Edit tour

Windows Analysis Report
http://exeteraaletter.estreamone.com

Overview

General Information

Sample URL:	http://exeteraaletter.estreamone.com
Analysis ID:	1638634
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2060,i,4031769586313537784,12686462495390506624,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2088 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6384 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://exeteraaletter.estreamone.com" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Suricata Signatures

ET PHISHING Suspicious SSN Parameter in HTTP POST - Possible Phishing

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T15:37:54.021449+0100	2026908	1	A Network Trojan was detected	192.168.2.7	49713	173.227.26.56	443	TCP
2025-03-14T15:38:06.026050+0100	2026908	1	A Network Trojan was detected	192.168.2.7	49715	173.227.26.56	443	TCP
2025-03-14T15:38:14.176642+0100	2026908	1	A Network Trojan was detected	192.168.2.7	49723	173.227.26.56	443	TCP
2025-03-14T15:38:22.857420+0100	2026908	1	A Network Trojan was detected	192.168.2.7	49727	173.227.26.56	443	TCP
2025-03-14T15:38:31.461150+0100	2026908	1	A Network Trojan was detected	192.168.2.7	49730	173.227.26.56	443	TCP
2025-03-14T15:38:46.602589+0100	2026908	1	A Network Trojan was detected	192.168.2.7	54831	173.227.26.56	443	TCP

HTTP traffic detected: POST / HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-aliveContent-Length: 228Cache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Origin: https://exeteraaletter.estreamone.comContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Mar 2025 14:37:41 GMTServer: KestrelCache-Control: no-store,no-cachePragma: no-cacheContent-Type: text/html; charset=utf-8X-Powered-By: ASP.NETConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Mar 2025 14:37:53 GMTServer: KestrelCache-Control: no-store,no-cachePragma: no-cacheContent-Type: text/html; charset=utf-8X-Powered-By: ASP.NETConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Mar 2025 14:38:06 GMTServer: KestrelCache-Control: no-store,no-cachePragma: no-cacheContent-Type: text/html; charset=utf-8X-Powered-By: ASP.NETConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Mar 2025 14:38:13 GMTServer: KestrelCache-Control: no-store,no-cachePragma: no-cacheContent-Type: text/html; charset=utf-8X-Powered-By: ASP.NETConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Mar 2025 14:38:22 GMTServer: KestrelCache-Control: no-store,no-cachePragma: no-cacheContent-Type: text/html; charset=utf-8X-Powered-By: ASP.NETConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Mar 2025 14:38:31 GMTServer: KestrelCache-Control: no-store,no-cachePragma: no-cacheContent-Type: text/html; charset=utf-8X-Powered-By: ASP.NETConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Mar 2025 14:38:46 GMTServer: KestrelCache-Control: no-store,no-cachePragma: no-cacheContent-Type: text/html; charset=utf-8X-Powered-By: ASP.NETConnection: closeTransfer-Encoding: chunked

Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://2k.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://33across.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://360yield.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://3lift.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://a-mo.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://acxiom.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ad-score.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ad-stir.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ad.gt
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adentifi.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adform.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adingo.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://admatrix.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://admission.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://admixer.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adnami.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adnxs.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adroll.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adsafeprotected.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adscale.de
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adsmeasurement.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adsrvr.org
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adswizz.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adthrive.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://adtrafficquality.google
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://advividnetwork.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://aggregation-service-site-dot-clz200258-datateam-italy.ew.r.appspot.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://akpytela.cz
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://alketech.eu
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://amazon-adsystem.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://aniview.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://anonymised.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://apex-football.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://aphub.ai
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://appconsent.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://appier.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://appsflyer.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://appsflyersdk.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://aqfer.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://atirun.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://atomex.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://audience360.com.au
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://audienceproject.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://authorizedvault.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://avads.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ayads.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://azubiyo.de
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://beaconmax.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://bidswitch.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://bidtheatre.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://blendee.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://bluems.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://boost-web.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://bounceexchange.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://bypass.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://casalemedia.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://cazamba.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://cdn-net.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://clickonometrics.pl
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://connatix.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://connected-stories.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://convertunits.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://coupang.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://cpx.to
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://crcldu.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://creative-serving.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://creativecdn.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://criteo.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ctnsnet.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://d-edgeconnect.media
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://dabbs.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://dailymail.co.uk
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://dailymotion.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://daum.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://deepintent.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://demand.supply
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://display.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://disqus.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://docomo.ne.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://dotdashmeredith.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://dotomi.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://doubleclick.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://doubleverify.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://dreammail.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://dynalyst.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ebayadservices.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ebis.ne.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://edkt.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://elle.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://elnacional.cat
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://eloan.co.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://euleriancdn.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://explorefledge.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ezoic.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://fanbyte.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://fandom.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://finn.no
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://flashtalking.com
Source: chromecache_70.1.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_70.1.dr	String found in binary or memory: https://fontawesome.com/license
Source: chromecache_69.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBGEe.woff2)
Source: chromecache_69.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBGEe.woff2)
Source: chromecache_69.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBGEe.woff2)
Source: chromecache_69.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3KUBGEe.woff2)
Source: chromecache_69.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3OUBGEe.woff2)
Source: chromecache_69.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBGEe.woff2)
Source: chromecache_69.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2)
Source: chromecache_69.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBGEe.woff2)
Source: chromecache_69.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBGEe.woff2)
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://fout.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://fwmrm.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://gama.globo
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://get3rdspace.com
Source: chromecache_63.1.dr, chromecache_64.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://getcapi.co
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://getyourguide.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ghtinc.com
Source: chromecache_63.1.dr, chromecache_64.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_64.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://globo.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://gmossp-sp.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://gokwik.co
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://google-analytics.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://googleadservices.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://googlesyndication.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://grxchange.gr
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://gsspat.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://gumgum.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://gunosy.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://halcy.de
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://html-load.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://i-mobile.co.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://im-apps.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://impact-ad.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://indexww.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ingereck.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://inmobi.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://innovid.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://iobeya.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://jivox.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://jkforum.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://kargo.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://kidoz.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://kompaspublishing.nl
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ladsp.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://linkedin.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://logly.co.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://lucead.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://lwadm.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://mail.ru
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://media.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://media6degrees.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://mediaintelligence.de
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://mediamath.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://mediavine.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://metro.co.uk
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://microad.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://momento.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://moshimo.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://naver.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://nexxen.tech
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://nhnace.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://nodals.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://onet.pl
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://onetag-sys.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://open-bid.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://openx.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://optable.co
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://outbrain.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://paa-reporting-advertising.amazon
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://payment.goog
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://permutive.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://pinterest.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://postrelease.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://presage.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://primecaster.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-ad-server.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-a.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-b.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-x.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp-y.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-dsp.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-a.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-b.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-x.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp-y.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-demos-ssp.dev
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandbox-test.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-ad-server.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-a1.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-b1.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-x.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp-y.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-dsp.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-a.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-b.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-x.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp-y.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://privacy-sandcastle-dev-ssp.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://ptb-msmt-static-5jyy5ulagq-uc.a.run.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://pub.network
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://pubmatic.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://pubtm.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://quantserve.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://quora.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://r2b2.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://relevant-digital.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://retargetly.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://rubiconproject.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://samplicio.us
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://sascdn.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://seedtag.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://semafor.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://sephora.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://shared-storage-demo-content-producer.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://shared-storage-demo-publisher-a.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://shared-storage-demo-publisher-b.web.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://shinobi.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://shinystat.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://simeola.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://singular.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://sitescout.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://smadexprivacysandbox.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://snapchat.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://socdm.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://sportradarserving.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://stackadapt.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://storygize.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://superfine.org
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://t13.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://taboola.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://tailtarget.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://tamedia.com.tw
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://tangooserver.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://teads.tv
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://theryn.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://tiktok.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://tncid.app
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://toponad.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://torneos.gg
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://tpmark.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://tribalfusion.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://trip.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://triptease.io
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://trkkn.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://tya-dev.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://uinterbox.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://undertone.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://unrulymedia.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://uol.com.br
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://usemax.de
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://validate.audio
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://verve.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://vg.no
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://vidazoo.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://vpadn.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://washingtonpost.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://weborama-tech.ru
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://weborama.fr
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://wepowerconnections.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://worldhistory.org
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://wp.pl
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://yahoo.co.jp
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://yahoo.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://yelp.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://yieldlab.net
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://yieldmo.com
Source: privacy-sandbox-attestations.dat.0.dr	String found in binary or memory: https://youronlinechoices.eu

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54827
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54829
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54831
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 54829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 142.250.185.68:443 -> 192.168.2.7:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.227.26.56:443 -> 192.168.2.7:49690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.7:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.7:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.227.26.56:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.7:49718 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir5048_1879947550	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_690078298	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_690078298\privacy-sandbox-attestations.dat	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_690078298\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_690078298\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_690078298\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_690078298\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir5048_1747828124	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5048_1879947550

Jump to behavior

Source: classification engine

Classification label: mal48.phis.win@23/28@14/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2060,i,4031769586313537784,12686462495390506624,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2088 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://exeteraaletter.estreamone.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2060,i,4031769586313537784,12686462495390506624,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2088 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://exeteraaletter.estreamone.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
https://exeteraaletter.estreamone.com/images/favicon-32x32.png	0%	Avira URL Cloud	safe
https://exeteraaletter.estreamone.com/js/bootstrap.bundle.min.js	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
exeteraaletter.estreamone.com	173.227.26.56	true	true	unknown
code.jquery.com	151.101.2.137	true	false	high
www.google.com	142.250.185.68	true	false	high
use.fontawesome.com.cdn.cloudflare.net	104.21.27.152	true	false	high
use.fontawesome.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://exeteraaletter.estreamone.com/images/favicon-32x32.png	true	Avira URL Cloud: safe	unknown
https://use.fontawesome.com/releases/v5.0.13/css/all.css	false		high
https://exeteraaletter.estreamone.com/js/bootstrap.bundle.min.js	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://mediavine.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://connatix.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://yelp.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://nodals.io	privacy-sandbox-attestations.dat.0.dr	false	high
https://getyourguide.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://mediaintelligence.de	privacy-sandbox-attestations.dat.0.dr	false	high
https://privacy-sandcastle-dev-dsp.web.app	privacy-sandbox-attestations.dat.0.dr	false	high
https://privacy-sandbox-demos-dsp-a.dev	privacy-sandbox-attestations.dat.0.dr	false	high
https://permutive.app	privacy-sandbox-attestations.dat.0.dr	false	high
https://privacy-sandbox-demos-dsp.dev	privacy-sandbox-attestations.dat.0.dr	false	high
https://adthrive.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://ad.gt	privacy-sandbox-attestations.dat.0.dr	false	high
https://gumgum.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://trkkn.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://logly.co.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://media6degrees.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://fontawesome.com	chromecache_70.1.dr	false	high
https://privacy-sandcastle-dev-ssp.web.app	privacy-sandbox-attestations.dat.0.dr	false	high
https://inmobi.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://33across.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_64.1.dr	false	high
https://dreammail.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://jkforum.net	privacy-sandbox-attestations.dat.0.dr	false	high
https://iobeya.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://a-mo.net	privacy-sandbox-attestations.dat.0.dr	false	high
https://ebis.ne.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://privacy-sandbox-demos-ssp-y.dev	privacy-sandbox-attestations.dat.0.dr	false	high
https://aphub.ai	privacy-sandbox-attestations.dat.0.dr	false	high
https://gama.globo	privacy-sandbox-attestations.dat.0.dr	false	high
https://audienceproject.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://adsrvr.org	privacy-sandbox-attestations.dat.0.dr	false	high
https://finn.no	privacy-sandbox-attestations.dat.0.dr	false	high
https://lucead.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://verve.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://r2b2.io	privacy-sandbox-attestations.dat.0.dr	false	high
https://bluems.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://edkt.io	privacy-sandbox-attestations.dat.0.dr	false	high
https://atomex.net	privacy-sandbox-attestations.dat.0.dr	false	high
https://crcldu.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://rubiconproject.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://sitescout.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://apex-football.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://dotomi.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://ctnsnet.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://toponad.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://shinobi.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://superfine.org	privacy-sandbox-attestations.dat.0.dr	false	high
https://360yield.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://usemax.de	privacy-sandbox-attestations.dat.0.dr	false	high
https://display.io	privacy-sandbox-attestations.dat.0.dr	false	high
https://adform.net	privacy-sandbox-attestations.dat.0.dr	false	high
https://eloan.co.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://postrelease.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://aqfer.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://docomo.ne.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://shared-storage-demo-publisher-a.web.app	privacy-sandbox-attestations.dat.0.dr	false	high
https://weborama-tech.ru	privacy-sandbox-attestations.dat.0.dr	false	high
https://innovid.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://demand.supply	privacy-sandbox-attestations.dat.0.dr	false	high
https://nexxen.tech	privacy-sandbox-attestations.dat.0.dr	false	high
https://2k.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://advividnetwork.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://undertone.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://creative-serving.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://unrulymedia.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://tailtarget.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://paa-reporting-advertising.amazon	privacy-sandbox-attestations.dat.0.dr	false	high
https://privacy-sandbox-demos-ssp-b.dev	privacy-sandbox-attestations.dat.0.dr	false	high
https://bypass.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://dotdashmeredith.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://atirun.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://adingo.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://impact-ad.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://admatrix.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://openx.net	privacy-sandbox-attestations.dat.0.dr	false	high
https://taboola.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://ayads.io	privacy-sandbox-attestations.dat.0.dr	false	high
https://i-mobile.co.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://uinterbox.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://mail.ru	privacy-sandbox-attestations.dat.0.dr	false	high
https://simeola.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://gmossp-sp.jp	privacy-sandbox-attestations.dat.0.dr	false	high
https://primecaster.net	privacy-sandbox-attestations.dat.0.dr	false	high
https://privacy-sandcastle-dev-ssp-a.web.app	privacy-sandbox-attestations.dat.0.dr	false	high
https://worldhistory.org	privacy-sandbox-attestations.dat.0.dr	false	high
https://fontawesome.com/license	chromecache_70.1.dr	false	high
https://adnxs.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://dabbs.net	privacy-sandbox-attestations.dat.0.dr	false	high
https://seedtag.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://casalemedia.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://privacy-sandcastle-dev-dsp-x.web.app	privacy-sandbox-attestations.dat.0.dr	false	high
https://authorizedvault.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://privacy-sandcastle-dev-ssp-y.web.app	privacy-sandbox-attestations.dat.0.dr	false	high
https://sportradarserving.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://semafor.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://lwadm.com	privacy-sandbox-attestations.dat.0.dr	false	high
https://appconsent.io	privacy-sandbox-attestations.dat.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
104.21.27.152	use.fontawesome.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
173.227.26.56	exeteraaletter.estreamone.com	United States	3549	LVLT-3549US	true

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638634
Start date and time:	2025-03-14 15:36:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://exeteraaletter.estreamone.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@23/28@14/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): sppsvc.exe, SIHClient.exe, SgrmBroker.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.110, 172.217.16.195, 172.217.16.206, 142.251.168.84, 142.251.13.139, 142.251.13.100, 142.251.13.101, 142.251.13.102, 142.251.13.138, 142.251.13.113, 142.250.185.78, 142.250.185.174, 216.58.206.78, 216.58.206.42, 142.250.184.227, 142.250.185.74, 142.250.184.234, 142.250.186.138, 216.58.212.170, 142.250.181.234, 142.250.185.234, 142.250.186.170, 142.250.186.106, 142.250.184.202, 142.250.186.74, 142.250.185.106, 172.217.16.202, 142.250.185.170, 142.250.186.42, 142.250.185.202, 199.232.210.172, 142.250.186.110, 142.250.186.131, 34.104.35.123, 4.245.163.56, 23.199.214.10
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://exeteraaletter.estreamone.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1792
Entropy (8bit):	6.019348476983808
Encrypted:	false
SSDEEP:	48:p/hP+drAdRW37aktiyC2xCe69xqYGCRk7NOzPI4Ek:RSQw37anyC+CDGGccA4f
MD5:	0F48EA696FDF31DABB72FD4A472E4A93
SHA1:	A24862DAB4B7146073F74165D733E8EDA45C5185
SHA-256:	57645239B1AECD3BFF0EDF2C489A55221855D4DD690541F57129449D34DC2CE6
SHA-512:	1A32EE516B00800EBE49A17D0DC05A0A21589016A28A6B0CA2934A951DF0E09CDF46B75A9DE7AF62435807DF1EEB10F128284E03AD84A324F7F71EE9AD191CBF
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoib1hRamtrQnY5dDFiX1Jzc0NBNjJhNzEwZEZZYVl2MktzOHpZTUFXWEUxMCJ9LHsicGF0aCI6InByaXZhY3ktc2FuZGJveC1hdHRlc3RhdGlvbnMuZGF0Iiwicm9vdF9oYXNoIjoiSnBiZFpKbk9wY0tXZE1zWVhZQVozTzNJR1BDZkg1NzZaS1FqbjZWUEtfZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5paWtoZGdhamxwaGZlaGVwYWJoaGJsYWtiZGdlZWZqIiwiaXRlbV92ZXJzaW9uIjoiMjAyNS4zLjEyLjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"D1yGWCJ13w_a4aZS-GmRy1UaSnKuPyDaexx705PHm_LYjgxXA8UjTQ9bScleEJZkORAwk9gKs65NUkOIZOPGdPUDhQg3gDWqrESXFzPZk4RzaEwwlPh-33zUE0qWXcz4FwKu1WGN_Ok4HrKRgdihn7ea4OvP8VqvfNRP56CMpOuQxMLdGtj33weeTm9wBG2D-g2De2hqPBC6G0Jr9FnJ_wLkuNsuMmotIuVgQMViTCStpvxyrUiSyBwWdJH9By924Uu66zgVGLnpcv5tMoSwVylMy3ouQ3_lj2ul-hu5YJa7RzW2gOxCwb7ZtnFkfFx

Source: https://exeteraaletter.estreamone.com/	Joe Sandbox AI: Score: 8 Reasons: The brand 'Exeter' is associated with Exeter Finance, a known financial services company., The URL 'exeteraaletter.estreamone.com' does not match the legitimate domain 'exeterfinance.com'., The domain 'estreamone.com' is not directly associated with Exeter Finance, which raises suspicion., The presence of sensitive input fields like 'Zip Code' and 'Last Four of SSN' on a non-legitimate domain is a common phishing tactic., The use of a subdomain and additional characters in the URL suggests a potential phishing attempt. DOM: 0.0.pages.csv
Source: https://exeteraaletter.estreamone.com/	Joe Sandbox AI: Score: 8 Reasons: The brand 'Exeter' is associated with Exeter Finance, a known financial services company., The URL 'exeteraaletter.estreamone.com' does not match the legitimate domain 'exeterfinance.com'., The domain 'estreamone.com' is not directly associated with Exeter Finance, which raises suspicion., The presence of sensitive input fields like 'Zip Code' and 'Last Four of SSN' on a non-legitimate domain increases the risk of phishing., The use of a subdomain and additional characters in 'exeteraaletter' suggests potential phishing tactics. DOM: 0.1.pages.csv

Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="author".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="author".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="author".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="author".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="author".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="author".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="author".. found

Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://exeteraaletter.estreamone.com/	HTTP Parser: No <meta name="copyright".. found

Source: Network traffic	Suricata IDS: 2026908 - Severity 1 - ET PHISHING Suspicious SSN Parameter in HTTP POST - Possible Phishing : 192.168.2.7:49713 -> 173.227.26.56:443
Source: Network traffic	Suricata IDS: 2026908 - Severity 1 - ET PHISHING Suspicious SSN Parameter in HTTP POST - Possible Phishing : 192.168.2.7:49723 -> 173.227.26.56:443
Source: Network traffic	Suricata IDS: 2026908 - Severity 1 - ET PHISHING Suspicious SSN Parameter in HTTP POST - Possible Phishing : 192.168.2.7:49715 -> 173.227.26.56:443
Source: Network traffic	Suricata IDS: 2026908 - Severity 1 - ET PHISHING Suspicious SSN Parameter in HTTP POST - Possible Phishing : 192.168.2.7:54831 -> 173.227.26.56:443
Source: Network traffic	Suricata IDS: 2026908 - Severity 1 - ET PHISHING Suspicious SSN Parameter in HTTP POST - Possible Phishing : 192.168.2.7:49727 -> 173.227.26.56:443
Source: Network traffic	Suricata IDS: 2026908 - Severity 1 - ET PHISHING Suspicious SSN Parameter in HTTP POST - Possible Phishing : 192.168.2.7:49730 -> 173.227.26.56:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.227
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.227
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /releases/v5.0.13/css/all.css HTTP/1.1Host: use.fontawesome.comConnection: keep-aliveOrigin: https://exeteraaletter.estreamone.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveOrigin: https://exeteraaletter.estreamone.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/normalize.css HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /css/bootstrap.min.css HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /css/style.css HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /images/exeter-logo.svg HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /js/bootstrap.bundle.min.js HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.6.0.min HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiKo8sBCIWgzQEI9s/OAQiB1s4BCMnczgEIhODOAQii5M4BCK/kzgEI5uTOAQjp5M4BSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon-32x32.png HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /images/exeter-logo.svg HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /images/favicon-32x32.png HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.6.0.min HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.6.0.min HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.6.0.min HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.6.0.min HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.6.0.min HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.6.0.min HTTP/1.1Host: exeteraaletter.estreamone.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://exeteraaletter.estreamone.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: exeteraaletter.estreamone.com
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 15:37:34.443823099 CET	53	60359	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:34.531236887 CET	53	59778	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:35.517623901 CET	53	58871	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:35.645325899 CET	53	52898	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:38.640655041 CET	54217	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:38.640892029 CET	61330	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:38.647679090 CET	53	54217	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:38.648993969 CET	53	61330	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:39.748764992 CET	60331	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:39.749228954 CET	57732	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:39.762615919 CET	53	57732	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:39.767404079 CET	63091	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:39.767560005 CET	56618	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:39.770520926 CET	53	60331	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:39.781713963 CET	53	56618	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:39.790131092 CET	53	63091	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:40.993037939 CET	62857	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:40.993208885 CET	60058	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:40.994563103 CET	54239	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:40.994734049 CET	64045	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:40.999562025 CET	53	62857	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:41.000319958 CET	53	63334	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:41.000623941 CET	53	60058	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:41.001317024 CET	53	64045	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:41.001616001 CET	53	54239	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:42.487652063 CET	53	55599	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:42.506867886 CET	57185	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:42.507033110 CET	61416	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:37:42.528173923 CET	53	57185	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:42.529012918 CET	53	61416	1.1.1.1	192.168.2.7
Mar 14, 2025 15:37:52.602371931 CET	53	50291	1.1.1.1	192.168.2.7
Mar 14, 2025 15:38:11.835656881 CET	53	54146	1.1.1.1	192.168.2.7
Mar 14, 2025 15:38:33.869261980 CET	53	55479	1.1.1.1	192.168.2.7
Mar 14, 2025 15:38:34.819700956 CET	53	57834	1.1.1.1	192.168.2.7
Mar 14, 2025 15:38:35.848882914 CET	53	62243	1.1.1.1	192.168.2.7
Mar 14, 2025 15:38:37.569278002 CET	53	57321	1.1.1.1	192.168.2.7
Mar 14, 2025 15:38:45.636250973 CET	61074	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:38:45.636419058 CET	55799	53	192.168.2.7	1.1.1.1
Mar 14, 2025 15:38:45.642378092 CET	53	64645	1.1.1.1	192.168.2.7
Mar 14, 2025 15:38:45.645052910 CET	53	61074	1.1.1.1	192.168.2.7
Mar 14, 2025 15:38:45.645062923 CET	53	55799	1.1.1.1	192.168.2.7

Timestamp	Bytes transferred	Direction	Data
Mar 14, 2025 15:37:51.644273996 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 14, 2025 15:37:52.276072979 CET	222	IN	HTTP/1.1 304 Not Modified Date: Fri, 14 Mar 2025 14:28:03 GMT Expires: Fri, 14 Mar 2025 15:18:03 GMT Age: 589 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 14, 2025 15:37:52.286839008 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 14, 2025 15:37:52.466207981 CET	222	IN	HTTP/1.1 304 Not Modified Date: Fri, 14 Mar 2025 14:28:11 GMT Expires: Fri, 14 Mar 2025 15:18:11 GMT Age: 581 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:40 UTC	679	OUT	GET / HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-14 14:37:40 UTC	511	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:40 GMT Server: Kestrel Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET Set-Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ; path=/; httponly; samesite=none; secure Connection: close Transfer-Encoding: chunked
2025-03-14 14:37:40 UTC	4960	IN	Data Raw: 64 66 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 21 5b 65 6e 64 69 Data Ascii: df4<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Exeter Finance</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> ...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endi

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:41 UTC	625	OUT	GET /releases/v5.0.13/css/all.css HTTP/1.1 Host: use.fontawesome.com Connection: keep-alive Origin: https://exeteraaletter.estreamone.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-14 14:37:41 UTC	989	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:41 GMT Content-Type: text/css Content-Length: 41065 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=31556926 ETag: "d61bfe9b56c13ecff5313ee3abb45e8b" Last-Modified: Fri, 22 Sep 2023 01:44:09 GMT Vary: Origin, Accept-Encoding CF-Cache-Status: HIT Age: 2563164 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mZjLdWbNWmr0ECXAhCMEhw1vh2%2B2N%2BeOeEIah0Ck5pePqA2w5VGRf0SQvqQfVMc4tiVG%2BBeuToMUZMAHLIuYAq7pQp6pThHKqQEm9NlcsiiKyEA%2B4G4hMQSvs%2B28EsO8G5azkcz8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 920482aee8274262-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1857&min_rtt=1836&rtt_var=731&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1197&delivery_rate=1454183&cwnd=160&unsent_bytes=0&cid=2ed4e722af7febec&ts=154&x=0"
2025-03-14 14:37:41 UTC	380	IN	Data Raw: 2f 2a 21 0a 20 2a 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 46 72 65 65 20 35 2e 30 2e 31 33 20 62 79 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 0a 20 2a 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 20 28 49 63 6f 6e 73 3a 20 43 43 20 42 59 20 34 2e 30 2c 20 46 6f 6e 74 73 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 6f 64 65 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2e 66 61 2c 2e 66 61 62 2c 2e 66 61 6c 2c 2e 66 61 72 2c 2e 66 61 73 7b 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f Data Ascii: /! Font Awesome Free 5.0.13 by @fontawesome - https://fontawesome.com * License - https://fontawesome.com/license (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) */.fa,.fab,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smo
2025-03-14 14:37:41 UTC	1369	IN	Data Raw: 69 7a 65 3a 31 2e 33 33 33 33 33 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 2e 37 35 65 6d 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 2d 2e 30 36 36 37 65 6d 7d 2e 66 61 2d 78 73 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 2e 66 61 2d 73 6d 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 65 6d 7d 2e 66 61 2d 31 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 2e 66 61 2d 32 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 7d 2e 66 61 2d 33 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 65 6d 7d 2e 66 61 2d 34 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 65 6d 7d 2e 66 61 2d 35 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 35 65 6d 7d 2e 66 61 2d 36 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 36 65 6d 7d 2e 66 61 2d 37 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 37 65 6d 7d 2e 66 61 2d 38 Data Ascii: ize:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8
2025-03-14 14:37:41 UTC	1369	IN	Data Raw: 61 6c 7b 2d 6d 73 2d 66 69 6c 74 65 72 3a 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 30 2c 20 6d 69 72 72 6f 72 3d 31 29 22 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 7d 2e 66 61 2d 66 6c 69 70 2d 76 65 72 74 69 63 61 6c 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 59 28 2d 31 29 7d 2e 66 61 2d 66 6c 69 70 2d 68 6f 72 69 7a 6f 6e 74 61 6c 2e 66 61 2d 66 6c 69 70 2d 76 65 72 74 69 63 61 6c 2c 2e 66 61 2d 66 6c 69 70 2d 76 65 72 74 69 63 61 6c 7b 2d 6d 73 2d 66 69 6c 74 65 72 3a 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 Data Ascii: al{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)";transform:scaleX(-1)}.fa-flip-vertical{transform:scaleY(-1)}.fa-flip-horizontal.fa-flip-vertical,.fa-flip-vertical{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(
2025-03-14 14:37:41 UTC	1369	IN	Data Raw: 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 32 63 22 7d 2e 66 61 2d 61 6d 62 75 6c 61 6e 63 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 66 39 22 7d 2e 66 61 2d 61 6d 65 72 69 63 61 6e 2d 73 69 67 6e 2d 6c 61 6e 67 75 61 67 65 2d 69 6e 74 65 72 70 72 65 74 69 6e 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 61 33 22 7d 2e 66 61 2d 61 6d 69 6c 69 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 36 64 22 7d 2e 66 61 2d 61 6e 63 68 6f 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 33 64 22 7d 2e 66 61 2d 61 6e 64 72 6f 69 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 62 22 7d 2e 66 61 2d 61 6e 67 65 6c 6c 69 73 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 30 Data Ascii: e{content:"\f42c"}.fa-ambulance:before{content:"\f0f9"}.fa-american-sign-language-interpreting:before{content:"\f2a3"}.fa-amilia:before{content:"\f36d"}.fa-anchor:before{content:"\f13d"}.fa-android:before{content:"\f17b"}.fa-angellist:before{content:"\f20
2025-03-14 14:37:41 UTC	1369	IN	Data Raw: 2e 66 61 2d 61 72 72 6f 77 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 36 32 22 7d 2e 66 61 2d 61 72 72 6f 77 73 2d 61 6c 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 62 32 22 7d 2e 66 61 2d 61 72 72 6f 77 73 2d 61 6c 74 2d 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 33 37 22 7d 2e 66 61 2d 61 72 72 6f 77 73 2d 61 6c 74 2d 76 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 33 38 22 7d 2e 66 61 2d 61 73 73 69 73 74 69 76 65 2d 6c 69 73 74 65 6e 69 6e 67 2d 73 79 73 74 65 6d 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 61 32 22 7d 2e 66 61 2d 61 73 74 65 72 69 73 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 36 39 22 7d 2e 66 61 2d 61 73 79 6d 6d 65 Data Ascii: .fa-arrow-up:before{content:"\f062"}.fa-arrows-alt:before{content:"\f0b2"}.fa-arrows-alt-h:before{content:"\f337"}.fa-arrows-alt-v:before{content:"\f338"}.fa-assistive-listening-systems:before{content:"\f2a2"}.fa-asterisk:before{content:"\f069"}.fa-asymme
2025-03-14 14:37:41 UTC	1369	IN	Data Raw: 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 38 22 7d 2e 66 61 2d 62 69 6e 6f 63 75 6c 61 72 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 65 35 22 7d 2e 66 61 2d 62 69 72 74 68 64 61 79 2d 63 61 6b 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 66 64 22 7d 2e 66 61 2d 62 69 74 62 75 63 6b 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 31 22 7d 2e 66 61 2d 62 69 74 63 6f 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 39 22 7d 2e 66 61 2d 62 69 74 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 37 61 22 7d 2e 66 61 2d 62 6c 61 63 6b 2d 74 69 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 37 65 22 7d 2e 66 61 2d 62 6c 61 63 6b 62 65 72 Data Ascii: before{content:"\f378"}.fa-binoculars:before{content:"\f1e5"}.fa-birthday-cake:before{content:"\f1fd"}.fa-bitbucket:before{content:"\f171"}.fa-bitcoin:before{content:"\f379"}.fa-bity:before{content:"\f37a"}.fa-black-tie:before{content:"\f27e"}.fa-blackber
2025-03-14 14:37:41 UTC	1369	IN	Data Raw: 6f 6e 74 65 6e 74 3a 22 5c 66 31 65 63 22 7d 2e 66 61 2d 63 61 6c 65 6e 64 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 33 33 22 7d 2e 66 61 2d 63 61 6c 65 6e 64 61 72 2d 61 6c 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 33 22 7d 2e 66 61 2d 63 61 6c 65 6e 64 61 72 2d 63 68 65 63 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 37 34 22 7d 2e 66 61 2d 63 61 6c 65 6e 64 61 72 2d 6d 69 6e 75 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 37 32 22 7d 2e 66 61 2d 63 61 6c 65 6e 64 61 72 2d 70 6c 75 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 37 31 22 7d 2e 66 61 2d 63 61 6c 65 6e 64 61 72 2d 74 69 6d 65 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 37 Data Ascii: ontent:"\f1ec"}.fa-calendar:before{content:"\f133"}.fa-calendar-alt:before{content:"\f073"}.fa-calendar-check:before{content:"\f274"}.fa-calendar-minus:before{content:"\f272"}.fa-calendar-plus:before{content:"\f271"}.fa-calendar-times:before{content:"\f27
2025-03-14 14:37:41 UTC	1369	IN	Data Raw: 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 66 65 22 7d 2e 66 61 2d 63 68 61 72 74 2d 62 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 38 30 22 7d 2e 66 61 2d 63 68 61 72 74 2d 6c 69 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 30 31 22 7d 2e 66 61 2d 63 68 61 72 74 2d 70 69 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 32 30 30 22 7d 2e 66 61 2d 63 68 65 63 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 63 22 7d 2e 66 61 2d 63 68 65 63 6b 2d 63 69 72 63 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 35 38 22 7d 2e 66 61 2d 63 68 65 63 6b 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 34 61 22 7d 2e 66 61 2d 63 68 65 73 73 3a Data Ascii: ore{content:"\f1fe"}.fa-chart-bar:before{content:"\f080"}.fa-chart-line:before{content:"\f201"}.fa-chart-pie:before{content:"\f200"}.fa-check:before{content:"\f00c"}.fa-check-circle:before{content:"\f058"}.fa-check-square:before{content:"\f14a"}.fa-chess:
2025-03-14 14:37:41 UTC	1369	IN	Data Raw: 6e 74 65 6e 74 3a 22 5c 66 33 38 31 22 7d 2e 66 61 2d 63 6c 6f 75 64 2d 75 70 6c 6f 61 64 2d 61 6c 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 38 32 22 7d 2e 66 61 2d 63 6c 6f 75 64 73 63 61 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 38 33 22 7d 2e 66 61 2d 63 6c 6f 75 64 73 6d 69 74 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 38 34 22 7d 2e 66 61 2d 63 6c 6f 75 64 76 65 72 73 69 66 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 38 35 22 7d 2e 66 61 2d 63 6f 64 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 32 31 22 7d 2e 66 61 2d 63 6f 64 65 2d 62 72 61 6e 63 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 32 36 22 7d 2e 66 61 2d 63 6f 64 65 70 65 Data Ascii: ntent:"\f381"}.fa-cloud-upload-alt:before{content:"\f382"}.fa-cloudscale:before{content:"\f383"}.fa-cloudsmith:before{content:"\f384"}.fa-cloudversify:before{content:"\f385"}.fa-code:before{content:"\f121"}.fa-code-branch:before{content:"\f126"}.fa-codepe
2025-03-14 14:37:41 UTC	1369	IN	Data Raw: 3a 22 5c 66 34 65 64 22 7d 2e 66 61 2d 63 72 65 61 74 69 76 65 2d 63 6f 6d 6d 6f 6e 73 2d 72 65 6d 69 78 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 65 65 22 7d 2e 66 61 2d 63 72 65 61 74 69 76 65 2d 63 6f 6d 6d 6f 6e 73 2d 73 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 65 66 22 7d 2e 66 61 2d 63 72 65 61 74 69 76 65 2d 63 6f 6d 6d 6f 6e 73 2d 73 61 6d 70 6c 69 6e 67 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 66 30 22 7d 2e 66 61 2d 63 72 65 61 74 69 76 65 2d 63 6f 6d 6d 6f 6e 73 2d 73 61 6d 70 6c 69 6e 67 2d 70 6c 75 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 34 66 31 22 7d 2e 66 61 2d 63 72 65 61 74 69 76 65 2d 63 6f 6d 6d 6f 6e 73 2d 73 68 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 Data Ascii: :"\f4ed"}.fa-creative-commons-remix:before{content:"\f4ee"}.fa-creative-commons-sa:before{content:"\f4ef"}.fa-creative-commons-sampling:before{content:"\f4f0"}.fa-creative-commons-sampling-plus:before{content:"\f4f1"}.fa-creative-commons-share:before{cont

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:41 UTC	598	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive Origin: https://exeteraaletter.estreamone.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-14 14:37:41 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 3204663 Date: Fri, 14 Mar 2025 14:37:41 GMT X-Served-By: cache-lga21931-LGA, cache-nyc-kteb1890060-NYC X-Cache: HIT, HIT X-Cache-Hits: 5930, 0 X-Timer: S1741963062.550455,VS0,VE1 Vary: Accept-Encoding
2025-03-14 14:37:41 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-14 14:37:41 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-03-14 14:37:41 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-03-14 14:37:41 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-03-14 14:37:41 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-03-14 14:37:41 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-03-14 14:37:41 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-03-14 14:37:41 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-03-14 14:37:41 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-03-14 14:37:41 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:41 UTC	782	OUT	GET /css/normalize.css HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:37:41 UTC	254	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:41 GMT Server: Kestrel Content-Length: 7622 Content-Type: text/css Last-Modified: Mon, 06 Mar 2017 18:10:56 GMT Accept-Ranges: bytes ETag: "1d296a4fff1a5c6" X-Powered-By: ASP.NET Connection: close
2025-03-14 14:37:41 UTC	3829	IN	Data Raw: 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 33 2e 30 2e 31 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 2e 69 6f 2f 6e 6f 72 6d 61 6c 69 7a 65 20 2a 2f 0a 0a 2f 2a 2a 0a 20 2a 20 31 2e 20 53 65 74 20 64 65 66 61 75 6c 74 20 66 6f 6e 74 20 66 61 6d 69 6c 79 20 74 6f 20 73 61 6e 73 2d 73 65 72 69 66 2e 0a 20 2a 20 32 2e 20 50 72 65 76 65 6e 74 20 69 4f 53 20 74 65 78 74 20 73 69 7a 65 20 61 64 6a 75 73 74 20 61 66 74 65 72 20 6f 72 69 65 6e 74 61 74 69 6f 6e 20 63 68 61 6e 67 65 2c 20 77 69 74 68 6f 75 74 20 64 69 73 61 62 6c 69 6e 67 0a 20 2a 20 20 20 20 75 73 65 72 20 7a 6f 6f 6d 2e 0a 20 2a 2f 0a 0a 68 74 6d 6c 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 2f 2a 20 31 20 2a 2f 20 2d 6d 73 Data Ascii: /! normalize.css v3.0.1 \| MIT License \| git.io/normalize //** * 1. Set default font family to sans-serif. * 2. Prevent iOS text size adjust after orientation change, without disabling * user zoom. /html { font-family: sans-serif; / 1 */ -ms
2025-03-14 14:37:41 UTC	3793	IN	Data Raw: 31 2e 20 43 6f 72 72 65 63 74 20 63 6f 6c 6f 72 20 6e 6f 74 20 62 65 69 6e 67 20 69 6e 68 65 72 69 74 65 64 2e 0a 20 2a 20 20 20 20 4b 6e 6f 77 6e 20 69 73 73 75 65 3a 20 61 66 66 65 63 74 73 20 63 6f 6c 6f 72 20 6f 66 20 64 69 73 61 62 6c 65 64 20 65 6c 65 6d 65 6e 74 73 2e 0a 20 2a 20 32 2e 20 43 6f 72 72 65 63 74 20 66 6f 6e 74 20 70 72 6f 70 65 72 74 69 65 73 20 6e 6f 74 20 62 65 69 6e 67 20 69 6e 68 65 72 69 74 65 64 2e 0a 20 2a 20 33 2e 20 41 64 64 72 65 73 73 20 6d 61 72 67 69 6e 73 20 73 65 74 20 64 69 66 66 65 72 65 6e 74 6c 79 20 69 6e 20 46 69 72 65 66 6f 78 20 34 2b 2c 20 53 61 66 61 72 69 2c 20 61 6e 64 20 43 68 72 6f 6d 65 2e 0a 20 2a 2f 0a 0a 62 75 74 74 6f 6e 2c 20 69 6e 70 75 74 2c 20 6f 70 74 67 72 6f 75 70 2c 20 73 65 6c 65 63 74 2c 20 Data Ascii: 1. Correct color not being inherited. * Known issue: affects color of disabled elements. * 2. Correct font properties not being inherited. * 3. Address margins set differently in Firefox 4+, Safari, and Chrome. */button, input, optgroup, select,

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:41 UTC	786	OUT	GET /css/bootstrap.min.css HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:37:41 UTC	256	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:41 GMT Server: Kestrel Content-Length: 161409 Content-Type: text/css Last-Modified: Tue, 19 Jan 2021 15:17:53 GMT Accept-Ranges: bytes ETag: "1d6ee7641b79001" X-Powered-By: ASP.NET Connection: close
2025-03-14 14:37:41 UTC	3827	IN	Data Raw: 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 36 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 31 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 31 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 69 6e 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 3a 72 6f 6f 74 7b 2d 2d 62 6c 75 65 3a 23 30 30 37 62 66 66 3b 2d 2d 69 6e 64 69 67 6f 3a 23 36 36 31 30 66 32 3b 2d 2d 70 75 Data Ascii: /! Bootstrap v4.6.0 (https://getbootstrap.com/) * Copyright 2011-2021 The Bootstrap Authors * Copyright 2011-2021 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE) */:root{--blue:#007bff;--indigo:#6610f2;--pu
2025-03-14 14:37:41 UTC	8192	IN	Data Raw: 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 70 61 64 64 69 6e 67 3a 30 7d 74 65 78 74 61 72 65 61 7b 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 72 65 73 69 7a 65 3a 76 65 72 74 69 63 61 6c 7d 66 69 65 6c 64 73 65 74 7b 6d 69 6e 2d 77 69 64 74 68 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 6c 65 67 65 6e 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 72 6d Data Ascii: g:border-box;padding:0}textarea{overflow:auto;resize:vertical}fieldset{min-width:0;padding:0;margin:0;border:0}legend{display:block;width:100%;max-width:100%;padding:0;margin-bottom:.5rem;font-size:1.5rem;line-height:inherit;color:inherit;white-space:norm
2025-03-14 14:37:41 UTC	1460	IN	Data Raw: 33 33 25 7d 2e 6f 66 66 73 65 74 2d 73 6d 2d 32 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 36 2e 36 36 36 36 36 37 25 7d 2e 6f 66 66 73 65 74 2d 73 6d 2d 33 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 35 25 7d 2e 6f 66 66 73 65 74 2d 73 6d 2d 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 33 2e 33 33 33 33 33 33 25 7d 2e 6f 66 66 73 65 74 2d 73 6d 2d 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 31 2e 36 36 36 36 36 37 25 7d 2e 6f 66 66 73 65 74 2d 73 6d 2d 36 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 30 25 7d 2e 6f 66 66 73 65 74 2d 73 6d 2d 37 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 33 25 7d 2e 6f 66 66 73 65 74 2d 73 6d 2d 38 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 36 36 2e 36 36 36 36 36 37 25 7d 2e 6f 66 66 73 65 74 2d 73 6d 2d 39 7b Data Ascii: 33%}.offset-sm-2{margin-left:16.666667%}.offset-sm-3{margin-left:25%}.offset-sm-4{margin-left:33.333333%}.offset-sm-5{margin-left:41.666667%}.offset-sm-6{margin-left:50%}.offset-sm-7{margin-left:58.333333%}.offset-sm-8{margin-left:66.666667%}.offset-sm-9{
2025-03-14 14:37:41 UTC	2920	IN	Data Raw: 3b 66 6c 65 78 3a 30 20 30 20 36 36 2e 36 36 36 36 36 37 25 3b 6d 61 78 2d 77 69 64 74 68 3a 36 36 2e 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6d 64 2d 39 7b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 37 35 25 3b 66 6c 65 78 3a 30 20 30 20 37 35 25 3b 6d 61 78 2d 77 69 64 74 68 3a 37 35 25 7d 2e 63 6f 6c 2d 6d 64 2d 31 30 7b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 38 33 2e 33 33 33 33 33 33 25 3b 66 6c 65 78 3a 30 20 30 20 38 33 2e 33 33 33 33 33 33 25 3b 6d 61 78 2d 77 69 64 74 68 3a 38 33 2e 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6d 64 2d 31 31 7b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 39 31 2e 36 36 36 36 36 37 25 3b 66 6c 65 78 3a 30 20 30 20 39 31 2e 36 36 36 36 36 37 25 3b 6d 61 78 2d 77 69 64 74 68 3a 39 31 2e 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6d 64 Data Ascii: ;flex:0 0 66.666667%;max-width:66.666667%}.col-md-9{-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-md-10{-ms-flex:0 0 83.333333%;flex:0 0 83.333333%;max-width:83.333333%}.col-md-11{-ms-flex:0 0 91.666667%;flex:0 0 91.666667%;max-width:91.666667%}.col-md
2025-03-14 14:37:42 UTC	2920	IN	Data Raw: 78 2d 6f 72 64 65 72 3a 33 3b 6f 72 64 65 72 3a 33 7d 2e 6f 72 64 65 72 2d 6c 67 2d 34 7b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 34 3b 6f 72 64 65 72 3a 34 7d 2e 6f 72 64 65 72 2d 6c 67 2d 35 7b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 35 3b 6f 72 64 65 72 3a 35 7d 2e 6f 72 64 65 72 2d 6c 67 2d 36 7b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 36 3b 6f 72 64 65 72 3a 36 7d 2e 6f 72 64 65 72 2d 6c 67 2d 37 7b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 37 3b 6f 72 64 65 72 3a 37 7d 2e 6f 72 64 65 72 2d 6c 67 2d 38 7b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 38 3b 6f 72 64 65 72 3a 38 7d 2e 6f 72 64 65 72 2d 6c 67 2d 39 7b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 39 3b 6f 72 64 65 72 3a 39 7d 2e 6f 72 64 65 72 2d 6c 67 2d 31 30 7b 2d 6d Data Ascii: x-order:3;order:3}.order-lg-4{-ms-flex-order:4;order:4}.order-lg-5{-ms-flex-order:5;order:5}.order-lg-6{-ms-flex-order:6;order:6}.order-lg-7{-ms-flex-order:7;order:7}.order-lg-8{-ms-flex-order:8;order:8}.order-lg-9{-ms-flex-order:9;order:9}.order-lg-10{-m
2025-03-14 14:37:42 UTC	2920	IN	Data Raw: 33 25 7d 2e 6f 66 66 73 65 74 2d 78 6c 2d 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 31 2e 36 36 36 36 36 37 25 7d 2e 6f 66 66 73 65 74 2d 78 6c 2d 36 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 30 25 7d 2e 6f 66 66 73 65 74 2d 78 6c 2d 37 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 33 25 7d 2e 6f 66 66 73 65 74 2d 78 6c 2d 38 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 36 36 2e 36 36 36 36 36 37 25 7d 2e 6f 66 66 73 65 74 2d 78 6c 2d 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 37 35 25 7d 2e 6f 66 66 73 65 74 2d 78 6c 2d 31 30 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 33 2e 33 33 33 33 33 33 25 7d 2e 6f 66 66 73 65 74 2d 78 6c 2d 31 31 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 39 31 2e 36 36 36 36 36 37 25 7d 7d 2e 74 61 62 6c 65 7b 77 69 64 74 Data Ascii: 3%}.offset-xl-5{margin-left:41.666667%}.offset-xl-6{margin-left:50%}.offset-xl-7{margin-left:58.333333%}.offset-xl-8{margin-left:66.666667%}.offset-xl-9{margin-left:75%}.offset-xl-10{margin-left:83.333333%}.offset-xl-11{margin-left:91.666667%}}.table{widt
2025-03-14 14:37:42 UTC	4380	IN	Data Raw: 2e 74 61 62 6c 65 2d 64 61 6e 67 65 72 3a 68 6f 76 65 72 3e 74 64 2c 2e 74 61 62 6c 65 2d 68 6f 76 65 72 20 2e 74 61 62 6c 65 2d 64 61 6e 67 65 72 3a 68 6f 76 65 72 3e 74 68 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 31 62 30 62 37 7d 2e 74 61 62 6c 65 2d 6c 69 67 68 74 2c 2e 74 61 62 6c 65 2d 6c 69 67 68 74 3e 74 64 2c 2e 74 61 62 6c 65 2d 6c 69 67 68 74 3e 74 68 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 64 66 64 66 65 7d 2e 74 61 62 6c 65 2d 6c 69 67 68 74 20 74 62 6f 64 79 2b 74 62 6f 64 79 2c 2e 74 61 62 6c 65 2d 6c 69 67 68 74 20 74 64 2c 2e 74 61 62 6c 65 2d 6c 69 67 68 74 20 74 68 2c 2e 74 61 62 6c 65 2d 6c 69 67 68 74 20 74 68 65 61 64 20 74 68 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 66 62 66 63 66 63 7d 2e Data Ascii: .table-danger:hover>td,.table-hover .table-danger:hover>th{background-color:#f1b0b7}.table-light,.table-light>td,.table-light>th{background-color:#fdfdfe}.table-light tbody+tbody,.table-light td,.table-light th,.table-light thead th{border-color:#fbfcfc}.
2025-03-14 14:37:42 UTC	7300	IN	Data Raw: 70 61 64 64 69 6e 67 3a 2e 32 35 72 65 6d 20 2e 35 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 32 72 65 6d 7d 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2d 6c 67 7b 68 65 69 67 68 74 3a 63 61 6c 63 28 31 2e 35 65 6d 20 2b 20 31 72 65 6d 20 2b 20 32 70 78 29 3b 70 61 64 64 69 6e 67 3a 2e 35 72 65 6d 20 31 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 33 72 65 6d 7d 73 65 6c 65 63 74 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 5b 6d 75 6c 74 69 70 6c 65 5d 2c 73 65 6c 65 63 74 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 5b 73 69 7a 65 5d 7b 68 65 Data Ascii: padding:.25rem .5rem;font-size:.875rem;line-height:1.5;border-radius:.2rem}.form-control-lg{height:calc(1.5em + 1rem + 2px);padding:.5rem 1rem;font-size:1.25rem;line-height:1.5;border-radius:.3rem}select.form-control[multiple],select.form-control[size]{he
2025-03-14 14:37:42 UTC	1460	IN	Data Raw: 2d 66 65 65 64 62 61 63 6b 2c 2e 66 6f 72 6d 2d 63 68 65 63 6b 2d 69 6e 70 75 74 2e 69 73 2d 69 6e 76 61 6c 69 64 7e 2e 69 6e 76 61 6c 69 64 2d 74 6f 6f 6c 74 69 70 2c 2e 77 61 73 2d 76 61 6c 69 64 61 74 65 64 20 2e 66 6f 72 6d 2d 63 68 65 63 6b 2d 69 6e 70 75 74 3a 69 6e 76 61 6c 69 64 7e 2e 69 6e 76 61 6c 69 64 2d 66 65 65 64 62 61 63 6b 2c 2e 77 61 73 2d 76 61 6c 69 64 61 74 65 64 20 2e 66 6f 72 6d 2d 63 68 65 63 6b 2d 69 6e 70 75 74 3a 69 6e 76 61 6c 69 64 7e 2e 69 6e 76 61 6c 69 64 2d 74 6f 6f 6c 74 69 70 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 69 6e 70 75 74 2e 69 73 2d 69 6e 76 61 6c 69 64 7e 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 2c 2e 77 61 73 2d 76 61 6c 69 64 61 74 65 Data Ascii: -feedback,.form-check-input.is-invalid~.invalid-tooltip,.was-validated .form-check-input:invalid~.invalid-feedback,.was-validated .form-check-input:invalid~.invalid-tooltip{display:block}.custom-control-input.is-invalid~.custom-control-label,.was-validate
2025-03-14 14:37:42 UTC	5840	IN	Data Raw: 66 6c 65 78 2d 66 6c 6f 77 3a 72 6f 77 20 77 72 61 70 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 66 6f 72 6d 2d 69 6e 6c 69 6e 65 20 2e 66 6f 72 6d 2d 63 68 65 63 6b 7b 77 69 64 74 68 3a 31 30 30 25 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 7b 2e 66 6f 72 6d 2d 69 6e 6c 69 6e 65 20 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 Data Ascii: flex-flow:row wrap;-ms-flex-align:center;align-items:center}.form-inline .form-check{width:100%}@media (min-width:576px){.form-inline label{display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center;-ms-flex-pack:center;justify-content:cent

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:41 UTC	778	OUT	GET /css/style.css HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:37:41 UTC	254	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:41 GMT Server: Kestrel Content-Length: 3580 Content-Type: text/css Last-Modified: Thu, 31 Mar 2022 14:12:41 GMT Accept-Ranges: bytes ETag: "1d8450962151f7c" X-Powered-By: ASP.NET Connection: close
2025-03-14 14:37:41 UTC	173	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 0a 2f 2a 20 43 53 53 20 44 6f 63 75 6d 65 6e 74 20 2a 2f 0a 2f 2a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 43 52 45 44 49 54 53 0a 54 68 65 6d 65 20 4e 61 6d 65 3a 20 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 0a 44 65 73 63 72 69 70 74 69 6f 6e 3a 20 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 2d 73 70 65 63 69 66 69 63 20 74 68 65 6d 65 20 66 6f 72 20 76 65 72 69 Data Ascii: @charset "UTF-8";/* CSS Document //-----------------------------------------------CREDITSTheme Name: Exeter FinanceDescription: Exeter Finance-specific theme for veri
2025-03-14 14:37:41 UTC	3407	IN	Data Raw: 66 69 63 61 74 69 6f 6e 20 6c 61 6e 64 69 6e 67 20 70 61 67 65 20 0a 41 75 74 68 6f 72 3a 20 46 53 53 49 2c 20 37 31 34 2e 34 33 36 2e 33 33 30 30 0a 56 65 72 73 69 6f 6e 3a 20 31 2e 30 0a 4c 61 73 74 20 63 68 61 6e 67 65 64 3a 20 30 33 2f 33 30 2f 32 32 20 5b 6a 70 5d 0a 41 73 73 69 67 6e 65 64 20 74 6f 3a 20 4a 6f 65 79 20 50 61 72 61 67 61 73 20 28 6a 70 29 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 43 4f 4e 54 45 4e 54 53 0a 31 2e 30 2e 20 42 6f 64 79 20 3c 62 6f 64 79 3e 0a 20 20 20 20 31 2e 31 2e 20 4c 69 6e 6b 73 20 2f 20 61 2c 20 61 3a 66 6f 63 75 73 2c 20 61 3a 68 6f 76 65 72 0a 20 20 20 20 31 2e 32 2e 20 50 61 72 61 67 72 61 70 68 20 2f 20 70 2c 20 73 74 72 6f 6e Data Ascii: fication landing page Author: FSSI, 714.436.3300Version: 1.0Last changed: 03/30/22 [jp]Assigned to: Joey Paragas (jp)----------------------------------------CONTENTS1.0. Body <body> 1.1. Links / a, a:focus, a:hover 1.2. Paragraph / p, stron

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:41 UTC	833	OUT	GET /images/exeter-logo.svg HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:37:41 UTC	259	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:41 GMT Server: Kestrel Content-Length: 7068 Content-Type: image/svg+xml Last-Modified: Tue, 08 Mar 2022 21:52:42 GMT Accept-Ranges: bytes ETag: "1d83336d60f2a9c" X-Powered-By: ASP.NET Connection: close
2025-03-14 14:37:41 UTC	3831	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 47 65 6e 65 72 61 74 6f 72 3a 20 41 64 6f 62 65 20 49 6c 6c 75 73 74 72 61 74 6f 72 20 32 32 2e 31 2e 30 2c 20 53 56 47 20 45 78 70 6f 72 74 20 50 6c 75 67 2d 49 6e 20 2e 20 53 56 47 20 56 65 72 73 69 6f 6e 3a 20 36 2e 30 30 20 42 75 69 6c 64 20 30 29 20 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 4c 61 79 65 72 5f 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 22 20 79 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) --><svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="
2025-03-14 14:37:41 UTC	3237	IN	Data Raw: 2c 30 2e 38 2d 30 2e 35 63 31 2e 31 2c 30 2c 32 2e 31 2c 30 2e 32 2c 33 2e 35 2c 30 2e 32 63 31 2e 33 2c 30 2c 31 2e 38 2d 30 2e 32 2c 33 2d 30 2e 32 63 31 2e 31 2c 30 2c 31 2e 34 2c 30 2e 32 2c 31 2e 34 2c 30 2e 36 63 30 2c 30 2e 34 2d 30 2e 34 2c 30 2e 36 2d 31 2e 32 2c 30 2e 37 0a 09 09 63 2d 30 2e 36 2c 30 2d 30 2e 38 2c 30 2e 32 2d 30 2e 38 2c 30 2e 36 63 30 2c 30 2e 33 2c 30 2e 34 2c 31 2c 31 2c 31 2e 38 6c 33 2c 33 2e 39 6c 32 2e 35 2d 33 2e 31 63 31 2e 31 2d 31 2e 34 2c 31 2e 36 2d 32 2e 32 2c 31 2e 36 2d 32 2e 37 63 30 2d 30 2e 34 2d 30 2e 33 2d 30 2e 36 2d 30 2e 38 2d 30 2e 36 63 2d 30 2e 39 2d 30 2e 31 2d 31 2e 32 2d 30 2e 33 2d 31 2e 32 2d 30 2e 37 0a 09 09 63 30 2d 30 2e 33 2c 30 2e 33 2d 30 2e 36 2c 31 2e 32 2d 30 2e 36 63 30 2e 39 2c 30 2c Data Ascii: ,0.8-0.5c1.1,0,2.1,0.2,3.5,0.2c1.3,0,1.8-0.2,3-0.2c1.1,0,1.4,0.2,1.4,0.6c0,0.4-0.4,0.6-1.2,0.7c-0.6,0-0.8,0.2-0.8,0.6c0,0.3,0.4,1,1,1.8l3,3.9l2.5-3.1c1.1-1.4,1.6-2.2,1.6-2.7c0-0.4-0.3-0.6-0.8-0.6c-0.9-0.1-1.2-0.3-1.2-0.7c0-0.3,0.3-0.6,1.2-0.6c0.9,0,

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:41 UTC	777	OUT	GET /js/bootstrap.bundle.min.js HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:37:41 UTC	269	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:41 GMT Server: Kestrel Content-Length: 84378 Content-Type: application/javascript Last-Modified: Tue, 19 Jan 2021 15:17:53 GMT Accept-Ranges: bytes ETag: "1d6ee7641b4af1a" X-Powered-By: ASP.NET Connection: close
2025-03-14 14:37:41 UTC	3821	IN	Data Raw: 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 36 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 31 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 69 6e 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 Data Ascii: /! Bootstrap v4.6.0 (https://getbootstrap.com/) * Copyright 2011-2021 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE) */!function(t,e){"ob
2025-03-14 14:37:41 UTC	2920	IN	Data Raw: 45 76 65 6e 74 28 22 63 6c 6f 73 65 2e 62 73 2e 61 6c 65 72 74 22 29 3b 72 65 74 75 72 6e 20 69 2e 64 65 66 61 75 6c 74 28 74 29 2e 74 72 69 67 67 65 72 28 65 29 2c 65 7d 2c 65 2e 5f 72 65 6d 6f 76 65 45 6c 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 69 66 28 69 2e 64 65 66 61 75 6c 74 28 74 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 73 68 6f 77 22 29 2c 69 2e 64 65 66 61 75 6c 74 28 74 29 2e 68 61 73 43 6c 61 73 73 28 22 66 61 64 65 22 29 29 7b 76 61 72 20 6e 3d 6c 2e 67 65 74 54 72 61 6e 73 69 74 69 6f 6e 44 75 72 61 74 69 6f 6e 46 72 6f 6d 45 6c 65 6d 65 6e 74 28 74 29 3b 69 2e 64 65 66 61 75 6c 74 28 74 29 2e 6f 6e 65 28 6c 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 Data Ascii: Event("close.bs.alert");return i.default(t).trigger(e),e},e._removeElement=function(t){var e=this;if(i.default(t).removeClass("show"),i.default(t).hasClass("fade")){var n=l.getTransitionDurationFromElement(t);i.default(t).one(l.TRANSITION_END,(function(n)
2025-03-14 14:37:42 UTC	6732	IN	Data Raw: 2c 2f 5e 66 6f 63 75 73 28 69 6e 29 3f 24 2f 2e 74 65 73 74 28 74 2e 74 79 70 65 29 29 7d 29 29 2c 69 2e 64 65 66 61 75 6c 74 28 77 69 6e 64 6f 77 29 2e 6f 6e 28 22 6c 6f 61 64 2e 62 73 2e 62 75 74 74 6f 6e 2e 64 61 74 61 2d 61 70 69 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 27 5b 64 61 74 61 2d 74 6f 67 67 6c 65 3d 22 62 75 74 74 6f 6e 73 22 5d 20 2e 62 74 6e 27 29 29 2c 65 3d 30 2c 6e 3d 74 2e 6c 65 6e 67 74 68 3b 65 3c 6e 3b 65 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 65 5d 2c 6f 3d 69 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 69 6e 70 75 74 3a 6e 6f 74 28 5b 74 79 70 65 3d 22 68 69 64 64 65 6e 22 5d 29 Data Ascii: ,/^focus(in)?$/.test(t.type))})),i.default(window).on("load.bs.button.data-api",(function(){for(var t=[].slice.call(document.querySelectorAll('[data-toggle="buttons"] .btn')),e=0,n=t.length;e<n;e++){var i=t[e],o=i.querySelector('input:not([type="hidden"])
2025-03-14 14:37:42 UTC	2920	IN	Data Raw: 64 65 66 61 75 6c 74 28 66 29 2e 68 61 73 43 6c 61 73 73 28 22 61 63 74 69 76 65 22 29 29 74 68 69 73 2e 5f 69 73 53 6c 69 64 69 6e 67 3d 21 31 3b 65 6c 73 65 20 69 66 28 21 74 68 69 73 2e 5f 74 72 69 67 67 65 72 53 6c 69 64 65 45 76 65 6e 74 28 66 2c 72 29 2e 69 73 44 65 66 61 75 6c 74 50 72 65 76 65 6e 74 65 64 28 29 26 26 73 26 26 66 29 7b 74 68 69 73 2e 5f 69 73 53 6c 69 64 69 6e 67 3d 21 30 2c 63 26 26 74 68 69 73 2e 70 61 75 73 65 28 29 2c 74 68 69 73 2e 5f 73 65 74 41 63 74 69 76 65 49 6e 64 69 63 61 74 6f 72 45 6c 65 6d 65 6e 74 28 66 29 2c 74 68 69 73 2e 5f 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3d 66 3b 76 61 72 20 68 3d 69 2e 64 65 66 61 75 6c 74 2e 45 76 65 6e 74 28 22 73 6c 69 64 2e 62 73 2e 63 61 72 6f 75 73 65 6c 22 2c 7b 72 65 6c 61 74 65 Data Ascii: default(f).hasClass("active"))this._isSliding=!1;else if(!this._triggerSlideEvent(f,r).isDefaultPrevented()&&s&&f){this._isSliding=!0,c&&this.pause(),this._setActiveIndicatorElement(f),this._activeElement=f;var h=i.default.Event("slid.bs.carousel",{relate
2025-03-14 14:37:42 UTC	5840	IN	Data Raw: 74 68 69 73 2e 5f 70 61 72 65 6e 74 3d 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 70 61 72 65 6e 74 3f 74 68 69 73 2e 5f 67 65 74 50 61 72 65 6e 74 28 29 3a 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 70 61 72 65 6e 74 7c 7c 74 68 69 73 2e 5f 61 64 64 41 72 69 61 41 6e 64 43 6f 6c 6c 61 70 73 65 64 43 6c 61 73 73 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 2c 74 68 69 73 2e 5f 74 72 69 67 67 65 72 41 72 72 61 79 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 74 6f 67 67 6c 65 26 26 74 68 69 73 2e 74 6f 67 67 6c 65 28 29 7d 76 61 72 20 65 3d 74 2e 70 72 6f 74 6f 74 79 70 65 3b 72 65 74 75 72 6e 20 65 2e 74 6f 67 67 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 2e 64 65 66 61 75 6c 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 Data Ascii: this._parent=this._config.parent?this._getParent():null,this._config.parent\|\|this._addAriaAndCollapsedClass(this._element,this._triggerArray),this._config.toggle&&this.toggle()}var e=t.prototype;return e.toggle=function(){i.default(this._element).hasClass
2025-03-14 14:37:42 UTC	8192	IN	Data Raw: 3d 3d 74 3f 4c 3a 31 30 3d 3d 3d 74 3f 50 3a 4c 7c 7c 50 7d 66 75 6e 63 74 69 6f 6e 20 52 28 74 29 7b 69 66 28 21 74 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3b 66 6f 72 28 76 61 72 20 65 3d 46 28 31 30 29 3f 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3a 6e 75 6c 6c 2c 6e 3d 74 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 7c 7c 6e 75 6c 6c 3b 6e 3d 3d 3d 65 26 26 74 2e 6e 65 78 74 45 6c 65 6d 65 6e 74 53 69 62 6c 69 6e 67 3b 29 6e 3d 28 74 3d 74 2e 6e 65 78 74 45 6c 65 6d 65 6e 74 53 69 62 6c 69 6e 67 29 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 3b 76 61 72 20 69 3d 6e 26 26 6e 2e 6e 6f 64 65 4e 61 6d 65 3b 72 65 74 75 72 6e 20 69 26 26 22 42 4f 44 59 22 21 3d 3d 69 26 26 22 48 54 4d 4c 22 21 3d 3d 69 3f 2d 31 21 Data Ascii: ==t?L:10===t?P:L\|\|P}function R(t){if(!t)return document.documentElement;for(var e=F(10)?document.body:null,n=t.offsetParent\|\|null;n===e&&t.nextElementSibling;)n=(t=t.nextElementSibling).offsetParent;var i=n&&n.nodeName;return i&&"BODY"!==i&&"HTML"!==i?-1!
2025-03-14 14:37:42 UTC	3488	IN	Data Raw: 68 69 73 2e 70 6f 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 2e 70 6f 70 70 65 72 29 2c 74 68 69 73 7d 66 75 6e 63 74 69 6f 6e 20 70 74 28 74 29 7b 76 61 72 20 65 3d 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3b 72 65 74 75 72 6e 20 65 3f 65 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 74 2c 65 2c 6e 2c 69 29 7b 6e 2e 75 70 64 61 74 65 42 6f 75 6e 64 3d 69 2c 70 74 28 74 29 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 6e 2e 75 70 64 61 74 65 42 6f 75 6e 64 2c 7b 70 61 73 73 69 76 65 3a 21 30 7d 29 3b 76 61 72 20 6f 3d 78 28 74 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 20 74 28 65 2c 6e 2c 69 2c 6f 29 7b 76 Data Ascii: his.popper.parentNode.removeChild(this.popper),this}function pt(t){var e=t.ownerDocument;return e?e.defaultView:window}function mt(t,e,n,i){n.updateBound=i,pt(t).addEventListener("resize",n.updateBound,{passive:!0});var o=x(t);return function t(e,n,i,o){v
2025-03-14 14:37:42 UTC	4380	IN	Data Raw: 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 58 28 7b 7d 2c 61 2c 66 5b 69 5d 29 7d 72 65 74 75 72 6e 20 74 7d 7d 2c 6f 66 66 73 65 74 3a 7b 6f 72 64 65 72 3a 32 30 30 2c 65 6e 61 62 6c 65 64 3a 21 30 2c 66 6e 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 65 2e 6f 66 66 73 65 74 2c 69 3d 74 2e 70 6c 61 63 65 6d 65 6e 74 2c 6f 3d 74 2e 6f 66 66 73 65 74 73 2c 72 3d 6f 2e 70 6f 70 70 65 72 2c 61 3d 6f 2e 72 65 66 65 72 65 6e 63 65 2c 73 3d 69 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 2c 6c 3d 76 6f 69 64 20 30 3b 72 65 74 75 72 6e 20 6c 3d 5f 74 28 2b 6e 29 3f 5b 2b 6e 2c 30 5d 3a 6b 74 28 6e 2c 72 2c 61 2c 73 29 2c 22 6c 65 66 74 22 3d 3d 3d 73 3f 28 72 2e 74 6f 70 2b 3d 6c 5b 30 5d 2c 72 2e 6c 65 66 74 2d 3d 6c 5b 31 5d 29 3a 22 72 69 Data Ascii: .offsets.popper=X({},a,f[i])}return t}},offset:{order:200,enabled:!0,fn:function(t,e){var n=e.offset,i=t.placement,o=t.offsets,r=o.popper,a=o.reference,s=i.split("-")[0],l=void 0;return l=_t(+n)?[+n,0]:kt(n,r,a,s),"left"===s?(r.top+=l[0],r.left-=l[1]):"ri
2025-03-14 14:37:42 UTC	1460	IN	Data Raw: 69 66 28 21 77 74 28 74 2e 69 6e 73 74 61 6e 63 65 2e 6d 6f 64 69 66 69 65 72 73 2c 22 68 69 64 65 22 2c 22 70 72 65 76 65 6e 74 4f 76 65 72 66 6c 6f 77 22 29 29 72 65 74 75 72 6e 20 74 3b 76 61 72 20 65 3d 74 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 2c 6e 3d 6c 74 28 74 2e 69 6e 73 74 61 6e 63 65 2e 6d 6f 64 69 66 69 65 72 73 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 70 72 65 76 65 6e 74 4f 76 65 72 66 6c 6f 77 22 3d 3d 3d 74 2e 6e 61 6d 65 7d 29 29 2e 62 6f 75 6e 64 61 72 69 65 73 3b 69 66 28 65 2e 62 6f 74 74 6f 6d 3c 6e 2e 74 6f 70 7c 7c 65 2e 6c 65 66 74 3e 6e 2e 72 69 67 68 74 7c 7c 65 2e 74 6f 70 3e 6e 2e 62 6f 74 74 6f 6d 7c 7c 65 2e 72 69 67 68 74 3c 6e 2e 6c 65 66 74 29 7b 69 66 28 21 30 3d 3d 3d 74 2e 68 69 64 Data Ascii: if(!wt(t.instance.modifiers,"hide","preventOverflow"))return t;var e=t.offsets.reference,n=lt(t.instance.modifiers,(function(t){return"preventOverflow"===t.name})).boundaries;if(e.bottom<n.top\|\|e.left>n.right\|\|e.top>n.bottom\|\|e.right<n.left){if(!0===t.hid
2025-03-14 14:37:42 UTC	1460	IN	Data Raw: 66 2e 6c 65 66 74 2c 61 26 26 68 29 75 5b 68 5d 3d 22 74 72 61 6e 73 6c 61 74 65 33 64 28 22 2b 70 2b 22 70 78 2c 20 22 2b 6d 2b 22 70 78 2c 20 30 29 22 2c 75 5b 64 5d 3d 30 2c 75 5b 63 5d 3d 30 2c 75 2e 77 69 6c 6c 43 68 61 6e 67 65 3d 22 74 72 61 6e 73 66 6f 72 6d 22 3b 65 6c 73 65 7b 76 61 72 20 67 3d 22 62 6f 74 74 6f 6d 22 3d 3d 3d 64 3f 2d 31 3a 31 2c 76 3d 22 72 69 67 68 74 22 3d 3d 3d 63 3f 2d 31 3a 31 3b 75 5b 64 5d 3d 6d 2a 67 2c 75 5b 63 5d 3d 70 2a 76 2c 75 2e 77 69 6c 6c 43 68 61 6e 67 65 3d 64 2b 22 2c 20 22 2b 63 7d 76 61 72 20 5f 3d 7b 22 78 2d 70 6c 61 63 65 6d 65 6e 74 22 3a 74 2e 70 6c 61 63 65 6d 65 6e 74 7d 3b 72 65 74 75 72 6e 20 74 2e 61 74 74 72 69 62 75 74 65 73 3d 58 28 7b 7d 2c 5f 2c 74 2e 61 74 74 72 69 62 75 74 65 73 29 2c 74 Data Ascii: f.left,a&&h)u[h]="translate3d("+p+"px, "+m+"px, 0)",u[d]=0,u[c]=0,u.willChange="transform";else{var g="bottom"===d?-1:1,v="right"===c?-1:1;u[d]=mg,u[c]=pv,u.willChange=d+", "+c}var _={"x-placement":t.placement};return t.attributes=X({},_,t.attributes),t

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:41 UTC	770	OUT	GET /js/jquery-3.6.0.min HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:37:42 UTC	242	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Mar 2025 14:37:41 GMT Server: Kestrel Cache-Control: no-store,no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 X-Powered-By: ASP.NET Connection: close Transfer-Encoding: chunked
2025-03-14 14:37:42 UTC	3456	IN	Data Raw: 64 37 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 21 5b 65 6e 64 69 Data Ascii: d74<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Exeter Finance</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> ...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endi

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:41 UTC	579	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiKo8sBCIWgzQEI9s/OAQiB1s4BCMnczgEIhODOAQii5M4BCK/kzgEI5uTOAQjp5M4B Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-14 14:37:42 UTC	1303	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:42 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Loc-07w7FPGXJktw2NyiGg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-14 14:37:42 UTC	87	IN	Data Raw: 33 36 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 72 61 69 6e 62 6f 77 20 73 69 78 20 73 69 65 67 65 20 78 20 63 6c 6f 73 65 64 20 62 65 74 61 22 2c 22 69 6e 76 69 6e 63 69 62 6c 65 20 73 65 61 73 6f 6e 20 33 22 2c 22 71 62 20 6b 79 6c 65 20 61 6c 6c 65 6e 22 2c Data Ascii: 36e)]}'["",["rainbow six siege x closed beta","invincible season 3","qb kyle allen",
2025-03-14 14:37:42 UTC	798	IN	Data Raw: 22 6b 61 69 69 72 20 65 6c 61 6d 20 64 61 6c 6c 61 73 20 63 6f 77 62 6f 79 73 20 74 72 61 64 65 22 2c 22 73 69 6c 65 6e 74 20 68 69 6c 6c 20 67 61 6d 65 73 22 2c 22 77 65 61 74 68 65 72 20 73 74 6f 72 6d 73 20 61 6e 64 20 74 6f 72 6e 61 64 6f 65 73 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 6d 61 72 63 68 20 31 34 22 2c 22 72 6f 62 65 72 74 20 68 69 67 68 74 20 72 65 74 69 72 65 73 20 6a 6f 68 6e 20 66 6f 72 63 65 20 72 61 63 69 6e 67 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 Data Ascii: "kaiir elam dallas cowboys trade","silent hill games","weather storms and tornadoes","nyt connections hints march 14","robert hight retires john force racing"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo"
2025-03-14 14:37:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:43 UTC	835	OUT	GET /images/favicon-32x32.png HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:37:43 UTC	255	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:42 GMT Server: Kestrel Content-Length: 2839 Content-Type: image/png Last-Modified: Wed, 30 Mar 2022 19:32:36 GMT Accept-Ranges: bytes ETag: "1d8446ce8c7e917" X-Powered-By: ASP.NET Connection: close
2025-03-14 14:37:43 UTC	2839	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 05 1b 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 Data Ascii: PNGIHDR szzpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:R

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://exeteraaletter.estreamone.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_690078298\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_690078298\manifest.fingerprint

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_690078298\manifest.json

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_690078298\privacy-sandbox-attestations.dat

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Static File Info

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

Windows Analysis Report
http://exeteraaletter.estreamone.com

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:44 UTC	618	OUT	GET /images/favicon-32x32.png HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:37:44 UTC	255	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:43 GMT Server: Kestrel Content-Length: 2839 Content-Type: image/png Last-Modified: Wed, 30 Mar 2022 19:32:36 GMT Accept-Ranges: bytes ETag: "1d8446ce8c7e917" X-Powered-By: ASP.NET Connection: close
2025-03-14 14:37:44 UTC	179	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 05 1b 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 Data Ascii: PNGIHDR szzpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
2025-03-14 14:37:44 UTC	2660	IN	Data Raw: 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 20 78 6d 6c 6e 73 3a 78 6d 70 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 22 20 78 6d 6c 6e 73 3a 64 63 3d 22 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 65 6c 65 6d 65 6e 74 73 2f 31 2e 31 2f 22 20 78 6d 6c 6e Data Ascii: tk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmln

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:37:53 UTC	1080	OUT	POST / HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive Content-Length: 228 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: https://exeteraaletter.estreamone.com Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:37:53 UTC	228	OUT	Data Raw: 7a 69 70 63 6f 64 65 3d 26 73 73 6e 3d 6b 25 32 43 45 66 25 32 39 2a 25 32 42 48 36 25 37 44 25 32 38 25 35 44 64 58 25 32 43 25 32 42 26 5f 5f 52 65 71 75 65 73 74 56 65 72 69 66 69 63 61 74 69 6f 6e 54 6f 6b 65 6e 3d 43 66 44 4a 38 4e 35 6a 63 75 65 32 5f 36 74 4f 6e 5a 79 2d 49 57 4c 4c 47 6e 6a 46 67 59 44 48 37 4d 59 4d 78 53 38 77 4a 59 61 77 78 44 52 67 6e 42 54 6a 68 39 42 52 52 47 42 65 4c 37 72 62 68 58 7a 5a 55 33 50 62 69 78 61 68 49 4e 55 6c 71 79 46 6b 30 69 64 78 30 51 58 4f 77 42 58 2d 6a 36 2d 41 74 59 56 34 4d 66 2d 4e 6b 37 43 71 30 66 77 6c 51 68 71 43 41 44 4d 51 5a 32 43 6b 2d 78 38 65 78 41 6b 59 59 35 72 67 2d 51 5f 31 38 43 79 6f 50 43 74 6f 73 47 67 Data Ascii: zipcode=&ssn=k%2CEf%29*%2BH6%7D%28%5DdX%2C%2B&__RequestVerificationToken=CfDJ8N5jcue2_6tOnZy-IWLLGnjFgYDH7MYMxS8wJYawxDRgnBTjh9BRRGBeL7rbhXzZU3PbixahINUlqyFk0idx0QXOwBX-j6-AtYV4Mf-Nk7Cq0fwlQhqCADMQZ2Ck-x8exAkYY5rg-Q_18CyoPCtosGg
2025-03-14 14:37:54 UTC	236	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:37:53 GMT Server: Kestrel Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html; charset=utf-8 X-Powered-By: ASP.NET Connection: close Transfer-Encoding: chunked
2025-03-14 14:37:54 UTC	5095	IN	Data Raw: 33 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 21 5b 65 6e 64 69 Data Ascii: 31c<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Exeter Finance</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> ...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endi

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:38:05 UTC	1080	OUT	POST / HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive Content-Length: 220 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: https://exeteraaletter.estreamone.com Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:38:05 UTC	220	OUT	Data Raw: 7a 69 70 63 6f 64 65 3d 26 73 73 6e 3d 53 76 57 25 32 33 74 25 33 43 30 35 25 35 45 36 25 33 46 45 71 25 32 43 26 5f 5f 52 65 71 75 65 73 74 56 65 72 69 66 69 63 61 74 69 6f 6e 54 6f 6b 65 6e 3d 43 66 44 4a 38 4e 35 6a 63 75 65 32 5f 36 74 4f 6e 5a 79 2d 49 57 4c 4c 47 6e 68 4b 7a 4e 79 63 30 72 45 44 4b 35 47 37 47 36 71 74 48 55 6d 50 61 4d 50 4b 76 49 75 4d 49 66 54 63 5f 6e 59 33 5f 67 4c 49 6c 69 76 4c 38 41 31 5f 77 76 72 68 70 6a 6e 48 67 76 4b 65 63 63 6c 72 48 61 73 31 6d 35 36 64 76 72 4e 68 6c 5a 55 39 6b 49 41 69 4c 49 61 67 51 4e 50 42 6a 45 55 66 6d 35 76 73 6e 73 79 38 43 54 56 5f 6b 47 41 33 4c 68 36 61 36 48 64 6a 61 36 45 34 4e 2d 30 Data Ascii: zipcode=&ssn=SvW%23t%3C05%5E6%3FEq%2C&__RequestVerificationToken=CfDJ8N5jcue2_6tOnZy-IWLLGnhKzNyc0rEDK5G7G6qtHUmPaMPKvIuMIfTc_nY3_gLIlivL8A1_wvrhpjnHgvKecclrHas1m56dvrNhlZU9kIAiLIagQNPBjEUfm5vsnsy8CTV_kGA3Lh6a6Hdja6E4N-0
2025-03-14 14:38:06 UTC	236	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:38:05 GMT Server: Kestrel Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html; charset=utf-8 X-Powered-By: ASP.NET Connection: close Transfer-Encoding: chunked
2025-03-14 14:38:06 UTC	3855	IN	Data Raw: 66 30 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 21 5b 65 6e 64 69 Data Ascii: f08<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Exeter Finance</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> ...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endi
2025-03-14 14:38:06 UTC	1234	IN	Data Raw: 34 63 62 0d 0a 72 6f 75 70 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d 20 65 3a 72 6f 77 20 2d 2d 3e 0d 0a 3c 69 6e 70 75 74 20 6e 61 6d 65 3d 22 5f 5f 52 65 71 75 65 73 74 56 65 72 69 66 69 63 61 74 69 6f 6e 54 6f 6b 65 6e 22 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 76 61 6c 75 65 3d 22 43 66 44 4a 38 4e 35 6a 63 75 65 32 5f 36 74 4f 6e 5a 79 2d 49 57 4c 4c 47 6e 68 6c 32 6a 68 68 4f 6d 77 73 78 6a 39 31 4e 4f 49 70 4a 39 58 50 48 54 4a 4c 53 71 50 38 66 52 53 2d 34 52 4c 77 6b 76 5f 35 48 32 4f 70 39 4a 73 2d 71 61 4e 31 39 30 34 67 77 38 31 71 48 6f 4b 41 65 68 4c 69 4b 73 43 4b 7a 36 6b 70 32 73 34 57 42 69 6b 44 77 5a 2d 59 43 76 37 55 56 4d 7a 61 45 4d 78 4f 31 44 65 33 34 35 38 74 4a Data Ascii: 4cbroup--> </div> </div>... e:row --><input name="__RequestVerificationToken" type="hidden" value="CfDJ8N5jcue2_6tOnZy-IWLLGnhl2jhhOmwsxj91NOIpJ9XPHTJLSqP8fRS-4RLwkv_5H2Op9Js-qaN1904gw81qHoKAehLiKsCKz6kp2s4WBikDwZ-YCv7UVMzaEMxO1De3458tJ
2025-03-14 14:38:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:38:13 UTC	1080	OUT	POST / HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive Content-Length: 196 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: https://exeteraaletter.estreamone.com Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:38:13 UTC	196	OUT	Data Raw: 7a 69 70 63 6f 64 65 3d 26 73 73 6e 3d 26 5f 5f 52 65 71 75 65 73 74 56 65 72 69 66 69 63 61 74 69 6f 6e 54 6f 6b 65 6e 3d 43 66 44 4a 38 4e 35 6a 63 75 65 32 5f 36 74 4f 6e 5a 79 2d 49 57 4c 4c 47 6e 68 6c 32 6a 68 68 4f 6d 77 73 78 6a 39 31 4e 4f 49 70 4a 39 58 50 48 54 4a 4c 53 71 50 38 66 52 53 2d 34 52 4c 77 6b 76 5f 35 48 32 4f 70 39 4a 73 2d 71 61 4e 31 39 30 34 67 77 38 31 71 48 6f 4b 41 65 68 4c 69 4b 73 43 4b 7a 36 6b 70 32 73 34 57 42 69 6b 44 77 5a 2d 59 43 76 37 55 56 4d 7a 61 45 4d 78 4f 31 44 65 33 34 35 38 74 4a 55 68 48 4c 52 72 7a 70 7a 6f 53 51 7a 67 32 54 79 67 Data Ascii: zipcode=&ssn=&__RequestVerificationToken=CfDJ8N5jcue2_6tOnZy-IWLLGnhl2jhhOmwsxj91NOIpJ9XPHTJLSqP8fRS-4RLwkv_5H2Op9Js-qaN1904gw81qHoKAehLiKsCKz6kp2s4WBikDwZ-YCv7UVMzaEMxO1De3458tJUhHLRrzpzoSQzg2Tyg
2025-03-14 14:38:14 UTC	236	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:38:13 GMT Server: Kestrel Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html; charset=utf-8 X-Powered-By: ASP.NET Connection: close Transfer-Encoding: chunked
2025-03-14 14:38:14 UTC	1152	IN	Data Raw: 34 37 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 21 5b 65 6e 64 69 Data Ascii: 479<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Exeter Finance</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> ...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endi
2025-03-14 14:38:14 UTC	3942	IN	Data Raw: 66 35 61 0d 0a 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 73 73 33 2d 6d 65 64 69 61 71 75 65 72 69 65 73 2d 6a 73 2e 67 6f 6f 67 6c 65 63 6f 64 65 2e 63 6f 6d 2f 73 76 6e 2f 74 72 75 6e 6b 2f 63 73 73 33 2d 6d 65 64 69 61 71 75 65 72 69 65 73 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 73 2f 76 35 2e 30 2e 31 33 2f 63 Data Ascii: f5ae="text/css" /> <script href="https://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js"></script> <![endif]--> ... Font Awesome --> <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.0.13/c

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:38:22 UTC	1080	OUT	POST / HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive Content-Length: 196 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: https://exeteraaletter.estreamone.com Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:38:22 UTC	196	OUT	Data Raw: 7a 69 70 63 6f 64 65 3d 26 73 73 6e 3d 26 5f 5f 52 65 71 75 65 73 74 56 65 72 69 66 69 63 61 74 69 6f 6e 54 6f 6b 65 6e 3d 43 66 44 4a 38 4e 35 6a 63 75 65 32 5f 36 74 4f 6e 5a 79 2d 49 57 4c 4c 47 6e 69 6d 73 79 46 67 6b 4c 4c 49 74 44 70 62 70 63 71 6b 44 61 71 37 79 34 77 71 67 56 77 38 78 44 4c 78 33 77 64 52 69 4c 41 55 69 7a 37 43 34 4d 48 75 78 41 51 34 74 4b 69 35 6a 4e 36 34 41 56 62 68 56 41 77 5a 50 41 53 41 42 4b 71 6c 6f 63 2d 67 6b 32 44 52 42 62 36 68 65 75 67 34 71 51 7a 49 2d 4d 41 36 47 66 4d 45 51 5a 2d 52 53 38 36 65 59 6d 42 30 68 4a 73 5a 58 53 50 6f 43 62 49 Data Ascii: zipcode=&ssn=&__RequestVerificationToken=CfDJ8N5jcue2_6tOnZy-IWLLGnimsyFgkLLItDpbpcqkDaq7y4wqgVw8xDLx3wdRiLAUiz7C4MHuxAQ4tKi5jN64AVbhVAwZPASABKqloc-gk2DRBb6heug4qQzI-MA6GfMEQZ-RS86eYmB0hJsZXSPoCbI
2025-03-14 14:38:22 UTC	236	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:38:21 GMT Server: Kestrel Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html; charset=utf-8 X-Powered-By: ASP.NET Connection: close Transfer-Encoding: chunked
2025-03-14 14:38:22 UTC	1245	IN	Data Raw: 34 64 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 21 5b 65 6e 64 69 Data Ascii: 4d6<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Exeter Finance</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> ...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endi
2025-03-14 14:38:22 UTC	3851	IN	Data Raw: 61 33 32 0d 0a 63 73 73 33 2d 6d 65 64 69 61 71 75 65 72 69 65 73 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 73 2f 76 35 2e 30 2e 31 33 2f 63 73 73 2f 61 6c 6c 2e 63 73 73 22 20 69 6e 74 65 67 72 69 74 79 3d 22 73 68 61 33 38 34 2d 44 4e 4f 48 5a 36 38 55 38 68 5a 66 4b 58 4f 72 74 6a 57 76 6a 78 75 73 47 6f 39 57 51 6e 72 4e 78 32 73 71 47 30 74 66 73 67 68 41 76 74 56 6c 52 57 33 74 76 6b 58 57 5a 68 35 38 4e 39 6a Data Ascii: a32css3-mediaqueries.js"></script> <![endif]--> ... Font Awesome --> <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.0.13/css/all.css" integrity="sha384-DNOHZ68U8hZfKXOrtjWvjxusGo9WQnrNx2sqG0tfsghAvtVlRW3tvkXWZh58N9j
2025-03-14 14:38:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:38:22 UTC	770	OUT	GET /js/jquery-3.6.0.min HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:38:23 UTC	242	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Mar 2025 14:38:22 GMT Server: Kestrel Cache-Control: no-store,no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 X-Powered-By: ASP.NET Connection: close Transfer-Encoding: chunked
2025-03-14 14:38:23 UTC	3456	IN	Data Raw: 64 37 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 21 5b 65 6e 64 69 Data Ascii: d74<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Exeter Finance</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> ...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endi

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:38:31 UTC	1080	OUT	POST / HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive Content-Length: 196 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: https://exeteraaletter.estreamone.com Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:38:31 UTC	196	OUT	Data Raw: 7a 69 70 63 6f 64 65 3d 26 73 73 6e 3d 26 5f 5f 52 65 71 75 65 73 74 56 65 72 69 66 69 63 61 74 69 6f 6e 54 6f 6b 65 6e 3d 43 66 44 4a 38 4e 35 6a 63 75 65 32 5f 36 74 4f 6e 5a 79 2d 49 57 4c 4c 47 6e 67 38 48 74 5a 44 6f 67 41 4c 7a 38 49 6b 68 61 6b 34 4e 64 69 74 41 49 79 4f 46 56 56 57 70 45 4a 56 58 72 37 30 77 72 61 37 2d 45 6f 4a 55 48 77 71 68 52 4a 76 42 4d 49 6f 63 75 69 6d 67 54 39 46 67 74 5a 6f 79 73 76 38 6e 78 4a 72 33 76 79 31 52 74 39 45 38 39 7a 69 44 72 36 39 36 38 61 37 54 38 37 37 43 4f 4f 43 4a 52 37 7a 35 34 5f 63 51 57 6a 49 34 56 37 46 4e 4e 66 35 5a 37 45 Data Ascii: zipcode=&ssn=&__RequestVerificationToken=CfDJ8N5jcue2_6tOnZy-IWLLGng8HtZDogALz8Ikhak4NditAIyOFVVWpEJVXr70wra7-EoJUHwqhRJvBMIocuimgT9FgtZoysv8nxJr3vy1Rt9E89ziDr6968a7T877COOCJR7z54_cQWjI4V7FNNf5Z7E
2025-03-14 14:38:31 UTC	236	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:38:30 GMT Server: Kestrel Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html; charset=utf-8 X-Powered-By: ASP.NET Connection: close Transfer-Encoding: chunked
2025-03-14 14:38:31 UTC	5089	IN	Data Raw: 66 30 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 21 5b 65 6e 64 69 Data Ascii: f08<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Exeter Finance</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> ...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endi
2025-03-14 14:38:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-14 14:38:46 UTC	1080	OUT	POST / HTTP/1.1 Host: exeteraaletter.estreamone.com Connection: keep-alive Content-Length: 215 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: https://exeteraaletter.estreamone.com Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://exeteraaletter.estreamone.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: .AspNetCore.Antiforgery.3bN2bLk5lSI=CfDJ8N5jcue2_6tOnZy-IWLLGniu9thVATvv6BHF1lHUULpomKhzCnGfZjKB-dA60ANFaTMFl9RekqRvECnR7E3G1Gx0Fp0VwnqLipUpsSoxpOWeAraZ9XvPhb2g-KjTZVAUFTQcai-xavFFnpznBJ_6RFQ
2025-03-14 14:38:46 UTC	215	OUT	Data Raw: 7a 69 70 63 6f 64 65 3d 26 73 73 6e 3d 25 33 43 4a 57 4c 53 25 32 43 63 39 25 32 38 69 78 75 74 26 5f 5f 52 65 71 75 65 73 74 56 65 72 69 66 69 63 61 74 69 6f 6e 54 6f 6b 65 6e 3d 43 66 44 4a 38 4e 35 6a 63 75 65 32 5f 36 74 4f 6e 5a 79 2d 49 57 4c 4c 47 6e 67 39 39 73 4c 4e 2d 79 5f 46 52 54 42 73 36 70 75 4e 5a 5f 74 58 54 65 44 36 44 2d 65 72 46 54 30 35 36 33 48 70 51 78 4e 42 38 4b 34 32 4d 54 58 78 4e 33 4d 33 6d 44 63 63 59 38 61 6a 39 6d 4b 76 4f 74 34 56 50 2d 55 47 42 6d 2d 7a 32 51 37 68 69 59 78 66 66 54 39 46 38 6f 38 72 79 4c 39 55 46 76 77 68 4e 68 58 79 49 4c 6b 5a 41 4c 68 79 73 69 49 46 39 7a 6b 72 6c 54 57 6c 66 38 73 Data Ascii: zipcode=&ssn=%3CJWLS%2Cc9%28ixut&__RequestVerificationToken=CfDJ8N5jcue2_6tOnZy-IWLLGng99sLN-y_FRTBs6puNZ_tXTeD6D-erFT0563HpQxNB8K42MTXxN3M3mDccY8aj9mKvOt4VP-UGBm-z2Q7hiYxffT9F8o8ryL9UFvwhNhXyILkZALhysiIF9zkrlTWlf8s
2025-03-14 14:38:46 UTC	236	IN	HTTP/1.1 200 OK Date: Fri, 14 Mar 2025 14:38:45 GMT Server: Kestrel Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html; charset=utf-8 X-Powered-By: ASP.NET Connection: close Transfer-Encoding: chunked
2025-03-14 14:38:46 UTC	191	IN	Data Raw: 62 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 78 65 74 65 72 20 46 69 6e 61 6e 63 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 6d 65 74 0d 0a Data Ascii: b9<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Exeter Finance</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> ...[if IE]><met
2025-03-14 14:38:46 UTC	4909	IN	Data Raw: 62 36 32 0d 0a 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 3e 3c 21 2d 2d 20 66 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 Data Ascii: b62a http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32.png">... favicon -->

Target ID:	0
Start time:	10:37:32
Start date:	14/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	10:37:33
Start date:	14/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2060,i,4031769586313537784,12686462495390506624,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2088 /prefetch:3
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false