Edit tour

Windows Analysis Report
https://r.mailing.campingcarpark.com/tr/cl/m2JPJkzPDbfL5s2bDabtlPRATYRQylIubPPupv_vc3kDzIWW2_TNYLb8YBmBuxxUamsx-FMq6iQDKP4aBiozKtmctIWJHvB_jMPMQCy2V9w9n7PdBiSom_VscfyxjRbqNIYqjqLTOUl5-9LarkHqAVm5L2wSo2oXxGVlFSK9ch7-9o3rO6zfaWOVTBYD4bj-cBh9D46nF7VLeW5JX646w9BMjGtwIbaonCu5pf0X8ov7yR1QFDHFtwW10C7XEoZag

Overview

General Information

Sample URL:	https://r.mailing.campingcarpark.com/tr/cl/m2JPJkzPDbfL5s2bDabtlPRATYRQylIubPPupv_vc3kDzIWW2_TNYLb8YBmBuxxUamsx-FMq6iQDKP4aBiozKtmctIWJHvB_jMPMQCy2V9w9n7PdBiSom_VscfyxjRbqNIYqjqLTOUl5-9LarkHqAVm5L2wSo
Analysis ID:	1548512
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected BlockedWebSite

Detected suspicious crossdomain redirect

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1356 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4856 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2516,i,6780448762081499821,3202721311829854477,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5608 --field-trial-handle=2516,i,6780448762081499821,3202721311829854477,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 --field-trial-handle=2516,i,6780448762081499821,3202721311829854477,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://r.mailing.campingcarpark.com/tr/cl/m2JPJkzPDbfL5s2bDabtlPRATYRQylIubPPupv_vc3kDzIWW2_TNYLb8YBmBuxxUamsx-FMq6iQDKP4aBiozKtmctIWJHvB_jMPMQCy2V9w9n7PdBiSom_VscfyxjRbqNIYqjqLTOUl5-9LarkHqAVm5L2wSo2oXxGVlFSK9ch7-9o3rO6zfaWOVTBYD4bj-cBh9D46nF7VLeW5JX646w9BMjGtwIbaonCu5pf0X8ov7yR1QFDHFtwW10C7XEoZag-1kPqsvroBYGdEMlwciu7AuBU1Y26NjgdB1vb4QnVOsIs_acQZJzGs0n3fybIY3bzcEJyP_Oy1jYqrav3I9lVVIjNjH0id0gdS4TbucLqy31-2RoRtZQc8bVuUs9GXZATyHwjK94EM9fKm3gaQ0u6Km4OhvabjJRJ1r26CvdUmHO1SK4HumQKUTUp8TXSmV-Stnpm_CGVl-UuJ0NvRq2I4Xw9uT__o0aJIGY71Xtr5Z7Y_et8YZZEgYR8N-C3PmDstWGdA9-IDO6X1D8sJVLEuj4ynD4q9-hO3nCsqHsDxKxs0cmE6rNpf8r-UvD1nXZ_a-VWCTi1NHu4b8MXaBheK-JZ2q5hHvkeAVzUdiXCOufUWyY-Ee97OlTdt1Y3IjIn0dj-CvUR17EtHIzPpKzFbJHJuSBA7gKlgbAXP5qj9Z9DYOs3fd4_dxBHDc4hFtPyERTdDEp75X34mcet-FOG2cCg6GELttByElL4HvrmfIJOs_BaLRaeRpYLsj2tIjMzr0T4OVWHBOW-Q1-iqoT_zCsmcuYUhzpgTIqTGpvB7QFG0i3ZF3aeteqWLx1NAZYNeYfLSsmOWLZWMqQuWpJNh5nxTAhUC-Ine_ExnFOYwfU5uvTSRkQ3WnzaJTik6lH8zjYuRq0R9zqImSml6gks4xbe9VZFCW-qtDzZihL-bjo2pnAM-z6PAC_JoDVrKTvQZZFhm5dMQTMyyNpmiJG_1gQ1xJxfcTrHmgDYLf" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
2.2.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

HTTP traffic detected: POST /report/v4?s=VN2itWIg%2FK7eSCzssAsd6dVURGZoK%2Fq%2FdLmytVHUr9h2p5fDlPpnDqmmLL%2FaoxOLELym02cvuLa0FjHtgDcXEY1eWmi0HzvVcQhu6bzOgTwrlSjVelUTm4IUKQqxP%2BbnMUkW HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 393Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 04 Nov 2024 14:31:04 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VN2itWIg%2FK7eSCzssAsd6dVURGZoK%2Fq%2FdLmytVHUr9h2p5fDlPpnDqmmLL%2FaoxOLELym02cvuLa0FjHtgDcXEY1eWmi0HzvVcQhu6bzOgTwrlSjVelUTm4IUKQqxP%2BbnMUkW"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8dd54e3b9b8547a5-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Nov 2024 14:31:09 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400Age: 1414Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u01LRUTFlSsL4cSSmSO3M2RK2JOSgJHcdoh4fXGLOjbjAiJMEg%2BFsnbisW%2FBpufryAylloLwkIuf3PJ6b4eIXe%2BGZY%2FIETfgsswg5fi1MOtY1Uw6fcbUEOtrGHbDzQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=17747&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2231&delivery_rate=163246&cwnd=251&unsent_bytes=0&cid=a0b379b41a26acba&ts=35&x=0"CF-Cache-Status: HITServer: cloudflareCF-RAY: 8dd54e5c6be1e7ff-DFWserver-timing: cfL4;desc="?proto=TCP&rtt=1308&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1173&delivery_rate=2172543&cwnd=251&unsent_bytes=0&cid=f0d1e087a1535567&ts=148&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Nov 2024 14:31:42 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: lznR34K+qktOtfpZMDIG66xHr41uubocCtc=$yKcdLO06py0WPryjServer: cloudflareCF-RAY: 8dd54f290afbe85b-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Nov 2024 14:31:47 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: crV0Bia8pabgFu8C1KekJFxh4MJbBA7EUKc=$7Ez+0/jery7GtBp7Server: cloudflareCF-RAY: 8dd54f487de36bd2-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Nov 2024 14:32:02 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: B+SYa+rZclroLDz/rBSzYanOfErvr9K7nag=$He4eLQ/yXpoYdHuJcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8dd54faa1c712cd5-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Mon, 04 Nov 2024 14:32:16 GMTserver: envoyContent-Length: 0strict-transport-security: max-age=31536000x-content-type-options: nosniffVia: HTTP/2 edgeproxy, 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/gsi/
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/gsi/button
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/gsi/fedcm.json
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/gsi/fedcmcsp?client_id=
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/gsi/iframe/select
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/gsi/log
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/gsi/revoke
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/gsi/select
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/gsi/status
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/gsi/style
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: chromecache_142.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/v2/auth
Source: chromecache_201.3.dr	String found in binary or memory: https://ad.doubleclick.net
Source: chromecache_202.3.dr, chromecache_130.3.dr, chromecache_218.3.dr, chromecache_201.3.dr	String found in binary or memory: https://ade.googlesyndication.com
Source: chromecache_201.3.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_200.3.dr	String found in binary or memory: https://api.usebutton.com
Source: chromecache_161.3.dr, chromecache_205.3.dr	String found in binary or memory: https://browser.sentry-cdn.com/6.19.7/bundle.min.js
Source: chromecache_203.3.dr, chromecache_179.3.dr, chromecache_202.3.dr, chromecache_130.3.dr, chromecache_125.3.dr, chromecache_218.3.dr, chromecache_201.3.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_200.3.dr	String found in binary or memory: https://cdn.usebutton.com/web-widgets/SmsCollectionV1.html
Source: chromecache_148.3.dr	String found in binary or memory: https://datadome.co
Source: chromecache_142.3.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/fedcm-migration
Source: chromecache_142.3.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/fedcm-migration?s=dc#cross_origin)
Source: chromecache_142.3.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/fedcm-migration?s=dc#display_moment
Source: chromecache_142.3.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/fedcm-migration?s=dc#skipped_moment
Source: chromecache_218.3.dr	String found in binary or memory: https://google.com
Source: chromecache_218.3.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_175.3.dr	String found in binary or memory: https://in-automate.brevo.com/cm?
Source: chromecache_212.3.dr	String found in binary or memory: https://lantern.roeye.com/track.php?
Source: chromecache_142.3.dr	String found in binary or memory: https://meet.google.com
Source: chromecache_142.3.dr	String found in binary or memory: https://oauth2.googleapis.com/revoke
Source: chromecache_201.3.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_203.3.dr, chromecache_179.3.dr, chromecache_202.3.dr, chromecache_130.3.dr, chromecache_125.3.dr, chromecache_218.3.dr, chromecache_201.3.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_217.3.dr	String found in binary or memory: https://protect.checkpoint.com/v2/r01/___http://email.mgb.modento.io/c/eJyczc9OwyAcwPGngdsI_wLswGHRV
Source: chromecache_130.3.dr, chromecache_218.3.dr	String found in binary or memory: https://s.pinimg.com/ct/core.js
Source: chromecache_217.3.dr	String found in binary or memory: https://sibautomation.com/cm.html?id=1126544#message_id=1acd5ab2-3c31-4981-b663-40c30c74a15e&tra
Source: chromecache_125.3.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_203.3.dr, chromecache_179.3.dr, chromecache_202.3.dr, chromecache_130.3.dr, chromecache_125.3.dr, chromecache_218.3.dr, chromecache_201.3.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_200.3.dr	String found in binary or memory: https://web.usebutton.com
Source: chromecache_162.3.dr, chromecache_215.3.dr	String found in binary or memory: https://www.etsy.com/ac/evergreenVendor/js/en-US/app-shell/globals/index.48ddbc2ae6190511f40d.js.LIC
Source: chromecache_188.3.dr, chromecache_208.3.dr	String found in binary or memory: https://www.etsy.com/ac/evergreenVendor/js/en-US/etsy_libs.6f2bc648a336d3e52761.js.LICENSE
Source: chromecache_214.3.dr, chromecache_181.3.dr	String found in binary or memory: https://www.etsy.com/ac/evergreenVendor/js/en-US/vendor_bundle.051a2557fd322e046abd.js.LICENSE
Source: chromecache_158.3.dr	String found in binary or memory: https://www.etsy.com/ac/evergreenVendor/js/en-US/vesta_homepage/bootstrap.aece6bab7a7b8083d5cc.js.LI
Source: chromecache_162.3.dr, chromecache_215.3.dr	String found in binary or memory: https://www.etsy.com/sourcemaps/evergreenVendor/en-US/app-shell/globals/index.48ddbc2ae6190511f40d.j
Source: chromecache_118.3.dr, chromecache_189.3.dr	String found in binary or memory: https://www.etsy.com/sourcemaps/evergreenVendor/en-US/async/common-entrypoints/auto/
Source: chromecache_188.3.dr, chromecache_208.3.dr	String found in binary or memory: https://www.etsy.com/sourcemaps/evergreenVendor/en-US/etsy_libs.6f2bc648a336d3e52761.js.map
Source: chromecache_214.3.dr	String found in binary or memory: https://www.etsy.com/sourcemaps/evergreenVendor/en-US/vendor_bundle.051a2557fd322e046abd.js.map
Source: chromecache_158.3.dr	String found in binary or memory: https://www.etsy.com/sourcemaps/evergreenVendor/en-US/vesta_homepage/bootstrap.aece6bab7a7b8083d5cc.
Source: chromecache_140.3.dr, chromecache_126.3.dr	String found in binary or memory: https://www.etsy.com/sourcemaps/evergreenVendor/en-US/vesta_homepage/search_bubbles.a18c2a5238135251
Source: chromecache_201.3.dr	String found in binary or memory: https://www.google.com
Source: chromecache_218.3.dr, chromecache_201.3.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_201.3.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_203.3.dr, chromecache_179.3.dr, chromecache_130.3.dr, chromecache_125.3.dr, chromecache_218.3.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_202.3.dr, chromecache_130.3.dr, chromecache_218.3.dr, chromecache_201.3.dr	String found in binary or memory: https://www.googletagmanager.com/dclk/ns/v1.js
Source: chromecache_203.3.dr, chromecache_179.3.dr, chromecache_130.3.dr, chromecache_125.3.dr, chromecache_218.3.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_125.3.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_125.3.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860

Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.7:49869 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@31/175@148/51

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2516,i,6780448762081499821,3202721311829854477,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://r.mailing.campingcarpark.com/tr/cl/m2JPJkzPDbfL5s2bDabtlPRATYRQylIubPPupv_vc3kDzIWW2_TNYLb8YBmBuxxUamsx-FMq6iQDKP4aBiozKtmctIWJHvB_jMPMQCy2V9w9n7PdBiSom_VscfyxjRbqNIYqjqLTOUl5-9LarkHqAVm5L2wSo2oXxGVlFSK9ch7-9o3rO6zfaWOVTBYD4bj-cBh9D46nF7VLeW5JX646w9BMjGtwIbaonCu5pf0X8ov7yR1QFDHFtwW10C7XEoZag-1kPqsvroBYGdEMlwciu7AuBU1Y26NjgdB1vb4QnVOsIs_acQZJzGs0n3fybIY3bzcEJyP_Oy1jYqrav3I9lVVIjNjH0id0gdS4TbucLqy31-2RoRtZQc8bVuUs9GXZATyHwjK94EM9fKm3gaQ0u6Km4OhvabjJRJ1r26CvdUmHO1SK4HumQKUTUp8TXSmV-Stnpm_CGVl-UuJ0NvRq2I4Xw9uT__o0aJIGY71Xtr5Z7Y_et8YZZEgYR8N-C3PmDstWGdA9-IDO6X1D8sJVLEuj4ynD4q9-hO3nCsqHsDxKxs0cmE6rNpf8r-UvD1nXZ_a-VWCTi1NHu4b8MXaBheK-JZ2q5hHvkeAVzUdiXCOufUWyY-Ee97OlTdt1Y3IjIn0dj-CvUR17EtHIzPpKzFbJHJuSBA7gKlgbAXP5qj9Z9DYOs3fd4_dxBHDc4hFtPyERTdDEp75X34mcet-FOG2cCg6GELttByElL4HvrmfIJOs_BaLRaeRpYLsj2tIjMzr0T4OVWHBOW-Q1-iqoT_zCsmcuYUhzpgTIqTGpvB7QFG0i3ZF3aeteqWLx1NAZYNeYfLSsmOWLZWMqQuWpJNh5nxTAhUC-Ine_ExnFOYwfU5uvTSRkQ3WnzaJTik6lH8zjYuRq0R9zqImSml6gks4xbe9VZFCW-qtDzZihL-bjo2pnAM-z6PAC_JoDVrKTvQZZFhm5dMQTMyyNpmiJG_1gQ1xJxfcTrHmgDYLf"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5608 --field-trial-handle=2516,i,6780448762081499821,3202721311829854477,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 --field-trial-handle=2516,i,6780448762081499821,3202721311829854477,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2516,i,6780448762081499821,3202721311829854477,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5608 --field-trial-handle=2516,i,6780448762081499821,3202721311829854477,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 --field-trial-handle=2516,i,6780448762081499821,3202721311829854477,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://r.mailing.campingcarpark.com/tr/cl/m2JPJkzPDbfL5s2bDabtlPRATYRQylIubPPupv_vc3kDzIWW2_TNYLb8YBmBuxxUamsx-FMq6iQDKP4aBiozKtmctIWJHvB_jMPMQCy2V9w9n7PdBiSom_VscfyxjRbqNIYqjqLTOUl5-9LarkHqAVm5L2wSo2oXxGVlFSK9ch7-9o3rO6zfaWOVTBYD4bj-cBh9D46nF7VLeW5JX646w9BMjGtwIbaonCu5pf0X8ov7yR1QFDHFtwW10C7XEoZag-1kPqsvroBYGdEMlwciu7AuBU1Y26NjgdB1vb4QnVOsIs_acQZJzGs0n3fybIY3bzcEJyP_Oy1jYqrav3I9lVVIjNjH0id0gdS4TbucLqy31-2RoRtZQc8bVuUs9GXZATyHwjK94EM9fKm3gaQ0u6Km4OhvabjJRJ1r26CvdUmHO1SK4HumQKUTUp8TXSmV-Stnpm_CGVl-UuJ0NvRq2I4Xw9uT__o0aJIGY71Xtr5Z7Y_et8YZZEgYR8N-C3PmDstWGdA9-IDO6X1D8sJVLEuj4ynD4q9-hO3nCsqHsDxKxs0cmE6rNpf8r-UvD1nXZ_a-VWCTi1NHu4b8MXaBheK-JZ2q5hHvkeAVzUdiXCOufUWyY-Ee97OlTdt1Y3IjIn0dj-CvUR17EtHIzPpKzFbJHJuSBA7gKlgbAXP5qj9Z9DYOs3fd4_dxBHDc4hFtPyERTdDEp75X34mcet-FOG2cCg6GELttByElL4HvrmfIJOs_BaLRaeRpYLsj2tIjMzr0T4OVWHBOW-Q1-iqoT_zCsmcuYUhzpgTIqTGpvB7QFG0i3ZF3aeteqWLx1NAZYNeYfLSsmOWLZWMqQuWpJNh5nxTAhUC-Ine_ExnFOYwfU5uvTSRkQ3WnzaJTik6lH8zjYuRq0R9zqImSml6gks4xbe9VZFCW-qtDzZihL-bjo2pnAM-z6PAC_JoDVrKTvQZZFhm5dMQTMyyNpmiJG_1gQ1xJxfcTrHmgDYLf	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://www.etsy.com/api/v3/ajax/bespoke/public/neu/specs/submenu?log_performance_metrics=false&specs%5Bsubmenu%5D%5B%5D=Etsy%5CModules%5CCategoryNav%5CSpecs%5CDropdownCatNav%5CDropdownSubmenu&runtime_analysis=false	0%	Avira URL Cloud	safe
https://i.etsystatic.com/5492298/r/il/ed2a9a/3145324589/il_600x600.3145324589_3wgr.jpg	0%	Avira URL Cloud	safe
https://www.etsy.com/paula/v3/polyfill.min.js?etsy-v=v5&flags=gated&features=AbortController%2CDOMTokenList.prototype.@@iterator%2CDOMTokenList.prototype.forEach%2CIntersectionObserver%2CIntersectionObserverEntry%2CNodeList.prototype.@@iterator%2CNodeList.prototype.forEach%2CObject.preventExtensions%2CString.prototype.anchor%2CString.raw%2Cdefault%2Ces2015%2Ces2016%2Ces2017%2Ces2018%2Ces2019%2Ces2020%2Ces2021%2Ces2022%2Cfetch%2CgetComputedStyle%2CmatchMedia%2Cperformance.now	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8dd54f0f5e834774/1730730701083/2ETqZfMiqtnrcb7	0%	Avira URL Cloud	safe
https://www.etsy.com/include/tags.js	0%	Avira URL Cloud	safe
https://tags.w55c.net/rs?sccid=42750cde-94cb-5917-16a1-ad9d397f6889&scc=1&id=590f83e499a54109bd553d1e2ebaf867&t=marketing	0%	Avira URL Cloud	safe
https://www.facebook.com/tr?uuid=1730730723&id=297472060462208&ev=PageView&ud[em]=%27%27%22&fbp=undefined&fbc=undefined	0%	Avira URL Cloud	safe
https://sibautomation.com/cm.html?id=1126544	0%	Avira URL Cloud	safe
https://ct.pinterest.com/user/?event=pagevisit&ed=%7B%22event_id%22%3A%22eoX3zvf0ngQyyWulcNlBD5rK46_i.1730730722.listing_id_na%22%2C%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_category%22%3A%22%22%7D%5D%7D&tid=2612477536450&cb=1730737083031&dep=5%2CEVENT_TAGS_ABSENT	0%	Avira URL Cloud	safe
https://i.etsystatic.com/32676577/c/2135/2135/1/0/il/696fe6/5831106951/il_200x200.5831106951_ht9r.jpg	0%	Avira URL Cloud	safe
https://ct.pinterest.com/v3/?tid=2612477536450&pd=%7B%22np%22%3A%22gtm%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.etsy.com%2F%22%2C%22ref%22%3A%22https%3A%2F%2Fq1.hacquiret.com%2F%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%22be180668%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.134%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1730737083033	0%	Avira URL Cloud	safe
https://lantern.roeye.com/track.php?fingerprint=ca6fda2f-f6a2-467f-8d04-642df62c2a6a&referrer=https%3A%2F%2Fq1.hacquiret.com%2F&landingpage=https%3A%2F%2Fwww.etsy.com%2F&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&site=6220	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/bfrzc/0x4AAAAAAAxVRUtOLMxM3GEy/auto/fbE/normal/auto/	0%	Avira URL Cloud	safe
https://www.etsy.com/ac/evergreenVendor/js/en-US/vesta_homepage/bootstrap.aece6bab7a7b8083d5cc.js	0%	Avira URL Cloud	safe
https://q1.hacquiret.com/cdn-cgi/phish-bypass?atok=ZZqmsX62kUdKkcfOyMLU_A4LjCBfWu1iMC3mknP6lms-1730730664-0.0.1.1-%2Fo6Em07%2F	0%	Avira URL Cloud	safe
https://www.etsy.com/ac/evergreenVendor/js/en-US/etsy_libs.6f2bc648a336d3e52761.js	0%	Avira URL Cloud	safe
https://i.etsystatic.com/8505634/c/1538/1538/0/611/il/5b99c1/4275912553/il_600x600.4275912553_se3v.jpg	0%	Avira URL Cloud	safe
https://www.etsy.com/dac/site-chrome/components/components.fc26458b142737,contentful-sitewide-hum.af079ccbcc7694,site-chrome/header/header.8e80a77c9be49c,__modules__CategoryNav__src__/Views/ButtonMenu/Menu.8d961c48ba074a,__modules__CategoryNav__src__/Views/DropdownMenu/Menu.74cb1c37c4995e,site-chrome/footer/footer.749e5f4f4b2e8b,gdpr/settings-overlay.74cb1c37c4995e.css?variant=sasquatch	0%	Avira URL Cloud	safe
https://q1.hacquiret.com/cdn-cgi/images/icon-exclamation.png?1376755637	0%	Avira URL Cloud	safe
https://www.etsy.com/ac/evergreenVendor/js/en-US/app-shell/globals/index.48ddbc2ae6190511f40d.js	0%	Avira URL Cloud	safe
https://i.etsystatic.com/25168585/c/1800/1800/298/0/il/e0da11/5460954945/il_300x300.5460954945_9tu4.jpg	0%	Avira URL Cloud	safe
https://i.etsystatic.com/16469007/c/1440/1440/0/239/il/7a83a2/2644416465/il_300x300.2644416465_5xjj.jpg	0%	Avira URL Cloud	safe
https://www.etsy.com/ac/evergreenVendor/js/en-US/async/common-entrypoints/auto/@etsy-modules/CategoryNav/NavHandlers/CategoryNavigationLoader.12cd58e93e791b36f37b.js	0%	Avira URL Cloud	safe
https://i.etsystatic.com/12188102/r/il/e24ab7/6275743143/il_300x300.6275743143_souf.jpg	0%	Avira URL Cloud	safe
https://www.etsy.com/sourcemaps/evergreenVendor/en-US/app-shell/globals/index.48ddbc2ae6190511f40d.j	0%	Avira URL Cloud	safe
https://i.etsystatic.com/35518631/r/il/e1cf46/6200065849/il_300x300.6200065849_s06d.jpg	0%	Avira URL Cloud	safe
https://i.etsystatic.com/6627720/c/1583/1583/534/250/il/5aa4f5/5542606845/il_200x200.5542606845_c12g.jpg	0%	Avira URL Cloud	safe
https://protect.checkpoint.com/v2/r01/___http://email.mgb.modento.io/c/eJyczc9OwyAcwPGngdsI_wLswGHRV	0%	Avira URL Cloud	safe
https://i.etsystatic.com/23824347/r/il/67d7f1/5200553974/il_300x300.5200553974_4yjs.jpg	0%	Avira URL Cloud	safe
https://trkn.us/pixel/conv/ppt=8398;g=homepage;gid=34719;ord=1730730723?gtmcb=275011559;ip=173.254.250.69;cuidchk=1	0%	Avira URL Cloud	safe
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=8fc99b97-b692-4960-b0ef-8e467c62b766	0%	Avira URL Cloud	safe
https://www.etsy.com/sourcemaps/evergreenVendor/en-US/vesta_homepage/search_bubbles.a18c2a5238135251	0%	Avira URL Cloud	safe
https://i.etsystatic.com/16320228/c/2058/2058/0/0/il/4cda38/5716292512/il_300x300.5716292512_oipg.jpg	0%	Avira URL Cloud	safe
https://bypvdrkkavk9dmt5r8jijnan9nbp97wqmxftdyisrznohoudx0rfjaxi1itb.wovablepric.com/57304049078703001147470oQVGiJLPQZUMXTOMDPBQIPKWFKBDASWYRQCPQZ	100%	Avira URL Cloud	phishing
https://i.etsystatic.com/ij/91a8c0/6418872477/ij_680x540.6418872477_t4u03iyo.jpg?version=0	0%	Avira URL Cloud	safe
https://www.etsy.com/ac/evergreenVendor/js/en-US/async/common-entrypoints/auto/@etsy-modules/CategoryNav/Views/DropdownMenu/Menu.5c7ec203235cc6232225.js	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8dd54f0f5e834774&lang=auto	0%	Avira URL Cloud	safe
https://i.etsystatic.com/24426965/c/2261/2261/0/270/il/64732a/4144763037/il_300x300.4144763037_cm8c.jpg	0%	Avira URL Cloud	safe
https://i.etsystatic.com/8622539/r/il/d0e539/4178592230/il_300x300.4178592230_icjm.jpg	0%	Avira URL Cloud	safe
https://protect.checkpoint.com/v2/r01/___http://email.mgb.modento.io/c/eJyczc9OwyAcwPGngdsI_wLswGHRVQ_WxETPC4NfgayUSll9fWPiE-z-_eYTrPBBAAbLtKDCaKYlTtaFwCUc2aQDMC-lV8EbDlQfmVbSGJztGNV1Pr0xGm9P4byvz5_j8qpebry-S_M1_iBJS7ySUgMsvZJc8WxT7-uGxAnxAfHhg5Hk_Pc9N-jE14L4UNW5UI34gP-_Sw4PSM3mZapI0rXB5O49kQU67jY25-Hwl7n54B3utmWfLgW2zUXAu-W_AQAA__8P0lcP___.YzJ1OnJpZ2h0cHJvc3BlY3RzOmM6bzpiYTRjY2RlODRjNWI5ZGU4OWFmODBhYmExZmJiYzhmODo3OmNhZmY6YjM3MjY5MTVjMjI3MjA5ZjUxMTViZjk5MTBkZDE1MGFmZjMxOWJkMjIwMGQ4NzUyYWI0OWU3MTk3NDJiNmJjMjpoOlQ6Rg	0%	Avira URL Cloud	safe
https://www.etsy.com/ac/evergreenVendor/js/en-US/vesta_homepage/search_bubbles.a18c2a52381352511211.js	0%	Avira URL Cloud	safe
https://www.etsy.com/ac/evergreenVendor/js/en-US/app-shell/globals/index.48ddbc2ae6190511f40d.js.LIC	0%	Avira URL Cloud	safe
https://www.etsy.com/ac/evergreenVendor/js/en-US/vesta_homepage/bootstrap.aece6bab7a7b8083d5cc.js.LI	0%	Avira URL Cloud	safe
https://i.etsystatic.com/12990737/r/il/0831dc/5520749852/il_200x200.5520749852_d4jx.jpg	0%	Avira URL Cloud	safe
https://in-automate.brevo.com/cm?uuid=a01b8ec6-65c8-408f-9096-52614df799a9&key=y7c49dwuox4ledq4km82k9he&trans=1&message_id=1acd5ab2-3c31-4981-b663-40c30c74a15e	0%	Avira URL Cloud	safe
https://q1.hacquiret.com/cdn-cgi/styles/cf.errors.css	0%	Avira URL Cloud	safe
http://email.mgb.modento.io/c/eJyczc9OwyAcwPGngdsI_wLswGHRVQ_WxETPC4NfgayUSll9fWPiE-z-_eYTrPBBAAbLtKDCaKYlTtaFwCUc2aQDMC-lV8EbDlQfmVbSGJztGNV1Pr0xGm9P4byvz5_j8qpebry-S_M1_iBJS7ySUgMsvZJc8WxT7-uGxAnxAfHhg5Hk_Pc9N-jE14L4UNW5UI34gP-_Sw4PSM3mZapI0rXB5O49kQU67jY25-Hwl7n54B3utmWfLgW2zUXAu-W_AQAA__8P0lcP	0%	Avira URL Cloud	safe
https://www.etsy.com/bcn/beacon	0%	Avira URL Cloud	safe
https://www.etsy.com/sourcemaps/evergreenVendor/en-US/vesta_homepage/bootstrap.aece6bab7a7b8083d5cc.	0%	Avira URL Cloud	safe
https://i.etsystatic.com/18124409/r/il/88e6b9/5506996893/il_300x300.5506996893_km7m.jpg	0%	Avira URL Cloud	safe
https://js.sentry-cdn.com/ba12d66291e647788d8a9f0878043603.min.js	0%	Avira URL Cloud	safe
https://i.etsystatic.com/34379934/c/1298/1298/366/405/il/e1e190/5286845407/il_300x300.5286845407_o0hc.jpg	0%	Avira URL Cloud	safe
https://www.etsy.com/ac/evergreenVendor/js/en-US/etsy_libs.6f2bc648a336d3e52761.js.LICENSE	0%	Avira URL Cloud	safe
https://q1.hacquiret.com/favicon.ico	0%	Avira URL Cloud	safe
https://ct.pinterest.com/user/?tid=2612477536450&pd=%7B%22np%22%3A%22gtm%22%7D&cb=1730737083029&dep=2%2CPAGE_LOAD	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/514611508:1730727389:Dz1k9F8kNW2YGgx0fEBqTVDncbWMgBDCSeAQ4IHqUAs/8dd54f0f5e834774/5QY89wHxDNiiLZPgORNAJVOPl19bii1XFbenKrMK9go-1730730698-1.1.1.1-JZpQqTr54OTIVGgC_UtUq.i5po4sMaufKusssYjN40sbCc5yqZXbuY1hxm.RITkK	0%	Avira URL Cloud	safe
https://i.etsystatic.com/6627720/c/1312/1312/342/1054/il/7fe969/4398462229/il_200x200.4398462229_q4ks.jpg	0%	Avira URL Cloud	safe
https://sibautomation.com/cm.html?id=1126544#message_id=1acd5ab2-3c31-4981-b663-40c30c74a15e&tra	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
dart.l.doubleclick.net	142.250.186.166	true	false	unknown
lantern.roeyecdn.com	13.224.189.79	true	false	unknown
alb-ireland-ext-ingress-group-474278744.eu-west-1.elb.amazonaws.com	99.81.3.93	true	false	unknown
bypvdrkkavk9dmt5r8jijnan9nbp97wqmxftdyisrznohoudx0rfjaxi1itb.wovablepric.com	172.67.142.230	true	false	unknown
adservice.google.com	142.250.185.162	true	false	unknown
dg2iu7dxxehbo.cloudfront.net	18.172.103.101	true	false	unknown
stats.g.doubleclick.net	64.233.184.156	true	false	high
cdn.w55c.net	3.68.252.101	true	false	unknown
js.sentry-cdn.com	151.101.194.217	true	false	unknown
insight.adsrvr.org	3.33.220.150	true	false	unknown
r1.mailin.fr	1.179.112.197	true	false	unknown
code.jquery.com	151.101.130.137	true	false	unknown
q1.hacquiret.com	188.114.96.3	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	high
cdn.pdst.fm	35.244.142.80	true	false	unknown
www.google.com	216.58.206.36	true	false	high
sibautomation.com	172.64.148.115	true	false	unknown
edge-web.dual-gslb.spotify.com	35.186.224.24	true	false	unknown
d2pbcviywxotf2.cloudfront.net	143.204.215.118	true	false	unknown
star-mini.c10r.facebook.com	157.240.253.35	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
google.com	142.250.184.238	true	false	unknown
ax-0001.ax-dc-msedge.net	150.171.29.10	true	false	unknown
ad.doubleclick.net	142.250.186.70	true	false	unknown
web.btncdn.com	99.86.4.48	true	false	unknown
d2srg6h49ykvtq.cloudfront.net	18.239.69.42	true	false	unknown
ax-0001.ax-msedge.net	150.171.28.10	true	false	unknown
mailgun.org	34.102.239.211	true	false	unknown
pixel.streetmetrics.io	172.67.143.206	true	false	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
analytics-alv.google.com	216.239.32.181	true	false	unknown
prod.pinterest.global.map.fastly.net	151.101.192.84	true	false	unknown
in-automate.brevo.com	172.64.150.216	true	false	unknown
googleads.g.doubleclick.net	172.217.16.194	true	false	high
lantern.roeye.com	99.80.131.149	true	false	unknown
dualstack.pinterest.map.fastly.net	151.101.128.84	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	unknown
etsy.map.fastly.net	151.101.1.224	true	false	unknown
td.doubleclick.net	142.250.185.162	true	false	high
trkn.us	95.101.111.166	true	false	unknown
ib.anycast.adnxs.com	185.89.210.244	true	false	unknown
9910951.fls.doubleclick.net	unknown	unknown	false	unknown
ct.pinterest.com	unknown	unknown	false	high
r.mailing.campingcarpark.com	unknown	unknown	false	unknown
pt.ispot.tv	unknown	unknown	false	unknown
i.etsystatic.com	unknown	unknown	false	unknown
pixels.spotify.com	unknown	unknown	false	unknown
tags.w55c.net	unknown	unknown	false	unknown
www.facebook.com	unknown	unknown	false	high
js.adsrvr.org	unknown	unknown	false	high
www.dwin1.com	unknown	unknown	false	unknown
www.etsy.com	unknown	unknown	false	unknown
resources.xg4ken.com	unknown	unknown	false	unknown
8666735.fls.doubleclick.net	unknown	unknown	false	unknown
email.mgb.modento.io	unknown	unknown	false	unknown
protect.checkpoint.com	unknown	unknown	false	unknown
s.pinimg.com	unknown	unknown	false	high
analytics.tiktok.com	unknown	unknown	false	high
analytics.google.com	unknown	unknown	false	high
ib.adnxs.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://insight.adsrvr.org/track/conv/?adv=r09jr34&ct=0:ezyvggn&fmt=3	false		high
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://www.etsy.com/include/tags.js	false	Avira URL Cloud: safe	unknown
https://i.etsystatic.com/32676577/c/2135/2135/1/0/il/696fe6/5831106951/il_200x200.5831106951_ht9r.jpg	false	Avira URL Cloud: safe	unknown
https://ct.pinterest.com/user/?event=pagevisit&ed=%7B%22event_id%22%3A%22eoX3zvf0ngQyyWulcNlBD5rK46_i.1730730722.listing_id_na%22%2C%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_category%22%3A%22%22%7D%5D%7D&tid=2612477536450&cb=1730737083031&dep=5%2CEVENT_TAGS_ABSENT	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/api/v3/ajax/bespoke/public/neu/specs/submenu?log_performance_metrics=false&specs%5Bsubmenu%5D%5B%5D=Etsy%5CModules%5CCategoryNav%5CSpecs%5CDropdownCatNav%5CDropdownSubmenu&runtime_analysis=false	false	Avira URL Cloud: safe	unknown
https://tags.w55c.net/rs?sccid=42750cde-94cb-5917-16a1-ad9d397f6889&scc=1&id=590f83e499a54109bd553d1e2ebaf867&t=marketing	false	Avira URL Cloud: safe	unknown
https://sibautomation.com/cm.html?id=1126544	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/paula/v3/polyfill.min.js?etsy-v=v5&flags=gated&features=AbortController%2CDOMTokenList.prototype.@@iterator%2CDOMTokenList.prototype.forEach%2CIntersectionObserver%2CIntersectionObserverEntry%2CNodeList.prototype.@@iterator%2CNodeList.prototype.forEach%2CObject.preventExtensions%2CString.prototype.anchor%2CString.raw%2Cdefault%2Ces2015%2Ces2016%2Ces2017%2Ces2018%2Ces2019%2Ces2020%2Ces2021%2Ces2022%2Cfetch%2CgetComputedStyle%2CmatchMedia%2Cperformance.now	false	Avira URL Cloud: safe	unknown
https://i.etsystatic.com/5492298/r/il/ed2a9a/3145324589/il_600x600.3145324589_3wgr.jpg	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8dd54f0f5e834774/1730730701083/2ETqZfMiqtnrcb7	false	Avira URL Cloud: safe	unknown
https://www.facebook.com/tr?uuid=1730730723&id=297472060462208&ev=PageView&ud[em]=%27%27%22&fbp=undefined&fbc=undefined	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/ac/evergreenVendor/js/en-US/etsy_libs.6f2bc648a336d3e52761.js	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/dac/site-chrome/components/components.fc26458b142737,contentful-sitewide-hum.af079ccbcc7694,site-chrome/header/header.8e80a77c9be49c,__modules__CategoryNav__src__/Views/ButtonMenu/Menu.8d961c48ba074a,__modules__CategoryNav__src__/Views/DropdownMenu/Menu.74cb1c37c4995e,site-chrome/footer/footer.749e5f4f4b2e8b,gdpr/settings-overlay.74cb1c37c4995e.css?variant=sasquatch	false	Avira URL Cloud: safe	unknown
https://lantern.roeye.com/track.php?fingerprint=ca6fda2f-f6a2-467f-8d04-642df62c2a6a&referrer=https%3A%2F%2Fq1.hacquiret.com%2F&landingpage=https%3A%2F%2Fwww.etsy.com%2F&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&site=6220	false	Avira URL Cloud: safe	unknown
https://web.btncdn.com/v1/button.js	false		high
https://ct.pinterest.com/v3/?tid=2612477536450&pd=%7B%22np%22%3A%22gtm%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.etsy.com%2F%22%2C%22ref%22%3A%22https%3A%2F%2Fq1.hacquiret.com%2F%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%22be180668%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.134%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1730737083033	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/ac/evergreenVendor/js/en-US/vesta_homepage/bootstrap.aece6bab7a7b8083d5cc.js	false	Avira URL Cloud: safe	unknown
https://q1.hacquiret.com/cdn-cgi/phish-bypass?atok=ZZqmsX62kUdKkcfOyMLU_A4LjCBfWu1iMC3mknP6lms-1730730664-0.0.1.1-%2Fo6Em07%2F	false	Avira URL Cloud: safe	unknown
https://js.adsrvr.org/up_loader.1.1.0.js	false		high
https://www.etsy.com/assets/type/Graphik-Medium-Web.woff2	false		high
https://q1.hacquiret.com/cdn-cgi/images/icon-exclamation.png?1376755637	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/ac/evergreenVendor/js/en-US/app-shell/globals/index.48ddbc2ae6190511f40d.js	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/bfrzc/0x4AAAAAAAxVRUtOLMxM3GEy/auto/fbE/normal/auto/	false	Avira URL Cloud: safe	unknown
https://i.etsystatic.com/8505634/c/1538/1538/0/611/il/5b99c1/4275912553/il_600x600.4275912553_se3v.jpg	false	Avira URL Cloud: safe	unknown
https://i.etsystatic.com/25168585/c/1800/1800/298/0/il/e0da11/5460954945/il_300x300.5460954945_9tu4.jpg	false	Avira URL Cloud: safe	unknown
https://i.etsystatic.com/16469007/c/1440/1440/0/239/il/7a83a2/2644416465/il_300x300.2644416465_5xjj.jpg	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/assets/type/Guardian-EgypTT-Light.woff2	false		high
https://www.etsy.com/ac/evergreenVendor/js/en-US/async/common-entrypoints/auto/@etsy-modules/CategoryNav/NavHandlers/CategoryNavigationLoader.12cd58e93e791b36f37b.js	false	Avira URL Cloud: safe	unknown
https://insight.adsrvr.org/track/up?adv=r09jr34&ref=https%3A%2F%2Fwww.etsy.com%2F&upid=c6e9qnb&upv=1.1.0&paapi=1	false		high
https://i.etsystatic.com/12188102/r/il/e24ab7/6275743143/il_300x300.6275743143_souf.jpg	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://i.etsystatic.com/6627720/c/1583/1583/534/250/il/5aa4f5/5542606845/il_200x200.5542606845_c12g.jpg	false	Avira URL Cloud: safe	unknown
https://tags.w55c.net/rs?id=590f83e499a54109bd553d1e2ebaf867&t=marketing	false		high
https://i.etsystatic.com/35518631/r/il/e1cf46/6200065849/il_300x300.6200065849_s06d.jpg	false	Avira URL Cloud: safe	unknown
https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3B63-3EB	false		high
https://q1.hacquiret.com/o6Em07/#kmmurray@chemungcanal.com	false		unknown
https://i.etsystatic.com/23824347/r/il/67d7f1/5200553974/il_300x300.5200553974_4yjs.jpg	false	Avira URL Cloud: safe	unknown
https://trkn.us/pixel/conv/ppt=8398;g=homepage;gid=34719;ord=1730730723?gtmcb=275011559;ip=173.254.250.69;cuidchk=1	false	Avira URL Cloud: safe	unknown
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=8fc99b97-b692-4960-b0ef-8e467c62b766	false	Avira URL Cloud: safe	unknown
https://q1.hacquiret.com/o6Em07/	false		unknown
https://www.google.com/.well-known/web-identity	false		high
https://i.etsystatic.com/16320228/c/2058/2058/0/0/il/4cda38/5716292512/il_300x300.5716292512_oipg.jpg	false	Avira URL Cloud: safe	unknown
https://lantern.roeyecdn.com/lantern_global_6220.min.js	false		high
https://bypvdrkkavk9dmt5r8jijnan9nbp97wqmxftdyisrznohoudx0rfjaxi1itb.wovablepric.com/57304049078703001147470oQVGiJLPQZUMXTOMDPBQIPKWFKBDASWYRQCPQZ	false	Avira URL Cloud: phishing	unknown
https://i.etsystatic.com/ij/91a8c0/6418872477/ij_680x540.6418872477_t4u03iyo.jpg?version=0	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8dd54f0f5e834774&lang=auto	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/ac/evergreenVendor/js/en-US/async/common-entrypoints/auto/@etsy-modules/CategoryNav/Views/DropdownMenu/Menu.5c7ec203235cc6232225.js	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/ac/evergreenVendor/js/en-US/vendor_bundle.051a2557fd322e046abd.js	false		high
https://www.dwin1.com/6220.js	false		high
https://i.etsystatic.com/24426965/c/2261/2261/0/270/il/64732a/4144763037/il_300x300.4144763037_cm8c.jpg	false	Avira URL Cloud: safe	unknown
https://i.etsystatic.com/8622539/r/il/d0e539/4178592230/il_300x300.4178592230_icjm.jpg	false	Avira URL Cloud: safe	unknown
https://protect.checkpoint.com/v2/r01/___http://email.mgb.modento.io/c/eJyczc9OwyAcwPGngdsI_wLswGHRVQ_WxETPC4NfgayUSll9fWPiE-z-_eYTrPBBAAbLtKDCaKYlTtaFwCUc2aQDMC-lV8EbDlQfmVbSGJztGNV1Pr0xGm9P4byvz5_j8qpebry-S_M1_iBJS7ySUgMsvZJc8WxT7-uGxAnxAfHhg5Hk_Pc9N-jE14L4UNW5UI34gP-_Sw4PSM3mZapI0rXB5O49kQU67jY25-Hwl7n54B3utmWfLgW2zUXAu-W_AQAA__8P0lcP___.YzJ1OnJpZ2h0cHJvc3BlY3RzOmM6bzpiYTRjY2RlODRjNWI5ZGU4OWFmODBhYmExZmJiYzhmODo3OmNhZmY6YjM3MjY5MTVjMjI3MjA5ZjUxMTViZjk5MTBkZDE1MGFmZjMxOWJkMjIwMGQ4NzUyYWI0OWU3MTk3NDJiNmJjMjpoOlQ6Rg	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/ac/evergreenVendor/js/en-US/vesta_homepage/search_bubbles.a18c2a52381352511211.js	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://s.pinimg.com/ct/core.js	false		high
https://q1.hacquiret.com/cdn-cgi/styles/cf.errors.css	false	Avira URL Cloud: safe	unknown
https://in-automate.brevo.com/cm?uuid=a01b8ec6-65c8-408f-9096-52614df799a9&key=y7c49dwuox4ledq4km82k9he&trans=1&message_id=1acd5ab2-3c31-4981-b663-40c30c74a15e	false	Avira URL Cloud: safe	unknown
https://i.etsystatic.com/12990737/r/il/0831dc/5520749852/il_200x200.5520749852_d4jx.jpg	false	Avira URL Cloud: safe	unknown
https://pixel.streetmetrics.io/pixel/62f2e71d-3885-4822-ba89-6e017b2f1a1e	false		high
http://email.mgb.modento.io/c/eJyczc9OwyAcwPGngdsI_wLswGHRVQ_WxETPC4NfgayUSll9fWPiE-z-_eYTrPBBAAbLtKDCaKYlTtaFwCUc2aQDMC-lV8EbDlQfmVbSGJztGNV1Pr0xGm9P4byvz5_j8qpebry-S_M1_iBJS7ySUgMsvZJc8WxT7-uGxAnxAfHhg5Hk_Pc9N-jE14L4UNW5UI34gP-_Sw4PSM3mZapI0rXB5O49kQU67jY25-Hwl7n54B3utmWfLgW2zUXAu-W_AQAA__8P0lcP	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/bcn/beacon	false	Avira URL Cloud: safe	unknown
https://i.etsystatic.com/18124409/r/il/88e6b9/5506996893/il_300x300.5506996893_km7m.jpg	false	Avira URL Cloud: safe	unknown
https://js.sentry-cdn.com/ba12d66291e647788d8a9f0878043603.min.js	false	Avira URL Cloud: safe	unknown
https://i.etsystatic.com/34379934/c/1298/1298/366/405/il/e1e190/5286845407/il_300x300.5286845407_o0hc.jpg	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/site.webmanifest	false		high
https://q1.hacquiret.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/	false		high
https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js	false		high
https://cdn.pdst.fm/ping.min.js	false		high
https://ct.pinterest.com/user/?tid=2612477536450&pd=%7B%22np%22%3A%22gtm%22%7D&cb=1730737083029&dep=2%2CPAGE_LOAD	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/514611508:1730727389:Dz1k9F8kNW2YGgx0fEBqTVDncbWMgBDCSeAQ4IHqUAs/8dd54f0f5e834774/5QY89wHxDNiiLZPgORNAJVOPl19bii1XFbenKrMK9go-1730730698-1.1.1.1-JZpQqTr54OTIVGgC_UtUq.i5po4sMaufKusssYjN40sbCc5yqZXbuY1hxm.RITkK	false	Avira URL Cloud: safe	unknown
https://i.etsystatic.com/6627720/c/1312/1312/342/1054/il/7fe969/4398462229/il_200x200.4398462229_q4ks.jpg	false	Avira URL Cloud: safe	unknown
https://pixels.spotify.com/v1/ingest	false		high
https://www.etsy.com/assets/type/Graphik-Regular-Web.woff2	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_125.3.dr	false		high
https://developers.google.com/identity/gsi/web/guides/fedcm-migration?s=dc#skipped_moment	chromecache_142.3.dr	false		high
https://www.google.com	chromecache_201.3.dr	false		high
https://www.youtube.com/iframe_api	chromecache_125.3.dr	false		high
https://datadome.co	chromecache_148.3.dr	false		high
https://in-automate.brevo.com/cm?	chromecache_175.3.dr	false		high
https://www.etsy.com/sourcemaps/evergreenVendor/en-US/vendor_bundle.051a2557fd322e046abd.js.map	chromecache_214.3.dr	false		high
https://api.usebutton.com	chromecache_200.3.dr	false		high
https://lantern.roeye.com/track.php?	chromecache_212.3.dr	false		high
https://www.etsy.com/sourcemaps/evergreenVendor/en-US/app-shell/globals/index.48ddbc2ae6190511f40d.j	chromecache_162.3.dr, chromecache_215.3.dr	false	Avira URL Cloud: safe	unknown
https://browser.sentry-cdn.com/6.19.7/bundle.min.js	chromecache_161.3.dr, chromecache_205.3.dr	false		high
https://cct.google/taggy/agent.js	chromecache_203.3.dr, chromecache_179.3.dr, chromecache_202.3.dr, chromecache_130.3.dr, chromecache_125.3.dr, chromecache_218.3.dr, chromecache_201.3.dr	false		high
https://protect.checkpoint.com/v2/r01/___http://email.mgb.modento.io/c/eJyczc9OwyAcwPGngdsI_wLswGHRV	chromecache_217.3.dr	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/sourcemaps/evergreenVendor/en-US/vesta_homepage/search_bubbles.a18c2a5238135251	chromecache_140.3.dr, chromecache_126.3.dr	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/ac/evergreenVendor/js/en-US/app-shell/globals/index.48ddbc2ae6190511f40d.js.LIC	chromecache_162.3.dr, chromecache_215.3.dr	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/ac/evergreenVendor/js/en-US/vesta_homepage/bootstrap.aece6bab7a7b8083d5cc.js.LI	chromecache_158.3.dr	false	Avira URL Cloud: safe	unknown
https://developers.google.com/identity/gsi/web/guides/fedcm-migration	chromecache_142.3.dr	false		high
https://meet.google.com	chromecache_142.3.dr	false		high
https://cdn.usebutton.com/web-widgets/SmsCollectionV1.html	chromecache_200.3.dr	false		high
https://www.etsy.com/sourcemaps/evergreenVendor/en-US/vesta_homepage/bootstrap.aece6bab7a7b8083d5cc.	chromecache_158.3.dr	false	Avira URL Cloud: safe	unknown
https://www.etsy.com/ac/evergreenVendor/js/en-US/etsy_libs.6f2bc648a336d3e52761.js.LICENSE	chromecache_188.3.dr, chromecache_208.3.dr	false	Avira URL Cloud: safe	unknown
https://developers.google.com/identity/gsi/web/guides/fedcm-migration?s=dc#cross_origin)	chromecache_142.3.dr	false		high
https://web.usebutton.com	chromecache_200.3.dr	false		high
https://googleads.g.doubleclick.net	chromecache_218.3.dr	false		high
https://sibautomation.com/cm.html?id=1126544#message_id=1acd5ab2-3c31-4981-b663-40c30c74a15e&tra	chromecache_217.3.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
99.86.4.106	unknown	United States	16509	AMAZON-02US	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
99.86.4.48	web.btncdn.com	United States	16509	AMAZON-02US	false
151.101.128.84	dualstack.pinterest.map.fastly.net	United States	54113	FASTLYUS	false
142.250.186.70	ad.doubleclick.net	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
99.81.3.93	alb-ireland-ext-ingress-group-474278744.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
1.179.112.197	r1.mailin.fr	Australia	9723	ISEEK-AS-APiseekCommunicationsPtyLtdAU	false
142.250.184.230	unknown	United States	15169	GOOGLEUS	false
3.33.220.150	insight.adsrvr.org	United States	8987	AMAZONEXPANSIONGB	false
216.239.32.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
150.171.29.10	ax-0001.ax-dc-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.102.239.211	mailgun.org	United States	15169	GOOGLEUS	false
142.250.186.100	unknown	United States	15169	GOOGLEUS	false
157.240.253.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
142.250.184.238	google.com	United States	15169	GOOGLEUS	false
172.217.16.194	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false
143.204.215.118	d2pbcviywxotf2.cloudfront.net	United States	16509	AMAZON-02US	false
18.172.103.101	dg2iu7dxxehbo.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
13.224.189.79	lantern.roeyecdn.com	United States	16509	AMAZON-02US	false
64.233.184.156	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
172.67.143.206	pixel.streetmetrics.io	United States	13335	CLOUDFLARENETUS	false
151.101.194.217	js.sentry-cdn.com	United States	54113	FASTLYUS	false
142.250.185.164	unknown	United States	15169	GOOGLEUS	false
150.171.28.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.150.216	in-automate.brevo.com	United States	13335	CLOUDFLARENETUS	false
104.21.39.34	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
99.80.131.149	lantern.roeye.com	United States	16509	AMAZON-02US	false
151.101.1.224	etsy.map.fastly.net	United States	54113	FASTLYUS	false
3.68.252.101	cdn.w55c.net	United States	16509	AMAZON-02US	false
18.239.69.42	d2srg6h49ykvtq.cloudfront.net	United States	16509	AMAZON-02US	false
172.67.142.230	bypvdrkkavk9dmt5r8jijnan9nbp97wqmxftdyisrznohoudx0rfjaxi1itb.wovablepric.com	United States	13335	CLOUDFLARENETUS	false
151.101.65.224	unknown	United States	54113	FASTLYUS	false
35.186.224.24	edge-web.dual-gslb.spotify.com	United States	15169	GOOGLEUS	false
151.101.2.137	unknown	United States	54113	FASTLYUS	false
188.114.96.3	q1.hacquiret.com	European Union	13335	CLOUDFLARENETUS	false
172.64.148.115	sibautomation.com	United States	13335	CLOUDFLARENETUS	false
95.101.111.166	trkn.us	European Union	12956	TELEFONICATELXIUSES	false
35.244.142.80	cdn.pdst.fm	United States	15169	GOOGLEUS	false
142.250.186.166	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
143.204.215.5	unknown	United States	16509	AMAZON-02US	false
157.240.251.35	unknown	United States	32934	FACEBOOKUS	false

Private

IP
192.168.2.7
192.168.2.9

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548512
Start date and time:	2024-11-04 15:29:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://r.mailing.campingcarpark.com/tr/cl/m2JPJkzPDbfL5s2bDabtlPRATYRQylIubPPupv_vc3kDzIWW2_TNYLb8YBmBuxxUamsx-FMq6iQDKP4aBiozKtmctIWJHvB_jMPMQCy2V9w9n7PdBiSom_VscfyxjRbqNIYqjqLTOUl5-9LarkHqAVm5L2wSo2oXxGVlFSK9ch7-9o3rO6zfaWOVTBYD4bj-cBh9D46nF7VLeW5JX646w9BMjGtwIbaonCu5pf0X8ov7yR1QFDHFtwW10C7XEoZag-1kPqsvroBYGdEMlwciu7AuBU1Y26NjgdB1vb4QnVOsIs_acQZJzGs0n3fybIY3bzcEJyP_Oy1jYqrav3I9lVVIjNjH0id0gdS4TbucLqy31-2RoRtZQc8bVuUs9GXZATyHwjK94EM9fKm3gaQ0u6Km4OhvabjJRJ1r26CvdUmHO1SK4HumQKUTUp8TXSmV-Stnpm_CGVl-UuJ0NvRq2I4Xw9uT__o0aJIGY71Xtr5Z7Y_et8YZZEgYR8N-C3PmDstWGdA9-IDO6X1D8sJVLEuj4ynD4q9-hO3nCsqHsDxKxs0cmE6rNpf8r-UvD1nXZ_a-VWCTi1NHu4b8MXaBheK-JZ2q5hHvkeAVzUdiXCOufUWyY-Ee97OlTdt1Y3IjIn0dj-CvUR17EtHIzPpKzFbJHJuSBA7gKlgbAXP5qj9Z9DYOs3fd4_dxBHDc4hFtPyERTdDEp75X34mcet-FOG2cCg6GELttByElL4HvrmfIJOs_BaLRaeRpYLsj2tIjMzr0T4OVWHBOW-Q1-iqoT_zCsmcuYUhzpgTIqTGpvB7QFG0i3ZF3aeteqWLx1NAZYNeYfLSsmOWLZWMqQuWpJNh5nxTAhUC-Ine_ExnFOYwfU5uvTSRkQ3WnzaJTik6lH8zjYuRq0R9zqImSml6gks4xbe9VZFCW-qtDzZihL-bjo2pnAM-z6PAC_JoDVrKTvQZZFhm5dMQTMyyNpmiJG_1gQ1xJxfcTrHmgDYLf
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@31/175@148/51
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 142.250.185.78, 173.194.76.84, 34.104.35.123, 4.175.87.197, 199.232.210.172, 52.165.164.15, 13.95.31.18, 216.58.206.35, 2.20.245.134, 2.20.245.138, 142.250.184.200, 52.149.20.212, 74.125.133.84, 216.58.206.74, 142.250.184.202, 142.250.185.170, 142.250.186.138, 216.58.206.42, 142.250.185.138, 142.250.186.74, 216.58.212.170, 142.250.185.106, 172.217.18.10, 142.250.74.202, 142.250.186.106, 142.250.185.74, 142.250.185.202, 142.250.184.234, 172.217.16.202, 216.58.206.40, 2.19.224.184, 2.18.64.7, 2.18.64.35, 2.18.64.18, 2.18.64.26, 2.18.64.21, 2.18.64.11, 2.18.64.32, 2.18.64.15, 2.18.64.20, 151.101.2.132, 151.101.194.132, 151.101.66.132, 151.101.130.132, 142.250.185.162, 64.233.167.84, 2.18.64.6, 2.18.64.16, 2.18.64.25, 2.18.64.5, 2.18.64.14, 172.217.23.98
Excluded domains from analysis (whitelisted): www.googleadservices.com, j.sni.global.fastly.net, slscr.update.microsoft.com, e6449.dsca.akamaiedge.net, clientservices.googleapis.com, time.windows.com, clients2.google.com, www.googletagmanager.com, glb.cws.prod.dcat.dsp.trafficmanager.net, 2-01-37d2-0018.cdx.cedexis.net, sls.update.microsoft.com, update.googleapis.com, bat.bing.com, analytics.tiktok.com.edgekey.net, e6449.a.akamaiedge.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, 2-01-37d2-0020.cdx.cedexis.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, a520.b.akamai.net, e35058.a.akamaiedge.net, ctldl.windowsupdate.com, i.etsystatic.com-sbd.edgesuite.net, fe3cr.delivery.mp.microsoft.com, www.pinterest.com.edgekey.net, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, s.pinimg.com.edgekey.net, xandr-g-geo.trafficmanager.net, clients.l.google.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://r.mailing.campingcarpark.com/tr/cl/m2JPJkzPDbfL5s2bDabtlPRATYRQylIubPPupv_vc3kDzIWW2_TNYLb8YBmBuxxUamsx-FMq6iQDKP4aBiozKtmctIWJHvB_jMPMQCy2V9w9n7PdBiSom_VscfyxjRbqNIYqjqLTOUl5-9LarkHqAVm5L2wSo2oXxGVlFSK9ch7-9o3rO6zfaWOVTBYD4bj-cBh9D46nF7VLeW5JX646w9BMjGtwIbaonCu5pf0X8ov7yR1QFDHFtwW10C7XEoZag-1kPqsvroBYGdEMlwciu7AuBU1Y26NjgdB1vb4QnVOsIs_acQZJzGs0n3fybIY3bzcEJyP_Oy1jYqrav3I9lVVIjNjH0id0gdS4TbucLqy31-2RoRtZQc8bVuUs9GXZATyHwjK94EM9fKm3gaQ0u6Km4OhvabjJRJ1r26CvdUmHO1SK4HumQKUTUp8TXSmV-Stnpm_CGVl-UuJ0NvRq2I4Xw9uT__o0aJIGY71Xtr5Z7Y_et8YZZEgYR8N-C3PmDstWGdA9-IDO6X1D8sJVLEuj4ynD4q9-hO3nCsqHsDxKxs0cmE6rNpf8r-UvD1nXZ_a-VWCTi1NHu4b8MXaBheK-JZ2q5hHvkeAVzUdiXCOufUWyY-Ee97OlTdt1Y3IjIn0dj-CvUR17EtHIzPpKzFbJHJuSBA7gKlgbAXP5qj9Z9DYOs3fd4_dxBHDc4hFtPyERTdDEp75X34mcet-FOG2cCg6GELttByElL4HvrmfIJOs_BaLRaeRpYLsj2tIjMzr0T4OVWHBOW-Q1-iqoT_zCsmcuYUhzpgTIqTGpvB7QFG0i3ZF3aeteqWLx1NAZYNeYfLSsmOWLZWMqQuWpJNh5nxTAhUC-Ine_ExnFOYwfU5uvTSRkQ3WnzaJTik6lH8zjYuRq0R9zqImSml6gks4xbe9VZFCW-qtDzZihL-bjo2pnAM-z6PAC_JoDV

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	low
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Source: https://r.mailing.campingcarpark.com/tr/cl/m2JPJkzPDbfL5s2bDabtlPRATYRQylIubPPupv_vc3kDzIWW2_TNYLb8YBmBuxxUamsx-FMq6iQDKP4aBiozKtmctIWJHvB_jMPMQCy2V9w9n7PdBiSom_VscfyxjRbqNIYqjqLTOUl5-9LarkHqAVm5L2wSo2oXxGVlFSK9ch7-9o3rO6zfaWOVTBYD4bj-cBh9D46nF7VLeW5JX646w9BMjGtwIbaonCu5pf0X8ov7yR1QFDHFtwW10C7XEoZag-1kPqsvroBYGdEMlwciu7AuBU1Y26NjgdB1vb4QnVOsIs_acQZJzGs0n3fybIY3bzcEJyP_Oy1jYqrav3I9lVVIjNjH0id0gdS4TbucLqy31-2RoRtZQc8bVuUs9GXZATyHwjK94EM9fKm3gaQ0u6Km4OhvabjJRJ1r26CvdUmHO1SK4HumQKUTUp8TXSmV-Stnpm_CGVl-UuJ0NvRq2I4Xw9uT__o0aJIGY71Xtr5Z7Y_et8YZZEgYR8N-C3PmDstWGdA9-IDO6X1D8sJVLEuj4ynD4q9-hO3nCsqHsDxKxs0cmE6rNpf8r-UvD1nXZ_a-VWCTi1NHu4b8MXaBheK-JZ2q5hHvkeAVzUdiXCOufUWyY-Ee97OlTdt1Y3IjIn0dj-CvUR17EtHIzPpKzFbJHJuSBA7gKlgbAXP5qj9Z9DYOs3fd4_dxBHDc4hFtPyERTdDEp75X34mcet-FOG2cCg6GELttByElL4HvrmfIJOs_BaLRaeRpYLsj2tIjMzr0T4OVWHBOW-Q1-iqoT_zCsmcuYUhzpgTIqTGpvB7QFG0i3ZF3aeteqWLx1NAZYNeYfLSsmOWLZWMqQuWpJNh5nxTAhUC-Ine_ExnFOYwfU5uvTSRkQ3WnzaJTik6lH8zjYuRq0R9zqImSml6gks4xbe9VZFCW-qtDzZihL-bjo2pnAM-z6PAC_JoDVrKTvQZZFhm5dMQTMyyNpmiJG...	HTTP Parser: No favicon
Source: https://q1.hacquiret.com/o6Em07/#kmmurray@chemungcanal.com	HTTP Parser: No favicon
Source: https://q1.hacquiret.com/o6Em07/	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: protect.checkpoint.com to http://email.mgb.modento.io/c/ejyczc9owyacwpgngdsi_wlswghrvq_wxetpc4nfgayusll9fwpie-z-_eytrpbbaabltkdcakylttafwcuc2aqdmc-lv8ebdlqfmvbsgjztgnv1pr0xgm9p4byvz5_j8qpebry-s_m1_ibjs7ysugmsvzjc8wxt7-ugxanxafhhg5hk_pc9n-je14l4unw5ui34gp-_sw4psm3mzapi0rxb5o49kqu67jy25-hwl7n54b3utmwflgw2zuxau-w_aqaa__8p0lcp
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: r.mailing.campingcarpark.com to https://q1.hacquiret.com/o6em07/

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45

Source: chromecache_125.3.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},rk:function(){e=pb()},zd:function(){d()}}};var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: chromecache_203.3.dr, chromecache_179.3.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=UA(a,c,e);S(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return S(122),!0;if(d&&f){for(var m=Ab(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},XA=function(){var a=[],b=function(c){return db(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_125.3.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Ah:e,yh:f,zh:g,ii:k,ji:m,Qe:n,Ib:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};G(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(yD(w,"iframe_api")\|\|yD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!pD&&wD(x[A],p.Qe))return oc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_203.3.dr, chromecache_179.3.dr, chromecache_202.3.dr, chromecache_130.3.dr, chromecache_218.3.dr, chromecache_201.3.dr	String found in binary or memory: return b}lD.F="internal.enableAutoEventOnTimer";var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: chromecache_203.3.dr, chromecache_179.3.dr	String found in binary or memory: var AC=function(a,b,c,d,e){var f=rA("fsl",c?"nv.mwt":"mwt",0),g;g=c?rA("fsl","nv.ids",[]):rA("fsl","ids",[]);if(!g.length)return!0;var k=wA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);S(121);if(m==="https://www.facebook.com/tr/")return S(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!dz(k,fz(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: r.mailing.campingcarpark.com
Source: global traffic	DNS traffic detected: DNS query: sibautomation.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: in-automate.brevo.com
Source: global traffic	DNS traffic detected: DNS query: protect.checkpoint.com
Source: global traffic	DNS traffic detected: DNS query: email.mgb.modento.io
Source: global traffic	DNS traffic detected: DNS query: q1.hacquiret.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: bypvdrkkavk9dmt5r8jijnan9nbp97wqmxftdyisrznohoudx0rfjaxi1itb.wovablepric.com
Source: global traffic	DNS traffic detected: DNS query: www.etsy.com
Source: global traffic	DNS traffic detected: DNS query: i.etsystatic.com
Source: global traffic	DNS traffic detected: DNS query: js.sentry-cdn.com
Source: global traffic	DNS traffic detected: DNS query: www.dwin1.com
Source: global traffic	DNS traffic detected: DNS query: trkn.us
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: s.pinimg.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: web.btncdn.com
Source: global traffic	DNS traffic detected: DNS query: resources.xg4ken.com
Source: global traffic	DNS traffic detected: DNS query: cdn.pdst.fm
Source: global traffic	DNS traffic detected: DNS query: analytics.tiktok.com
Source: global traffic	DNS traffic detected: DNS query: pt.ispot.tv
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: 8666735.fls.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: pixels.spotify.com
Source: global traffic	DNS traffic detected: DNS query: lantern.roeyecdn.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: 9910951.fls.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: lantern.roeye.com
Source: global traffic	DNS traffic detected: DNS query: ct.pinterest.com
Source: global traffic	DNS traffic detected: DNS query: pixel.streetmetrics.io
Source: global traffic	DNS traffic detected: DNS query: tags.w55c.net
Source: global traffic	DNS traffic detected: DNS query: adservice.google.com
Source: global traffic	DNS traffic detected: DNS query: insight.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: js.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 4, 2024 15:30:56.506118059 CET	192.168.2.7	1.1.1.1	0x8a7d	Standard query (0)	r.mailing.campingcarpark.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:30:56.506454945 CET	192.168.2.7	1.1.1.1	0xc8ca	Standard query (0)	r.mailing.campingcarpark.com	65	IN (0x0001)	false
Nov 4, 2024 15:30:58.379357100 CET	192.168.2.7	1.1.1.1	0xb610	Standard query (0)	sibautomation.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:30:58.379771948 CET	192.168.2.7	1.1.1.1	0xb3af	Standard query (0)	sibautomation.com	65	IN (0x0001)	false
Nov 4, 2024 15:30:58.729274035 CET	192.168.2.7	1.1.1.1	0x30dd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:30:58.729645014 CET	192.168.2.7	1.1.1.1	0xa6b4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:00.051099062 CET	192.168.2.7	1.1.1.1	0xcbd0	Standard query (0)	in-automate.brevo.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:00.051744938 CET	192.168.2.7	1.1.1.1	0x33e9	Standard query (0)	in-automate.brevo.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:00.106940031 CET	192.168.2.7	1.1.1.1	0x3daf	Standard query (0)	protect.checkpoint.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:00.106940031 CET	192.168.2.7	1.1.1.1	0x4050	Standard query (0)	protect.checkpoint.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:02.095530987 CET	192.168.2.7	1.1.1.1	0x46c2	Standard query (0)	email.mgb.modento.io	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:02.095892906 CET	192.168.2.7	1.1.1.1	0xb3e8	Standard query (0)	email.mgb.modento.io	65	IN (0x0001)	false
Nov 4, 2024 15:31:02.936014891 CET	192.168.2.7	1.1.1.1	0x8067	Standard query (0)	q1.hacquiret.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:02.936203003 CET	192.168.2.7	1.1.1.1	0x5f79	Standard query (0)	q1.hacquiret.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:04.341607094 CET	192.168.2.7	1.1.1.1	0xb960	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:04.341959953 CET	192.168.2.7	1.1.1.1	0xbfa3	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:08.225606918 CET	192.168.2.7	1.1.1.1	0x8396	Standard query (0)	q1.hacquiret.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:08.226070881 CET	192.168.2.7	1.1.1.1	0xc2e9	Standard query (0)	q1.hacquiret.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:34.710932016 CET	192.168.2.7	1.1.1.1	0x4896	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:34.711546898 CET	192.168.2.7	1.1.1.1	0xf768	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:34.712352991 CET	192.168.2.7	1.1.1.1	0x16b7	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:34.715462923 CET	192.168.2.7	1.1.1.1	0x5f85	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:34.716702938 CET	192.168.2.7	1.1.1.1	0x11e6	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:34.717102051 CET	192.168.2.7	1.1.1.1	0x507e	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:36.257317066 CET	192.168.2.7	1.1.1.1	0xb8b6	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:36.257769108 CET	192.168.2.7	1.1.1.1	0xcf19	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:36.726397991 CET	192.168.2.7	1.1.1.1	0xc815	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:36.726936102 CET	192.168.2.7	1.1.1.1	0xc919	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:37.371419907 CET	192.168.2.7	1.1.1.1	0x16c1	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:37.371875048 CET	192.168.2.7	1.1.1.1	0x74f7	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:37.406825066 CET	192.168.2.7	1.1.1.1	0x4108	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:37.407238007 CET	192.168.2.7	1.1.1.1	0x15e7	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:58.538837910 CET	192.168.2.7	1.1.1.1	0x9b03	Standard query (0)	bypvdrkkavk9dmt5r8jijnan9nbp97wqmxftdyisrznohoudx0rfjaxi1itb.wovablepric.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:58.539324999 CET	192.168.2.7	1.1.1.1	0xa2b3	Standard query (0)	bypvdrkkavk9dmt5r8jijnan9nbp97wqmxftdyisrznohoudx0rfjaxi1itb.wovablepric.com	65	IN (0x0001)	false
Nov 4, 2024 15:31:58.932547092 CET	192.168.2.7	1.1.1.1	0x75a7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:31:58.932924986 CET	192.168.2.7	1.1.1.1	0xcf00	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:01.445858955 CET	192.168.2.7	1.1.1.1	0x7569	Standard query (0)	www.etsy.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:01.446444035 CET	192.168.2.7	1.1.1.1	0x4e61	Standard query (0)	www.etsy.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:03.568110943 CET	192.168.2.7	1.1.1.1	0xe139	Standard query (0)	i.etsystatic.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:03.568572998 CET	192.168.2.7	1.1.1.1	0x5eda	Standard query (0)	i.etsystatic.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:03.626926899 CET	192.168.2.7	1.1.1.1	0x1b1a	Standard query (0)	bypvdrkkavk9dmt5r8jijnan9nbp97wqmxftdyisrznohoudx0rfjaxi1itb.wovablepric.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:03.627847910 CET	192.168.2.7	1.1.1.1	0x1c87	Standard query (0)	bypvdrkkavk9dmt5r8jijnan9nbp97wqmxftdyisrznohoudx0rfjaxi1itb.wovablepric.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:03.633929968 CET	192.168.2.7	1.1.1.1	0x25d9	Standard query (0)	js.sentry-cdn.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:03.634083033 CET	192.168.2.7	1.1.1.1	0xfa59	Standard query (0)	js.sentry-cdn.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:05.291060925 CET	192.168.2.7	1.1.1.1	0xea92	Standard query (0)	js.sentry-cdn.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:05.291273117 CET	192.168.2.7	1.1.1.1	0x3d04	Standard query (0)	js.sentry-cdn.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:05.293250084 CET	192.168.2.7	1.1.1.1	0xc53e	Standard query (0)	i.etsystatic.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:05.293349981 CET	192.168.2.7	1.1.1.1	0x6f7c	Standard query (0)	i.etsystatic.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:06.064392090 CET	192.168.2.7	1.1.1.1	0x1c15	Standard query (0)	www.etsy.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:06.064698935 CET	192.168.2.7	1.1.1.1	0xb84c	Standard query (0)	www.etsy.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:10.101527929 CET	192.168.2.7	1.1.1.1	0x6ab3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:10.102798939 CET	192.168.2.7	1.1.1.1	0x6aec	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:10.347429991 CET	192.168.2.7	1.1.1.1	0x6693	Standard query (0)	www.dwin1.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:10.347965002 CET	192.168.2.7	1.1.1.1	0x8dcd	Standard query (0)	www.dwin1.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:10.348683119 CET	192.168.2.7	1.1.1.1	0x744c	Standard query (0)	trkn.us	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:10.349142075 CET	192.168.2.7	1.1.1.1	0x337a	Standard query (0)	trkn.us	65	IN (0x0001)	false
Nov 4, 2024 15:32:10.350091934 CET	192.168.2.7	1.1.1.1	0x31fc	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:10.350544930 CET	192.168.2.7	1.1.1.1	0x9ce9	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:11.436470032 CET	192.168.2.7	1.1.1.1	0x94e8	Standard query (0)	s.pinimg.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:11.469629049 CET	192.168.2.7	1.1.1.1	0xd72a	Standard query (0)	s.pinimg.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:11.859247923 CET	192.168.2.7	1.1.1.1	0xdb7d	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:11.859828949 CET	192.168.2.7	1.1.1.1	0x50e4	Standard query (0)	google.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:12.349401951 CET	192.168.2.7	1.1.1.1	0xca6a	Standard query (0)	web.btncdn.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:12.349553108 CET	192.168.2.7	1.1.1.1	0x7daa	Standard query (0)	web.btncdn.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:12.393065929 CET	192.168.2.7	1.1.1.1	0x2f6a	Standard query (0)	resources.xg4ken.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:12.393598080 CET	192.168.2.7	1.1.1.1	0x490d	Standard query (0)	resources.xg4ken.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:12.395589113 CET	192.168.2.7	1.1.1.1	0x546e	Standard query (0)	cdn.pdst.fm	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:12.395740986 CET	192.168.2.7	1.1.1.1	0xd5e	Standard query (0)	cdn.pdst.fm	65	IN (0x0001)	false
Nov 4, 2024 15:32:12.397667885 CET	192.168.2.7	1.1.1.1	0x60a9	Standard query (0)	analytics.tiktok.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:12.397820950 CET	192.168.2.7	1.1.1.1	0x3ec9	Standard query (0)	analytics.tiktok.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:12.405492067 CET	192.168.2.7	1.1.1.1	0xb6a5	Standard query (0)	pt.ispot.tv	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:12.406148911 CET	192.168.2.7	1.1.1.1	0x32b0	Standard query (0)	pt.ispot.tv	65	IN (0x0001)	false
Nov 4, 2024 15:32:12.965466022 CET	192.168.2.7	1.1.1.1	0x746a	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:12.965596914 CET	192.168.2.7	1.1.1.1	0xdf5e	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Nov 4, 2024 15:32:12.979238987 CET	192.168.2.7	1.1.1.1	0xf884	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:12.979437113 CET	192.168.2.7	1.1.1.1	0x4323	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:13.027570009 CET	192.168.2.7	1.1.1.1	0x7ccb	Standard query (0)	8666735.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:13.027713060 CET	192.168.2.7	1.1.1.1	0xbe5c	Standard query (0)	8666735.fls.doubleclick.net	65	IN (0x0001)	false
Nov 4, 2024 15:32:13.216881037 CET	192.168.2.7	1.1.1.1	0xca75	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:13.217025995 CET	192.168.2.7	1.1.1.1	0x8d14	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:13.280234098 CET	192.168.2.7	1.1.1.1	0x83b6	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:13.280390978 CET	192.168.2.7	1.1.1.1	0x1f50	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Nov 4, 2024 15:32:13.283301115 CET	192.168.2.7	1.1.1.1	0x2152	Standard query (0)	pixels.spotify.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:13.283480883 CET	192.168.2.7	1.1.1.1	0xafbf	Standard query (0)	pixels.spotify.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:13.455399990 CET	192.168.2.7	1.1.1.1	0x3af9	Standard query (0)	lantern.roeyecdn.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:13.455579996 CET	192.168.2.7	1.1.1.1	0xdad6	Standard query (0)	lantern.roeyecdn.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:14.043874025 CET	192.168.2.7	1.1.1.1	0xacb8	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:14.044368982 CET	192.168.2.7	1.1.1.1	0xd3c	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Nov 4, 2024 15:32:14.091995001 CET	192.168.2.7	1.1.1.1	0xea50	Standard query (0)	9910951.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:14.092140913 CET	192.168.2.7	1.1.1.1	0xb634	Standard query (0)	9910951.fls.doubleclick.net	65	IN (0x0001)	false
Nov 4, 2024 15:32:14.348166943 CET	192.168.2.7	1.1.1.1	0xe155	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:14.348505974 CET	192.168.2.7	1.1.1.1	0xa98e	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Nov 4, 2024 15:32:14.614748001 CET	192.168.2.7	1.1.1.1	0x3975	Standard query (0)	lantern.roeye.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:14.614898920 CET	192.168.2.7	1.1.1.1	0x3db	Standard query (0)	lantern.roeye.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:15.026871920 CET	192.168.2.7	1.1.1.1	0xc354	Standard query (0)	ct.pinterest.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:15.027009964 CET	192.168.2.7	1.1.1.1	0x9eb9	Standard query (0)	ct.pinterest.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:15.213534117 CET	192.168.2.7	1.1.1.1	0x3d8e	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:15.213699102 CET	192.168.2.7	1.1.1.1	0xe5a7	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:15.534876108 CET	192.168.2.7	1.1.1.1	0xde36	Standard query (0)	pixel.streetmetrics.io	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:15.535082102 CET	192.168.2.7	1.1.1.1	0x9cb7	Standard query (0)	pixel.streetmetrics.io	65	IN (0x0001)	false
Nov 4, 2024 15:32:15.535582066 CET	192.168.2.7	1.1.1.1	0xdd7b	Standard query (0)	tags.w55c.net	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:15.535753965 CET	192.168.2.7	1.1.1.1	0x829b	Standard query (0)	tags.w55c.net	65	IN (0x0001)	false
Nov 4, 2024 15:32:15.536252022 CET	192.168.2.7	1.1.1.1	0x270e	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:15.536386013 CET	192.168.2.7	1.1.1.1	0xacfc	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:15.536731005 CET	192.168.2.7	1.1.1.1	0x2219	Standard query (0)	insight.adsrvr.org	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:15.536885023 CET	192.168.2.7	1.1.1.1	0xd2b4	Standard query (0)	insight.adsrvr.org	65	IN (0x0001)	false
Nov 4, 2024 15:32:15.563205004 CET	192.168.2.7	1.1.1.1	0xc93e	Standard query (0)	js.adsrvr.org	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:15.563853979 CET	192.168.2.7	1.1.1.1	0xd9	Standard query (0)	js.adsrvr.org	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.078346014 CET	192.168.2.7	1.1.1.1	0xef82	Standard query (0)	www.dwin1.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.078722000 CET	192.168.2.7	1.1.1.1	0x5f09	Standard query (0)	www.dwin1.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.095346928 CET	192.168.2.7	1.1.1.1	0xda80	Standard query (0)	pt.ispot.tv	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.095581055 CET	192.168.2.7	1.1.1.1	0x1fda	Standard query (0)	pt.ispot.tv	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.098071098 CET	192.168.2.7	1.1.1.1	0x8dc8	Standard query (0)	s.pinimg.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.098071098 CET	192.168.2.7	1.1.1.1	0x87f1	Standard query (0)	s.pinimg.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.107996941 CET	192.168.2.7	1.1.1.1	0x9a07	Standard query (0)	cdn.pdst.fm	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.107996941 CET	192.168.2.7	1.1.1.1	0xc02e	Standard query (0)	cdn.pdst.fm	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.123543978 CET	192.168.2.7	1.1.1.1	0x9570	Standard query (0)	trkn.us	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.123918056 CET	192.168.2.7	1.1.1.1	0x9edf	Standard query (0)	trkn.us	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.128015041 CET	192.168.2.7	1.1.1.1	0x9836	Standard query (0)	web.btncdn.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.128395081 CET	192.168.2.7	1.1.1.1	0x530c	Standard query (0)	web.btncdn.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.132167101 CET	192.168.2.7	1.1.1.1	0xe8f7	Standard query (0)	analytics.tiktok.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.132167101 CET	192.168.2.7	1.1.1.1	0x6f12	Standard query (0)	analytics.tiktok.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.162575960 CET	192.168.2.7	1.1.1.1	0x8e18	Standard query (0)	resources.xg4ken.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.162930965 CET	192.168.2.7	1.1.1.1	0xce3c	Standard query (0)	resources.xg4ken.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.344650984 CET	192.168.2.7	1.1.1.1	0xa7	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.344930887 CET	192.168.2.7	1.1.1.1	0x7446	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.506948948 CET	192.168.2.7	1.1.1.1	0xd01b	Standard query (0)	lantern.roeyecdn.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.507204056 CET	192.168.2.7	1.1.1.1	0x50f3	Standard query (0)	lantern.roeyecdn.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.522603989 CET	192.168.2.7	1.1.1.1	0x608f	Standard query (0)	pixels.spotify.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.522725105 CET	192.168.2.7	1.1.1.1	0x54a9	Standard query (0)	pixels.spotify.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.575891018 CET	192.168.2.7	1.1.1.1	0xb970	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.576030016 CET	192.168.2.7	1.1.1.1	0xb180	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.657228947 CET	192.168.2.7	1.1.1.1	0xebd5	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.657228947 CET	192.168.2.7	1.1.1.1	0x1487	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.688436985 CET	192.168.2.7	1.1.1.1	0xf5c0	Standard query (0)	lantern.roeye.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.688668966 CET	192.168.2.7	1.1.1.1	0xae9a	Standard query (0)	lantern.roeye.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:16.849066019 CET	192.168.2.7	1.1.1.1	0xf1cf	Standard query (0)	ct.pinterest.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:16.849200964 CET	192.168.2.7	1.1.1.1	0x2ffe	Standard query (0)	ct.pinterest.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:17.832787991 CET	192.168.2.7	1.1.1.1	0xd4a4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:17.832918882 CET	192.168.2.7	1.1.1.1	0x9980	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:17.833178997 CET	192.168.2.7	1.1.1.1	0x7ab0	Standard query (0)	js.adsrvr.org	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:17.833295107 CET	192.168.2.7	1.1.1.1	0x45a9	Standard query (0)	js.adsrvr.org	65	IN (0x0001)	false
Nov 4, 2024 15:32:17.971303940 CET	192.168.2.7	1.1.1.1	0x8b11	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:17.971457005 CET	192.168.2.7	1.1.1.1	0xe7f1	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Nov 4, 2024 15:32:17.991389990 CET	192.168.2.7	1.1.1.1	0x159c	Standard query (0)	pixel.streetmetrics.io	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:17.991513968 CET	192.168.2.7	1.1.1.1	0x6e43	Standard query (0)	pixel.streetmetrics.io	65	IN (0x0001)	false
Nov 4, 2024 15:32:18.335975885 CET	192.168.2.7	1.1.1.1	0xef20	Standard query (0)	tags.w55c.net	A (IP address)	IN (0x0001)	false
Nov 4, 2024 15:32:18.336189032 CET	192.168.2.7	1.1.1.1	0xa385	Standard query (0)	tags.w55c.net	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 15:31:02.133306980 CET	705	OUT	GET /c/eJyczc9OwyAcwPGngdsI_wLswGHRVQ_WxETPC4NfgayUSll9fWPiE-z-_eYTrPBBAAbLtKDCaKYlTtaFwCUc2aQDMC-lV8EbDlQfmVbSGJztGNV1Pr0xGm9P4byvz5_j8qpebry-S_M1_iBJS7ySUgMsvZJc8WxT7-uGxAnxAfHhg5Hk_Pc9N-jE14L4UNW5UI34gP-_Sw4PSM3mZapI0rXB5O49kQU67jY25-Hwl7n54B3utmWfLgW2zUXAu-W_AQAA__8P0lcP HTTP/1.1 Host: email.mgb.modento.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 4, 2024 15:31:02.773560047 CET	716	IN	HTTP/1.1 302 Found Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Cache-Control: no-store Content-Length: 414 Content-Type: text/html Date: Mon, 04 Nov 2024 14:31:02 GMT Location: https://Q1.hacquiret.com/o6Em07/ X-Robots-Tag: noindex X-Xss-Protection: 1; mode=block Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 73 68 6f 75 6c 64 20 62 65 20 72 65 64 69 72 65 63 74 65 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 74 6f 20 74 61 72 67 65 74 20 55 52 4c 3a 20 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 51 31 2e 68 61 63 71 75 69 72 65 74 2e 63 6f 6d 2f 6f 36 45 6d 30 37 2f 22 3e 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta name="robots" content="noindex"><meta charset="utf-8"></head><body><title>Redirecting...</title><h1>Redirecting...</h1><p>You should be redirected automatically to target URL: <a href="https://Q1.hacquiret.com/o6Em07/">https://Q1.hacquiret.com/o6Em07/</a>. If not click the link.</body></html>
Nov 4, 2024 15:31:47.773900032 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:30:57 UTC	1677	OUT	GET /tr/cl/m2JPJkzPDbfL5s2bDabtlPRATYRQylIubPPupv_vc3kDzIWW2_TNYLb8YBmBuxxUamsx-FMq6iQDKP4aBiozKtmctIWJHvB_jMPMQCy2V9w9n7PdBiSom_VscfyxjRbqNIYqjqLTOUl5-9LarkHqAVm5L2wSo2oXxGVlFSK9ch7-9o3rO6zfaWOVTBYD4bj-cBh9D46nF7VLeW5JX646w9BMjGtwIbaonCu5pf0X8ov7yR1QFDHFtwW10C7XEoZag-1kPqsvroBYGdEMlwciu7AuBU1Y26NjgdB1vb4QnVOsIs_acQZJzGs0n3fybIY3bzcEJyP_Oy1jYqrav3I9lVVIjNjH0id0gdS4TbucLqy31-2RoRtZQc8bVuUs9GXZATyHwjK94EM9fKm3gaQ0u6Km4OhvabjJRJ1r26CvdUmHO1SK4HumQKUTUp8TXSmV-Stnpm_CGVl-UuJ0NvRq2I4Xw9uT__o0aJIGY71Xtr5Z7Y_et8YZZEgYR8N-C3PmDstWGdA9-IDO6X1D8sJVLEuj4ynD4q9-hO3nCsqHsDxKxs0cmE6rNpf8r-UvD1nXZ_a-VWCTi1NHu4b8MXaBheK-JZ2q5hHvkeAVzUdiXCOufUWyY-Ee97OlTdt1Y3IjIn0dj-CvUR17EtHIzPpKzFbJHJuSBA7gKlgbAXP5qj9Z9DYOs3fd4_dxBHDc4hFtPyERTdDEp75X34mcet-FOG2cCg6GELttByElL4HvrmfIJOs_BaLRaeRpYLsj2tIjMzr0T4OVWHBOW-Q1-iqoT_zCsmcuYUhzpgTIqTGpvB7QFG0i3ZF3aeteqWLx1NAZYNeYfLSsmOWLZWMqQuWpJNh5nxTAhUC-Ine_ExnFOYwfU5uvTSRkQ3WnzaJTik6lH8zjYuRq0R9zqImSml6gks4xbe9VZFCW-qtDzZihL-bjo2pnAM-z6PAC_JoDVrKTvQZZFhm5dMQTMyyNpmiJG_1gQ1xJxfcTrHmgDYLf HTTP/1.1 Host: r.mailing.campingcarpark.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:30:57 UTC	242	IN	HTTP/1.1 200 OK Content-Length: 2206 Content-Type: text/html; charset=utf-8 Date: Mon, 04 Nov 2024 14:30:57 GMT X-Content-Type-Options: nosniff X-Sib-Server: gke-public-cluster-v2-1-179-112-141 X-Xss-Protection: 1 Connection: close
2024-11-04 14:30:57 UTC	944	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 6e 6f 73 63 72 69 70 74 3e 0a 09 09 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 2e 30 3b 68 74 74 70 73 3a 2f 2f 70 72 6f 74 65 63 74 2e 63 68 65 63 6b 70 6f 69 6e 74 2e 63 6f 6d 2f 76 32 2f 72 30 31 2f 5f 5f 5f 68 74 74 70 3a 2f 2f 65 6d 61 69 6c 2e 6d 67 62 2e 6d 6f 64 65 6e 74 6f 2e 69 6f 2f 63 2f 65 4a 79 63 7a 63 39 4f 77 79 41 63 77 50 47 6e 67 64 73 49 5f 77 4c 73 77 47 48 52 56 51 5f 57 78 45 54 50 43 34 4e 66 67 61 79 55 53 6c 6c 39 Data Ascii: <!DOCTYPE html><html><head><title>Redirection</title></head><body><noscript> <meta http-equiv="refresh" content="0.0;https://protect.checkpoint.com/v2/r01/___http://email.mgb.modento.io/c/eJyczc9OwyAcwPGngdsI_wLswGHRVQ_WxETPC4NfgayUSll9
2024-11-04 14:30:57 UTC	1262	IN	Data Raw: 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 70 72 6f 74 65 63 74 2e 63 68 65 63 6b 70 6f 69 6e 74 2e 63 6f 6d 5c 2f 76 32 5c 2f 72 30 31 5c 2f 5f 5f 5f 68 74 74 70 3a 5c 2f 5c 2f 65 6d 61 69 6c 2e 6d 67 62 2e 6d 6f 64 65 6e 74 6f 2e 69 6f 5c 2f 63 5c 2f 65 4a 79 63 7a 63 39 4f 77 79 41 63 77 50 47 6e 67 64 73 49 5f 77 4c 73 77 47 48 52 56 51 5f 57 78 45 54 50 43 34 4e 66 67 61 79 55 53 6c 6c 39 66 57 50 69 45 2d 7a 2d 5f 65 59 54 72 50 42 42 41 41 62 4c 74 4b 44 43 61 4b 59 6c 54 74 61 46 77 43 55 63 32 61 51 44 4d 43 2d 6c 56 38 45 62 44 6c 51 66 6d 56 62 53 47 4a 7a 74 47 4e 56 31 50 72 30 78 47 6d 39 50 34 62 79 76 7a 35 5f 6a 38 71 70 65 62 72 79 2d 53 5f 4d 31 5f 69 42 4a 53 Data Ascii: out(function(){ top.location='https:\/\/protect.checkpoint.com\/v2\/r01\/___http:\/\/email.mgb.modento.io\/c\/eJyczc9OwyAcwPGngdsI_wLswGHRVQ_WxETPC4NfgayUSll9fWPiE-z-_eYTrPBBAAbLtKDCaKYlTtaFwCUc2aQDMC-lV8EbDlQfmVbSGJztGNV1Pr0xGm9P4byvz5_j8qpebry-S_M1_iBJS

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:30:57 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:30:57 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:30:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 03 Nov 2024 10:28:28 GMT ETag: "0x8DCFBF241C15278" x-ms-request-id: bcb504eb-401e-0035-19e9-2d82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143057Z-158dbd74bf4tfjlhhC1SN1m37400000002f000000000ata7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:30:57 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-04 14:30:57 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-04 14:30:57 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-04 14:30:57 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-04 14:30:57 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-04 14:30:57 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-04 14:30:57 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-04 14:30:57 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-04 14:30:57 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-04 14:30:57 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:30:59 UTC	710	OUT	GET /cm.html?id=1126544 HTTP/1.1 Host: sibautomation.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://r.mailing.campingcarpark.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:30:59 UTC	394	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:30:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: Sails <sailsjs.com> vary: Accept-Encoding access-control-allow-origin: * CF-Cache-Status: HIT Age: 26159 Expires: Mon, 04 Nov 2024 16:30:59 GMT Cache-Control: public, max-age=7200 Server: cloudflare CF-RAY: 8dd54e1b989e68f9-DFW
2024-11-04 14:30:59 UTC	975	IN	Data Raw: 39 38 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 75 75 69 64 56 34 28 29 20 7b 20 76 61 72 20 64 20 3d 20 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 3b 20 72 65 74 75 72 6e 20 27 78 78 78 78 78 78 78 78 2d 78 78 78 78 2d 34 78 78 78 2d 79 78 78 78 2d 78 78 78 78 78 78 78 78 78 78 78 78 27 2e 72 65 70 6c 61 63 65 28 2f 5b 78 79 5d 2f 67 2c 20 66 75 6e 63 74 69 6f 6e 28 63 29 7b 20 76 61 72 20 72 20 3d 20 28 64 20 2b 20 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 20 2a 20 31 36 29 20 25 20 31 36 20 7c 20 30 3b 20 64 20 3d 20 4d 61 74 68 2e 66 6c 6f 6f 72 28 Data Ascii: 98d<!DOCTYPE html><html><head><script type="text/javascript"> function uuidV4() { var d = new Date().getTime(); return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c){ var r = (d + Math.random() * 16) % 16 \| 0; d = Math.floor(
2024-11-04 14:30:59 UTC	1369	IN	Data Raw: 20 69 66 20 28 63 2e 69 6e 64 65 78 4f 66 28 63 6e 29 20 3d 3d 20 30 29 20 72 65 74 75 72 6e 20 63 2e 73 75 62 73 74 72 69 6e 67 28 63 6e 2e 6c 65 6e 67 74 68 2c 20 63 2e 6c 65 6e 67 74 68 29 3b 7d 20 72 65 74 75 72 6e 20 27 27 3b 7d 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 71 73 5f 65 6e 63 6f 64 65 28 6f 29 20 7b 20 76 61 72 20 73 74 72 20 3d 20 5b 5d 3b 20 66 6f 72 20 28 76 61 72 20 70 20 69 6e 20 6f 29 20 7b 20 6f 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 70 29 20 26 26 20 73 74 72 2e 70 75 73 68 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 70 29 20 2b 20 22 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6f 5b 70 5d 29 29 3b 7d 72 65 74 75 72 6e 20 73 74 72 2e 6a 6f 69 6e 28 22 26 22 29 3b 7d 0a 20 20 20 Data Ascii: if (c.indexOf(cn) == 0) return c.substring(cn.length, c.length);} return '';} function qs_encode(o) { var str = []; for (var p in o) { o.hasOwnProperty(p) && str.push(encodeURIComponent(p) + "=" + encodeURIComponent(o[p]));}return str.join("&");}
2024-11-04 14:30:59 UTC	108	IN	Data Raw: 20 28 71 73 2e 63 75 69 64 29 20 7b 63 6d 2e 63 75 69 64 20 3d 20 71 73 2e 63 75 69 64 3b 7d 3b 20 69 66 20 28 63 6d 5f 66 6c 61 67 29 20 7b 72 71 5f 73 65 6e 64 28 63 6d 29 3b 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: (qs.cuid) {cm.cuid = qs.cuid;}; if (cm_flag) {rq_send(cm);} </script></head><body></body></html>
2024-11-04 14:30:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47671)
Category:	dropped
Size (bytes):	47672
Entropy (8bit):	5.401921124762015
Encrypted:	false
SSDEEP:	768:OeCtueCACDHsEW8tZunqu5TTfjdTdWm54gEnih4A2WibLXKUEn+V1Kgbdfi0Vdua:OvXmHFW8tZuquNP54VnKJ3UEsnpj
MD5:	B804BCD42117B1BBE45326212AF85105
SHA1:	7B4175AAF0B7E45E03390F50CB8ED93185017014
SHA-256:	B7595C3D2E94DF7416308FA2CCF5AE8832137C76D2E9A8B02E6ED2CB2D92E2F7
SHA-512:	9A4F038F9010DDCCF5E0FAF97102465EF7BA27B33F55C4B86D167C41096DB1E76C8212A5E36565F0447C4F57340A10DB07BB9AE26982DFFF92C411B5B1F1FB97
Malicious:	false
Reputation:	low
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,l,g){try{var h=e[l](g),u=h.value}catch(f){n(f);return}h.done?r(u):Promise.resolve(u).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);function g(u){Ht(l,o,c,g,h,"next",u)}function h(u){Ht(l,o,c,g,h,"throw",u)}g(void 0)})}}function V(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):V(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:30:59 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:30:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:30:59 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: ece73ca0-101e-007a-073f-2e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143059Z-157b9fd754f8vn5phC1SN10bks00000003300000000054cw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:30:59 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:30:59 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:30:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:30:59 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 5dfad506-901e-0029-2a46-2e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143059Z-158dbd74bf4ch7lbhC1SN1t5p000000002q00000000016ee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:30:59 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:30:59 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:30:59 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:30:59 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 281ea711-401e-0047-215f-2e8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143059Z-158dbd74bf4fwv52hC1SN1tbkg00000002mg000000007bps x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:30:59 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:30:59 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:30:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:30:59 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: d78ce712-d01e-007a-194f-2ef38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143059Z-158dbd74bf4jjjdmhC1SN1vmen00000002q0000000006k6z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:30:59 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:30:59 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:30:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:30:59 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 23b843a5-001e-0065-686a-2e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143059Z-158dbd74bf4dtwdphC1SN1ubaw000000025g0000000077tq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:30:59 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:00 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b71120f-601e-0050-0560-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143100Z-158dbd74bf4tfjlhhC1SN1m37400000002fg000000007yyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:00 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 2b307645-e01e-001f-335c-2e1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143100Z-158dbd74bf4wlzpzhC1SN10qvc00000002g00000000065zn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:00 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 00beaf03-101e-0065-2c60-2e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143100Z-157b9fd754f2v9cjhC1SN1cryn00000002wg0000000097hg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:00 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:00 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e9380aa8-701e-005c-5160-2ebb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143100Z-157b9fd754fdsnsqhC1SN1tzrn000000038g000000002z5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:00 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:00 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-04 14:31:01 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=94512 Date: Mon, 04 Nov 2024 14:31:01 GMT Connection: close X-CID: 2

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:01 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:01 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 94eba7f5-101e-0079-455c-2e5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143101Z-158dbd74bf4kd595hC1SN1av8c00000002mg000000007k0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:01 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:01 UTC	682	OUT	GET /cm?uuid=a01b8ec6-65c8-408f-9096-52614df799a9&key=y7c49dwuox4ledq4km82k9he&trans=1&message_id=1acd5ab2-3c31-4981-b663-40c30c74a15e HTTP/1.1 Host: in-automate.brevo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://sibautomation.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sibautomation.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:31:01 UTC	233	IN	HTTP/1.1 204 No Content Date: Mon, 04 Nov 2024 14:31:01 GMT Connection: close access-control-allow-origin: * Cache-Control: no-cache via: 1.1 google CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8dd54e296f0445e3-DFW

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:01 UTC	1189	OUT	GET /v2/r01/___http://email.mgb.modento.io/c/eJyczc9OwyAcwPGngdsI_wLswGHRVQ_WxETPC4NfgayUSll9fWPiE-z-_eYTrPBBAAbLtKDCaKYlTtaFwCUc2aQDMC-lV8EbDlQfmVbSGJztGNV1Pr0xGm9P4byvz5_j8qpebry-S_M1_iBJS7ySUgMsvZJc8WxT7-uGxAnxAfHhg5Hk_Pc9N-jE14L4UNW5UI34gP-_Sw4PSM3mZapI0rXB5O49kQU67jY25-Hwl7n54B3utmWfLgW2zUXAu-W_AQAA__8P0lcP___.YzJ1OnJpZ2h0cHJvc3BlY3RzOmM6bzpiYTRjY2RlODRjNWI5ZGU4OWFmODBhYmExZmJiYzhmODo3OmNhZmY6YjM3MjY5MTVjMjI3MjA5ZjUxMTViZjk5MTBkZDE1MGFmZjMxOWJkMjIwMGQ4NzUyYWI0OWU3MTk3NDJiNmJjMjpoOlQ6Rg HTTP/1.1 Host: protect.checkpoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://r.mailing.campingcarpark.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-04 14:31:02 UTC	767	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 04 Nov 2024 14:31:01 GMT set-cookie: x-cloud-sec-ctp = ae8c953a-6625-4402-8285-70976e965117; Secure; HttpOnly; path=/; expires=04-Nov-2025 14:31:01 GMT location: http://email.mgb.modento.io/c/eJyczc9OwyAcwPGngdsI_wLswGHRVQ_WxETPC4NfgayUSll9fWPiE-z-_eYTrPBBAAbLtKDCaKYlTtaFwCUc2aQDMC-lV8EbDlQfmVbSGJztGNV1Pr0xGm9P4byvz5_j8qpebry-S_M1_iBJS7ySUgMsvZJc8WxT7-uGxAnxAfHhg5Hk_Pc9N-jE14L4UNW5UI34gP-_Sw4PSM3mZapI0rXB5O49kQU67jY25-Hwl7n54B3utmWfLgW2zUXAu-W_AQAA__8P0lcP Apigw-Requestid: AucZ8giYIAMEamA= X-Cache: Miss from cloudfront Via: 1.1 7785d4956cb908a17db2e556c11a4ea4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: FcpPmHRQIIkR1MjKQC2skE-iN4-UbvXq3Ajtx4WutA92ltZ5z6I6Kg==

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:01 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: ea0f8f90-301e-0020-7758-2e6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143101Z-157b9fd754ftc7cbhC1SN1xe2w00000003300000000027px x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:01 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:01 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: c0039004-a01e-0070-7e5f-2e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143101Z-157b9fd754frbrzghC1SN12cu400000002yg000000009gph x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:01 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: f5f9dbe8-f01e-0071-2e5c-2e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143101Z-157b9fd754frph49hC1SN1dtxw000000032g00000000a29f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:01 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 38302bdf-e01e-0052-3b4a-2ed9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143101Z-158dbd74bf4hnrcphC1SN1f41800000002g000000000669b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:02 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-04 14:31:02 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=94352 Date: Mon, 04 Nov 2024 14:31:02 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-04 14:31:02 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:02 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:02 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 676680a8-d01e-0082-1c5c-2ee489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143102Z-157b9fd754ft5czbhC1SN1716c00000003300000000026bu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:02 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-11-04 14:31:02 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-04 14:31:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 14:31:02 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: bfc5cfc9-a01e-0070-0546-2e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241104T143102Z-158dbd74bf4rjfxfhC1SN1a43800000002p00000000031c2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-04 14:31:02 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />