Edit tour

Windows Analysis Report
Pmendon.ext_Reord_Adjustment.docx

Overview

General Information

Sample name:	Pmendon.ext_Reord_Adjustment.docx
Analysis ID:	1555285
MD5:	5b103f7bf3ff14cef45567a527812be1
SHA1:	dcae3fddbcc4248154c2b90f3036e3fe19b3426f
SHA256:	488f034dd875312ed8ef92a540c677865269bfacd573d90455fc93dc6251474d
Infos:

Detection

Captcha Phish

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Captcha Phish

AI detected landing page (webpage, office document or email)

Detected use of open redirect vulnerability

Connects to many different domains

Detected suspicious crossdomain redirect

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

HTML body with high number of embedded SVGs detected

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

WINWORD.EXE (PID: 4420 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Pmendon.ext_Reord_Adjustment.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 6352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://r.neurotags.net/?e=email-activity&h=PROD&u=60e82f265911d0314d7422c2&ue=consumer&cl=5e2e8dd7fcfabf10d812e952&c=61dec6ecbd90fb61c1705cd7&cs=1&ec=0&a=link-clicked&rt=Read%20More.&r=https://sepedatua.com/158983/secure-redirect#Pmendon.ext+goeasy.com MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1976,i,12167023317948266424,17469008393303426487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 8064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5672 --field-trial-handle=1976,i,12167023317948266424,17469008393303426487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 8144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 --field-trial-handle=1976,i,12167023317948266424,17469008393303426487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
2.4.pages.csv	JoeSecurity_CaptchaPhish	Yara detected Captcha Phish	Joe Security

Sigma Signatures

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.17, DestinationIsIpv6: false, DestinationPort: 49791, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 4420, Protocol: tcp, SourceIp: 1.1.1.1, SourceIsIpv6: false, SourcePort: 53

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T17:29:02.593091+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.17	49712	TCP
2024-11-13T17:29:40.192165+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.17	49994	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected Captcha Phish

Source: Yara match

File source: 2.4.pages.csv, type: HTML

Detected use of open redirect vulnerability

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Proxy from: r.neurotags.net/?e=email-activity&h=prod&u=60e82f265911d0314d7422c2&ue=consumer&cl=5e2e8dd7fcfabf10d812e952&c=61dec6ecbd90fb61c1705cd7&cs=1&ec=0&a=link-clicked&rt=read more.&r=https://sepedatua.com/158983/secure-redirect to https://sepedatua.com/158983/secure-redirect

Source: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTED

HTTP Parser: Total embedded SVG size: 443405

Source: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTED	HTTP Parser: No favicon
Source: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTED	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.157:443 -> 192.168.2.17:50010 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 22MB later: 85MB

Source: unknown

Network traffic detected: DNS query count 44

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: r.neurotags.net to https://sepedatua.com/158983/secure-redirect

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: Joe Sandbox View	IP Address: 91.228.74.166 91.228.74.166
Source: Joe Sandbox View	IP Address: 18.244.18.112 18.244.18.112
Source: Joe Sandbox View	IP Address: 91.228.74.200 91.228.74.200
Source: Joe Sandbox View	IP Address: 18.66.102.15 18.66.102.15

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.17:49712
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.17:49994

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	HTTP traffic detected: GET /?e=email-activity&h=PROD&u=60e82f265911d0314d7422c2&ue=consumer&cl=5e2e8dd7fcfabf10d812e952&c=61dec6ecbd90fb61c1705cd7&cs=1&ec=0&a=link-clicked&rt=Read%20More.&r=https://sepedatua.com/158983/secure-redirect HTTP/1.1Host: r.neurotags.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bspA476fsYy55S4&MD=WXEEmc47 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /158983/secure-redirect HTTP/1.1Host: sepedatua.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /158983/secure-redirect/ HTTP/1.1Host: sepedatua.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WEB-ID-6672849687924/zerobot?email=Pmendon.ext@goeasy.com HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://sepedatua.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.com HTTP/1.1Host: mazans.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://sepedatua.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.css HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-site.lc-91a9f83e57a9c0ac9996388c5a881204-lc.min.css HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/sendgrid/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.css HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/sendgrid/clientlibs/clientlib-site.lc-e2ee9b88808de4233ff130f26c4dc422-lc.min.css HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /v1/projects/1CjnBNPybWzyv10ssZRxdwmb8vrYF4yj/integrations HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://mazans.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.js HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/clientlibs/granite/jquery.lc-f9e8e8c279baf6a1a278042afe4f395a-lc.min.js HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/clientlibs/granite/utils.lc-899004cc02c33efc1f6694b1aee587fd-lc.min.js HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-site.lc-65e4613a26158083e3e99e53ac7ff36f-lc.min.js HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/sendgrid/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.js HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/sendgrid/clientlibs/clientlib-site.lc-47fa670601ba9b5db3afd22023c57f06-lc.min.js HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /https://sendgrid.com/error/etc.clientlibs/core/wcm/components/commons/datalayer/v1/clientlibs/core.wcm.components.commons.datalayer.v1.lc-70264651675213ed7f7cc5a02a00f621-lc.min.js HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9
Source: global traffic	HTTP traffic detected: GET /analytics.js/v1/1CjnBNPybWzyv10ssZRxdwmb8vrYF4yj/analytics.min.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/projects/1CjnBNPybWzyv10ssZRxdwmb8vrYF4yj/integrations HTTP/1.1Host: cdn.segment.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rest/v1/delivery?client=twilio&sessionId=ead54cbe71824480b6163d2cf14e5e54&version=2.11.4 HTTP/1.1Host: twilio.tt.omtrdc.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: twilio!mboxSession=ead54cbe71824480b6163d2cf14e5e54; twilio!mboxPC=ead54cbe71824480b6163d2cf14e5e54.37_0
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=6Lc3fVoiAAAAAPwG5oAIHRlqs43SHIxX8Zi1CpOs HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notice?domain=sendgrid.com&c=teconsent&gtm=1&js=nj&noticeType=bb HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sxp/i/c6a47dab391ea1c8a8b2709f8479395d.js HTTP/1.1Host: euob.powerrobotflower.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/projects/1CjnBNPybWzyv10ssZRxdwmb8vrYF4yj/settings HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://mazans.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics.js/v1/1CjnBNPybWzyv10ssZRxdwmb8vrYF4yj/analytics.min.js HTTP/1.1Host: cdn.segment.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /content/dam/sendgrid/core-assets/social/site.webmanifest HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTEDAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=6Lc3fVoiAAAAAPwG5oAIHRlqs43SHIxX8Zi1CpOs HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuidj HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://mazans.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /asset/notice.js/v/v1.7-776 HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mazans.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?domain=sendgrid.com&country=us&state=&behavior=implied&session=57cd44ce-3945-49f8-b363-1f9e5ecbe175&userType=NEW&c=a562&referer=https://mazans.com&language=en HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notice?domain=sendgrid.com&c=teconsent&gtm=1&js=nj&noticeType=bb HTTP/1.1Host: consent.trustarc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbds.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/heap-1541905715.js HTTP/1.1Host: cdn.heapanalytics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/pixel.js HTTP/1.1Host: www.redditstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /x/45414/inlinks.js HTTP/1.1Host: jscloud.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bat.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?domain=sendgrid.com&country=us&state=&behavior=implied&session=57cd44ce-3945-49f8-b363-1f9e5ecbe175&userType=NEW&c=a562&referer=https://mazans.com&language=en HTTP/1.1Host: consent.trustarc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aquant.js?a=p-de_F6qVUp9bug HTTP/1.1Host: secure.quantserve.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/projects/1CjnBNPybWzyv10ssZRxdwmb8vrYF4yj/settings HTTP/1.1Host: cdn.segment.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuidj HTTP/1.1Host: secure.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /get?name=Whitney-Book.otf HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mazans.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /asset/notice.js/v/v1.7-776 HTTP/1.1Host: consent.trustarc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /x/45414/httpsmazanscomWEBID6672849687924zerobotemailEMAIL_REDACTED.json HTTP/1.1Host: jscloud.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://mazans.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/conversions-config/v1/pixel/config/t2_i1au5p4_telemetry HTTP/1.1Host: www.redditstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://mazans.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixels/t2_i1au5p4/config HTTP/1.1Host: pixel-config.reddit.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://mazans.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/pixel.js HTTP/1.1Host: www.redditstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sxp/i/c6a47dab391ea1c8a8b2709f8479395d.js HTTP/1.1Host: euob.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /x/45414/inlinks.js HTTP/1.1Host: jscloud.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics-next/bundles/ajs-destination.bundle.ed53a26b6edc80c65d73.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /asset/twilio2.png HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rp.gif?ts=1731515353679&id=t2_i1au5p4&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=59612d52-27d8-4d62-91ae-7a523b33ca67&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1280&sw=1024&v=rdt_49267bce&dpm=&dpcc=&dprc= HTTP/1.1Host: alb.reddit.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bat.js HTTP/1.1Host: bat.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ct?id=72967&url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&sf=0&tpi=&ch=SendGrid&uvid=&tsf=0&tsfmi=&tsfu=&cb=1731515352667&hl=1&op=0&ag=300509663&rand=53607585128791107956101156266160898169065292290902265118522000152187107289761818102920&fs=1280x907&fst=1280x907&np=win32&nv=google%20inc.&ref=https%3A%2F%2Fsepedatua.com%2F&ss=1280x1024&nc=0&at=&di=W1siZWYiLDM4ODhdLFsiYWJuY2giLDE3XSxbLTI0LCJbXSJdLFstMjgsImVuLVVTLGVuIl0sWy0zNCwiLSJdLFstNDYsIjAiXSxbLTQ4LCIwLDAiXSxbMTIsIntcImN0eFwiOlwid2ViZ2xcIixcInZcIjpcImdvb2dsZSBpbmMuIChnb29nbGUpXCIsXCJyXCI6XCJhbmdsZSAoZ29vZ2xlLCB2dWxrYW4gMS4zLjAgKHN3aWZ0c2hhZGVyIGRldmljZSAoc3ViemVybykgKDB4MDAwMGMwZGUpKSwgc3dpZnRzaGFkZXIgZHJpdmVyKVwiLFwic2x2XCI6XCJ3ZWJnbCBnbHNsIGVzIDEuMCAob3BlbmdsIGVzIGdsc2wgZXMgMS4wIGNocm9taXVtKVwiLFwiZ3ZlclwiOlwid2ViZ2wgMS4wIChvcGVuZ2wgZXMgMi4wIGNocm9taXVtKVwiLFwiZ3ZlblwiOlwid2Via2l0XCIsXCJiZW5cIjo3LFwid2dsXCI6MSxcImdyZW5cIjpcIndlYmtpdCB3ZWJnbFwiLFwic2VmXCI6MzY5ODUxODcxMCxcInNlY1wiOlwiXCJ9Il0sWy00LCItIl0sWy0zNSwiWzE3MzE1MTUzNTI0MDksNV0iXSxbLTQzLCIwMDAwMDAwMTAxMDAwMDAxMTAxMTEwMTEwMTEwMTEwMTAwMDAwMTAiXSxbLTUzLCIxMDAiXSxbLTU4LCItIl0sWy05LCIrIl0sWy0xOSwiWzAsMCwwLDAsMCwwLDEsMjQsMjQsXCItXCIsMTI4MCw5ODQsMTI4MCwxMDI0LDEyODAsOTg0LDEyODAsOTA3LDAsMCwwLDAsXCItXCIsXCItXCIsMTI2Myw5MDddIl0sWy0yNSwiLSJdLFstNTUsIjEiXSxbLTYwLDIwMV0sWy02MSwie1wid2dzbFwiOlwiMDtcIixcInBjZlwiOlwiYmdyYTh1bm9ybVwifSJdLFstNjYsImdlb2xvY2F0aW9uLHN0b3JhZ2VhY2Nlc3MsZ2FtZXBhZCxjaGVjdCxtaWRpLGRpc3BsYXljYXB0dXJlLHVzYixicm93c2luZ3RvcGljcyxsb2NhbGZvbnRzLHBpY3R1cmVpbnBpY3R1cmUsam9pbmFkaW50ZXJlc3Rncm91cCxwdWJsaWNrZXljcmVkZW50aWFsc2dldCxvdHBjcmVkZW50aWFscyxjaHVhZm9ybWZhY3RvcixlbmNyeXB0ZWRtZWRpYSxjaHNhdmVkYXRhLGNodWFmdWxsdmVyc2lvbmxpc3QsY2h1YXdvdzY0LHNoYXJlZHN0b3JhZ2UsY2hkb3dubGluayxjaHByZWZlcnNjb2xvcnNjaGVtZSxzeW5jeGhyLGNodWFtb2RlbCxzZXJpYWwsY2FtZXJhLGNocHJlZmVyc3JlZHVjZWRtb3Rpb24scHJpdmF0ZXN0YXRldG9rZW5pc3N1YW5jZSxibHVldG9vdGgsaWRlbnRpdHljcmVkZW50aWFsc2dldCxjaHVhZnVsbHZlcnNpb24sZnVsbHNjcmVlbixjaGRwcix1bmxvYWQsa2V5Ym9hcmRtYXAsY2h1YXBsYXRmb3JtLHNoYXJlZHN0b3JhZ2VzZWxlY3R1cmwsZ3lyb3Njb3BlLGludGVyZXN0Y29ob3J0LHdpbmRvd3BsYWNlbWVudCxjaHVhbW9iaWxlLGNodWEscnVuYWRhdWN0aW9uLG1hZ25ldG9tZXRlcixhY2NlbGVyb21ldGVyLHByaXZhdGVzdGF0ZXRva2VucmVkZW1wdGlvbixjaHVhYXJjaCx4cnNwYXRpYWx0cmFja2luZyxpZGxlZGV0ZWN0aW9uLGNodWFwbGF0Zm9ybXZlcnNpb24sY2h3aWR0aCxjbGlwYm9hcmRyZWFkLGNodmlld3BvcnR3aWR0aCxwYXltZW50LGNodmlld3BvcnRoZWlnaHQsY2hydHQsYXV0b3BsYXksY3Jvc3NvcmlnaW5pc29sYXRlZCxoaWQsY2h1YWJpdG5lc3Msc2NyZWVud2FrZWxvY2sscHJpdmF0ZWFnZ3JlZ2F0aW9uLGNsaXBib2FyZHdyaXRlLGF0dHJpYnV0aW9ucmVwb3J0aW5nLGNoZGV2aWNlbWVtb3J5LG1pY3JvcGhvbmUiXSxbLTcxLCJhMDEwMDEwMTEwMDEwMDEwMTAwMDEwMTAwMTExMTEwMDAwMDAxMCJdLFstMywiW1wiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiXSJdLFstMzksIltcIjIwMDMwMTA3XCIsMixcIkdlY2tvXCIsXCJOZXRzY2FwZVwiLFwiTW96aWxsYVwiLG51bGwsbnVsbCx0cnVlLDgsZmFsc2UsbnVsbCw1LHRydWUsdHJ1ZSxudWxsLDAsdHJ1ZSx0cnVlXSJdLFstNjMsIi0iXSxbLTcwLCItIl0
Source: global traffic	HTTP traffic detected: GET /bannermsg?action=views&domain=sendgrid.com&behavior=implied&country=us&language=en&rand=0.21308546817366736&session=57cd44ce-3945-49f8-b363-1f9e5ecbe175&userType=NEW&referer=https://mazans.com HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/action/5202129.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/heap-1541905715.js HTTP/1.1Host: cdn.heapanalytics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/rul/923239173?random=1731515353497&cv=11&fst=1731515353497&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4b70v875390547z89126943770za201zb9126943770&gcd=13t3t3t3t5l1&dma=0&tag_exp=101823848~101925629~102067554~102077854&u_w=1280&u_h=1024&url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&ref=https%3A%2F%2Fsepedatua.com%2F&hn=www.googleadservices.com&frm=0&tiba=Page%20not%20found%20%7C%20SendGrid&did=dNTIxZG&gdid=dNTIxZG&npa=0&pscdl=noapi&auid=1581689275.1731515350&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=ads_data_redaction%3Dfalse HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aquant.js?a=p-de_F6qVUp9bug HTTP/1.1Host: secure.quantserve.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/conversions-config/v1/pixel/config/t2_i1au5p4_telemetry HTTP/1.1Host: www.redditstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixels/t2_i1au5p4/config HTTP/1.1Host: pixel-config.reddit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /x/45414/httpsmazanscomWEBID6672849687924zerobotemailEMAIL_REDACTED.json HTTP/1.1Host: jscloud.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics-next/bundles/ajs-destination.bundle.ed53a26b6edc80c65d73.js HTTP/1.1Host: cdn.segment.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uxa/8bbf67c487693.js HTTP/1.1Host: t.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/731950963606637?v=2.9.176&r=stable&domain=mazans.com&hme=872f04a0547459b3285cb03b0d7a47bfde40628f4b386809918a621e2688602f&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules-p-de_F6qVUp9bug.js HTTP/1.1Host: rules.quantcount.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rp.gif?ts=1731515353679&id=t2_i1au5p4&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=59612d52-27d8-4d62-91ae-7a523b33ca67&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1280&sw=1024&v=rdt_49267bce&dpm=&dpcc=&dprc= HTTP/1.1Host: alb.reddit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6Lc3fVoiAAAAAPwG5oAIHRlqs43SHIxX8Zi1CpOs&co=aHR0cHM6Ly9tYXphbnMuY29tOjQ0Mw..&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=invisible&cb=ef4fwz83bs9w HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics-next/bundles/schemaFilter.bundle.5c2661f67b4b71a6d9bd.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/action/5202129.js HTTP/1.1Host: bat.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /asset/twilio2.png HTTP/1.1Host: consent.trustarc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bannermsg?action=views&domain=sendgrid.com&behavior=implied&country=us&language=en&rand=0.21308546817366736&session=57cd44ce-3945-49f8-b363-1f9e5ecbe175&userType=NEW&referer=https://mazans.com HTTP/1.1Host: consent.trustarc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tag/uet/5202129 HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ct?id=72967&url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&sf=0&tpi=&ch=SendGrid&uvid=&tsf=0&tsfmi=&tsfu=&cb=1731515352667&hl=1&op=0&ag=300509663&rand=53607585128791107956101156266160898169065292290902265118522000152187107289761818102920&fs=1280x907&fst=1280x907&np=win32&nv=google%20inc.&ref=https%3A%2F%2Fsepedatua.com%2F&ss=1280x1024&nc=0&at=&di=W1siZWYiLDM4ODhdLFsiYWJuY2giLDE3XSxbLTI0LCJbXSJdLFstMjgsImVuLVVTLGVuIl0sWy0zNCwiLSJdLFstNDYsIjAiXSxbLTQ4LCIwLDAiXSxbMTIsIntcImN0eFwiOlwid2ViZ2xcIixcInZcIjpcImdvb2dsZSBpbmMuIChnb29nbGUpXCIsXCJyXCI6XCJhbmdsZSAoZ29vZ2xlLCB2dWxrYW4gMS4zLjAgKHN3aWZ0c2hhZGVyIGRldmljZSAoc3ViemVybykgKDB4MDAwMGMwZGUpKSwgc3dpZnRzaGFkZXIgZHJpdmVyKVwiLFwic2x2XCI6XCJ3ZWJnbCBnbHNsIGVzIDEuMCAob3BlbmdsIGVzIGdsc2wgZXMgMS4wIGNocm9taXVtKVwiLFwiZ3ZlclwiOlwid2ViZ2wgMS4wIChvcGVuZ2wgZXMgMi4wIGNocm9taXVtKVwiLFwiZ3ZlblwiOlwid2Via2l0XCIsXCJiZW5cIjo3LFwid2dsXCI6MSxcImdyZW5cIjpcIndlYmtpdCB3ZWJnbFwiLFwic2VmXCI6MzY5ODUxODcxMCxcInNlY1wiOlwiXCJ9Il0sWy00LCItIl0sWy0zNSwiWzE3MzE1MTUzNTI0MDksNV0iXSxbLTQzLCIwMDAwMDAwMTAxMDAwMDAxMTAxMTEwMTEwMTEwMTEwMTAwMDAwMTAiXSxbLTUzLCIxMDAiXSxbLTU4LCItIl0sWy05LCIrIl0sWy0xOSwiWzAsMCwwLDAsMCwwLDEsMjQsMjQsXCItXCIsMTI4MCw5ODQsMTI4MCwxMDI0LDEyODAsOTg0LDEyODAsOTA3LDAsMCwwLDAsXCItXCIsXCItXCIsMTI2Myw5MDddIl0sWy0yNSwiLSJdLFstNTUsIjEiXSxbLTYwLDIwMV0sWy02MSwie1wid2dzbFwiOlwiMDtcIixcInBjZlwiOlwiYmdyYTh1bm9ybVwifSJdLFstNjYsImdlb2xvY2F0aW9uLHN0b3JhZ2VhY2Nlc3MsZ2FtZXBhZCxjaGVjdCxtaWRpLGRpc3BsYXljYXB0dXJlLHVzYixicm93c2luZ3RvcGljcyxsb2NhbGZvbnRzLHBpY3R1cmVpbnBpY3R1cmUsam9pbmFkaW50ZXJlc3Rncm91cCxwdWJsaWNrZXljcmVkZW50aWFsc2dldCxvdHBjcmVkZW50aWFscyxjaHVhZm9ybWZhY3RvcixlbmNyeXB0ZWRtZWRpYSxjaHNhdmVkYXRhLGNodWFmdWxsdmVyc2lvbmxpc3QsY2h1YXdvdzY0LHNoYXJlZHN0b3JhZ2UsY2hkb3dubGluayxjaHByZWZlcnNjb2xvcnNjaGVtZSxzeW5jeGhyLGNodWFtb2RlbCxzZXJpYWwsY2FtZXJhLGNocHJlZmVyc3JlZHVjZWRtb3Rpb24scHJpdmF0ZXN0YXRldG9rZW5pc3N1YW5jZSxibHVldG9vdGgsaWRlbnRpdHljcmVkZW50aWFsc2dldCxjaHVhZnVsbHZlcnNpb24sZnVsbHNjcmVlbixjaGRwcix1bmxvYWQsa2V5Ym9hcmRtYXAsY2h1YXBsYXRmb3JtLHNoYXJlZHN0b3JhZ2VzZWxlY3R1cmwsZ3lyb3Njb3BlLGludGVyZXN0Y29ob3J0LHdpbmRvd3BsYWNlbWVudCxjaHVhbW9iaWxlLGNodWEscnVuYWRhdWN0aW9uLG1hZ25ldG9tZXRlcixhY2NlbGVyb21ldGVyLHByaXZhdGVzdGF0ZXRva2VucmVkZW1wdGlvbixjaHVhYXJjaCx4cnNwYXRpYWx0cmFja2luZyxpZGxlZGV0ZWN0aW9uLGNodWFwbGF0Zm9ybXZlcnNpb24sY2h3aWR0aCxjbGlwYm9hcmRyZWFkLGNodmlld3BvcnR3aWR0aCxwYXltZW50LGNodmlld3BvcnRoZWlnaHQsY2hydHQsYXV0b3BsYXksY3Jvc3NvcmlnaW5pc29sYXRlZCxoaWQsY2h1YWJpdG5lc3Msc2NyZWVud2FrZWxvY2sscHJpdmF0ZWFnZ3JlZ2F0aW9uLGNsaXBib2FyZHdyaXRlLGF0dHJpYnV0aW9ucmVwb3J0aW5nLGNoZGV2aWNlbWVtb3J5LG1pY3JvcGhvbmUiXSxbLTcxLCJhMDEwMDEwMTEwMDEwMDEwMTAwMDEwMTAwMTExMTEwMDAwMDAxMCJdLFstMywiW1wiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiXSJdLFstMzksIltcIjIwMDMwMTA3XCIsMixcIkdlY2tvXCIsXCJOZXRzY2FwZVwiLFwiTW96aWxsYVwiLG51bGwsbnVsbCx0cnVlLDgsZmFsc2UsbnVsbCw1LHRydWUsdHJ1ZSxudWxsLDAsdHJ1ZSx0cnVlXSJdLFstNjMsIi0iXSxbLTcwLCItIl0
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/923239173/?random=1731515353497&cv=11&fst=1731515353497&bg=ffffff&guid=ON&async=1&gtm=45be4b70v875390547z89126943770za201zb9126943770&gcd=13t3t3t3t5l1&dma=0&tag_exp=101823848~101925629~102067554~102077854&u_w=1280&u_h=1024&url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&ref=https%3A%2F%2Fsepedatua.com%2F&hn=www.googleadservices.com&frm=0&tiba=Page%20not%20found%20%7C%20SendGrid&did=dNTIxZG&gdid=dNTIxZG&npa=0&pscdl=noapi&auid=1581689275.1731515350&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=ads_data_redaction%3Dfalse&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /action/0?ti=5202129&Ver=2&mid=23341f73-a829-452a-8715-848086e91659&bo=1&sid=6c20c730a1dc11ef92b555071f46574f&vid=6c2123d0a1dc11ef9ad55fff4e91da09&vids=1&msclkid=N&uach=pv%3D10.0.0&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&tl=Page%20not%20found%20%7C%20SendGrid&p=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&r=https%3A%2F%2Fsepedatua.com%2F&lt=6000&evt=pageLoad&sv=1&cdb=ARoR&rn=686857 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics-next/bundles/schemaFilter.bundle.5c2661f67b4b71a6d9bd.js HTTP/1.1Host: cdn.segment.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tag/uet/5202129 HTTP/1.1Host: www.clarity.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CLID=578bbac004b6466f83ade27540643b49.20241113.20251113
Source: global traffic	HTTP traffic detected: GET /s/0.7.49/clarity.js HTTP/1.1Host: www.clarity.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CLID=578bbac004b6466f83ade27540643b49.20241113.20251113
Source: global traffic	HTTP traffic detected: GET /signals/config/731950963606637?v=2.9.176&r=stable&domain=mazans.com&hme=872f04a0547459b3285cb03b0d7a47bfde40628f4b386809918a621e2688602f&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=731950963606637&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515356384&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&it=1731515354065&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/1040773425961662?v=2.9.176&r=stable&domain=mazans.com&hme=872f04a0547459b3285cb03b0d7a47bfde40628f4b386809918a621e2688602f&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113%2C201%2C200%2C202%2C207%2C208%2C209%2C205%2C197%2C132%2C163%2C196%2C198%2C122%2C157%2C145%2C151%2C129%2C233%2C116%2C127%2C234%2C165%2C119%2C236%2C166%2C136%2C123%2C154%2C148%2C193%2C114%2C128 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uxa/8bbf67c487693.js HTTP/1.1Host: t.contentsquare.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules-p-de_F6qVUp9bug.js HTTP/1.1Host: rules.quantcount.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=731950963606637&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515356384&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&it=1731515354065&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: not-navigation-source, trigger, event-sourceReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/923239173/?random=1731515353497&cv=11&fst=1731515353497&bg=ffffff&guid=ON&async=1&gtm=45be4b70v875390547z89126943770za201zb9126943770&gcd=13t3t3t3t5l1&dma=0&tag_exp=101823848~101925629~102067554~102077854&u_w=1280&u_h=1024&url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&ref=https%3A%2F%2Fsepedatua.com%2F&hn=www.googleadservices.com&frm=0&tiba=Page%20not%20found%20%7C%20SendGrid&did=dNTIxZG&gdid=dNTIxZG&npa=0&pscdl=noapi&auid=1581689275.1731515350&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=ads_data_redaction%3Dfalse&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /tracker/tc_imp.gif?e=37dfbd8ee84e001269efc234ef448f989225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5913846b2017071a10acf9f29f671885858e052a3a1ead2b760dd46edd63c60634062a965a535c32045bc0bc6b4f77be26bb25cb43e2923cf34c6da909337814da4de444ec8bc59a7ee46a56a82b9eec47679c796e092818c5871d61eb72bffeb1ba131be20ecca7478c31db6bda508e1547f77303fd1f564c2acf503ed79ffca8328828bf7d8557ec4b7274a7d43169230121e118f58109ac5d6ead83c6771e217dcf965d78c9df014b3545700015a7902c7e7d17c7ab1f28cef2ea2b93e745711b3eb7b4e7c1d965b4cfd908e2529d516b3098e89ae6a231c3daea6dc1345ad0f0c8241f14fe3467a0910678fc86ae668504f745b7980a870d97dd75d66071d2d964d27a8f8fb9b9deb1a00779a972a9dc8f5b4c4dc8ce6596b340bb414f07df5a5387d4ced0c6ec8830c53c9dc3b2877be5722413ab5b00baa9a16901f3c9458c27a7dd0d9070ef25110514dc31bc1cd1cbee27ebd56a964ea9cfdd9b3fce6e752db31e1413261a3087bb60f41d8282c734a29a62ed802bcac2b1be7799a6f54e3e33c5f85956dcb10a4c15f7a0e339f92588f64ebcb83cb86ec364cb07a3568efc2edb0879b5e8cb316e7b395c74195605f4f3907e8553c419171677bccd1bcd920a11eca4cdecee1f9eb4b1a2c281fbe3415d21e95b94f4057c8928641bd7605d6d6fea66a87718def6c6628e7cca238bab41d1aa59dc225b332a107d0d9dc7e7da397a50991d478b95bfc4f7823b7e9ac1ea0bf3b7000998c00e2e2abcc88d442ba5269b5e9819e23a9a17d8cd11e6fa77a0c0888cfa303bbb99453ac67fda9facb952d93560040f86695d51b6a05e8aed11c99c99d62da4e3d46974341ac76afe50d123e7807b8a200161172877148c469cc3770cab65c0bbe761888b1cf02b20fe552573c18a845d03b12fe78412c615655508ae312d82afd468d7457ec7d401abdec1edc01f8f1f472814f277265280824c01f82eedfedd3fd090bf5f4f76a3763257479c4212f493ef181193626dc1c8c4128bc6b0cf4530e366ee156057d05c723cc7da0c408bd6ffc4bbf16aa148fa31867e98d155d6e7ae7a6bacd30d&cri=BaOHhi2XtN&ts=2363&cb=1731515355030 HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200
Source: global traffic	HTTP traffic detected: GET /pixel;r=914973261;labels=_fp.event.Page%20not%20found%20%7C%20SendGrid;rf=0;a=p-de_F6qVUp9bug;url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED;ref=https%3A%2F%2Fsepedatua.com%2F;ns=0;ce=1;qjs=1;qv=6cdb9339-20241109062824;dst=1;et=1731515356482;tzo=300;ogl=type.website%2Csite_name.SendGrid%2Curl.https%3A%2F%2Fsendgrid%252Ecom%2Fen-us%2F404%2Ctitle.Page%20not%20found%20%7C%20SendGrid%20%2Cdescription.%2Cimage.https%3A%2F%2Fsendgrid%252Ecom%2Fcontent%2Fdam%2Fsendgrid%2Fcore-assets%2Fsocial%2Fsendgrid-default-og;ses=866c6b77-1f69-4857-b1ec-19e8d7f84073;d=mazans.com;uht=2;fpan=1;fpa=P0-2005580295-1731515356484;pbc=;gdpr=0;mdl= HTTP/1.1Host: pixel.quantserve.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pageview?ex=&dt=2445&pvt=n&la=en-US&uc=0&url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&dr=https%3A%2F%2Fsepedatua.com%2F&dw=1263&dh=44898&ww=1280&wh=907&sw=1280&sh=1024&uu=392b47b9-fdc5-a91a-dc6e-b9b5c392f625&sn=1&hd=1731515356&v=32bb33fe4ed6e6973ce6df5d79a84ef3f564da91&pid=84712&pn=1&happid=1541905715&hsid=5313631937644667&huu=6112782573225535&r=521041 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/0.7.49/clarity.js HTTP/1.1Host: www.clarity.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CLID=578bbac004b6466f83ade27540643b49.20241113.20251113
Source: global traffic	HTTP traffic detected: GET /v1/p HTTP/1.1Host: api.segment.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/923239173/?random=1731515353497&cv=11&fst=1731513600000&bg=ffffff&guid=ON&async=1&gtm=45be4b70v875390547z89126943770za201zb9126943770&gcd=13t3t3t3t5l1&dma=0&tag_exp=101823848~101925629~102067554~102077854&u_w=1280&u_h=1024&url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&ref=https%3A%2F%2Fsepedatua.com%2F&hn=www.googleadservices.com&frm=0&tiba=Page%20not%20found%20%7C%20SendGrid&did=dNTIxZG&gdid=dNTIxZG&npa=0&pscdl=noapi&auid=1581689275.1731515350&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=ads_data_redaction%3Dfalse&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7d_FlbTcxAkA3WYiine-jPApibz-O4Xg&random=4124225919&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=731950963606637&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515356384&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&it=1731515354065&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=1040773425961662&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515357841&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&cs_est=true&it=1731515354065&coo=false&dpo=&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=1040773425961662&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515357841&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&cs_est=true&it=1731515354065&coo=false&dpo=&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger=navigation-sourceReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/1040773425961662?v=2.9.176&r=stable&domain=mazans.com&hme=872f04a0547459b3285cb03b0d7a47bfde40628f4b386809918a621e2688602f&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113%2C201%2C200%2C202%2C207%2C208%2C209%2C205%2C197%2C132%2C163%2C196%2C198%2C122%2C157%2C145%2C151%2C129%2C233%2C116%2C127%2C234%2C165%2C119%2C236%2C166%2C136%2C123%2C154%2C148%2C193%2C114%2C128 HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=731950963606637&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515356384&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&it=1731515354065&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200
Source: global traffic	HTTP traffic detected: GET /pixel;r=914973261;labels=_fp.event.Page%20not%20found%20%7C%20SendGrid;rf=0;a=p-de_F6qVUp9bug;url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED;ref=https%3A%2F%2Fsepedatua.com%2F;ns=0;ce=1;qjs=1;qv=6cdb9339-20241109062824;dst=1;et=1731515356482;tzo=300;ogl=type.website%2Csite_name.SendGrid%2Curl.https%3A%2F%2Fsendgrid%252Ecom%2Fen-us%2F404%2Ctitle.Page%20not%20found%20%7C%20SendGrid%20%2Cdescription.%2Cimage.https%3A%2F%2Fsendgrid%252Ecom%2Fcontent%2Fdam%2Fsendgrid%2Fcore-assets%2Fsocial%2Fsendgrid-default-og;ses=866c6b77-1f69-4857-b1ec-19e8d7f84073;d=mazans.com;uht=2;fpan=1;fpa=P0-2005580295-1731515356484;pbc=;gdpr=0;mdl= HTTP/1.1Host: pixel.quantserve.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mc=6734d3de-eac9d-cb333-2df9d
Source: global traffic	HTTP traffic detected: GET /tracker/tc_imp.gif?e=37dfbd8ee84e001269efc234ef448f989225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5913846b2017071a10acf9f29f671885858e052a3a1ead2b760dd46edd63c60634062a965a535c32045bc0bc6b4f77be26bb25cb43e2923cf34c6da909337814da4de444ec8bc59a7ee46a56a82b9eec47679c796e092818c5871d61eb72bffeb1ba131be20ecca7478c31db6bda508e1547f77303fd1f564c2acf503ed79ffca8328828bf7d8557ec4b7274a7d43169230121e118f58109ac5d6ead83c6771e217dcf965d78c9df014b3545700015a7902c7e7d17c7ab1f28cef2ea2b93e745711b3eb7b4e7c1d965b4cfd908e2529d516b3098e89ae6a231c3daea6dc1345ad0f0c8241f14fe3467a0910678fc86ae668504f745b7980a870d97dd75d66071d2d964d27a8f8fb9b9deb1a00779a972a9dc8f5b4c4dc8ce6596b340bb414f07df5a5387d4ced0c6ec8830c53c9dc3b2877be5722413ab5b00baa9a16901f3c9458c27a7dd0d9070ef25110514dc31bc1cd1cbee27ebd56a964ea9cfdd9b3fce6e752db31e1413261a3087bb60f41d8282c734a29a62ed802bcac2b1be7799a6f54e3e33c5f85956dcb10a4c15f7a0e339f92588f64ebcb83cb86ec364cb07a3568efc2edb0879b5e8cb316e7b395c74195605f4f3907e8553c419171677bccd1bcd920a11eca4cdecee1f9eb4b1a2c281fbe3415d21e95b94f4057c8928641bd7605d6d6fea66a87718def6c6628e7cca238bab41d1aa59dc225b332a107d0d9dc7e7da397a50991d478b95bfc4f7823b7e9ac1ea0bf3b7000998c00e2e2abcc88d442ba5269b5e9819e23a9a17d8cd11e6fa77a0c0888cfa303bbb99453ac67fda9facb952d93560040f86695d51b6a05e8aed11c99c99d62da4e3d46974341ac76afe50d123e7807b8a200161172877148c469cc3770cab65c0bbe761888b1cf02b20fe552573c18a845d03b12fe78412c615655508ae312d82afd468d7457ec7d401abdec1edc01f8f1f472814f277265280824c01f82eedfedd3fd090bf5f4f76a3763257479c4212f493ef181193626dc1c8c4128bc6b0cf4530e366ee156057d05c723cc7da0c408bd6ffc4bbf16aa148fa31867e98d155d6e7ae7a6bacd30d&cri=BaOHhi2XtN&ts=2363&cb=1731515355030 HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/923239173/?random=1731515353497&cv=11&fst=1731513600000&bg=ffffff&guid=ON&async=1&gtm=45be4b70v875390547z89126943770za201zb9126943770&gcd=13t3t3t3t5l1&dma=0&tag_exp=101823848~101925629~102067554~102077854&u_w=1280&u_h=1024&url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&ref=https%3A%2F%2Fsepedatua.com%2F&hn=www.googleadservices.com&frm=0&tiba=Page%20not%20found%20%7C%20SendGrid&did=dNTIxZG&gdid=dNTIxZG&npa=0&pscdl=noapi&auid=1581689275.1731515350&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=ads_data_redaction%3Dfalse&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7d_FlbTcxAkA3WYiine-jPApibz-O4Xg&random=4124225919&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=1040773425961662&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515357841&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&cs_est=true&it=1731515354065&coo=false&dpo=&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=1040773425961662&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515357841&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&cs_est=true&it=1731515354065&coo=false&dpo=&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /h?a=1541905715&u=6112782573225535&v=2199469863289764&s=5313631937644667&b=web&tv=4.0&z=0&h=%2FWEB-ID-6672849687924%2Fzerobot%2F&q=%3Femail%3DEMAIL_REDACTED&d=mazans.com&t=Page%20not%20found%20%7C%20SendGrid&r=https%3A%2F%2Fsepedatua.com%2F&k=Device%20screen%20resolution&k=1280%20x%201024&k=Inner%20window%20dimensions&k=1280%20x%20907&ts=1731515354042&srp=cs%3A84712%252F392b47b9-fdc5-a91a-dc6e-b9b5c392f625%252F1%252F1%252F2520&cspid=84712&cspvid=1&cssn=1&csts=2520&csuu=392b47b9-fdc5-a91a-dc6e-b9b5c392f625&ubv=117.0.5938.149&upv=10.0.0&sch=907&scw=1280&st=1731515359048&lv=4.23.4&ld=cdn.heapanalytics.com HTTP/1.1Host: heapanalytics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200
Source: global traffic	HTTP traffic detected: GET /h?a=1541905715&u=6112782573225535&v=2199469863289764&s=5313631937644667&b=web&tv=4.0&z=0&h=%2FWEB-ID-6672849687924%2Fzerobot%2F&q=%3Femail%3DEMAIL_REDACTED&d=mazans.com&t=Page%20not%20found%20%7C%20SendGrid&r=https%3A%2F%2Fsepedatua.com%2F&k=Device%20screen%20resolution&k=1280%20x%201024&k=Inner%20window%20dimensions&k=1280%20x%20907&ts=1731515354042&srp=cs%3A84712%252F392b47b9-fdc5-a91a-dc6e-b9b5c392f625%252F1%252F1%252F2520&cspid=84712&cspvid=1&cssn=1&csts=2520&csuu=392b47b9-fdc5-a91a-dc6e-b9b5c392f625&ubv=117.0.5938.149&upv=10.0.0&sch=907&scw=1280&st=1731515359048&lv=4.23.4&ld=cdn.heapanalytics.com HTTP/1.1Host: heapanalytics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200
Source: global traffic	HTTP traffic detected: GET /content/dam/sendgrid/core-assets/social/favicon-32x32.png HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTEDAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9; at_check=true; mbox=session#ead54cbe71824480b6163d2cf14e5e54#1731517211\|PC#ead54cbe71824480b6163d2cf14e5e54.37_0#1794760151; _gcl_au=1.1.1581689275.1731515350; _gd_visitor=68a6beac-571c-486f-896d-0de3508c5af9; _gd_session=5109dfa4-7e15-4de3-89f4-70d06284fa1b; TAsessionID=57cd44ce-3945-49f8-b363-1f9e5ecbe175\|NEW; notice_behavior=implied,eu; _cq_duid=1.1731515352.vVOwxXK4AgFUHCBp; _cq_suid=1.1731515352.purk0nRGidINit9L; _mkto_trk=id:294-TKB-300&token:_mch-mazans.com-1731515352683-23262; _an_uid=0; _ga_8W5LR442LD=GS1.1.1731515352.1.0.1731515352.0.0.0; _ga=GA1.1.70095159.1731515353; _rdt_uuid=1731515353676.59612d52-27d8-4d62-91ae-7a523b33ca67; _hp2_id.1541905715=%7B%22userId%22%3A%226112782573225535%22%2C%22pageviewId%22%3A%222199469863289764%22%2C%22sessionId%22%3A%225313631937644667%22%2C%22identity%22%3Anull%2C%22trackerVersion%22%3A%224.0%22%7D; _uetsid=6c20c730a1dc11ef92b555071f46574f; _uetvid=6c2123d0a1dc11ef9ad55fff4e91da09; ajs_anonymous_id=a6484a29-d020-4de6-a9ba-3d1267788ab8; _fbp=fb.1.1731515356382.644741780521606255; _cs_c=0; _cs_id=392b47b9-fdc5-a91a-dc6e-b9b5c392f625.1731515356.1.1731515356.1731515356.1728518226.1765679356523.1; _cs_s=1.0.0.9.1731517156537; _ga_8W5LR442L=GS1.1.1731515356.1.0.1731515356.0.0.0; _clck=1aw3k49%7C2%7Cfqu%7C0%7C1778; __qca=P0-2005580295-1731515356484; _clsk=1s9q9l2%7C1731515358678%7C1%7C0%7Cs.clarity.ms%2Fcollect; _hp2_ses_props.1541905715=%7B%22r%22%3A%22https%3A%2F%2Fsepedatua.com%2F%22%2C%22ts%22%3A1731515354042%2C%22d%22%3A%22mazans.com%22%2C%22h%22%3A%22%2FWEB-ID-6672849687924%2Fzerobot%2F%22%2C%22q%22%3A%22%3Femail%3DEMAIL_REDACTED%22%7D
Source: global traffic	HTTP traffic detected: GET /content/dam/sendgrid/core-assets/social/favicon-96x96.png HTTP/1.1Host: mazans.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTEDAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=760389281e5877a1c07bb48e8e0ac3a9; at_check=true; mbox=session#ead54cbe71824480b6163d2cf14e5e54#1731517211\|PC#ead54cbe71824480b6163d2cf14e5e54.37_0#1794760151; _gcl_au=1.1.1581689275.1731515350; _gd_visitor=68a6beac-571c-486f-896d-0de3508c5af9; _gd_session=5109dfa4-7e15-4de3-89f4-70d06284fa1b; TAsessionID=57cd44ce-3945-49f8-b363-1f9e5ecbe175\|NEW; notice_behavior=implied,eu; _cq_duid=1.1731515352.vVOwxXK4AgFUHCBp; _cq_suid=1.1731515352.purk0nRGidINit9L; _mkto_trk=id:294-TKB-300&token:_mch-mazans.com-1731515352683-23262; _an_uid=0; _ga_8W5LR442LD=GS1.1.1731515352.1.0.1731515352.0.0.0; _ga=GA1.1.70095159.1731515353; _rdt_uuid=1731515353676.59612d52-27d8-4d62-91ae-7a523b33ca67; _hp2_id.1541905715=%7B%22userId%22%3A%226112782573225535%22%2C%22pageviewId%22%3A%222199469863289764%22%2C%22sessionId%22%3A%225313631937644667%22%2C%22identity%22%3Anull%2C%22trackerVersion%22%3A%224.0%22%7D; _uetsid=6c20c730a1dc11ef92b555071f46574f; _uetvid=6c2123d0a1dc11ef9ad55fff4e91da09; ajs_anonymous_id=a6484a29-d020-4de6-a9ba-3d1267788ab8; _fbp=fb.1.1731515356382.644741780521606255; _cs_c=0; _cs_id=392b47b9-fdc5-a91a-dc6e-b9b5c392f625.1731515356.1.1731515356.1731515356.1728518226.1765679356523.1; _cs_s=1.0.0.9.1731517156537; _ga_8W5LR442L=GS1.1.1731515356.1.0.1731515356.0.0.0; _clck=1aw3k49%7C2%7Cfqu%7C0%7C1778; __qca=P0-2005580295-1731515356484; _clsk=1s9q9l2%7C1731515358678%7C1%7C0%7Cs.clarity.ms%2Fcollect; _hp2_ses_props.1541905715=%7B%22r%22%3A%22https%3A%2F%2Fsepedatua.com%2F%22%2C%22ts%22%3A1731515354042%2C%22d%22%3A%22mazans.com%22%2C%22h%22%3A%22%2FWEB-ID-6672849687924%2Fzerobot%2F%22%2C%22q%22%3A%22%3Femail%3DEMAIL_REDACTED%22%7D
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bspA476fsYy55S4&MD=WXEEmc47 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -300X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; StandardBias=0; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAZ9wFy4prAXDotaSkjc8ffAiUyEj64CQlxVeaR9qcW7MT11UX1XM//U6xk7zg85MnS/VYq12XqBiLIJS04X13LOtiX5o9CvJS/eIGVIMh2Dx27rTmSLkvIDyfYlXAGfUSYLpzb3N81Sp7msx7v1gOwbzvZE4v85HuSmeUUled9wIRwjU2G8Xz4GXdiGe9yt8n5WAncovn/pkUEcDePMQ4g%2BC857zTgEEwMYQjfjWE1TrSsYzA%2B/cviLxh8uEHO/mvkNehdUvmW43r9456sgNjkS4ktSjywc7Lx5G9/QsSUky1RzdipdNtjuLML8n6WEW3AWXnE%2B6wNYTpHWPWpqa8ywQZgAAEPJnAZc3PSJ//mrFg6dnTMywAUKR1cLcuvv1Q/RHF/B25hy3ktknCm9NUsR1AhtEf7eoU196JGOJJg40Wam%2BxZpmt0GG5ibLf/nD3s1f5CCQsbU4l2DdHTJF89GkL4T3%2BCNzNTQlIqml7BSNDJocd4plQGCE8CQfBbjCO8E67Q%2BtZK4O2DatdgGac6P6/BLDr03XnfW0jZ8WnMD0H2Rn5hOEcJuA%2B%2B%2BWUr1K/eFt5XRU%2BfEXG8TB6UD1wFXW4Cn4rBJ0GI2WyRsnTwCaKjIWIgq7RYjCm7/N%2BttB2I/gwVbx9i4fpAYYRseMv/ZBenN37hX74CgM4qHctFZXgrbTJVgpSpeXCtgYmNCkJW3Kpb3dM3Ph9EW9ndW4Z7yMFsVK5dIVEJ5T%2BJO3PWgNdp9scL28L2dozVqWNivlAvGycP/cHK3R6B6PcQPZdB%2BEvGt6xIEcM8443YBFSAC77Q7DHQ9NmXWyLeG0cZAw%2BACmjP90mTy2eGNTtAUcksViqbEcoaM16L9YQgRcL7CHu%2B4qH3DGKJPqGRIbsgm7VNwtMGad4xcfk8umpW9EvHSYIDMKth4c6e8/5cSnLu6Nht55Plu20NoB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1731515398User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 7F9AC86BFC3645F1AA7A60F77D753DABX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /mon HTTP/1.1Host: obseu.powerrobotflower.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cg_uuid=a7672655cc19ce211243958c37046200

Source: chromecache_353.7.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},xk:function(){e=qb()},zd:function(){d()}}};var Zb=ma(["data-gtm-yt-inspected-"]),uD=["www.youtube.com","www.youtube-nocookie.com"],vD,wD=!1; equals www.youtube.com (Youtube)
Source: chromecache_353.7.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Ah:e,yh:f,zh:g,ii:k,ji:m,Qe:n,Ib:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(FD(w,"iframe_api")\|\|FD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!wD&&DD(x[A],p.Qe))return pc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: r.neurotags.net
Source: global traffic	DNS traffic detected: DNS query: sepedatua.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mazans.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: cdn.segment.com
Source: global traffic	DNS traffic detected: DNS query: rum.hlx.page
Source: global traffic	DNS traffic detected: DNS query: twilio.tt.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: j.6sc.co
Source: global traffic	DNS traffic detected: DNS query: euob.powerrobotflower.com
Source: global traffic	DNS traffic detected: DNS query: consent.trustarc.com
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: munchkin.marketo.net
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: c.6sc.co
Source: global traffic	DNS traffic detected: DNS query: ipv6.6sc.co
Source: global traffic	DNS traffic detected: DNS query: b.6sc.co
Source: global traffic	DNS traffic detected: DNS query: a.quora.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: cdn.heapanalytics.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: secure.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: jscloud.net
Source: global traffic	DNS traffic detected: DNS query: www.redditstatic.com
Source: global traffic	DNS traffic detected: DNS query: q.quora.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.net
Source: global traffic	DNS traffic detected: DNS query: obseu.powerrobotflower.com
Source: global traffic	DNS traffic detected: DNS query: pixel-config.reddit.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: alb.reddit.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: t.contentsquare.net
Source: global traffic	DNS traffic detected: DNS query: rules.quantcount.com
Source: global traffic	DNS traffic detected: DNS query: www.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: w3-reporting-nel.reddit.com
Source: global traffic	DNS traffic detected: DNS query: api.segment.io
Source: global traffic	DNS traffic detected: DNS query: 294-tkb-300.mktoresp.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: pixel.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: c.contentsquare.net
Source: global traffic	DNS traffic detected: DNS query: s.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: heapanalytics.com
Source: global traffic	DNS traffic detected: DNS query: c.clarity.ms

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:10 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:13 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:24 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 16:29:25 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Wed, 07 Sep 2022 17:01:41 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html

Source: chromecache_307.7.dr, chromecache_342.7.dr, chromecache_347.7.dr	String found in binary or memory: http://cdn.jsinit.directfwd.com/sk-jspark_init.php
Source: chromecache_314.7.dr	String found in binary or memory: http://consent.trustarc.com/noticemsg?
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: chromecache_407.7.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_353.7.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_314.7.dr	String found in binary or memory: https://api-js-log.trustarc.com/error
Source: chromecache_398.7.dr, chromecache_404.7.dr	String found in binary or memory: https://app.sendgrid.com/signup
Source: chromecache_355.7.dr	String found in binary or memory: https://assets.adobedtm.com/a62564f453ce/3a3a2543ac65/launch-7021ca0c1852.js
Source: chromecache_353.7.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_356.7.dr, chromecache_384.7.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_356.7.dr, chromecache_384.7.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_314.7.dr	String found in binary or memory: https://consent-pref.trustarc.com?type=sendgrid_gdpr_v3&layout=gdpr
Source: chromecache_314.7.dr	String found in binary or memory: https://consent.trustarc.com/
Source: chromecache_314.7.dr	String found in binary or memory: https://consent.trustarc.com/bannermsg?
Source: chromecache_314.7.dr	String found in binary or memory: https://consent.trustarc.com/get?name=SurveyorSSm-LightItalic-Pro.otf)
Source: chromecache_314.7.dr	String found in binary or memory: https://consent.trustarc.com/get?name=Whitney-Book.otf)
Source: chromecache_314.7.dr	String found in binary or memory: https://consent.trustarc.com/get?name=Whitney-Light.otf)
Source: chromecache_314.7.dr	String found in binary or memory: https://consent.trustarc.com/get?name=Whitney-Medium.otf)
Source: chromecache_314.7.dr	String found in binary or memory: https://consent.trustarc.com/log
Source: chromecache_356.7.dr, chromecache_384.7.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_356.7.dr, chromecache_384.7.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_356.7.dr, chromecache_384.7.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_374.7.dr	String found in binary or memory: https://developers.marketo.com/MunchkinLicense.pdf
Source: chromecache_345.7.dr	String found in binary or memory: https://github.com/microsoft/clarity
Source: chromecache_353.7.dr	String found in binary or memory: https://google.com
Source: chromecache_353.7.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_331.7.dr	String found in binary or memory: https://j.6sc.co/6si.min.js
Source: chromecache_335.7.dr	String found in binary or memory: https://jscloud.net/x/
Source: chromecache_353.7.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_353.7.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_384.7.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_407.7.dr	String found in binary or memory: https://rum.hlx.page
Source: chromecache_390.7.dr, chromecache_330.7.dr	String found in binary or memory: https://segment.com
Source: chromecache_398.7.dr, chromecache_404.7.dr	String found in binary or memory: https://sendgrid.com/
Source: chromecache_398.7.dr, chromecache_404.7.dr	String found in binary or memory: https://sendgrid.com/?
Source: chromecache_398.7.dr, chromecache_404.7.dr	String found in binary or memory: https://sendgrid.com/automated-email
Source: chromecache_398.7.dr, chromecache_404.7.dr	String found in binary or memory: https://sendgrid.com/contact-us-form/
Source: chromecache_398.7.dr, chromecache_404.7.dr	String found in binary or memory: https://sendgrid.com/marketing/sendgrid-services
Source: chromecache_398.7.dr, chromecache_404.7.dr	String found in binary or memory: https://sendgrid.com/partners/amazon-web-services/
Source: chromecache_398.7.dr, chromecache_404.7.dr	String found in binary or memory: https://sendgrid.com/solutions/email-marketing
Source: chromecache_398.7.dr, chromecache_404.7.dr	String found in binary or memory: https://signup.sendgrid.com/
Source: chromecache_353.7.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_384.7.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_356.7.dr, chromecache_384.7.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_356.7.dr, chromecache_384.7.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_356.7.dr, chromecache_384.7.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_353.7.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_398.7.dr, chromecache_404.7.dr	String found in binary or memory: https://threads.io/
Source: chromecache_373.7.dr	String found in binary or memory: https://www.clarity.ms/tag/uet/
Source: chromecache_353.7.dr	String found in binary or memory: https://www.google.com
Source: chromecache_380.7.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/923239173/?random
Source: chromecache_356.7.dr, chromecache_384.7.dr, chromecache_328.7.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_353.7.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_353.7.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_353.7.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_353.7.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_356.7.dr, chromecache_384.7.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__.
Source: chromecache_328.7.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__en.js
Source: chromecache_353.7.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_379.7.dr	String found in binary or memory: https://www.quantcast.com/legal/license
Source: chromecache_314.7.dr	String found in binary or memory: https://www.twilio.com/en-us/legal/privacy
Source: chromecache_314.7.dr	String found in binary or memory: https://www.twilio.com/en-us/legal/privacy#cookies-and-tracking-technologies
Source: chromecache_314.7.dr	String found in binary or memory: https://www.twilio.com/en-us/legal/tos
Source: chromecache_353.7.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true

Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Pmendon.ext_Reord_Adjustment.docx" /o ""
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://r.neurotags.net/?e=email-activity&h=PROD&u=60e82f265911d0314d7422c2&ue=consumer&cl=5e2e8dd7fcfabf10d812e952&c=61dec6ecbd90fb61c1705cd7&cs=1&ec=0&a=link-clicked&rt=Read%20More.&r=https://sepedatua.com/158983/secure-redirect#Pmendon.ext+goeasy.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1976,i,12167023317948266424,17469008393303426487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5672 --field-trial-handle=1976,i,12167023317948266424,17469008393303426487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 --field-trial-handle=1976,i,12167023317948266424,17469008393303426487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1976,i,12167023317948266424,17469008393303426487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5672 --field-trial-handle=1976,i,12167023317948266424,17469008393303426487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 --field-trial-handle=1976,i,12167023317948266424,17469008393303426487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: Pmendon.ext_Reord_Adjustment.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\Pmendon.ext_Reord_Adjustment.docx
Source: Google Drive.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Web Protocols	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/sendgrid/clientlibs/clientlib-site.lc-47fa670601ba9b5db3afd22023c57f06-lc.min.js	0%	Avira URL Cloud	safe
https://sepedatua.com/158983/secure-redirect	0%	Avira URL Cloud	safe
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/core/wcm/components/commons/datalayer/v1/clientlibs/core.wcm.components.commons.datalayer.v1.lc-70264651675213ed7f7cc5a02a00f621-lc.min.js	0%	Avira URL Cloud	safe
https://sepedatua.com/158983/secure-redirect/	0%	Avira URL Cloud	safe
https://mazans.com/WEB-ID-6672849687924/zerobot?email=Pmendon.ext@goeasy.com	0%	Avira URL Cloud	safe
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-site.lc-65e4613a26158083e3e99e53ac7ff36f-lc.min.js	0%	Avira URL Cloud	safe
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.js	0%	Avira URL Cloud	safe
https://mazans.com/content/dam/sendgrid/core-assets/social/favicon-32x32.png	0%	Avira URL Cloud	safe
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.css	0%	Avira URL Cloud	safe
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/sendgrid/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.css	0%	Avira URL Cloud	safe
https://mazans.com/content/dam/sendgrid/core-assets/social/site.webmanifest	0%	Avira URL Cloud	safe
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/sendgrid/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.js	0%	Avira URL Cloud	safe
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/clientlibs/granite/jquery.lc-f9e8e8c279baf6a1a278042afe4f395a-lc.min.js	0%	Avira URL Cloud	safe
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/clientlibs/granite/utils.lc-899004cc02c33efc1f6694b1aee587fd-lc.min.js	0%	Avira URL Cloud	safe
https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.com	0%	Avira URL Cloud	safe
https://r.neurotags.net/?e=email-activity&h=PROD&u=60e82f265911d0314d7422c2&ue=consumer&cl=5e2e8dd7fcfabf10d812e952&c=61dec6ecbd90fb61c1705cd7&cs=1&ec=0&a=link-clicked&rt=Read%20More.&r=https://sepedatua.com/158983/secure-redirect	0%	Avira URL Cloud	safe
https://mazans.com/content/dam/sendgrid/core-assets/social/favicon-96x96.png	0%	Avira URL Cloud	safe
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-site.lc-91a9f83e57a9c0ac9996388c5a881204-lc.min.css	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
jscloud.net	104.26.5.39	true	false	high
d2fashanjl7d9f.cloudfront.net	18.66.102.15	true	false	high
global.px.quantserve.com	91.228.74.166	true	false	high
mazans.com	162.241.85.172	true	false	high
obseu.powerrobotflower.com	54.75.69.192	true	false	high
adobetarget.data.adobedc.net	66.235.152.156	true	false	high
d296je7bbdd650.cloudfront.net	99.86.8.175	true	false	high
scontent.xx.fbcdn.net	157.240.0.6	true	false	high
c.ba.contentsquare.net	46.137.111.148	true	false	high
294-tkb-300.mktoresp.com	192.28.147.68	true	false	high
www.google.com	142.250.186.100	true	false	high
api.segment.io	44.234.198.184	true	false	high
t.contentsquare.net	18.244.18.115	true	false	high
windowsupdatebg.s.llnwi.net	87.248.205.0	true	false	high
star-mini.c10r.facebook.com	157.240.253.35	true	false	high
sepedatua.com	103.134.152.12	true	true	unknown
cdn.heapanalytics.com	13.32.27.86	true	false	high
euob.powerrobotflower.com	143.204.98.11	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
r.neurotags.net	34.168.114.70	true	true	unknown
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
consent.trustarc.com	13.225.78.57	true	false	high
heapanalytics.com	3.219.22.30	true	false	high
dualstack.reddit.map.fastly.net	151.101.129.140	true	false	high
reddit.map.fastly.net	151.101.129.140	true	false	high
googleads.g.doubleclick.net	142.250.181.226	true	false	high
td.doubleclick.net	142.250.185.98	true	false	high
ib.anycast.adnxs.com	185.89.210.122	true	false	high
alb.reddit.com	unknown	unknown	false	high
a.quora.com	unknown	unknown	false	high
secure.adnxs.com	unknown	unknown	false	high
w3-reporting-nel.reddit.com	unknown	unknown	false	high
rules.quantcount.com	unknown	unknown	false	high
twilio.tt.omtrdc.net	unknown	unknown	false	high
s.clarity.ms	unknown	unknown	false	high
cdn.segment.com	unknown	unknown	false	high
pixel-config.reddit.com	unknown	unknown	false	high
b.6sc.co	unknown	unknown	false	high
j.6sc.co	unknown	unknown	false	high
c.clarity.ms	unknown	unknown	false	high
q.quora.com	unknown	unknown	false	high
www.facebook.net	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
rum.hlx.page	unknown	unknown	false	high
www.redditstatic.com	unknown	unknown	false	high
c.6sc.co	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
www.clarity.ms	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
secure.quantserve.com	unknown	unknown	false	high
pixel.quantserve.com	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
munchkin.marketo.net	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high
c.contentsquare.net	unknown	unknown	false	high
ipv6.6sc.co	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/core/wcm/components/commons/datalayer/v1/clientlibs/core.wcm.components.commons.datalayer.v1.lc-70264651675213ed7f7cc5a02a00f621-lc.min.js	false	Avira URL Cloud: safe	unknown
https://mazans.com/content/dam/sendgrid/core-assets/social/site.webmanifest	false	Avira URL Cloud: safe	unknown
https://heapanalytics.com/h?a=1541905715&u=6112782573225535&v=2199469863289764&s=5313631937644667&b=web&tv=4.0&z=0&h=%2FWEB-ID-6672849687924%2Fzerobot%2F&q=%3Femail%3DEMAIL_REDACTED&d=mazans.com&t=Page%20not%20found%20%7C%20SendGrid&r=https%3A%2F%2Fsepedatua.com%2F&k=Device%20screen%20resolution&k=1280%20x%201024&k=Inner%20window%20dimensions&k=1280%20x%20907&ts=1731515354042&srp=cs%3A84712%252F392b47b9-fdc5-a91a-dc6e-b9b5c392f625%252F1%252F1%252F2520&cspid=84712&cspvid=1&cssn=1&csts=2520&csuu=392b47b9-fdc5-a91a-dc6e-b9b5c392f625&ubv=117.0.5938.149&upv=10.0.0&sch=907&scw=1280&st=1731515359048&lv=4.23.4&ld=cdn.heapanalytics.com	false		high
https://www.redditstatic.com/ads/pixel.js	false		high
https://www.clarity.ms/s/0.7.49/clarity.js	false		high
https://www.facebook.com/tr/?id=1040773425961662&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515357841&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&cs_est=true&it=1731515354065&coo=false&dpo=&rqm=GET	false		high
https://mazans.com/WEB-ID-6672849687924/zerobot?email=Pmendon.ext@goeasy.com	false	Avira URL Cloud: safe	unknown
https://w3-reporting-nel.reddit.com/reports	false		high
https://mazans.com/content/dam/sendgrid/core-assets/social/favicon-32x32.png	false	Avira URL Cloud: safe	unknown
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.css	false	Avira URL Cloud: safe	unknown
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.js	false	Avira URL Cloud: safe	unknown
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1040773425961662&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515357841&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&cs_est=true&it=1731515354065&coo=false&dpo=&rqm=FGET	false		high
https://secure.quantserve.com/aquant.js?a=p-de_F6qVUp9bug	false		high
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/sendgrid/clientlibs/clientlib-site.lc-47fa670601ba9b5db3afd22023c57f06-lc.min.js	false	Avira URL Cloud: safe	unknown
https://connect.facebook.net/en_US/fbevents.js	false		high
https://sepedatua.com/158983/secure-redirect/	false	Avira URL Cloud: safe	unknown
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-site.lc-65e4613a26158083e3e99e53ac7ff36f-lc.min.js	false	Avira URL Cloud: safe	unknown
https://cdn.segment.com/v1/projects/1CjnBNPybWzyv10ssZRxdwmb8vrYF4yj/settings	false		high
https://sepedatua.com/158983/secure-redirect	true	Avira URL Cloud: safe	unknown
https://www.facebook.com/tr/?id=731950963606637&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515356384&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&it=1731515354065&coo=false&rqm=GET	false		high
https://alb.reddit.com/rp.gif?ts=1731515353679&id=t2_i1au5p4&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=59612d52-27d8-4d62-91ae-7a523b33ca67&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1280&sw=1024&v=rdt_49267bce&dpm=&dpcc=&dprc=	false		high
https://www.google.com/recaptcha/api.js?render=6Lc3fVoiAAAAAPwG5oAIHRlqs43SHIxX8Zi1CpOs	false		high
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=731950963606637&ev=PageView&dl=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&rl=https%3A%2F%2Fsepedatua.com%2F&if=false&ts=1731515356384&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1731515356382.644741780521606255&ler=other&cdl=API_unavailable&it=1731515354065&coo=false&rqm=FGET	false		high
https://connect.facebook.net/en_US/fbds.js	false		high
https://294-tkb-300.mktoresp.com/webevents/visitWebPage?_mchNc=1731515352683&_mchCn=&_mchId=294-TKB-300&_mchTk=_mch-mazans.com-1731515352683-23262&_mchHo=mazans.com&_mchPo=&_mchRu=%2FWEB-ID-6672849687924%2Fzerobot%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Fsepedatua.com%2F&_mchQp=email%3DEMAIL_REDACTED	false		high
https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.5c2661f67b4b71a6d9bd.js	false		high
https://consent.trustarc.com/log?domain=sendgrid.com&country=us&state=&behavior=implied&session=57cd44ce-3945-49f8-b363-1f9e5ecbe175&userType=NEW&c=a562&referer=https://mazans.com&language=en	false		high
https://t.contentsquare.net/uxa/8bbf67c487693.js	false		high
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/sendgrid/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.css	false	Avira URL Cloud: safe	unknown
https://mazans.com/WEB-ID-6672849687924/zerobot/?email=Pmendon.ext@goeasy.com	false	Avira URL Cloud: safe	unknown
https://consent.trustarc.com/notice?domain=sendgrid.com&c=teconsent&gtm=1&js=nj&noticeType=bb	false		high
https://cdn.segment.com/analytics.js/v1/1CjnBNPybWzyv10ssZRxdwmb8vrYF4yj/analytics.min.js	false		high
https://consent.trustarc.com/asset/notice.js/v/v1.7-776	false		high
https://obseu.powerrobotflower.com/mon	false		high
https://r.neurotags.net/?e=email-activity&h=PROD&u=60e82f265911d0314d7422c2&ue=consumer&cl=5e2e8dd7fcfabf10d812e952&c=61dec6ecbd90fb61c1705cd7&cs=1&ec=0&a=link-clicked&rt=Read%20More.&r=https://sepedatua.com/158983/secure-redirect	false	Avira URL Cloud: safe	unknown
https://api.segment.io/v1/p	false		high
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/clientlibs/granite/utils.lc-899004cc02c33efc1f6694b1aee587fd-lc.min.js	false	Avira URL Cloud: safe	unknown
https://secure.adnxs.com/getuidj	false		high
https://twilio.tt.omtrdc.net/rest/v1/delivery?client=twilio&sessionId=ead54cbe71824480b6163d2cf14e5e54&version=2.11.4	false		high
https://consent.trustarc.com/get?name=Whitney-Book.otf	false		high
https://connect.facebook.net/signals/config/1040773425961662?v=2.9.176&r=stable&domain=mazans.com&hme=872f04a0547459b3285cb03b0d7a47bfde40628f4b386809918a621e2688602f&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113%2C201%2C200%2C202%2C207%2C208%2C209%2C205%2C197%2C132%2C163%2C196%2C198%2C122%2C157%2C145%2C151%2C129%2C233%2C116%2C127%2C234%2C165%2C119%2C236%2C166%2C136%2C123%2C154%2C148%2C193%2C114%2C128	false		high
https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.ed53a26b6edc80c65d73.js	false		high
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/twilio-foundation/clientlibs/clientlib-site.lc-91a9f83e57a9c0ac9996388c5a881204-lc.min.css	false	Avira URL Cloud: safe	unknown
https://mazans.com/content/dam/sendgrid/core-assets/social/favicon-96x96.png	false	Avira URL Cloud: safe	unknown
https://www.clarity.ms/tag/uet/5202129	false		high
https://pixel.quantserve.com/pixel;r=914973261;labels=_fp.event.Page%20not%20found%20%7C%20SendGrid;rf=0;a=p-de_F6qVUp9bug;url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED;ref=https%3A%2F%2Fsepedatua.com%2F;ns=0;ce=1;qjs=1;qv=6cdb9339-20241109062824;dst=1;et=1731515356482;tzo=300;ogl=type.website%2Csite_name.SendGrid%2Curl.https%3A%2F%2Fsendgrid%252Ecom%2Fen-us%2F404%2Ctitle.Page%20not%20found%20%7C%20SendGrid%20%2Cdescription.%2Cimage.https%3A%2F%2Fsendgrid%252Ecom%2Fcontent%2Fdam%2Fsendgrid%2Fcore-assets%2Fsocial%2Fsendgrid-default-og;ses=866c6b77-1f69-4857-b1ec-19e8d7f84073;d=mazans.com;uht=2;fpan=1;fpa=P0-2005580295-1731515356484;pbc=;gdpr=0;mdl=	false		high
https://cdn.segment.com/v1/projects/1CjnBNPybWzyv10ssZRxdwmb8vrYF4yj/integrations	false		high
https://rules.quantcount.com/rules-p-de_F6qVUp9bug.js	false		high
https://jscloud.net/x/45414/inlinks.js	false		high
https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_i1au5p4_telemetry	false		high
https://cdn.heapanalytics.com/js/heap-1541905715.js	false		high
https://obseu.powerrobotflower.com/tracker/tc_imp.gif?e=37dfbd8ee84e001269efc234ef448f989225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5913846b2017071a10acf9f29f671885858e052a3a1ead2b760dd46edd63c60634062a965a535c32045bc0bc6b4f77be26bb25cb43e2923cf34c6da909337814da4de444ec8bc59a7ee46a56a82b9eec47679c796e092818c5871d61eb72bffeb1ba131be20ecca7478c31db6bda508e1547f77303fd1f564c2acf503ed79ffca8328828bf7d8557ec4b7274a7d43169230121e118f58109ac5d6ead83c6771e217dcf965d78c9df014b3545700015a7902c7e7d17c7ab1f28cef2ea2b93e745711b3eb7b4e7c1d965b4cfd908e2529d516b3098e89ae6a231c3daea6dc1345ad0f0c8241f14fe3467a0910678fc86ae668504f745b7980a870d97dd75d66071d2d964d27a8f8fb9b9deb1a00779a972a9dc8f5b4c4dc8ce6596b340bb414f07df5a5387d4ced0c6ec8830c53c9dc3b2877be5722413ab5b00baa9a16901f3c9458c27a7dd0d9070ef25110514dc31bc1cd1cbee27ebd56a964ea9cfdd9b3fce6e752db31e1413261a3087bb60f41d8282c734a29a62ed802bcac2b1be7799a6f54e3e33c5f85956dcb10a4c15f7a0e339f92588f64ebcb83cb86ec364cb07a3568efc2edb0879b5e8cb316e7b395c74195605f4f3907e8553c419171677bccd1bcd920a11eca4cdecee1f9eb4b1a2c281fbe3415d21e95b94f4057c8928641bd7605d6d6fea66a87718def6c6628e7cca238bab41d1aa59dc225b332a107d0d9dc7e7da397a50991d478b95bfc4f7823b7e9ac1ea0bf3b7000998c00e2e2abcc88d442ba5269b5e9819e23a9a17d8cd11e6fa77a0c0888cfa303bbb99453ac67fda9facb952d93560040f86695d51b6a05e8aed11c99c99d62da4e3d46974341ac76afe50d123e7807b8a200161172877148c469cc3770cab65c0bbe761888b1cf02b20fe552573c18a845d03b12fe78412c615655508ae312d82afd468d7457ec7d401abdec1edc01f8f1f472814f277265280824c01f82eedfedd3fd090bf5f4f76a3763257479c4212f493ef181193626dc1c8c4128bc6b0cf4530e366ee156057d05c723cc7da0c408bd6ffc4bbf16aa148fa31867e98d155d6e7ae7a6bacd30d&cri=BaOHhi2XtN&ts=2363&cb=1731515355030	false		high
https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTED	false		unknown
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/clientlibs/granite/jquery.lc-f9e8e8c279baf6a1a278042afe4f395a-lc.min.js	false	Avira URL Cloud: safe	unknown
https://connect.facebook.net/signals/config/731950963606637?v=2.9.176&r=stable&domain=mazans.com&hme=872f04a0547459b3285cb03b0d7a47bfde40628f4b386809918a621e2688602f&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113	false		high
https://c.contentsquare.net/pageview?ex=&dt=2445&pvt=n&la=en-US&uc=0&url=https%3A%2F%2Fmazans.com%2FWEB-ID-6672849687924%2Fzerobot%2F%3Femail%3DEMAIL_REDACTED&dr=https%3A%2F%2Fsepedatua.com%2F&dw=1263&dh=44898&ww=1280&wh=907&sw=1280&sh=1024&uu=392b47b9-fdc5-a91a-dc6e-b9b5c392f625&sn=1&hd=1731515356&v=32bb33fe4ed6e6973ce6df5d79a84ef3f564da91&pid=84712&pn=1&happid=1541905715&hsid=5313631937644667&huu=6112782573225535&r=521041	false		high
https://mazans.com/https://sendgrid.com/error/etc.clientlibs/sendgrid/clientlibs/clientlib-dependencies.lc-d41d8cd98f00b204e9800998ecf8427e-lc.min.js	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_353.7.dr	false	high
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_356.7.dr, chromecache_384.7.dr	false	high
https://support.google.com/recaptcha#6262736	chromecache_356.7.dr, chromecache_384.7.dr	false	high
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_356.7.dr, chromecache_384.7.dr	false	high
https://www.google.com	chromecache_353.7.dr	false	high
https://www.youtube.com/iframe_api	chromecache_353.7.dr	false	high
https://sendgrid.com/	chromecache_398.7.dr, chromecache_404.7.dr	false	high
https://sendgrid.com/partners/amazon-web-services/	chromecache_398.7.dr, chromecache_404.7.dr	false	high
https://support.google.com/recaptcha/#6175971	chromecache_356.7.dr, chromecache_384.7.dr	false	high
https://consent.trustarc.com/get?name=SurveyorSSm-LightItalic-Pro.otf)	chromecache_314.7.dr	false	high
https://github.com/microsoft/clarity	chromecache_345.7.dr	false	high
https://support.google.com/recaptcha	chromecache_384.7.dr	false	high
http://cdn.jsinit.directfwd.com/sk-jspark_init.php	chromecache_307.7.dr, chromecache_342.7.dr, chromecache_347.7.dr	false	high
https://www.gstatic.c..?/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__.	chromecache_356.7.dr, chromecache_384.7.dr	false	high
https://sendgrid.com/automated-email	chromecache_398.7.dr, chromecache_404.7.dr	false	high
https://cct.google/taggy/agent.js	chromecache_353.7.dr	false	high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_356.7.dr, chromecache_384.7.dr	false	high
https://play.google.com/log?format=json&hasfast=true	chromecache_384.7.dr	false	high
https://www.twilio.com/en-us/legal/privacy#cookies-and-tracking-technologies	chromecache_314.7.dr	false	high
https://developers.marketo.com/MunchkinLicense.pdf	chromecache_374.7.dr	false	high
https://consent.trustarc.com/log	chromecache_314.7.dr	false	high
https://threads.io/	chromecache_398.7.dr, chromecache_404.7.dr	false	high
https://consent-pref.trustarc.com?type=sendgrid_gdpr_v3&layout=gdpr	chromecache_314.7.dr	false	high
https://www.clarity.ms/tag/uet/	chromecache_373.7.dr	false	high
https://sendgrid.com/marketing/sendgrid-services	chromecache_398.7.dr, chromecache_404.7.dr	false	high
https://consent.trustarc.com/get?name=Whitney-Light.otf)	chromecache_314.7.dr	false	high
https://cloud.google.com/contact	chromecache_356.7.dr, chromecache_384.7.dr	false	high
https://j.6sc.co/6si.min.js	chromecache_331.7.dr	false	high
https://sendgrid.com/?	chromecache_398.7.dr, chromecache_404.7.dr	false	high
https://api-js-log.trustarc.com/error	chromecache_314.7.dr	false	high
https://segment.com	chromecache_390.7.dr, chromecache_330.7.dr	false	high
https://www.google.com/recaptcha/api2/	chromecache_356.7.dr, chromecache_384.7.dr, chromecache_328.7.dr	false	high
https://assets.adobedtm.com/a62564f453ce/3a3a2543ac65/launch-7021ca0c1852.js	chromecache_355.7.dr	false	high
http://www.apache.org/licenses/LICENSE-2.0	chromecache_407.7.dr	false	high
https://consent.trustarc.com/	chromecache_314.7.dr	false	high
http://consent.trustarc.com/noticemsg?	chromecache_314.7.dr	false	high
https://consent.trustarc.com/get?name=Whitney-Medium.otf)	chromecache_314.7.dr	false	high
https://rum.hlx.page	chromecache_407.7.dr	false	high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_356.7.dr, chromecache_384.7.dr	false	high
https://googleads.g.doubleclick.net	chromecache_353.7.dr	false	high
https://www.google.com/pagead/1p-user-list/923239173/?random	chromecache_380.7.dr	false	high
https://consent.trustarc.com/bannermsg?	chromecache_314.7.dr	false	high
https://app.sendgrid.com/signup	chromecache_398.7.dr, chromecache_404.7.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
91.228.74.166	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
18.244.18.112	unknown	United States	16509	AMAZON-02US	false
91.228.74.200	unknown	United Kingdom	27281	QUANTCASTUS	false
18.66.102.15	d2fashanjl7d9f.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.66.102.121	unknown	United States	3	MIT-GATEWAYSUS	false
151.101.193.140	unknown	United States	54113	FASTLYUS	false
66.235.152.221	unknown	United States	15224	OMNITUREUS	false
151.101.65.140	unknown	United States	54113	FASTLYUS	false
104.26.5.39	jscloud.net	United States	13335	CLOUDFLARENETUS	false
143.204.98.128	unknown	United States	16509	AMAZON-02US	false
18.244.18.115	t.contentsquare.net	United States	16509	AMAZON-02US	false
143.204.98.11	euob.powerrobotflower.com	United States	16509	AMAZON-02US	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
54.75.69.192	obseu.powerrobotflower.com	United States	16509	AMAZON-02US	false
52.22.214.68	unknown	United States	14618	AMAZON-AESUS	false
13.225.78.53	unknown	United States	16509	AMAZON-02US	false
13.32.27.86	cdn.heapanalytics.com	United States	7018	ATT-INTERNET4US	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
157.240.0.35	unknown	United States	32934	FACEBOOKUS	false
185.89.210.122	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
13.225.78.57	consent.trustarc.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
66.235.152.156	adobetarget.data.adobedc.net	United States	15224	OMNITUREUS	false
46.137.111.148	c.ba.contentsquare.net	Ireland	16509	AMAZON-02US	false
103.134.152.12	sepedatua.com	Singapore	138608	CLOUDHOST-AS-APCloudHostPteLtdSG	true
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
99.86.8.175	d296je7bbdd650.cloudfront.net	United States	16509	AMAZON-02US	false
157.240.253.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
157.240.0.6	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
192.28.147.68	294-tkb-300.mktoresp.com	United States	53580	MARKETOUS	false
35.160.151.220	unknown	United States	16509	AMAZON-02US	false
150.171.28.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.248.162.96	unknown	United States	16509	AMAZON-02US	false
142.250.186.98	unknown	United States	15169	GOOGLEUS	false
185.89.210.141	unknown	Germany	29990	ASN-APPNEXUS	false
34.251.101.162	unknown	United States	16509	AMAZON-02US	false
151.101.1.140	unknown	United States	54113	FASTLYUS	false
3.219.22.30	heapanalytics.com	United States	14618	AMAZON-AESUS	false
216.58.206.68	unknown	United States	15169	GOOGLEUS	false
150.171.27.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.226	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
162.241.85.172	mazans.com	United States	26337	OIS1US	false
104.26.4.39	unknown	United States	13335	CLOUDFLARENETUS	false
34.168.114.70	r.neurotags.net	United States	2686	ATGS-MMD-ASUS	true
157.240.253.1	unknown	United States	32934	FACEBOOKUS	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
44.234.198.184	api.segment.io	United States	16509	AMAZON-02US	false
151.101.129.140	dualstack.reddit.map.fastly.net	United States	54113	FASTLYUS	false
142.250.185.98	td.doubleclick.net	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555285
Start date and time:	2024-11-13 17:28:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Pmendon.ext_Reord_Adjustment.docx
Detection:	MAL
Classification:	mal56.phis.winDOCX@24/414@173/52
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://mazans.com
URL: Office document Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Access your secure document by scanning the QR code below with your smartphone. This will take you directly to the document review page.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": true }

URL: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTED Model: claude-3-haiku-20240307	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Office document Model: claude-3-haiku-20240307	```json { "brands": [ "Goeasy" ] }
	```json { "brands": [ "Goeasy" ] }
URL: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTED Model: claude-3-haiku-20240307	```json { "brands": [ "Twilio", "Sendgrid" ] }
	```json { "brands": [ "Twilio", "Sendgrid" ] }
URL: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTED Model: claude-3-haiku-20240307	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://mazans.com/WEB-ID-6672849687924/zerobot/?email=EMAIL_REDACTED Model: claude-3-haiku-20240307	```json { "brands": [ "Twilio", "Sendgrid" ] }
	```json { "brands": [ "Twilio", "Sendgrid" ] }

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
91.228.74.166	http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9	Get hash	malicious	Unknown	Browse
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse
	https://axieu.com/terma/GeHDLf	Get hash	malicious	Unknown	Browse
	Sampension-file-846845087.pdf	Get hash	malicious	Captcha Phish	Browse
	https://issuu.com/mathildagr/docs/pmd9746827?fr=sZTMyNjc4NzAyNzM	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFmiRUl-2BtxcZ73D3PC6s7dEdSEpNEVf7BmEr33HzpWyzDy2Qc_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZML5SAWON4OCquRGeOrZOG6X7bKIH2ouDi7O5ssZhkwdV9j8BuAetGO74HzivTb4yjw5AGX5ZMnsGYBS3vBuNNgFYRVSYVxc5dN7eCLDUr43XjgYUZE2GmJzXmN-2BelIHWKsvaOOIeqiW6cnMf2CI6MeEhodwtV2LpZJtWZhkGi5I2rlc08PnxbPlMsOj2Cr9oC-2BCWb9WuPqmZU8rqYD8CNL-2BgY3UElGOq-2BfG3NfYFdrc0Rb11eU0t5G2ihyqzzZVfI-3D#cHNjaG1pdHRAZ3Jpc3Qub3Jn	Get hash	malicious	Unknown	Browse
	http://199.59.243.227	Get hash	malicious	HTMLPhisher	Browse
	Salary_Structure_Benefits_for_Sebastien.daveauIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse
	https://linkednnn.weebly.com/	Get hash	malicious	Unknown	Browse
	https://zupimages.net/up/24/42/ol13.jpg?d6mSMvU0ZvpGwffnuqPHYMR7NvlxIzVjDfTD4YJjdRSCOcc	Get hash	malicious	Unknown	Browse
18.244.18.112	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse
	https://resetnowjunocarecentermaijunonew.square.site/	Get hash	malicious	Unknown	Browse
	https://att-103454.square.site/	Get hash	malicious	Unknown	Browse
	https://vh.gskoffihoura.com/okta.vailhealth.org/oauth2/v1/authorize&client_id=okta-2b1959c8-bcc0-56eb	Get hash	malicious	Unknown	Browse
	https://btinternet-102307.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	https://att-100184.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	https://att-service-106132.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	https://shaw-101329.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://btinternet-107377.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://juno-message-center-101610.weeblysite.com/	Get hash	malicious	Unknown	Browse
91.228.74.200	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#<EMAIL>	Get hash	malicious	Unknown	Browse
	EXT__Transaction Details for Martibs -462fd4a1151861ecbc00b016e69e7825.eml	Get hash	malicious	Unknown	Browse
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse
	Sampension-file-846845087.pdf	Get hash	malicious	Captcha Phish	Browse
	Cursor Commander.exe	Get hash	malicious	Unknown	Browse
	https://bitcoinwisdom.com/these-workers-found-a-giant-snake-you-wont-believe-what-they-found-inside/2/?utm_source=taboola&utm_term=yahoo-aol-mail&utm_medium=cpc&utm_campaign=Snake+US.D_snake&cost=0.13&tblci=GiAmoZnDSKA9Rcvf4CX7BxL2zvlH6pqfvE-XRuuUPfhj0iCA4Woo2fPniM_m2u-_ATDYl18	Get hash	malicious	LiteHTTP Bot	Browse
	https://isu.pub/Mzk5MDc	Get hash	malicious	Unknown	Browse
	https://t.co/WUjzOGRMNx	Get hash	malicious	Unknown	Browse
	https://issuu.com/mathildagr/docs/pmd9746827?fr=sZTMyNjc4NzAyNzM	Get hash	malicious	Unknown	Browse
18.66.102.15	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFmiRUl-2BtxcZ73D3PC6s7dEdSEpNEVf7BmEr33HzpWyzDy2Qc_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZML5SAWON4OCquRGeOrZOG6X7bKIH2ouDi7O5ssZhkwdV9j8BuAetGO74HzivTb4yjw5AGX5ZMnsGYBS3vBuNNgFYRVSYVxc5dN7eCLDUr43XjgYUZE2GmJzXmN-2BelIHWKsvaOOIeqiW6cnMf2CI6MeEhodwtV2LpZJtWZhkGi5I2rlc08PnxbPlMsOj2Cr9oC-2BCWb9WuPqmZU8rqYD8CNL-2BgY3UElGOq-2BfG3NfYFdrc0Rb11eU0t5G2ihyqzzZVfI-3D#cHNjaG1pdHRAZ3Jpc3Qub3Jn	Get hash	malicious	Unknown	Browse
	https://fromsmash.com/8A4OM5kRFs-et	Get hash	malicious	Unknown	Browse
	https://zupimages.net/up/24/42/ol13.jpg?d6mSMvU0ZvpGwffnuqPHYMR7NvlxIzVjDfTD4YJjdRSCOcc	Get hash	malicious	Unknown	Browse
	https://beforeitsnews.com/health/2024/10/the-happier-meditation-app-is-offering-free-1-year-access-99-value-3059722.html	Get hash	malicious	Unknown	Browse
	http://bancolombia-seguridad-co.glitch.me/	Get hash	malicious	Unknown	Browse
	https://issuu.com/ryanrodger/docs/smn8263528?fr=sMTQ5NTc4NTgxNDc	Get hash	malicious	Unknown	Browse
	https://shaw-104901.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	https://resetnowjunocarecentermaijunonew.square.site/	Get hash	malicious	Unknown	Browse
	http://ogp.me/ns#	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://arcalo.ru.com/#cathy.sekula@steptoe-johnson.com	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 40.126.31.73
	https://carrier.businessappdevs.com/Baa9N	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 40.126.31.73
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 40.126.31.73
	https://webconference.protected-forms.com/XZmlBeUlkbExkNHYxS3piZldoaGJqTzUrV3RZK1BkOGZVMlRsRGFZcnlYbnJ1K3h1VjJEMnY1d0lXNFNQVmswcXFCTmFqczEyaHMyc3lwSUpvNnFFYlJLemVwaEpGbjRXVnVRRk93ZUxYY0dwRmhsZ010WmVrNTNVR0N0YkdCeTRnTHZMb043aXdiVFo5a25TNjZkVThLaW8wem41RTU3MUl5b2dxWjNpdjFLNWdRSmdxL2ZocGVvdDVBPT0tLVNLdmlEU1hLTGZIRW9VQ0YtLWFoQVVsMnk3VVFLbzBPZHpycUt6OEE9PQ==?cid=2178924675	Get hash	malicious	KnowBe4	Browse	52.149.20.212 184.28.90.27 40.126.31.73
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#<EMAIL>	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.73
	http://www.cognitoforms.com/f/LoVi2fXPMEGZ3d_zXYkCcg/1	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.73
	http://googleads.g.doubleclick.net/aclk?sa=L&ai=CJF0hsbsNVNi_DIPR0AGqhIGYDPfOz9MFj-TFvsMB25uy0esBEAEg4_uTA1DMiaOOBWDN8N-A5ALIAQSpAgbEodTv6J0-qAMBmAQFqgSnAU_QL6NE73jlCJ7TFvA2kg2Ig3wrASDHwt7I6P2gJSz2wmCekvewEDUw1zPqYx0NADEmzairfw3ur1wkNI8P6teiwhlldXdj5OGBN4lmsCEDPv86I5o3eNVngnJfRiuDvxlWje20-VfTVoLEZHjLsyN8zQleVTsGbhHjd1BSHfxBMk8P6-QwvlL67TaFDfOyk-sIZEC0a7hK4DdrheQBo-5kNsgA7ijRoAYEgAfP_b4i&num=1&sig=AOD64_1QMErG-pSUGweRO5zdk0lMn9Ngwg&client=ca-pub-6219811747049371&adurl=http://nDmfN.toplogtrans.com.br%2Fcgi-bin%2F9224511553/9224511553/cGFydG5lcmhuZHVhbWVyQHB1cmVzdG9yYWdlLmNvbQ==	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.73
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.73
	https://uxfol.io/p/b02d8c67/029f480a	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.73
	EXT_Transaction Details for Martibs -462fd4a1151861ecbc00b016e69e7825 (18.7 KB).msg	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.73
6271f898ce5be7dd52b0fc260d0662b3	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	2.23.209.157
	https://uxfol.io/p/b02d8c67/029f480a	Get hash	malicious	Unknown	Browse	2.23.209.157
	https://wetransfer.com/downloads/dfae2da4024c0a427ba385707deb5ffa20240620022822/9659fc	Get hash	malicious	Unknown	Browse	2.23.209.157
	https://disq.us/?url=https%3A%2F%2Fntx.redblocks.io%2F&key=sKOAfZD3HOV0MD3CksmWcg	Get hash	malicious	Unknown	Browse	2.23.209.157
	https://customization-connect-7617.my.salesforce.com/sfc/p/d3000000Byor/a/d300000000RR/ML8ajzoJU6aJIvGQZGZ6S9rRHpaD1XaytKzcNGEf56g	Get hash	malicious	HTMLPhisher	Browse	2.23.209.157
	Payment advice_USD75,230.18.xls	Get hash	malicious	Unknown	Browse	2.23.209.157
	https://t.ly/RpFMV	Get hash	malicious	HTMLPhisher	Browse	2.23.209.157
	http://heptagon-olive-l8hr.squarespace.com	Get hash	malicious	Unknown	Browse	2.23.209.157
	https://6n95d.outouncip.com/ZXvIWsw/	Get hash	malicious	Unknown	Browse	2.23.209.157
	kWeHSi4zZT.xls	Get hash	malicious	Unknown	Browse	2.23.209.157
3b5074b1b5d032e5620f69f9f700ff0e	Factura de proforma.exe	Get hash	malicious	AgentTesla	Browse	13.107.5.88
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	13.107.5.88
	https://uxfol.io/p/b02d8c67/029f480a	Get hash	malicious	Unknown	Browse	13.107.5.88
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.5.88
	https://bonzibuddy.org/Bonzi.zip	Get hash	malicious	Unknown	Browse	13.107.5.88
	https://wetransfer.com/downloads/dfae2da4024c0a427ba385707deb5ffa20240620022822/9659fc	Get hash	malicious	Unknown	Browse	13.107.5.88
	Company Profile_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	13.107.5.88
	SUNNY (1).exe	Get hash	malicious	MassLogger RAT	Browse	13.107.5.88
	SFL OP990M3 PO.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	13.107.5.88
	http://junocis.com	Get hash	malicious	Unknown	Browse	13.107.5.88

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Pmendon.ext_Reord_Adjustment.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B48226D5.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D0E1D6D2.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F700C124.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{300FD6AC-53FC-4801-BA12-49B85E4DE8B2}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{478440B3-7F49-4211-9B9D-56DB7F1544D5}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1731515330388989600_93EE127B-E2BE-43AF-88BB-7FB208601885.log

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1731515330389863400_93EE127B-E2BE-43AF-88BB-7FB208601885.log

C:\Users\user\AppData\Local\Temp\TCDEEDC.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDEEDC.tmp\mlaseventheditionofficeonline.xsl

C:\Users\user\AppData\Local\Temp\TCDEEED.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDEEED.tmp\gostname.xsl

C:\Users\user\AppData\Local\Temp\TCDEEEE.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDEEEE.tmp\iso690.xsl

C:\Users\user\AppData\Local\Temp\TCDEEEF.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDEEEF.tmp\chicago.xsl

C:\Users\user\AppData\Local\Temp\TCDEEF1.tmp\Content.inf

Windows Analysis Report
Pmendon.ext_Reord_Adjustment.docx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4716392542064556
Encrypted:	false
SSDEEP:	6:kKNRtK8oJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:ntK4kPlE99SCQl2DUevat
MD5:	E93F2ED13F69B87A6C0DE47C90513BAC
SHA1:	042DE974E3BF719ECCC31C47E50664BD8B7714EC
SHA-256:	E34A4B28AB7E22E5BCDC45FD01C005642B24411C3C497756A078AAD82B97B9F8
SHA-512:	AFA94E3E9DDC3AA0E975EE3B2BBF965E8413163FC8B4BCD0D82CE1AB6575F9D4405A44B073E5D403F8C4AA4A96EA6E18CFE0D8D7D30DD5674A1136150F78BF63
Malicious:	false
Reputation:	low
Preview:	p...... ...........!.5..(...............................................B:.VZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 13 15:28:57 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.993127389404594
Encrypted:	false
SSDEEP:	48:8mYdOTX7stHtidAKZdA1JehwiZUklqehRdy+3:8mVsdwdy
MD5:	165616D92DE67989DC3D06CC37CBFBE4
SHA1:	E5A506609E093F54AFA7786A1F36100375749821
SHA-256:	1376647F2B2C173B0692909D99FE1495F8B83A9C6286997E86B0A3EECD00778A
SHA-512:	8FFFC19AC29F216EA6320A2C31CB2643AA0850BCB6F10B5BA8A0459C626D411D76619B36E3CF1DB813A7CFDAE0D93520EECDB62E18A2A4A9553D075D2C34655D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......#.5......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.ImY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VmY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VmY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VmY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VmY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........{..^.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	Microsoft OOXML
Entropy (8bit):	7.994047925906876
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	Pmendon.ext_Reord_Adjustment.docx
File size:	137'779 bytes
MD5:	5b103f7bf3ff14cef45567a527812be1
SHA1:	dcae3fddbcc4248154c2b90f3036e3fe19b3426f
SHA256:	488f034dd875312ed8ef92a540c677865269bfacd573d90455fc93dc6251474d
SHA512:	80f781a2e52998f3f479e6fc5288b330acd2167aab086b20fb6dfa5544a2714ab5230020db78e9525882834e2b642a4cf3f8541ead81b4de7ad94059a773c718
SSDEEP:	3072:gm7rZHgCTmSCuPV1eMfU5P7iSKJB8BOaV8BSDoMMhvK4ST:BnZdqkVKP7jKJB8kAwxMMAT
TLSH:	EDD31269CC1C9477F083FF30ED695880E98897E95547E351BC9A8247E5B31CCEB6260B
File Content Preview:	PK.........nmY................[Content_Types].xml..OO.0...\|.(..P....VM9,p\.(b..3i..'....g.h...)[.D.g.{...gz.dM....wuqTM.....v...._.'E.$]#.wP....tv0.o.`.b.u.".?.@..+....WZ..$~.K....K.?&.c..#pTR..g.3h..Pv....H~.`.g.^.SV.k.......7,I......Id.F+I\...y7K.:G....

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 17:28:56.422385931 CET	53	54924	1.1.1.1	192.168.2.17
Nov 13, 2024 17:28:56.428670883 CET	65064	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:28:56.428847075 CET	62905	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:28:56.441170931 CET	53	65064	1.1.1.1	192.168.2.17
Nov 13, 2024 17:28:56.441180944 CET	53	62905	1.1.1.1	192.168.2.17
Nov 13, 2024 17:28:56.486299992 CET	53	52190	1.1.1.1	192.168.2.17
Nov 13, 2024 17:28:57.404319048 CET	54569	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:28:57.404319048 CET	55225	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:28:57.733145952 CET	53	50564	1.1.1.1	192.168.2.17
Nov 13, 2024 17:28:57.943727016 CET	53	54569	1.1.1.1	192.168.2.17
Nov 13, 2024 17:28:58.224303961 CET	53	55225	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:01.165375948 CET	62156	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:01.165601969 CET	62229	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:01.172250032 CET	53	62156	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:01.172672987 CET	53	62229	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:04.645173073 CET	62744	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:04.645427942 CET	51515	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:04.803235054 CET	53	62744	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:04.947940111 CET	53	51515	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:08.319380999 CET	63137	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:08.319560051 CET	65034	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:08.337538958 CET	64896	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:08.337678909 CET	57359	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:08.338211060 CET	62932	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:08.338362932 CET	54273	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:08.344575882 CET	53	64896	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:08.345207930 CET	53	57359	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:08.346007109 CET	53	54273	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:09.106856108 CET	57664	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:09.106996059 CET	52766	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:09.116213083 CET	53	52766	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:09.238811970 CET	53	56125	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:09.810400009 CET	62095	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:09.810568094 CET	50822	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:09.856405020 CET	63468	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:09.856564999 CET	53874	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:09.861032009 CET	57727	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:09.861488104 CET	50090	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:09.867661953 CET	53	63468	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:09.876272917 CET	53	53874	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:10.106508970 CET	65526	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:10.106899023 CET	55140	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:10.114598036 CET	53	65526	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:10.115823984 CET	53	55140	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:11.014821053 CET	60764	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.014985085 CET	63217	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.015656948 CET	65396	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.015866995 CET	59078	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.026118040 CET	53	60764	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:11.035794973 CET	53	63217	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:11.137501955 CET	53	55618	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:11.192941904 CET	57542	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.193125010 CET	54880	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.207684040 CET	53	54880	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:11.207703114 CET	53	57542	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:11.263899088 CET	51343	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.264043093 CET	64112	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.264448881 CET	50559	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.264632940 CET	63623	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.265002966 CET	64629	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.265444040 CET	52245	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.265444040 CET	52933	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.265851974 CET	49243	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:11.282845974 CET	53	63623	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:11.286459923 CET	53	49791	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:11.290632010 CET	53	64112	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:11.298357964 CET	53	50559	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:11.305058002 CET	53	51343	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:12.355619907 CET	62428	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.355789900 CET	55204	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.362545967 CET	63871	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.362938881 CET	56853	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.363282919 CET	64476	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.363467932 CET	52898	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.363955021 CET	61855	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.363955021 CET	55043	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.364085913 CET	53	55204	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:12.364130020 CET	53	62428	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:12.372340918 CET	53	56853	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:12.386812925 CET	60469	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.386812925 CET	60666	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.571336985 CET	59992	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.571337938 CET	62277	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.575752974 CET	56362	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.575752974 CET	51757	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.583668947 CET	53	51757	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:12.594527960 CET	53	56362	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:12.642869949 CET	59329	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.643018007 CET	56165	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.643456936 CET	50898	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.643547058 CET	62832	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.647058010 CET	60354	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.647244930 CET	65072	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:12.650944948 CET	53	56165	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:12.654268980 CET	53	65072	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.308866024 CET	53647	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.309040070 CET	62469	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.315442085 CET	64658	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.315699100 CET	52615	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.316603899 CET	53	53647	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.319459915 CET	53	62469	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.323065042 CET	57880	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.323667049 CET	56473	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.323853016 CET	53	64658	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.323868036 CET	53	52615	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.332278013 CET	53	57880	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.341759920 CET	53	56473	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.495224953 CET	58049	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.495435953 CET	52087	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.503499985 CET	53	52087	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.503609896 CET	53	58049	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.509042025 CET	57128	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.509196997 CET	58896	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.558469057 CET	54369	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.558661938 CET	51505	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.659977913 CET	51895	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.660154104 CET	64327	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.667705059 CET	53	64327	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.684154034 CET	63196	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.684154034 CET	64566	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.691442013 CET	53	64566	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.771857023 CET	56997	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.771940947 CET	58664	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.773720980 CET	62088	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.773853064 CET	51087	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.780028105 CET	53	56997	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.784020901 CET	53	58664	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.796546936 CET	64073	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.796546936 CET	54014	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.804439068 CET	53	54014	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.805422068 CET	53	64073	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.836523056 CET	58085	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.837162018 CET	63768	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:13.844415903 CET	53	63768	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:13.861535072 CET	53	64832	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.530327082 CET	56217	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.530664921 CET	63492	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.537704945 CET	53	56217	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.538031101 CET	53	63492	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.538664103 CET	57678	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.545929909 CET	53	57678	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.547856092 CET	64488	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.548098087 CET	59075	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.565220118 CET	53	64488	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.565566063 CET	53	59075	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.621176004 CET	65462	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.621340990 CET	61834	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.625338078 CET	50996	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.625515938 CET	50494	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.628921032 CET	53	61834	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.629683971 CET	50735	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.629975080 CET	52903	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.631309986 CET	53	65462	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.632275105 CET	53	50996	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.635011911 CET	53	50494	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.637878895 CET	53	50735	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.637893915 CET	53	52903	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.654098034 CET	53	60476	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.656941891 CET	55327	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.657103062 CET	58378	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.664176941 CET	53	58378	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.959814072 CET	62093	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.959942102 CET	53443	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.967170954 CET	53	53443	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.967185974 CET	53	62093	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.975090027 CET	54542	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.975388050 CET	60391	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.975600958 CET	56174	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.975753069 CET	60039	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.981813908 CET	53	54542	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.982671022 CET	53	56174	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.982949018 CET	53	60039	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.983339071 CET	53	60391	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:14.994450092 CET	59212	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:14.994575024 CET	63885	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.001272917 CET	53	59212	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.001400948 CET	53	63885	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.013305902 CET	60619	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.013439894 CET	60908	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.020468950 CET	53	60619	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.020894051 CET	53	60908	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.390630007 CET	63316	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.390773058 CET	54786	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.398514032 CET	53	63316	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.399465084 CET	53	54786	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.724603891 CET	62847	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.724821091 CET	57400	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.726790905 CET	59152	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.726854086 CET	57056	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.737445116 CET	53	62847	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.738162994 CET	53	57400	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.742809057 CET	53	59152	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.743793011 CET	53	57056	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.765047073 CET	64453	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.765228033 CET	54442	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.787735939 CET	53	64453	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.788917065 CET	53	54442	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.870628119 CET	51196	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.870764971 CET	54034	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.878066063 CET	53	51196	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.878278971 CET	53	54034	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.955984116 CET	56363	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.956198931 CET	53824	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:15.963023901 CET	53	56363	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:15.963083982 CET	53	53824	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:16.091661930 CET	53	55962	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:16.102703094 CET	65361	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:16.102703094 CET	55207	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:16.121324062 CET	53	55207	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:16.145618916 CET	53	65361	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:16.177546978 CET	58065	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:16.177546978 CET	53003	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:16.699918985 CET	50057	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:16.700042963 CET	60564	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:16.908674002 CET	58285	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:16.908837080 CET	58281	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:16.916418076 CET	53	58285	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:16.916604042 CET	53	58281	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.109719992 CET	62927	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.110619068 CET	54205	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.117687941 CET	53	62927	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.118482113 CET	53	54205	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.181214094 CET	65519	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.181355953 CET	63102	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.183393955 CET	63343	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.183530092 CET	61625	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.274859905 CET	53	63102	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.276372910 CET	53	65519	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.434492111 CET	58159	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.434657097 CET	56460	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.438810110 CET	57619	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.439095974 CET	50337	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.439547062 CET	59006	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.439698935 CET	64834	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.443077087 CET	53	56460	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.443114996 CET	53	58159	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.446818113 CET	53	64834	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.446963072 CET	53	59006	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.446993113 CET	53	57619	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.447910070 CET	53	50337	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.688951969 CET	54637	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.689356089 CET	56865	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.697459936 CET	53	54637	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.698065996 CET	53	56865	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.720202923 CET	63576	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.720642090 CET	62180	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:17.727618933 CET	53	63576	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:17.728295088 CET	53	62180	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:18.016087055 CET	64266	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:18.016087055 CET	57277	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:18.023258924 CET	53	64266	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:18.024421930 CET	53	57277	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:18.251940966 CET	52176	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:18.251940966 CET	61801	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:18.259061098 CET	53	52176	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:18.259074926 CET	53	61801	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:18.538569927 CET	63674	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:18.538805962 CET	63745	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:18.545734882 CET	53	63674	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:18.545777082 CET	53	63745	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:18.586992025 CET	63255	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:18.587153912 CET	60667	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:18.595474005 CET	53	60667	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:19.147665024 CET	59998	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:19.147826910 CET	59976	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:19.154795885 CET	53	59976	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:19.156439066 CET	53	59998	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:20.000610113 CET	65320	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:20.000766039 CET	54285	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:20.009500980 CET	53	65320	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:20.010296106 CET	53	54285	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:21.725660086 CET	49764	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:21.725779057 CET	54257	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:21.733283043 CET	53	49764	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:21.733350039 CET	53	54257	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:23.993839979 CET	50736	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:23.994791031 CET	58332	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:24.003150940 CET	53	58332	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:28.113799095 CET	61850	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:28.113954067 CET	51283	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:28.121236086 CET	53	51283	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:28.367132902 CET	49316	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:28.374250889 CET	53	49316	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:32.027688026 CET	53	56267	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:45.726120949 CET	51559	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:29:45.733755112 CET	53	51559	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:53.335628986 CET	53	59760	1.1.1.1	192.168.2.17
Nov 13, 2024 17:29:56.354823112 CET	53	56587	1.1.1.1	192.168.2.17
Nov 13, 2024 17:30:01.226182938 CET	53904	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:01.226361990 CET	62858	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:01.233498096 CET	53	62858	1.1.1.1	192.168.2.17
Nov 13, 2024 17:30:01.235136986 CET	53	53904	1.1.1.1	192.168.2.17
Nov 13, 2024 17:30:07.129084110 CET	138	138	192.168.2.17	192.168.2.255
Nov 13, 2024 17:30:16.220377922 CET	59442	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:16.220571041 CET	62114	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:16.238677025 CET	53	59442	1.1.1.1	192.168.2.17
Nov 13, 2024 17:30:16.242728949 CET	53	62114	1.1.1.1	192.168.2.17
Nov 13, 2024 17:30:17.602591038 CET	51297	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:17.602849960 CET	60251	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:17.610207081 CET	53	60251	1.1.1.1	192.168.2.17
Nov 13, 2024 17:30:17.626107931 CET	53	51297	1.1.1.1	192.168.2.17
Nov 13, 2024 17:30:19.826196909 CET	61475	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:19.826328993 CET	51756	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:21.011850119 CET	58041	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:21.011987925 CET	63547	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:22.113467932 CET	53	63874	1.1.1.1	192.168.2.17
Nov 13, 2024 17:30:26.012783051 CET	51018	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:26.012980938 CET	51242	53	192.168.2.17	1.1.1.1
Nov 13, 2024 17:30:26.240856886 CET	53	51242	1.1.1.1	192.168.2.17

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 13, 2024 17:28:58.224436045 CET	192.168.2.17	1.1.1.1	c237	(Port unreachable)	Destination Unreachable
Nov 13, 2024 17:29:04.948009014 CET	192.168.2.17	1.1.1.1	c229	(Port unreachable)	Destination Unreachable
Nov 13, 2024 17:29:11.035871029 CET	192.168.2.17	1.1.1.1	c262	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-11-13 16:28:57 UTC	864	OUT	GET /?e=email-activity&h=PROD&u=60e82f265911d0314d7422c2&ue=consumer&cl=5e2e8dd7fcfabf10d812e952&c=61dec6ecbd90fb61c1705cd7&cs=1&ec=0&a=link-clicked&rt=Read%20More.&r=https://sepedatua.com/158983/secure-redirect HTTP/1.1 Host: r.neurotags.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 16:28:57 UTC	313	IN	HTTP/1.1 302 Found Date: Wed, 13 Nov 2024 16:28:57 GMT Server: Apache/2.4.41 (Ubuntu) Set-Cookie: B=9080aa16.626cdd49a2c48; path=/; max-age=630720000; domain=.neurotags.com Location: https://sepedatua.com/158983/secure-redirect Content-Length: 1 Connection: close Content-Type: text/html; charset=UTF-8
2024-11-13 16:28:57 UTC	1	IN	Data Raw: 0a Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-11-13 16:28:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-13 16:28:58 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 16:28:58 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 16:27:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 31dac266-cf7e-4033-a1c4-9b58cf0f5a87 PPServer: PPV: 30 H: PH1PEPF00018BDD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 16:28:57 GMT Connection: close Content-Length: 11392
2024-11-13 16:28:58 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-11-13 16:28:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-13 16:28:59 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 16:29:00 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 16:27:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: dc16c856-1db2-44dc-8569-afaaa52d55d5 PPServer: PPV: 30 H: SN1PEPF0002F941 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 16:28:59 GMT Connection: close Content-Length: 11392
2024-11-13 16:29:00 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-11-13 16:29:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-13 16:29:01 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-13 16:29:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 13 Nov 2024 16:28:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 52511343-3f93-441e-975c-722f5d2c452e PPServer: PPV: 30 H: PH1PEPF0001B695 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 13 Nov 2024 16:29:01 GMT Connection: close Content-Length: 11392
2024-11-13 16:29:01 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-11-13 16:29:02 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bspA476fsYy55S4&MD=WXEEmc47 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-13 16:29:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 39cdf40b-848f-429f-9222-c718c8484074 MS-RequestId: 435f320e-c660-4ede-9df3-b3719b6cc269 MS-CV: ouoCMfkZQEWOEH8t.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 13 Nov 2024 16:29:01 GMT Connection: close Content-Length: 24490
2024-11-13 16:29:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-13 16:29:02 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1