar 11, 2024 13:04:57.305155039 CET	864	OUT	GET /cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess HTTP/1.1 Host: refer.ccbill.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: TS01121727=01c886b93cd3f20ae0e723d7ebf82af081b6487e915153c6a93494889b4116eca1ae1ec29f91d7a52bbc6b7e3cefb2714fed22cb81; 933697=CLICKS2U2FsdGVkX1!lvHvGvrYVb^e3tey8ePeUTPY*; TS0163356d=01c886b93c03a9ce1cb1fa09ef0d351befeef456835153c6a93494889b4116eca1ae1ec29fa7301fc6210280432c8489414d11692abb06b244e93bf16a6b03feab1d9216f6
Mar 11, 2024 13:04:57.489057064 CET	950	IN	HTTP/1.1 302 Found Date: Mon, 11 Mar 2024 12:04:57 GMT Set-Cookie: 933697=CLICKS2U2FsdGVkX1^v^SfPZjrxsMwTXO9MdT29IrE*; expires=? 14-Mar-24 05:04:57 GMT; path=/; domain=.ccbill.com Location: https://derekcotton.com/htaccess?CA=933697&PA=2445527 Content-Length: 241 X-Cnection: close Content-Type: text/html; charset=iso-8859-1 X-Robots-Tag: noindex, nofollow, noarchive Set-Cookie: TS01121727=01c886b93cd3f20ae0e723d7ebf82af081b6487e915153c6a93494889b4116eca1ae1ec29f91d7a52bbc6b7e3cefb2714fed22cb81; Path=/ Set-Cookie: TS0163356d=01c886b93c36900783aec7c97f8a5143d0c920faff5153c6a93494889b4116eca1ae1ec29fa7301fc6210280432c8489414d11692a181252ceb211aac5c9261aa37b8d1879; path=/; domain=.ccbill.com Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 72 65 6b 63 6f 74 74 6f 6e 2e 63 6f 6d 2f 68 74 61 63 63 65 73 73 3f 43 41 3d 39 33 33 36 39 37 26 61 6d 70 3b 50 41 3d 32 34 34 35 35 32 37 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://derekcotton.com/htaccess?CA=933697&PA=2445527">here</a>.</p></body></html>
Mar 11, 2024 13:05:42.499686003 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:41 UTC	687	OUT	GET /htaccess?CA=933697&PA=2445527 HTTP/1.1 Host: derekcotton.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:03:42 UTC	238	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Mar 2024 12:03:42 GMT Server: Apache Location: https://derekcotton.com/htaccess/?CA=933697&PA=2445527 Content-Length: 266 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-03-11 12:03:42 UTC	266	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 72 65 6b 63 6f 74 74 6f 6e 2e 63 6f 6d 2f 68 74 61 63 63 65 73 73 2f 3f 43 41 3d 39 33 33 36 39 37 26 61 6d 70 3b 50 41 3d 32 34 34 35 35 32 37 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://derekcotton.com/htaccess/?CA=933697&PA=2445527">here</a>.</p></bo

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:42 UTC	688	OUT	GET /htaccess/?CA=933697&PA=2445527 HTTP/1.1 Host: derekcotton.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:03:43 UTC	263	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 12:03:43 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 30 Sep 2022 16:13:41 GMT Accept-Ranges: bytes Content-Length: 17108 Vary: Accept-Encoding Content-Type: text/html
2024-03-11 12:03:43 UTC	7929	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head profile="http://gmpg.org/xfn/11"> <meta http-equiv="Content-Typ
2024-03-11 12:03:43 UTC	8000	IN	Data Raw: 75 6c 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 3c 73 74 72 6f 6e 67 3e 2d 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 69 72 73 74 22 3e 72 77 78 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 65 63 6f 6e 64 22 3e 72 2d 78 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 68 69 72 64 22 3e 72 2d 78 3c 2f 73 70 61 6e 3e 3c 2f 73 74 72 6f 6e 67 3e 20 61 20 72 65 67 75 6c 61 72 20 66 69 6c 65 20 77 68 6f 73 65 20 75 73 65 72 20 63 6c 61 73 73 20 68 61 73 20 66 75 6c 6c 20 70 65 72 6d 69 73 73 69 6f 6e 73 20 61 6e 64 20 77 68 6f 73 65 20 67 72 6f 75 70 20 61 6e 64 20 6f 74 68 65 72 73 20 63 6c 61 73 73 65 73 20 68 61 76 65 20 6f 6e 6c 79 20 74 68 65 20 72 65 61 64 20 61 6e 64 20 65 78 65 63 75 74 65 20 70 65 72 6d 69 73 73 69 Data Ascii: ul><li><strong>-<span class="first">rwx</span><span class="second">r-x</span><span class="third">r-x</span></strong> a regular file whose user class has full permissions and whose group and others classes have only the read and execute permissi
2024-03-11 12:03:43 UTC	1179	IN	Data Raw: 09 09 09 09 3c 68 34 3e 3c 75 3e 54 6f 20 45 64 69 74 20 74 68 65 20 50 65 72 6d 69 73 73 69 6f 6e 73 3c 2f 75 3e 3c 2f 68 34 3e 0a 09 09 09 09 09 09 09 09 3c 6f 6c 3e 0a 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 52 69 67 68 74 20 63 6c 69 63 6b 20 6f 6e 20 74 68 65 20 3c 73 74 72 6f 6e 67 3e 66 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 3c 2f 73 74 72 6f 6e 67 3e 20 61 6e 64 20 63 6c 69 63 6b 26 6e 62 73 70 3b 3c 73 74 72 6f 6e 67 3e 43 68 61 6e 67 65 20 50 65 72 6d 69 73 73 69 6f 6e 73 3c 2f 73 74 72 6f 6e 67 3e 20 66 72 6f 6d 20 74 68 65 20 6d 65 6e 75 2e 3c 2f 6c 69 3e 0a 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 41 20 64 69 61 6c 6f 67 75 65 20 62 6f 78 20 73 68 6f 75 6c 64 20 61 70 70 65 61 72 20 61 6c 6c 6f 77 69 6e 67 20 79 6f 75 20 74 6f 20 73 65 Data Ascii: <h4><u>To Edit the Permissions</u></h4><ol><li>Right click on the <strong>file or directory</strong> and click <strong>Change Permissions</strong> from the menu.</li><li>A dialogue box should appear allowing you to se

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:43 UTC	576	OUT	GET /cgi-sys/js/simple-expand.min.js HTTP/1.1 Host: derekcotton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:03:44 UTC	268	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:03:43 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 30 Sep 2022 16:13:43 GMT Accept-Ranges: bytes Content-Length: 2782 Vary: Accept-Encoding Content-Type: application/javascript
2024-03-11 12:03:44 UTC	2782	IN	Data Raw: 2f 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 31 32 20 53 79 6c 76 61 69 6e 20 48 61 6d 65 6c 0a 50 72 6f 6a 65 63 74 3a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 72 65 64 68 6f 74 73 6c 79 2f 73 69 6d 70 6c 65 2d 65 78 70 61 6e 64 0a 4d 49 54 20 4c 69 63 65 6e 63 65 3a 20 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 72 65 64 68 6f 74 73 6c 79 2f 73 69 6d 70 6c 65 2d 65 78 70 61 6e 64 2f 6d 61 73 74 65 72 2f 6c 69 63 65 6e 63 65 2d 6d 69 74 2e 74 78 74 20 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 24 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 65 2e 64 65 66 61 75 6c 74 73 3d 7b 68 69 64 65 4d 6f 64 65 3a 22 66 61 64 65 54 6f 67 67 6c Data Ascii: /* Copyright (C) 2012 Sylvain HamelProject: https://github.com/redhotsly/simple-expandMIT Licence: https://raw.github.com/redhotsly/simple-expand/master/licence-mit.txt */(function($){"use strict";function e(){var e=this;e.defaults={hideMode:"fadeToggl

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:43 UTC	625	OUT	GET /cgi-sys/images/f.png HTTP/1.1 Host: derekcotton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:03:44 UTC	233	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:03:43 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 02 Oct 2022 08:39:57 GMT Accept-Ranges: bytes Content-Length: 18239 Content-Type: image/png
2024-03-11 12:03:44 UTC	7959	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 8c 08 06 00 00 00 ae c0 41 3e 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 dd 08 1c 14 1b 17 79 01 43 46 00 00 20 00 49 44 41 54 78 da ed bd 69 98 24 d7 75 1d 78 ce 7b 11 99 59 fb d6 5d 55 dd 0d a0 b1 11 20 20 ae e0 02 41 00 28 91 b4 24 ee 04 d0 00 49 7d 96 65 ea 93 64 8d 38 a3 b1 c7 96 3c 14 c7 1a 2d 94 2c 5b b2 ad 95 9f e8 a1 c6 5a c8 cf 63 11 68 80 d4 42 93 92 b8 89 a4 c4 0d e2 4e 11 3b 1a dd 0d 54 57 55 57 15 6a c9 2d e2 dd 3b 3f 62 7b 11 19 59 dd 8d ee 06 01 09 49 16 ba 32 2b 2b 2b 33 e2 c4 bd e7 9c 7b df 7d c0 33 b7 67 6e cf dc 86 df ee 9a 9a 3a Data Ascii: PNGIHDRA>sRGBbKGDpHYstIMEyCF IDATxi$ux{Y]U A($I}ed8<-,[ZchBN;TWUWj-;?b{YI2+++3{}3gn:
2024-03-11 12:03:44 UTC	8000	IN	Data Raw: 20 49 5b e0 e5 67 e7 c3 28 43 10 30 61 a3 68 2e ae 8b 0a 4c a4 66 fb e8 71 6c 3f f0 c0 69 a9 9c 1c dd a7 61 3f 67 dc c8 f8 e5 07 53 3e e9 f0 2e d6 cc fc ab d6 86 c4 ab fe 66 27 c7 a9 c0 c5 92 0a b6 a8 e8 ee 77 59 df ca 60 41 cf a5 4b 54 04 18 00 8b df 7b cb 34 d2 aa 16 7b 25 19 22 07 8b b1 26 2d 93 94 c1 52 1a f2 5c 73 ff 54 29 ab bf be 8e 93 5f 38 89 c6 cc 0c 26 af ba 12 a6 d9 1c 4c 4f a5 7c 9f 91 67 5e 7c 56 80 d1 64 17 f9 64 cf 67 e4 a3 6d cb 7c 85 44 fb d8 71 6c df ff 60 52 ab 39 8d b4 53 17 35 4c dd c1 f0 a2 48 b1 dd 4c f1 e7 8d b7 49 48 a9 b0 a9 92 ce 75 29 37 71 67 7d 2e 61 ab 85 08 40 38 31 51 f2 50 fc a5 20 59 2b 65 e4 62 34 26 c6 f3 ee 3f 33 32 8a b8 1f 41 b3 05 f0 a5 4a 33 10 45 31 c2 d1 b1 e2 0a 6e 8d 40 e5 64 0e 16 a6 3b b3 99 74 9b 1b 72 70 Data Ascii: I[g(C0ah.Lfql?ia?gS>.f'wY`AKT{4{%"&-R\sT)_8&LO\|g^\|Vddgm\|Dql`R9S5LHLIHu)7qg}.a@81QP Y+eb4&?32AJ3E1n@d;trp
2024-03-11 12:03:44 UTC	2280	IN	Data Raw: 40 09 41 78 59 80 fb 2e 0b 79 3f 80 78 4b ec d4 3d 7d 79 fe b2 e8 73 b7 15 73 7f df d7 50 15 36 7d 45 28 80 11 aa ce 58 72 c6 10 13 29 98 42 96 f7 ac cc 80 d1 13 60 5b 81 4d 49 78 c8 a6 14 43 d0 08 c2 40 95 64 14 50 7b 7b 68 ee b9 28 d0 af 5e 12 f2 81 c4 5f 54 93 b6 54 59 5f 38 81 26 11 5b 4e 93 fe 2d 2a 48 0a 20 02 a1 c0 c0 41 c4 81 26 06 d4 41 25 e9 e9 32 74 0a 0a a8 42 3a 55 63 92 f8 44 d5 a1 3b b8 3d 6d 48 ef 34 2c 9a 8b 01 7a 9d 86 36 9a 0d 50 5b 68 d8 51 0a 47 d4 70 94 d0 d1 44 5a 63 44 53 d2 4b 20 50 d5 80 86 56 25 5d 3e 6d d2 c6 36 25 95 0a 08 48 d2 24 29 0a 49 bf 64 d1 7a 40 e6 45 c1 e4 ed 90 d4 e3 91 ec 3f 1e e3 b2 75 c5 25 6d d1 8b 84 a6 39 10 4b b8 1b fa 8b 78 48 40 1b c4 f2 14 f9 f0 1e a3 0f 5e 12 f2 81 26 d1 87 9f ad b2 c4 69 8c 28 94 94 4c Data Ascii: @AxY.y?xK=}yssP6}E(Xr)B`[MIxC@dP{{h(^_TTY_8&[N-*H A&A%2tB:UcD;=mH4,z6P[hQGpDZcDSK PV%]>m6%H$)Idz@E?u%m9KxH@^&i(L

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:44 UTC	632	OUT	GET /cgi-sys/images/404top_w.jpg HTTP/1.1 Host: derekcotton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:03:44 UTC	233	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:03:44 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 02 Oct 2022 08:39:46 GMT Accept-Ranges: bytes Content-Length: 4335 Content-Type: image/jpeg
2024-03-11 12:03:44 UTC	4335	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 a9 03 64 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 01 00 02 03 01 00 00 00 00 00 00 00 00 00 00 00 01 02 04 03 07 08 05 ff c4 00 3a 10 01 00 01 03 00 07 04 07 07 04 02 03 00 00 00 00 00 01 03 07 11 02 04 06 16 17 81 c2 12 21 94 d2 31 36 46 51 74 84 91 05 13 14 61 71 Data Ascii: JFIFHHC!"$"$Cd:!16FQtaq

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:44 UTC	630	OUT	GET /cgi-sys/images/404mid.gif HTTP/1.1 Host: derekcotton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:03:44 UTC	231	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:03:44 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 30 Sep 2022 16:14:48 GMT Accept-Ranges: bytes Content-Length: 120 Content-Type: image/gif
2024-03-11 12:03:44 UTC	120	IN	Data Raw: 47 49 46 38 39 61 64 03 04 00 91 00 00 9a b2 c9 ff ff ff a0 b6 cc a1 b7 cd 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 04 00 00 02 49 dc 82 a9 cb ed 0f a3 9c b4 da 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a6 ea ca b6 ee 9b 00 80 01 d7 f6 8d e7 fa ce f7 fe 0f 0c 0a 87 44 8a 8c 56 4c 2a 97 cc a6 f3 09 8d 4a a7 54 cc f1 50 cd 6a b7 dc ae f7 0b 0e 8b 2d b2 02 00 3b Data Ascii: GIF89ad!,dIHDVL*JTPj-;

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:44 UTC	633	OUT	GET /cgi-sys/images/404bottom.gif HTTP/1.1 Host: derekcotton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:03:44 UTC	231	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:03:44 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 30 Sep 2022 16:14:12 GMT Accept-Ranges: bytes Content-Length: 537 Content-Type: image/gif
2024-03-11 12:03:44 UTC	537	IN	Data Raw: 47 49 46 38 39 61 64 03 0e 00 d5 00 00 36 65 94 f7 f9 fb ad c0 d4 9d b4 cb cd d9 e4 7c 9b b9 a2 b8 ce 6d 8f b1 e6 ec f2 5c 82 a9 8c a7 c2 bd cd dc 4e 77 a1 f2 f5 f8 b0 c3 d5 85 a2 be dc e4 ec 93 ad c6 ff ff ff 58 7f a6 73 94 b5 a7 bc d0 c5 d2 e0 64 89 ad 81 9e bc d1 dc e7 ea ef f4 f6 f8 fa b3 c5 d7 7b 94 b5 7e 9d bb 8c ad c5 6b 94 b5 8c a5 bd 63 87 ac 59 80 a7 d4 de e8 ed f1 f5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 00 07 00 ff 00 2c 00 00 00 00 64 03 0e 00 00 06 ff 40 83 41 42 2c 1a 8f c8 a4 72 c9 6c 3a 9f d0 a8 74 4a ad 5a af d8 ac 76 cb ed 7a bf e0 b0 Data Ascii: GIF89ad6e\|m\NwXsd{~kcY!,d@AB,rl:tJZvz

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:44 UTC	359	OUT	GET /cgi-sys/images/f.png HTTP/1.1 Host: derekcotton.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:03:45 UTC	233	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:03:45 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 02 Oct 2022 08:39:57 GMT Accept-Ranges: bytes Content-Length: 18239 Content-Type: image/png
2024-03-11 12:03:45 UTC	7959	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 8c 08 06 00 00 00 ae c0 41 3e 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 dd 08 1c 14 1b 17 79 01 43 46 00 00 20 00 49 44 41 54 78 da ed bd 69 98 24 d7 75 1d 78 ce 7b 11 99 59 fb d6 5d 55 dd 0d a0 b1 11 20 20 ae e0 02 41 00 28 91 b4 24 ee 04 d0 00 49 7d 96 65 ea 93 64 8d 38 a3 b1 c7 96 3c 14 c7 1a 2d 94 2c 5b b2 ad 95 9f e8 a1 c6 5a c8 cf 63 11 68 80 d4 42 93 92 b8 89 a4 c4 0d e2 4e 11 3b 1a dd 0d 54 57 55 57 15 6a c9 2d e2 dd 3b 3f 62 7b 11 19 59 dd 8d ee 06 01 09 49 16 ba 32 2b 2b 2b 33 e2 c4 bd e7 9c 7b df 7d c0 33 b7 67 6e cf dc 86 df ee 9a 9a 3a Data Ascii: PNGIHDRA>sRGBbKGDpHYstIMEyCF IDATxi$ux{Y]U A($I}ed8<-,[ZchBN;TWUWj-;?b{YI2+++3{}3gn:
2024-03-11 12:03:45 UTC	8000	IN	Data Raw: 20 49 5b e0 e5 67 e7 c3 28 43 10 30 61 a3 68 2e ae 8b 0a 4c a4 66 fb e8 71 6c 3f f0 c0 69 a9 9c 1c dd a7 61 3f 67 dc c8 f8 e5 07 53 3e e9 f0 2e d6 cc fc ab d6 86 c4 ab fe 66 27 c7 a9 c0 c5 92 0a b6 a8 e8 ee 77 59 df ca 60 41 cf a5 4b 54 04 18 00 8b df 7b cb 34 d2 aa 16 7b 25 19 22 07 8b b1 26 2d 93 94 c1 52 1a f2 5c 73 ff 54 29 ab bf be 8e 93 5f 38 89 c6 cc 0c 26 af ba 12 a6 d9 1c 4c 4f a5 7c 9f 91 67 5e 7c 56 80 d1 64 17 f9 64 cf 67 e4 a3 6d cb 7c 85 44 fb d8 71 6c df ff 60 52 ab 39 8d b4 53 17 35 4c dd c1 f0 a2 48 b1 dd 4c f1 e7 8d b7 49 48 a9 b0 a9 92 ce 75 29 37 71 67 7d 2e 61 ab 85 08 40 38 31 51 f2 50 fc a5 20 59 2b 65 e4 62 34 26 c6 f3 ee 3f 33 32 8a b8 1f 41 b3 05 f0 a5 4a 33 10 45 31 c2 d1 b1 e2 0a 6e 8d 40 e5 64 0e 16 a6 3b b3 99 74 9b 1b 72 70 Data Ascii: I[g(C0ah.Lfql?ia?gS>.f'wY`AKT{4{%"&-R\sT)_8&LO\|g^\|Vddgm\|Dql`R9S5LHLIHu)7qg}.a@81QP Y+eb4&?32AJ3E1n@d;trp
2024-03-11 12:03:45 UTC	2280	IN	Data Raw: 40 09 41 78 59 80 fb 2e 0b 79 3f 80 78 4b ec d4 3d 7d 79 fe b2 e8 73 b7 15 73 7f df d7 50 15 36 7d 45 28 80 11 aa ce 58 72 c6 10 13 29 98 42 96 f7 ac cc 80 d1 13 60 5b 81 4d 49 78 c8 a6 14 43 d0 08 c2 40 95 64 14 50 7b 7b 68 ee b9 28 d0 af 5e 12 f2 81 c4 5f 54 93 b6 54 59 5f 38 81 26 11 5b 4e 93 fe 2d 2a 48 0a 20 02 a1 c0 c0 41 c4 81 26 06 d4 41 25 e9 e9 32 74 0a 0a a8 42 3a 55 63 92 f8 44 d5 a1 3b b8 3d 6d 48 ef 34 2c 9a 8b 01 7a 9d 86 36 9a 0d 50 5b 68 d8 51 0a 47 d4 70 94 d0 d1 44 5a 63 44 53 d2 4b 20 50 d5 80 86 56 25 5d 3e 6d d2 c6 36 25 95 0a 08 48 d2 24 29 0a 49 bf 64 d1 7a 40 e6 45 c1 e4 ed 90 d4 e3 91 ec 3f 1e e3 b2 75 c5 25 6d d1 8b 84 a6 39 10 4b b8 1b fa 8b 78 48 40 1b c4 f2 14 f9 f0 1e a3 0f 5e 12 f2 81 26 d1 87 9f ad b2 c4 69 8c 28 94 94 4c Data Ascii: @AxY.y?xK=}yssP6}E(Xr)B`[MIxC@dP{{h(^_TTY_8&[N-*H A&A%2tB:UcD;=mH4,z6P[hQGpDZcDSK PV%]>m6%H$)Idz@E?u%m9KxH@^&i(L

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:45 UTC	616	OUT	GET /favicon.ico HTTP/1.1 Host: derekcotton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:03:46 UTC	176	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:03:45 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Content-Length: 0 Content-Type: text/html; charset=UTF-8

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:46 UTC	350	OUT	GET /favicon.ico HTTP/1.1 Host: derekcotton.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:03:47 UTC	176	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:03:47 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Content-Length: 0 Content-Type: text/html; charset=UTF-8

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:53 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-11 12:03:54 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/250E) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=26500 Date: Mon, 11 Mar 2024 12:03:54 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:54 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-11 12:03:54 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0Fz4RYwAAAACZW8dCTzveR7lI76J6Z2l5U0pDRURHRTA1MTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=26406 Date: Mon, 11 Mar 2024 12:03:54 GMT Content-Length: 55 Connection: close X-CID: 2
2024-03-11 12:03:54 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:03:56 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oNS+Dd6DFMcrUvW&MD=tOHPEbuV HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-03-11 12:03:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 27917571-1841-41cc-8f8e-c4a5a02abb9c MS-RequestId: cf934113-ce7e-4c81-b9b7-132164c8c8bf MS-CV: vCfmq1OnfE6rP5JE.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 12:03:55 GMT Connection: close Content-Length: 24490
2024-03-11 12:03:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-03-11 12:03:56 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:02 UTC	616	OUT	GET /favicon.ico HTTP/1.1 Host: derekcotton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:02 UTC	176	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:04:02 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Content-Length: 0 Content-Type: text/html; charset=UTF-8

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:03 UTC	350	OUT	GET /favicon.ico HTTP/1.1 Host: derekcotton.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:03 UTC	176	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:04:03 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Content-Length: 0 Content-Type: text/html; charset=UTF-8

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:28 UTC	688	OUT	GET /htaccess/?CA=933697&PA=2445527 HTTP/1.1 Host: derekcotton.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:28 UTC	263	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 12:04:28 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 30 Sep 2022 16:13:41 GMT Accept-Ranges: bytes Content-Length: 17108 Vary: Accept-Encoding Content-Type: text/html
2024-03-11 12:04:28 UTC	7929	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head profile="http://gmpg.org/xfn/11"> <meta http-equiv="Content-Typ
2024-03-11 12:04:29 UTC	8000	IN	Data Raw: 75 6c 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 3c 73 74 72 6f 6e 67 3e 2d 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 69 72 73 74 22 3e 72 77 78 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 65 63 6f 6e 64 22 3e 72 2d 78 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 68 69 72 64 22 3e 72 2d 78 3c 2f 73 70 61 6e 3e 3c 2f 73 74 72 6f 6e 67 3e 20 61 20 72 65 67 75 6c 61 72 20 66 69 6c 65 20 77 68 6f 73 65 20 75 73 65 72 20 63 6c 61 73 73 20 68 61 73 20 66 75 6c 6c 20 70 65 72 6d 69 73 73 69 6f 6e 73 20 61 6e 64 20 77 68 6f 73 65 20 67 72 6f 75 70 20 61 6e 64 20 6f 74 68 65 72 73 20 63 6c 61 73 73 65 73 20 68 61 76 65 20 6f 6e 6c 79 20 74 68 65 20 72 65 61 64 20 61 6e 64 20 65 78 65 63 75 74 65 20 70 65 72 6d 69 73 73 69 Data Ascii: ul><li><strong>-<span class="first">rwx</span><span class="second">r-x</span><span class="third">r-x</span></strong> a regular file whose user class has full permissions and whose group and others classes have only the read and execute permissi
2024-03-11 12:04:29 UTC	1179	IN	Data Raw: 09 09 09 09 3c 68 34 3e 3c 75 3e 54 6f 20 45 64 69 74 20 74 68 65 20 50 65 72 6d 69 73 73 69 6f 6e 73 3c 2f 75 3e 3c 2f 68 34 3e 0a 09 09 09 09 09 09 09 09 3c 6f 6c 3e 0a 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 52 69 67 68 74 20 63 6c 69 63 6b 20 6f 6e 20 74 68 65 20 3c 73 74 72 6f 6e 67 3e 66 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 3c 2f 73 74 72 6f 6e 67 3e 20 61 6e 64 20 63 6c 69 63 6b 26 6e 62 73 70 3b 3c 73 74 72 6f 6e 67 3e 43 68 61 6e 67 65 20 50 65 72 6d 69 73 73 69 6f 6e 73 3c 2f 73 74 72 6f 6e 67 3e 20 66 72 6f 6d 20 74 68 65 20 6d 65 6e 75 2e 3c 2f 6c 69 3e 0a 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 41 20 64 69 61 6c 6f 67 75 65 20 62 6f 78 20 73 68 6f 75 6c 64 20 61 70 70 65 61 72 20 61 6c 6c 6f 77 69 6e 67 20 79 6f 75 20 74 6f 20 73 65 Data Ascii: <h4><u>To Edit the Permissions</u></h4><ol><li>Right click on the <strong>file or directory</strong> and click <strong>Change Permissions</strong> from the menu.</li><li>A dialogue box should appear allowing you to se

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:30 UTC	350	OUT	GET /favicon.ico HTTP/1.1 Host: derekcotton.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:30 UTC	176	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:04:30 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Content-Length: 0 Content-Type: text/html; charset=UTF-8

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:34 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oNS+Dd6DFMcrUvW&MD=tOHPEbuV HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-03-11 12:04:35 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 9b8781cf-c8c4-4754-bd6e-4e90e6981336 MS-RequestId: 64af1361-7e67-4c46-b830-13e3020eba7a MS-CV: zGCjpP2tsUiLpS+E.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 12:04:34 GMT Connection: close Content-Length: 25457
2024-03-11 12:04:35 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-03-11 12:04:35 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:54 UTC	802	OUT	GET /s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess HTTP/1.1 Host: link.edgepilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:54 UTC	177	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Mar 2024 12:04:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2590 Connection: close Cache-Control: no-cache
2024-03-11 12:04:54 UTC	2590	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 68 65 63 6b 69 6e 67 20 6c 69 6e 6b 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 61 70 70 2e 63 73 73 3f 76 3d 31 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f 6f 74 73 74 72 Data Ascii: <html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1" /> <title>Checking link...</title> <link href="/css/app.css?v=1" rel="stylesheet"> <link href="//maxcdn.bootstrapcdn.com/bootstr

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:54 UTC	691	OUT	GET /css/app.css?v=1 HTTP/1.1 Host: link.edgepilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://link.edgepilot.com/s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:54 UTC	249	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Mar 2024 12:04:54 GMT Content-Type: text/css Content-Length: 819 Last-Modified: Wed, 01 Mar 2023 20:35:57 GMT Connection: close ETag: "63ffb72d-333" Cache-Control: max-age Accept-Ranges: bytes
2024-03-11 12:04:54 UTC	819	IN	Data Raw: 6e 61 76 2e 6e 61 76 62 61 72 20 7b 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 38 30 70 78 20 21 20 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 69 6e 68 65 72 69 74 20 21 20 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 20 21 20 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 35 70 78 20 21 20 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 6e 61 76 2e 6e 61 76 62 61 72 20 3e 20 2a 20 7b 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 38 30 70 78 3b 0a 7d 0a 2e 6e 61 76 62 61 72 2d 62 72 61 6e 64 20 7b 0a 20 20 68 65 69 67 68 74 3a 20 37 30 70 78 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 30 20 30 3b 0a 20 20 Data Ascii: nav.navbar { min-height: 80px ! important; background-color: inherit ! important; border-color: transparent ! important; margin-bottom: 5px ! important;}nav.navbar > * { min-height: 80px;}.navbar-brand { height: 70px; margin: 0 0 0 0;

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:54 UTC	609	OUT	GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://link.edgepilot.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://link.edgepilot.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:55 UTC	932	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:04:55 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"ec3bb52a00e176a7181d454dffaea219" Last-Modified: Mon, 25 Jan 2021 22:03:59 GMT CDN-CachedAt: 10/31/2023 18:51:53 CDN-ProxyVer: 1.04 CDN-RequestPullCode: 200 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 852 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestId: 2aec76ee6e10977ab22d69991e2b8599 CDN-Cache: HIT CF-Cache-Status: HIT Age: 9422898 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 862b68e43f4169e3-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 12:04:55 UTC	437	IN	Data Raw: 37 63 30 66 0d 0a 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 33 2e 37 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 36 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 33 2e 30 2e 33 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 68 75 62 2e 63 6f 6d 2f 6e 65 63 6f 6c 61 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 2a 2f 68 74 6d 6c 7b Data Ascii: 7c0f/! Bootstrap v3.3.7 (http://getbootstrap.com) * Copyright 2011-2016 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 70 72 6f 67 72 65 73 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 5b 68 69 64 64 65 6e 5d 2c 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 61 3a 61 63 74 69 76 65 2c 61 3a 68 6f 76 65 72 7b 6f 75 74 6c 69 6e 65 3a 30 7d 61 62 62 72 5b 74 69 74 6c 65 5d 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 64 6f 74 Data Ascii: y{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dot
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 79 70 65 3d 73 65 61 72 63 68 5d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 74 65 78 74 66 69 65 6c 64 7d 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 63 61 6e 63 65 6c 2d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 64 65 63 6f 72 61 74 69 6f 6e 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 7d 66 69 65 6c 64 73 65 74 7b 70 61 64 64 Data Ascii: ype=search]{-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-appearance:textfield}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration{-webkit-appearance:none}fieldset{padd
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 72 74 61 6e 74 7d 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 47 6c 79 70 68 69 63 6f 6e 73 20 48 61 6c 66 6c 69 6e 67 73 27 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 65 6f 74 29 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 65 6f 74 3f 23 69 65 66 69 78 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c Data Ascii: rtant}}@font-face{font-family:'Glyphicons Halflings';src:url(../fonts/glyphicons-halflings-regular.eot);src:url(../fonts/glyphicons-halflings-regular.eot?#iefix) format('embedded-opentype'),url(../fonts/glyphicons-halflings-regular.woff2) format('woff2'),
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 7a 6f 6f 6d 2d 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 7a 6f 6f 6d 2d 6f 75 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6f 66 66 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 Data Ascii: :before{content:"\e011"}.glyphicon-th-list:before{content:"\e012"}.glyphicon-ok:before{content:"\e013"}.glyphicon-remove:before{content:"\e014"}.glyphicon-zoom-in:before{content:"\e015"}.glyphicon-zoom-out:before{content:"\e016"}.glyphicon-off:before{cont
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 61 6d 65 72 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6f 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 62 6f 6c 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 69 74 61 6c 69 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 39 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 65 78 74 2d 68 65 69 67 68 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 Data Ascii: content:"\e044"}.glyphicon-print:before{content:"\e045"}.glyphicon-camera:before{content:"\e046"}.glyphicon-font:before{content:"\e047"}.glyphicon-bold:before{content:"\e048"}.glyphicon-italic:before{content:"\e049"}.glyphicon-text-height:before{content:"
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 65 6a 65 63 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 6c 65 66 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 39 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 30 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 6c 75 73 2d 73 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6d 69 6e 75 73 2d 73 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 32 22 7d 2e 67 6c 79 70 68 69 63 Data Ascii: before{content:"\e077"}.glyphicon-eject:before{content:"\e078"}.glyphicon-chevron-left:before{content:"\e079"}.glyphicon-chevron-right:before{content:"\e080"}.glyphicon-plus-sign:before{content:"\e081"}.glyphicon-minus-sign:before{content:"\e082"}.glyphic
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6d 61 67 6e 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 74 77 65 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 73 68 6f 70 70 69 6e 67 2d 63 61 72 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 36 22 7d 2e 67 6c 79 70 68 69 63 Data Ascii: :before{content:"\e111"}.glyphicon-magnet:before{content:"\e112"}.glyphicon-chevron-up:before{content:"\e113"}.glyphicon-chevron-down:before{content:"\e114"}.glyphicon-retweet:before{content:"\e115"}.glyphicon-shopping-cart:before{content:"\e116"}.glyphic
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 65 31 34 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 61 70 65 72 63 6c 69 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 68 65 61 72 74 2d 65 6d 70 74 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6c 69 6e 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 68 6f 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 75 73 68 70 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 75 73 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 38 22 7d Data Ascii: e141"}.glyphicon-paperclip:before{content:"\e142"}.glyphicon-heart-empty:before{content:"\e143"}.glyphicon-link:before{content:"\e144"}.glyphicon-phone:before{content:"\e145"}.glyphicon-pushpin:before{content:"\e146"}.glyphicon-usd:before{content:"\e148"}
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 73 61 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 6f 70 65 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 72 65 64 69 74 2d 63 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 72 61 6e 73 66 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 75 74 6c 65 72 79 3a 62 65 66 6f 72 65 7b 63 Data Ascii: glyphicon-floppy-remove:before{content:"\e174"}.glyphicon-floppy-save:before{content:"\e175"}.glyphicon-floppy-open:before{content:"\e176"}.glyphicon-credit-card:before{content:"\e177"}.glyphicon-transfer:before{content:"\e178"}.glyphicon-cutlery:before{c

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:54 UTC	593	OUT	GET /bootstrap/3.3.7/js/bootstrap.min.js HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://link.edgepilot.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://link.edgepilot.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:55 UTC	947	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:04:55 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: DE Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"5869c96cc8f19086aee625d670d741f9" Last-Modified: Mon, 25 Jan 2021 22:04:00 GMT CDN-CachedAt: 11/15/2022 10:30:01 CDN-ProxyVer: 1.03 CDN-RequestPullCode: 200 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 1053 CDN-Status: 200 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-RequestId: 7cd5f82ca8714ac966f2d509cec8085c CDN-Cache: HIT CF-Cache-Status: HIT Age: 9506735 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 862b68e438a409f3-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 12:04:55 UTC	422	IN	Data Raw: 37 63 30 31 0d 0a 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 33 2e 37 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 36 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 2f 0a 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 6a 51 75 65 72 79 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 42 6f 6f 74 73 74 72 61 70 27 73 20 4a 61 76 61 53 63 72 69 70 74 20 72 65 71 75 69 72 65 73 20 6a 51 75 65 72 79 22 29 3b 2b 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 62 3d 61 2e 66 6e Data Ascii: 7c01/! Bootstrap v3.3.7 (http://getbootstrap.com) * Copyright 2011-2016 Twitter, Inc. * Licensed under the MIT license */if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");+function(a){"use strict";var b=a.fn
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 75 74 20 6c 6f 77 65 72 20 74 68 61 6e 20 76 65 72 73 69 6f 6e 20 34 22 29 7d 28 6a 51 75 65 72 79 29 2c 2b 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 62 6f 6f 74 73 74 72 61 70 22 29 2c 62 3d 7b 57 65 62 6b 69 74 54 72 61 6e 73 69 74 69 6f 6e 3a 22 77 65 62 6b 69 74 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 22 2c 4d 6f 7a 54 72 61 6e 73 69 74 69 6f 6e 3a 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 2c 4f 54 72 61 6e 73 69 74 69 6f 6e 3a 22 6f 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 20 6f 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 2c 74 72 61 6e 73 69 74 69 6f 6e 3a 22 74 72 61 6e 73 69 74 69 6f 6e 65 Data Ascii: ut lower than version 4")}(jQuery),+function(a){"use strict";function b(){var a=document.createElement("bootstrap"),b={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitione
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 73 65 2e 62 73 2e 61 6c 65 72 74 22 29 29 2c 62 2e 69 73 44 65 66 61 75 6c 74 50 72 65 76 65 6e 74 65 64 28 29 7c 7c 28 67 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 69 6e 22 29 2c 61 2e 73 75 70 70 6f 72 74 2e 74 72 61 6e 73 69 74 69 6f 6e 26 26 67 2e 68 61 73 43 6c 61 73 73 28 22 66 61 64 65 22 29 3f 67 2e 6f 6e 65 28 22 62 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 22 2c 63 29 2e 65 6d 75 6c 61 74 65 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 64 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 44 55 52 41 54 49 4f 4e 29 3a 63 28 29 29 7d 3b 76 61 72 20 65 3d 61 2e 66 6e 2e 61 6c 65 72 74 3b 61 2e 66 6e 2e 61 6c 65 72 74 3d 62 2c 61 2e 66 6e 2e 61 6c 65 72 74 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 64 2c 61 2e 66 6e 2e 61 6c 65 72 74 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d Data Ascii: se.bs.alert")),b.isDefaultPrevented()\|\|(g.removeClass("in"),a.support.transition&&g.hasClass("fade")?g.one("bsTransitionEnd",c).emulateTransitionEnd(d.TRANSITION_DURATION):c())};var e=a.fn.alert;a.fn.alert=b,a.fn.alert.Constructor=d,a.fn.alert.noConflict=
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 63 74 69 76 65 22 29 29 3a 22 63 68 65 63 6b 62 6f 78 22 3d 3d 63 2e 70 72 6f 70 28 22 74 79 70 65 22 29 26 26 28 63 2e 70 72 6f 70 28 22 63 68 65 63 6b 65 64 22 29 21 3d 3d 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 68 61 73 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 26 26 28 61 3d 21 31 29 2c 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 74 6f 67 67 6c 65 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 29 2c 63 2e 70 72 6f 70 28 22 63 68 65 63 6b 65 64 22 2c 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 68 61 73 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 29 2c 61 26 26 63 2e 74 72 69 67 67 65 72 28 22 63 68 61 6e 67 65 22 29 7d 65 6c 73 65 20 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 61 74 74 72 28 22 61 72 69 61 2d 70 72 65 73 73 65 64 22 2c 21 74 68 69 73 2e Data Ascii: ctive")):"checkbox"==c.prop("type")&&(c.prop("checked")!==this.$element.hasClass("active")&&(a=!1),this.$element.toggleClass("active")),c.prop("checked",this.$element.hasClass("active")),a&&c.trigger("change")}else this.$element.attr("aria-pressed",!this.
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 65 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 6c 69 64 69 6e 67 3d 6e 75 6c 6c 2c 74 68 69 73 2e 69 6e 74 65 72 76 61 6c 3d 6e 75 6c 6c 2c 74 68 69 73 2e 24 61 63 74 69 76 65 3d 6e 75 6c 6c 2c 74 68 69 73 2e 24 69 74 65 6d 73 3d 6e 75 6c 6c 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 6b 65 79 62 6f 61 72 64 26 26 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 6f 6e 28 22 6b 65 79 64 6f 77 6e 2e 62 73 2e 63 61 72 6f 75 73 65 6c 22 2c 61 2e 70 72 6f 78 79 28 74 68 69 73 2e 6b 65 79 64 6f 77 6e 2c 74 68 69 73 29 29 2c 22 68 6f 76 65 72 22 3d 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 70 61 75 73 65 26 26 21 28 22 6f 6e 74 6f 75 63 68 73 74 61 72 74 22 69 6e 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 29 26 26 74 68 69 73 2e 24 65 6c 65 6d Data Ascii: ed=null,this.sliding=null,this.interval=null,this.$active=null,this.$items=null,this.options.keyboard&&this.$element.on("keydown.bs.carousel",a.proxy(this.keydown,this)),"hover"==this.options.pause&&!("ontouchstart"in document.documentElement)&&this.$elem
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 29 29 72 65 74 75 72 6e 20 74 68 69 73 2e 73 6c 69 64 69 6e 67 3f 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 6f 6e 65 28 22 73 6c 69 64 2e 62 73 2e 63 61 72 6f 75 73 65 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 62 2e 74 6f 28 61 29 7d 29 3a 63 3d 3d 61 3f 74 68 69 73 2e 70 61 75 73 65 28 29 2e 63 79 63 6c 65 28 29 3a 74 68 69 73 2e 73 6c 69 64 65 28 61 3e 63 3f 22 6e 65 78 74 22 3a 22 70 72 65 76 22 2c 74 68 69 73 2e 24 69 74 65 6d 73 2e 65 71 28 61 29 29 7d 2c 63 2e 70 72 6f 74 6f 74 79 70 65 2e 70 61 75 73 65 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7c 7c 28 74 68 69 73 2e 70 61 75 73 65 64 3d 21 30 29 2c 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 66 69 6e 64 28 22 2e 6e 65 78 74 2c 20 2e 70 72 65 76 22 29 2e 6c 65 6e 67 74 68 26 26 Data Ascii: ))return this.sliding?this.$element.one("slid.bs.carousel",function(){b.to(a)}):c==a?this.pause().cycle():this.slide(a>c?"next":"prev",this.$items.eq(a))},c.prototype.pause=function(b){return b\|\|(this.paused=!0),this.$element.find(".next, .prev").length&&
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 29 2c 69 2e 73 6c 69 64 69 6e 67 3d 21 31 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 2e 24 65 6c 65 6d 65 6e 74 2e 74 72 69 67 67 65 72 28 6d 29 7d 2c 30 29 7d 29 2e 65 6d 75 6c 61 74 65 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 63 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 44 55 52 41 54 49 4f 4e 29 29 3a 28 65 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 2c 66 2e 61 64 64 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 2c 74 68 69 73 2e 73 6c 69 64 69 6e 67 3d 21 31 2c 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 74 72 69 67 67 65 72 28 6d 29 29 2c 67 26 26 74 68 69 73 2e 63 79 63 6c 65 28 29 2c 74 68 69 73 7d 7d 3b 76 61 72 20 64 3d 61 2e 66 6e 2e 63 61 72 6f 75 73 65 6c 3b 61 2e 66 6e 2e 63 61 72 6f 75 73 65 6c 3d Data Ascii: ),i.sliding=!1,setTimeout(function(){i.$element.trigger(m)},0)}).emulateTransitionEnd(c.TRANSITION_DURATION)):(e.removeClass("active"),f.addClass("active"),this.sliding=!1,this.$element.trigger(m)),g&&this.cycle(),this}};var d=a.fn.carousel;a.fn.carousel=
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 3d 22 63 6f 6c 6c 61 70 73 65 22 5d 5b 68 72 65 66 3d 22 23 27 2b 62 2e 69 64 2b 27 22 5d 2c 5b 64 61 74 61 2d 74 6f 67 67 6c 65 3d 22 63 6f 6c 6c 61 70 73 65 22 5d 5b 64 61 74 61 2d 74 61 72 67 65 74 3d 22 23 27 2b 62 2e 69 64 2b 27 22 5d 27 29 2c 74 68 69 73 2e 74 72 61 6e 73 69 74 69 6f 6e 69 6e 67 3d 6e 75 6c 6c 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 70 61 72 65 6e 74 3f 74 68 69 73 2e 24 70 61 72 65 6e 74 3d 74 68 69 73 2e 67 65 74 50 61 72 65 6e 74 28 29 3a 74 68 69 73 2e 61 64 64 41 72 69 61 41 6e 64 43 6f 6c 6c 61 70 73 65 64 43 6c 61 73 73 28 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2c 74 68 69 73 2e 24 74 72 69 67 67 65 72 29 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 74 6f 67 67 6c 65 26 26 74 68 69 73 2e 74 6f 67 67 6c 65 28 29 7d 3b 64 2e 56 Data Ascii: ="collapse"][href="#'+b.id+'"],[data-toggle="collapse"][data-target="#'+b.id+'"]'),this.transitioning=null,this.options.parent?this.$parent=this.getParent():this.addAriaAndCollapsedClass(this.$element,this.$trigger),this.options.toggle&&this.toggle()};d.V
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 74 79 70 65 2e 68 69 64 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 74 68 69 73 2e 74 72 61 6e 73 69 74 69 6f 6e 69 6e 67 26 26 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 68 61 73 43 6c 61 73 73 28 22 69 6e 22 29 29 7b 76 61 72 20 62 3d 61 2e 45 76 65 6e 74 28 22 68 69 64 65 2e 62 73 2e 63 6f 6c 6c 61 70 73 65 22 29 3b 69 66 28 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 74 72 69 67 67 65 72 28 62 29 2c 21 62 2e 69 73 44 65 66 61 75 6c 74 50 72 65 76 65 6e 74 65 64 28 29 29 7b 76 61 72 20 63 3d 74 68 69 73 2e 64 69 6d 65 6e 73 69 6f 6e 28 29 3b 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 5b 63 5d 28 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 5b 63 5d 28 29 29 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 2c 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 61 64 64 Data Ascii: type.hide=function(){if(!this.transitioning&&this.$element.hasClass("in")){var b=a.Event("hide.bs.collapse");if(this.$element.trigger(b),!b.isDefaultPrevented()){var c=this.dimension();this.$element[c](this.$element[c]())[0].offsetHeight,this.$element.add
2024-03-11 12:04:55 UTC	1369	IN	Data Raw: 20 65 3d 61 28 74 68 69 73 29 3b 65 2e 61 74 74 72 28 22 64 61 74 61 2d 74 61 72 67 65 74 22 29 7c 7c 64 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 76 61 72 20 66 3d 62 28 65 29 2c 67 3d 66 2e 64 61 74 61 28 22 62 73 2e 63 6f 6c 6c 61 70 73 65 22 29 2c 68 3d 67 3f 22 74 6f 67 67 6c 65 22 3a 65 2e 64 61 74 61 28 29 3b 63 2e 63 61 6c 6c 28 66 2c 68 29 7d 29 7d 28 6a 51 75 65 72 79 29 2c 2b 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 76 61 72 20 63 3d 62 2e 61 74 74 72 28 22 64 61 74 61 2d 74 61 72 67 65 74 22 29 3b 63 7c 7c 28 63 3d 62 2e 61 74 74 72 28 22 68 72 65 66 22 29 2c 63 3d 63 26 26 2f 23 5b 41 2d 5a 61 2d 7a 5d 2f 2e 74 65 73 74 28 63 29 26 26 63 2e 72 65 70 6c 61 Data Ascii: e=a(this);e.attr("data-target")\|\|d.preventDefault();var f=b(e),g=f.data("bs.collapse"),h=g?"toggle":e.data();c.call(f,h)})}(jQuery),+function(a){"use strict";function b(b){var c=b.attr("data-target");c\|\|(c=b.attr("href"),c=c&&/#[A-Za-z]/.test(c)&&c.repla

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:54 UTC	569	OUT	GET /jquery-3.2.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://link.edgepilot.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://link.edgepilot.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:55 UTC	568	IN	HTTP/1.1 200 OK Connection: close Content-Length: 86659 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15283" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Mon, 11 Mar 2024 12:04:55 GMT Age: 2178294 X-Served-By: cache-lga21971-LGA, cache-lax-kwhp1940033-LAX X-Cache: HIT, HIT X-Cache-Hits: 760, 1 X-Timer: S1710158695.059182,VS0,VE1 Vary: Accept-Encoding
2024-03-11 12:04:55 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 32 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.2.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery
2024-03-11 12:04:55 UTC	1378	IN	Data Raw: 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 63 3e 3d 30 26 26 63 3c 62 3f 5b 74 68 69 73 5b 63 5d 5d 3a 5b 5d 29 7d 2c 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 7c 7c 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7d 2c 70 75 73 68 3a 68 2c 73 6f 72 74 3a 63 2e 73 6f 72 74 2c 73 70 6c 69 63 65 3a 63 2e 73 70 6c 69 63 65 7d 2c 72 2e 65 78 74 65 6e 64 3d 72 2e 66 6e 2e 65 78 74 65 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 7c 7c 7b 7d 2c 68 3d 31 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6a 3d 21 31 3b 66 6f 72 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 Data Ascii: rn this.pushStack(c>=0&&c<b?[this[c]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:h,sort:c.sort,splice:c.splice},r.extend=r.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]\|\|{},h=1,i=arguments.length,j=!1;for("boolean"==typeof
2024-03-11 12:04:55 UTC	1378	IN	Data Raw: 63 2c 64 3d 30 3b 69 66 28 77 28 61 29 29 7b 66 6f 72 28 63 3d 61 2e 6c 65 6e 67 74 68 3b 64 3c 63 3b 64 2b 2b 29 69 66 28 62 2e 63 61 6c 6c 28 61 5b 64 5d 2c 64 2c 61 5b 64 5d 29 3d 3d 3d 21 31 29 62 72 65 61 6b 7d 65 6c 73 65 20 66 6f 72 28 64 20 69 6e 20 61 29 69 66 28 62 2e 63 61 6c 6c 28 61 5b 64 5d 2c 64 2c 61 5b 64 5d 29 3d 3d 3d 21 31 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 61 7d 2c 74 72 69 6d 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 22 22 3a 28 61 2b 22 22 29 2e 72 65 70 6c 61 63 65 28 73 2c 22 22 29 7d 2c 6d 61 6b 65 41 72 72 61 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 62 7c 7c 5b 5d 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 61 26 26 28 77 28 4f 62 6a 65 63 74 28 61 29 29 3f Data Ascii: c,d=0;if(w(a)){for(c=a.length;d<c;d++)if(b.call(a[d],d,a[d])===!1)break}else for(d in a)if(b.call(a[d],d,a[d])===!1)break;return a},trim:function(a){return null==a?"":(a+"").replace(s,"")},makeArray:function(a,b){var c=b\|\|[];return null!=a&&(w(Object(a))?
2024-03-11 12:04:55 UTC	1378	IN	Data Raw: 2c 65 2c 66 2c 67 2c 68 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 2c 70 2c 71 2c 72 2c 73 2c 74 2c 75 3d 22 73 69 7a 7a 6c 65 22 2b 31 2a 6e 65 77 20 44 61 74 65 2c 76 3d 61 2e 64 6f 63 75 6d 65 6e 74 2c 77 3d 30 2c 78 3d 30 2c 79 3d 68 61 28 29 2c 7a 3d 68 61 28 29 2c 41 3d 68 61 28 29 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 3d 3d 3d 62 26 26 28 6c 3d 21 30 29 2c 30 7d 2c 43 3d 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 44 3d 5b 5d 2c 45 3d 44 2e 70 6f 70 2c 46 3d 44 2e 70 75 73 68 2c 47 3d 44 2e 70 75 73 68 2c 48 3d 44 2e 73 6c 69 63 65 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 30 2c 64 3d 61 2e 6c 65 6e 67 74 68 3b 63 3c 64 3b 63 2b 2b 29 69 66 28 61 5b 63 5d 3d 3d 3d Data Ascii: ,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u="sizzle"+1*new Date,v=a.document,w=0,x=0,y=ha(),z=ha(),A=ha(),B=function(a,b){return a===b&&(l=!0),0},C={}.hasOwnProperty,D=[],E=D.pop,F=D.push,G=D.push,H=D.slice,I=function(a,b){for(var c=0,d=a.length;c<d;c++)if(a[c]===
2024-03-11 12:04:55 UTC	1378	IN	Data Raw: 2b 22 2a 5c 5c 29 7c 29 28 3f 3d 5b 5e 2d 5d 7c 24 29 22 2c 22 69 22 29 7d 2c 57 3d 2f 5e 28 3f 3a 69 6e 70 75 74 7c 73 65 6c 65 63 74 7c 74 65 78 74 61 72 65 61 7c 62 75 74 74 6f 6e 29 24 2f 69 2c 58 3d 2f 5e 68 5c 64 24 2f 69 2c 59 3d 2f 5e 5b 5e 7b 5d 2b 5c 7b 5c 73 2a 5c 5b 6e 61 74 69 76 65 20 5c 77 2f 2c 5a 3d 2f 5e 28 3f 3a 23 28 5b 5c 77 2d 5d 2b 29 7c 28 5c 77 2b 29 7c 5c 2e 28 5b 5c 77 2d 5d 2b 29 29 24 2f 2c 24 3d 2f 5b 2b 7e 5d 2f 2c 5f 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 28 5b 5c 5c 64 61 2d 66 5d 7b 31 2c 36 7d 22 2b 4b 2b 22 3f 7c 28 22 2b 4b 2b 22 29 7c 2e 29 22 2c 22 69 67 22 29 2c 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 22 30 78 22 2b 62 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 64 21 3d Data Ascii: +"\\)\|)(?=[^-]\|$)","i")},W=/^(?:input\|select\|textarea\|button)$/i,X=/^h\d$/i,Y=/^[^{]+\{\s\[native \w/,Z=/^(?:#([\w-]+)\|(\w+)\|\.([\w-]+))$/,$=/[+~]/,_=new RegExp("\\\\([\\da-f]{1,6}"+K+"?\|("+K+")\|.)","ig"),aa=function(a,b,c){var d="0x"+b-65536;return d!=
2024-03-11 12:04:55 UTC	1378	IN	Data Raw: 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 66 29 29 2c 64 7d 69 66 28 63 2e 71 73 61 26 26 21 41 5b 61 2b 22 20 22 5d 26 26 28 21 71 7c 7c 21 71 2e 74 65 73 74 28 61 29 29 29 7b 69 66 28 31 21 3d 3d 77 29 73 3d 62 2c 72 3d 61 3b 65 6c 73 65 20 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7b 28 6b 3d 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 6b 3d 6b 2e 72 65 70 6c 61 63 65 28 62 61 2c 63 61 29 3a 62 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 6b 3d 75 29 2c 6f 3d 67 28 61 29 2c 68 3d 6f 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 68 2d 2d 29 6f 5b 68 5d 3d 22 23 22 2b 6b 2b 22 20 22 2b 73 61 28 6f 5b 68 5d 29 3b 72 3d 6f 2e 6a 6f 69 6e 28 Data Ascii: ementsByClassName(f)),d}if(c.qsa&&!A[a+" "]&&(!q\|\|!q.test(a))){if(1!==w)s=b,r=a;else if("object"!==b.nodeName.toLowerCase()){(k=b.getAttribute("id"))?k=k.replace(ba,ca):b.setAttribute("id",k=u),o=g(a),h=o.length;while(h--)o[h]="#"+k+" "+sa(o[h]);r=o.join(
2024-03-11 12:04:55 UTC	1378	IN	Data Raw: 73 61 62 6c 65 64 3d 3d 3d 61 3a 22 6c 61 62 65 6c 22 69 6e 20 62 26 26 62 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 61 28 61 29 7b 72 65 74 75 72 6e 20 69 61 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 3d 2b 62 2c 69 61 28 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 76 61 72 20 65 2c 66 3d 61 28 5b 5d 2c 63 2e 6c 65 6e 67 74 68 2c 62 29 2c 67 3d 66 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 67 2d 2d 29 63 5b 65 3d 66 5b 67 5d 5d 26 26 28 63 5b 65 5d 3d 21 28 64 5b 65 5d 3d 63 5b 65 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 71 61 28 61 29 7b 72 65 74 75 72 6e 20 61 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 61 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 Data Ascii: sabled===a:"label"in b&&b.disabled===a}}function pa(a){return ia(function(b){return b=+b,ia(function(c,d){var e,f=a([],c.length,b),g=f.length;while(g--)c[e=f[g]]&&(c[e]=!(d[e]=c[e]))})})}function qa(a){return a&&"undefined"!=typeof a.getElementsByTagName&
2024-03-11 12:04:55 UTC	1378	IN	Data Raw: 64 22 29 3b 72 65 74 75 72 6e 20 63 26 26 63 2e 76 61 6c 75 65 3d 3d 3d 62 7d 7d 2c 64 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 70 29 7b 76 61 72 20 63 2c 64 2c 65 2c 66 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 3b 69 66 28 66 29 7b 69 66 28 63 3d 66 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 2c 63 26 26 63 2e 76 61 6c 75 65 3d 3d 3d 61 29 72 65 74 75 72 6e 5b 66 5d 3b 65 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 61 29 2c 64 3d 30 3b 77 68 69 6c 65 28 66 3d 65 5b 64 2b 2b 5d 29 69 66 28 63 3d 66 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 Data Ascii: d");return c&&c.value===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c,d,e,f=b.getElementById(a);if(f){if(c=f.getAttributeNode("id"),c&&c.value===a)return[f];e=b.getElementsByName(a),d=0;while(f=e[d++])if(c=f.getAttributeNod
2024-03-11 12:04:55 UTC	1378	IN	Data Raw: 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 3b 62 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 2c 22 68 69 64 64 65 6e 22 29 2c 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 62 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 2c 22 44 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6e 61 6d 65 3d 64 5d 22 29 2e 6c 65 6e 67 74 68 26 26 71 2e 70 75 73 68 28 22 6e 61 6d 65 22 2b 4b 2b 22 2a 5b 2a 5e 24 7c 21 7e 5d 3f 3d 22 29 2c 32 21 3d 3d 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 65 6e 61 62 6c 65 64 22 29 2e 6c 65 6e 67 74 68 26 26 71 2e 70 75 73 68 28 22 3a 65 6e 61 62 6c 65 64 22 2c 22 3a 64 69 73 61 62 6c 65 64 22 29 2c 6f 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 2e 64 69 Data Ascii: eElement("input");b.setAttribute("type","hidden"),a.appendChild(b).setAttribute("name","D"),a.querySelectorAll("[name=d]").length&&q.push("name"+K+"[^$\|!~]?="),2!==a.querySelectorAll(":enabled").length&&q.push(":enabled",":disabled"),o.appendChild(a).di
2024-03-11 12:04:55 UTC	1378	IN	Data Raw: 20 6c 3d 21 30 2c 30 3b 76 61 72 20 63 2c 64 3d 30 2c 65 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 66 3d 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 67 3d 5b 61 5d 2c 68 3d 5b 62 5d 3b 69 66 28 21 65 7c 7c 21 66 29 72 65 74 75 72 6e 20 61 3d 3d 3d 6e 3f 2d 31 3a 62 3d 3d 3d 6e 3f 31 3a 65 3f 2d 31 3a 66 3f 31 3a 6b 3f 49 28 6b 2c 61 29 2d 49 28 6b 2c 62 29 3a 30 3b 69 66 28 65 3d 3d 3d 66 29 72 65 74 75 72 6e 20 6c 61 28 61 2c 62 29 3b 63 3d 61 3b 77 68 69 6c 65 28 63 3d 63 2e 70 61 72 65 6e 74 4e 6f 64 65 29 67 2e 75 6e 73 68 69 66 74 28 63 29 3b 63 3d 62 3b 77 68 69 6c 65 28 63 3d 63 2e 70 61 72 65 6e 74 4e 6f 64 65 29 68 2e 75 6e 73 68 69 66 74 28 63 29 3b 77 68 69 6c 65 28 67 5b 64 5d 3d 3d 3d 68 5b 64 5d 29 64 2b 2b 3b 72 65 74 75 72 6e 20 64 3f 6c 61 28 Data Ascii: l=!0,0;var c,d=0,e=a.parentNode,f=b.parentNode,g=[a],h=[b];if(!e\|\|!f)return a===n?-1:b===n?1:e?-1:f?1:k?I(k,a)-I(k,b):0;if(e===f)return la(a,b);c=a;while(c=c.parentNode)g.unshift(c);c=b;while(c=c.parentNode)h.unshift(c);while(g[d]===h[d])d++;return d?la(

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:55 UTC	733	OUT	GET /favicon.ico HTTP/1.1 Host: link.edgepilot.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://link.edgepilot.com/s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:56 UTC	177	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Mar 2024 12:04:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1310 Connection: close Cache-Control: no-cache
2024-03-11 12:04:56 UTC	1310	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 61 70 70 2e 63 73 73 3f 76 3d 31 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f 6f Data Ascii: <html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1" /> <title>404 - page not found</title> <link href="/css/app.css?v=1" rel="stylesheet"> <link href="//maxcdn.bootstrapcdn.com/boo

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:56 UTC	966	OUT	POST /filter HTTP/1.1 Host: link.edgepilot.com Connection: keep-alive Content-Length: 351 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://link.edgepilot.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://link.edgepilot.com/s/e5bfd306/GNd1eJTCNEmSEHo2ufWwoA?u=http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697%26PA=2445527%26HTML=https://derekcotton.com/htaccess Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:56 UTC	351	OUT	Data Raw: 64 69 67 65 73 74 3d 65 35 62 66 64 33 30 36 26 69 64 3d 47 4e 64 31 65 4a 54 43 4e 45 6d 53 45 48 6f 32 75 66 57 77 6f 41 26 78 66 77 64 3d 31 35 34 2e 31 36 2e 31 30 35 2e 33 38 26 75 61 67 65 6e 74 3d 4d 6f 7a 69 6c 6c 61 25 32 46 35 2e 30 2b 25 32 38 57 69 6e 64 6f 77 73 2b 4e 54 2b 31 30 2e 30 25 33 42 2b 57 69 6e 36 34 25 33 42 2b 78 36 34 25 32 39 2b 41 70 70 6c 65 57 65 62 4b 69 74 25 32 46 35 33 37 2e 33 36 2b 25 32 38 4b 48 54 4d 4c 25 32 43 2b 6c 69 6b 65 2b 47 65 63 6b 6f 25 32 39 2b 43 68 72 6f 6d 65 25 32 46 31 31 37 2e 30 2e 30 2e 30 2b 53 61 66 61 72 69 25 32 46 35 33 37 2e 33 36 26 70 61 74 68 3d 73 26 75 72 6c 3d 61 48 52 30 63 44 6f 76 4c 33 4a 6c 5a 6d 56 79 4c 6d 4e 6a 59 6d 6c 73 62 43 35 6a 62 32 30 76 59 32 64 70 4c 57 4a 70 62 69 Data Ascii: digest=e5bfd306&id=GNd1eJTCNEmSEHo2ufWwoA&xfwd=154.16.105.38&uagent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F117.0.0.0+Safari%2F537.36&path=s&url=aHR0cDovL3JlZmVyLmNjYmlsbC5jb20vY2dpLWJpbi
2024-03-11 12:04:57 UTC	259	IN	HTTP/1.1 302 Found Server: nginx Date: Mon, 11 Mar 2024 12:04:57 GMT Transfer-Encoding: chunked Connection: close Location: http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=933697&PA=2445527&HTML=https://derekcotton.com/htaccess Cache-Control: no-cache
2024-03-11 12:04:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:57 UTC	699	OUT	GET /htaccess?CA=933697&PA=2445527 HTTP/1.1 Host: derekcotton.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:58 UTC	238	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Mar 2024 12:04:58 GMT Server: Apache Location: https://derekcotton.com/htaccess/?CA=933697&PA=2445527 Content-Length: 266 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-03-11 12:04:58 UTC	266	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 72 65 6b 63 6f 74 74 6f 6e 2e 63 6f 6d 2f 68 74 61 63 63 65 73 73 2f 3f 43 41 3d 39 33 33 36 39 37 26 61 6d 70 3b 50 41 3d 32 34 34 35 35 32 37 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://derekcotton.com/htaccess/?CA=933697&PA=2445527">here</a>.</p></bo

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:58 UTC	700	OUT	GET /htaccess/?CA=933697&PA=2445527 HTTP/1.1 Host: derekcotton.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:04:59 UTC	263	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 12:04:59 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 30 Sep 2022 16:13:41 GMT Accept-Ranges: bytes Content-Length: 17108 Vary: Accept-Encoding Content-Type: text/html
2024-03-11 12:04:59 UTC	7929	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head profile="http://gmpg.org/xfn/11"> <meta http-equiv="Content-Typ
2024-03-11 12:04:59 UTC	8000	IN	Data Raw: 75 6c 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 3c 73 74 72 6f 6e 67 3e 2d 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 69 72 73 74 22 3e 72 77 78 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 65 63 6f 6e 64 22 3e 72 2d 78 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 68 69 72 64 22 3e 72 2d 78 3c 2f 73 70 61 6e 3e 3c 2f 73 74 72 6f 6e 67 3e 20 61 20 72 65 67 75 6c 61 72 20 66 69 6c 65 20 77 68 6f 73 65 20 75 73 65 72 20 63 6c 61 73 73 20 68 61 73 20 66 75 6c 6c 20 70 65 72 6d 69 73 73 69 6f 6e 73 20 61 6e 64 20 77 68 6f 73 65 20 67 72 6f 75 70 20 61 6e 64 20 6f 74 68 65 72 73 20 63 6c 61 73 73 65 73 20 68 61 76 65 20 6f 6e 6c 79 20 74 68 65 20 72 65 61 64 20 61 6e 64 20 65 78 65 63 75 74 65 20 70 65 72 6d 69 73 73 69 Data Ascii: ul><li><strong>-<span class="first">rwx</span><span class="second">r-x</span><span class="third">r-x</span></strong> a regular file whose user class has full permissions and whose group and others classes have only the read and execute permissi
2024-03-11 12:04:59 UTC	1179	IN	Data Raw: 09 09 09 09 3c 68 34 3e 3c 75 3e 54 6f 20 45 64 69 74 20 74 68 65 20 50 65 72 6d 69 73 73 69 6f 6e 73 3c 2f 75 3e 3c 2f 68 34 3e 0a 09 09 09 09 09 09 09 09 3c 6f 6c 3e 0a 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 52 69 67 68 74 20 63 6c 69 63 6b 20 6f 6e 20 74 68 65 20 3c 73 74 72 6f 6e 67 3e 66 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 3c 2f 73 74 72 6f 6e 67 3e 20 61 6e 64 20 63 6c 69 63 6b 26 6e 62 73 70 3b 3c 73 74 72 6f 6e 67 3e 43 68 61 6e 67 65 20 50 65 72 6d 69 73 73 69 6f 6e 73 3c 2f 73 74 72 6f 6e 67 3e 20 66 72 6f 6d 20 74 68 65 20 6d 65 6e 75 2e 3c 2f 6c 69 3e 0a 09 09 09 09 09 09 09 09 09 3c 6c 69 3e 41 20 64 69 61 6c 6f 67 75 65 20 62 6f 78 20 73 68 6f 75 6c 64 20 61 70 70 65 61 72 20 61 6c 6c 6f 77 69 6e 67 20 79 6f 75 20 74 6f 20 73 65 Data Ascii: <h4><u>To Edit the Permissions</u></h4><ol><li>Right click on the <strong>file or directory</strong> and click <strong>Change Permissions</strong> from the menu.</li><li>A dialogue box should appear allowing you to se

Timestamp	Bytes transferred	Direction	Data
2024-03-11 12:04:59 UTC	616	OUT	GET /favicon.ico HTTP/1.1 Host: derekcotton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://derekcotton.com/htaccess/?CA=933697&PA=2445527 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-03-11 12:05:00 UTC	176	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 12:05:00 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Content-Length: 0 Content-Type: text/html; charset=UTF-8