Edit tour

Windows Analysis Report
Message.eml

Overview

General Information

Sample name:	Message.eml
Analysis ID:	1643071
MD5:	08813298dac46c69f7f09675846cb1e5
SHA1:	ed17bc6c4034bc6ae28bb490e29c766d053af6b4
SHA256:	4e86bdff14cba66d2dff589d28c00ddbe1b2b6882e53eaebb9d27b2b7a72dd5c
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected suspicious elements in Email content

Creates files inside the system directory

Deletes files inside the Windows folder

HTML page contains hidden javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Suspicious Office Outbound Connections

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6276 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6456 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "925A9D40-8260-4594-9CBE-12B47E13870D" "8543A2D0-7560-4E82-B01E-A5EF66D0EBF5" "6276" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

POWERPNT.EXE (PID: 6828 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DYA2IVVR\Salary_Adjustment.pptx" /ou "" MD5: 2A43FE7F9F699F7F53FEBC254F68F46D)

ai.exe (PID: 6964 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "059DD4BA-5259-41EF-B3AE-3151DD5E7610" "EE794F4C-7B54-4B03-98D2-9E23959D7184" "6828" "C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

POWERPNT.EXE (PID: 7048 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE" /Embedding MD5: 2A43FE7F9F699F7F53FEBC254F68F46D)

chrome.exe (PID: 2924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://scanned.page/67d9e2d6eeffd MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,7118776425326495962,3081775529696763486,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6276, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49706, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, Initiated: true, ProcessId: 6828, Protocol: tcp, SourceIp: 13.107.253.72, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:01:27.371366+0100	2028371	3	Unknown Traffic	192.168.2.16	49706	13.107.253.72	443	TCP
2025-03-19T14:01:31.797009+0100	2028371	3	Unknown Traffic	192.168.2.16	49711	13.107.253.72	443	TCP
2025-03-19T14:01:31.880519+0100	2028371	3	Unknown Traffic	192.168.2.16	49710	13.107.253.72	443	TCP
2025-03-19T14:01:31.914579+0100	2028371	3	Unknown Traffic	192.168.2.16	49709	13.107.253.72	443	TCP

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: Screenshot id: 12

Joe Sandbox AI: Screenshot id: 12 contains QR code

AI detected suspicious elements in Email content

Source: Email

Joe Sandbox AI: Detected potential phishing email: Suspicious sender domain 'humanquality.com.mx' doesn't match a legitimate HR department email. Generic 'H.R' display name is commonly used in phishing attempts. Subject line contains suspicious number '41' which is often used in phishing to create urgency

Source: https://scanned.page/67d9e2d6eeffd

HTTP Parser: Base64 decoded: %7B%22executed%22%3A%5B%5D%2C%22t%22%3A%22%22%2C%22x%22%3A0.5396619284458812%2C%22w%22%3A1280%2C%22h%22%3A1024%2C%22j%22%3A897%2C%22e%22%3A1280%2C%22l%22%3A%22https%3A%2F%2Fscanned.page%2F67d9e2d6eeffd%22%2C%22r%22%3A%22%22%2C%22k%22%3A24%2C%22n%22%3A%22U...

Source: Email

Classification: Payroll Fraud

Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.79.73:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.71.154:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.228:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.196:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.71.154:443 -> 192.168.2.16:49764 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 104.26.12.106 104.26.12.106
Source: Joe Sandbox View	IP Address: 13.107.253.72 13.107.253.72
Source: Joe Sandbox View	IP Address: 104.16.79.73 104.16.79.73

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49706 -> 13.107.253.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49710 -> 13.107.253.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49711 -> 13.107.253.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49709 -> 13.107.253.72:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.67
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.67
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rules/powerpnt.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule840000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule68022v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /67d9e2d6eeffd HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main.c588d2a4.css HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://scanned.page/67d9e2d6eeffdAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/main.5dbfdb16.js HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://scanned.page/67d9e2d6eeffdAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1Host: static.cloudflareinsights.comConnection: keep-aliveOrigin: https://scanned.pagesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://scanned.page/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyJTIyJTJDJTIyeCUyMiUzQTAuNTM5NjYxOTI4NDQ1ODgxMiUyQyUyMnclMjIlM0ExMjgwJTJDJTIyaCUyMiUzQTEwMjQlMkMlMjJqJTIyJTNBODk3JTJDJTIyZSUyMiUzQTEyODAlMkMlMjJsJTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZzY2FubmVkLnBhZ2UlMkY2N2Q5ZTJkNmVlZmZkJTIyJTJDJTIyciUyMiUzQSUyMiUyMiUyQyUyMmslMjIlM0EyNCUyQyUyMm4lMjIlM0ElMjJVVEYtOCUyMiUyQyUyMm8lMjIlM0EyNDAlMkMlMjJxJTIyJTNBJTVCJTVEJTdE HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://scanned.page/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://scanned.page/67d9e2d6eeffdAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369f-4183-9911-825e1b6a8be7&_u=KGDAAEADQAAAAC%7E&z=1276851356&slf_rd=1 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://scanned.pageX-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://scanned.page/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /manifest.json HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://scanned.page/67d9e2d6eeffdAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/regular.1fd3cd7ade0f79b2152a.ttf HTTP/1.1Host: scanned.pageConnection: keep-aliveOrigin: https://scanned.pagesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://scanned.page/static/css/main.c588d2a4.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: scanned.pageConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369f-4183-9911-825e1b6a8be7&_u=KGDAAEADQAAAAC%7E&z=1276851356&slf_rd=1 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logo_192x192.png HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://scanned.page/67d9e2d6eeffdAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
Source: global traffic	HTTP traffic detected: GET /logo_192x192.png HTTP/1.1Host: scanned.pageConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
Source: global traffic	HTTP traffic detected: GET /67d9e2d6eeffd HTTP/1.1Host: scanned.pageConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7DIf-Modified-Since: Fri, 14 Mar 2025 03:08:28 GMT
Source: global traffic	HTTP traffic detected: GET /static/css/main.c588d2a4.css HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"If-None-Match: "2ee6263d5ec8ce3071e4c7a3b3ab18cc"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"If-Modified-Since: Fri, 14 Mar 2025 03:10:14 GMTsec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://scanned.page/67d9e2d6eeffdAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
Source: global traffic	HTTP traffic detected: GET /static/js/main.5dbfdb16.js HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://scanned.page/67d9e2d6eeffdAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7DRange: bytes=2922802-2922802If-Range: "9c5eb1769cb6e81f65b17b3c54cd89c2"
Source: global traffic	HTTP traffic detected: GET /static/js/main.5dbfdb16.js HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://scanned.page/67d9e2d6eeffdAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7DRange: bytes=2922802-3103507If-Range: "9c5eb1769cb6e81f65b17b3c54cd89c2"
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyJTIyJTJDJTIyeCUyMiUzQTAuNjc5Mjg1NTE2NTY1NDE3JTJDJTIydyUyMiUzQTEyODAlMkMlMjJoJTIyJTNBMTAyNCUyQyUyMmolMjIlM0E4OTclMkMlMjJlJTIyJTNBMTI4MCUyQyUyMmwlMjIlM0ElMjJodHRwcyUzQSUyRiUyRnNjYW5uZWQucGFnZSUyRjY3ZDllMmQ2ZWVmZmQlMjIlMkMlMjJyJTIyJTNBJTIyJTIyJTJDJTIyayUyMiUzQTI0JTJDJTIybiUyMiUzQSUyMlVURi04JTIyJTJDJTIybyUyMiUzQTI0MCUyQyUyMnElMjIlM0ElNUIlNUQlN0Q= HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://scanned.page/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925335031%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389335031%22%2C%22e%22%3A1773925335031%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%222%22%2C%22e%22%3A1773925335031%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391135031%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925335031%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925335031%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389335031%22%2C%22e%22%3A1773925335031%7D%7D
Source: global traffic	HTTP traffic detected: GET /manifest.json HTTP/1.1Host: scanned.pageConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://scanned.page/67d9e2d6eeffdAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9If-None-Match: "80861a3fdc6289183c6daac930f0e4a4"If-Modified-Since: Fri, 14 Mar 2025 03:08:30 GMT
Source: global traffic	HTTP traffic detected: GET /g/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369f-4183-9911-825e1b6a8be7&_u=KGDAAEADQAAAAC%7E&z=2097968364 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://scanned.pageX-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://scanned.page/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: otelrules.svc.static.microsoft
Source: global traffic	DNS traffic detected: DNS query: scanned.page
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=d5VQ53LFdzt3AI0V%2BLucrkgPO6sg8uSjJ5AgOkant4BdGeN1O4W%2BR%2B0dVzZiDhdCeWsAGs8ANFQnctaF5e1A%2FBw%2F%2BvpvaYcGSAhArOLP0iTp6n19rrotM3HsyLhycg%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 478Content-Type: application/reports+jsonOrigin: https://scanned.pageUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_714.15.dr	String found in binary or memory: http://www.grillitype.com/
Source: chromecache_714.15.dr	String found in binary or memory: http://www.grillitype.com/http://www.grillitype.com/http://www.grillitype.com/http://www.grillitype.
Source: chromecache_708.15.dr	String found in binary or memory: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Source: chromecache_710.15.dr, chromecache_711.15.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-3
Source: chromecache_703.15.dr	String found in binary or memory: https://tailwindcss.com
Source: chromecache_711.15.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.79.73:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.71.154:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.106:443 -> 192.168.2.16:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.228:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.196:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.71.154:443 -> 192.168.2.16:49764 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir2924_1533390748

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir2924_1533390748

Source: classification engine

Classification label: mal48.winEML@29/30@28/10

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250319T0901090877-6276.etl

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Message.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "925A9D40-8260-4594-9CBE-12B47E13870D" "8543A2D0-7560-4E82-B01E-A5EF66D0EBF5" "6276" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DYA2IVVR\Salary_Adjustment.pptx" /ou ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "059DD4BA-5259-41EF-B3AE-3151DD5E7610" "EE794F4C-7B54-4B03-98D2-9E23959D7184" "6828" "C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE" /Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://scanned.page/67d9e2d6eeffd
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,7118776425326495962,3081775529696763486,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "925A9D40-8260-4594-9CBE-12B47E13870D" "8543A2D0-7560-4E82-B01E-A5EF66D0EBF5" "6276" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DYA2IVVR\Salary_Adjustment.pptx" /ou ""	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "059DD4BA-5259-41EF-B3AE-3151DD5E7610" "EE794F4C-7B54-4B03-98D2-9E23959D7184" "6828" "C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE" /Embedding	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,7118776425326495962,3081775529696763486,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935} DeviceTicket

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\PowerPointCombinedFloatieLreOnline.onnx VolumeInformation			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	21 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://www.grillitype.com/	0%	Avira URL Cloud	safe
http://www.grillitype.com/http://www.grillitype.com/http://www.grillitype.com/http://www.grillitype.	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
static.cloudflareinsights.com	104.16.79.73	true	false	high
beacons-handoff.gcp.gvt2.com	142.251.143.35	true	false	high
www.google.com	142.250.185.228	true	false	high
s-0005.dual-s-dc-msedge.net	52.123.130.14	true	false	high
scanned.page	104.26.12.106	true	false	high
stats.g.doubleclick.net	74.125.71.154	true	false	high
otelrules.svc.static.microsoft	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://scanned.page/static/css/main.c588d2a4.css	false	high
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015	false	high
https://scanned.page/67d9e2d6eeffd	false	high
https://otelrules.svc.static.microsoft/rules/powerpnt.exe-Production-v19.bundle	false	high
https://stats.g.doubleclick.net/g/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369f-4183-9911-825e1b6a8be7&_u=KGDAAEADQAAAAC%7E&z=1276851356	false	high
https://scanned.page/cdn-cgi/zaraz/t	false	high
https://scanned.page/favicon.png	false	high
https://a.nel.cloudflare.com/report/v4?s=d5VQ53LFdzt3AI0V%2BLucrkgPO6sg8uSjJ5AgOkant4BdGeN1O4W%2BR%2B0dVzZiDhdCeWsAGs8ANFQnctaF5e1A%2FBw%2F%2BvpvaYcGSAhArOLP0iTp6n19rrotM3HsyLhycg%3D%3D	false	high
https://scanned.page/cdn-cgi/rum?	false	high
https://otelrules.svc.static.microsoft/rules/rule68022v8s19.xml	false	high
https://scanned.page/logo_192x192.png	false	high
https://otelrules.svc.static.microsoft/rules/rule63067v4s19.xml	false	high
https://otelrules.svc.static.microsoft/rules/rule840000v1s19.xml	false	high
https://scanned.page/static/media/regular.1fd3cd7ade0f79b2152a.ttf	false	high
https://scanned.page/manifest.json	false	high
https://scanned.page/cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyJTIyJTJDJTIyeCUyMiUzQTAuNTM5NjYxOTI4NDQ1ODgxMiUyQyUyMnclMjIlM0ExMjgwJTJDJTIyaCUyMiUzQTEwMjQlMkMlMjJqJTIyJTNBODk3JTJDJTIyZSUyMiUzQTEyODAlMkMlMjJsJTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZzY2FubmVkLnBhZ2UlMkY2N2Q5ZTJkNmVlZmZkJTIyJTJDJTIyciUyMiUzQSUyMiUyMiUyQyUyMmslMjIlM0EyNCUyQyUyMm4lMjIlM0ElMjJVVEYtOCUyMiUyQyUyMm8lMjIlM0EyNDAlMkMlMjJxJTIyJTNBJTVCJTVEJTdE	false	high
https://scanned.page/static/js/main.5dbfdb16.js	false	high
https://stats.g.doubleclick.net/g/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369f-4183-9911-825e1b6a8be7&_u=KGDAAEADQAAAAC%7E&z=2097968364	false	high
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369f-4183-9911-825e1b6a8be7&_u=KGDAAEADQAAAAC%7E&z=1276851356&slf_rd=1	false	high
https://scanned.page/cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyJTIyJTJDJTIyeCUyMiUzQTAuNjc5Mjg1NTE2NTY1NDE3JTJDJTIydyUyMiUzQTEyODAlMkMlMjJoJTIyJTNBMTAyNCUyQyUyMmolMjIlM0E4OTclMkMlMjJlJTIyJTNBMTI4MCUyQyUyMmwlMjIlM0ElMjJodHRwcyUzQSUyRiUyRnNjYW5uZWQucGFnZSUyRjY3ZDllMmQ2ZWVmZmQlMjIlMkMlMjJyJTIyJTNBJTIyJTIyJTJDJTIyayUyMiUzQTI0JTJDJTIybiUyMiUzQSUyMlVURi04JTIyJTJDJTIybyUyMiUzQTI0MCUyQyUyMnElMjIlM0ElNUIlNUQlN0Q=	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.grillitype.com/	chromecache_714.15.dr	false	Avira URL Cloud: safe	unknown
https://tailwindcss.com	chromecache_703.15.dr	false		high
http://www.grillitype.com/http://www.grillitype.com/http://www.grillitype.com/http://www.grillitype.	chromecache_714.15.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/g/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-3	chromecache_710.15.dr, chromecache_711.15.dr	false		high
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369	chromecache_711.15.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
104.26.12.106	scanned.page	United States	13335	CLOUDFLARENETUS	false
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
74.125.71.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
13.107.253.72	s-part-0044.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.228	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.16.79.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1643071
Start date and time:	2025-03-19 14:00:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Message.eml
Detection:	MAL
Classification:	mal48.winEML@29/30@28/10
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, MavInject32.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.109.89.119, 104.46.162.227, 20.189.173.15, 95.101.182.66, 95.101.182.98, 142.250.186.142, 142.250.185.227, 216.58.206.78, 64.233.184.84, 142.250.185.238, 142.250.185.174, 142.250.184.206, 52.182.143.214, 172.217.18.14, 142.250.186.78, 142.250.186.110, 142.250.186.35, 216.58.206.46, 172.217.16.206, 142.250.184.195, 142.250.74.206, 52.123.130.14, 4.245.163.56, 23.199.214.10, 172.202.163.200, 20.190.160.5, 104.126.37.123
Excluded domains from analysis (whitelisted): odc.officeapps.live.com, slscr.update.microsoft.com, europe.odcsm1.live.com.akadns.net, templatesmetadata.office.net.edgekey.net, clientservices.googleapis.com, mobile.events.data.microsoft.com, osiprod-weu-bronze-azsc-000.westeurope.cloudapp.azure.com, dual-s-0005-office.config.skype.com, clients2.google.com, onedscolprdaus03.australiasoutheast.cloudapp.azure.com, redirector.gvt1.com, login.live.com, update.googleapis.com, officeclient.microsoft.com, templatesmetadata.office.net, ukw-azsc-config.officeapps.live.com, onedscolprdwus14.westus.cloudapp.azure.com, www.bing.com, clients1.google.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, accounts.google.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, weu-azsc-000.odc.officeapps.live.com, fe3cr.delivery.mp.microsoft.com, e26769.dscb.akamaiedge.net, edgedl.me.gvt1.com, config.officeapps.live.com, onedscolprdcus19.centralus.cloudapp.azure.com, metadata.templates.cd
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Source	URL
Screenshot	https://scanned.page/67d9e2d6eeffd

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.12.106	BACS190027-01.pdf	Get hash	malicious	Unknown	Browse
	https://trk.klclick3.com/ls/click?upn=Z2YftmlPqOUJRbmpQmhm03VBrbAfNASoybRFQlz9YCOPx1NG1yHHLvlM52XrZrBSjxmEZhpWdOpYWx2nCJqPvGvUp18Fx-2F9VpZPklUWUAKSGRrFhHBnlLNy6OUdgzLS3-2B72KTkMminPUMWceqCQLtSK8y9YKHVPPTqUUY9f8zt1BWagmkFkZhaIjFwQ4T6wdNrNAY84jQS2neg7R86enJAeZ-2BSCvACA1oEVYpSQA9D9Fs-2B7ieo07foOsTABkTj-2BM8wBq_ILWvhtRdUhnsYs3T75zbrql7hmRToExk5CwKJTXgdnM9HwphGc-2BGHfsBMlOCw66f4sSHSyoIYmnvRmZgyVIlmmrp1-2BodGpTjl8JcEVGOo2y0JVQzNfIC4B9fQe4pbuFgxA86UwGPIradNX70btXNwyMDGl6JPDXYGJ2BOZjkhW58Q0TbKRZKk7bwfEal3I5Zcj9joOaYK5WQIWgimIkE8FtXE-2F5xVX92gA4IXRnikpXGJAjC-2B8vH9dggFKXjHq-2Bi-2BwJWDhcaU4uJY49JXvz3dCrAgfxdRARk9o8J1H0xcO1PsY1RKdbNkKgwXVgBAWOv	Get hash	malicious	Unknown	Browse
	https://www.icr.ro/engine/track.php?nlid=368&email=altmarius1@gmail.com&url=https://vs%E2%93%98a%E2%93%93fs.wc%E2%93%98trusfvi.com%3Fid%3Dcom.outlook.msn.android.systematic.facebook.music.baracuda.proofpoint	Get hash	malicious	HTMLPhisher	Browse
	https://www.interecm.com/interecm/tracker?op=click&id=5204.db2&url=https://web%E2%93%A2so.lnl%E2%93%90grup%E3%80%82com%3Fid%3Dcom.google.msn.android.apps.youtube.music	Get hash	malicious	HTMLPhisher	Browse
	http://cd-log.co.il/languages/en/change?redirectUrl=https://tit%E2%93%90n.citr%E2%93%A4sefi.com%3Fid%3Dcom.google.msn.android.apps.youtube.music	Get hash	malicious	HTMLPhisher	Browse
	http://sme.in/Authenticate.aspx?PageName=https://sso4-prod.wilnlawgroup%E3%80%82com	Get hash	malicious	HTMLPhisher	Browse
13.107.253.72	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	New Purchase Order.exe	Get hash	malicious	MSIL Logger, MassLogger RAT, XRed	Browse
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fuser.mxhemlock.com.mcas.ms%2F67cf5cc2c98f50010c977283%2Fl%2FHv7qKvsUB0cRchSlE%3Frn%3D%26re%3DgIt92YuwWah12ZARjMn5WarRWYlxWZoRnI%26sc%3Dfalse%26McasTsid%3D20596%23user_email%3Dcassandra.calpe%40cfainstitute.org%26fname%3DCassandra%26lname%3DBecerra&McasCSRF=57c9b97c65d2c90c6a2c27b6584a511a97f57752289aca897fe7252a6b88ff8f	Get hash	malicious	HTMLPhisher	Browse
	https://public-usa.mkt.dynamics.com/api/orgs/f8d62d3a-5b03-f011-b015-6045bd003905/r/FMPIXkRqqkmv-j_Li7QBAAEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fgamma.app%252Fdocs%252FJanel-Group-Completed-Document-x686r1ir4nghubz%253Fmode%253Dpresent%2523card-an1daph37h4un5p%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%220%22%3Anull%7D%7D&digest=O1MpDB0efooTe4PN%2BrbvabY6GTxgYZEijI2csju%2FBYg%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	Get hash	malicious	HTMLPhisher	Browse
	https://geminilogfine.webflow.io/	Get hash	malicious	HTMLPhisher	Browse
	http://metamaskelogines.webflow.io/	Get hash	malicious	HTMLPhisher	Browse
	PO#450-1469.xla.xlsx	Get hash	malicious	Unknown	Browse
	SOA_26225.xls	Get hash	malicious	Unknown	Browse
	CMT 240819 085.xls	Get hash	malicious	Unknown	Browse
	PO#4500550389.xla.xlsx	Get hash	malicious	Unknown	Browse
104.16.79.73	https://rpc-cryptolive.com	Get hash	malicious	Unknown	Browse
	https://opensea-nftpro5-eight.vercel.app	Get hash	malicious	Unknown	Browse
	https://tokennodelink.pages.dev	Get hash	malicious	HTMLPhisher	Browse
	https://solaxxy.click	Get hash	malicious	HTMLPhisher	Browse
	https://pell-network.website	Get hash	malicious	HTMLPhisher	Browse
	https://solaxy-claimtoken.pages.dev	Get hash	malicious	HTMLPhisher	Browse
	http://pub-a5c199e46db94f72884285a0394a65f2.r2.dev/green-table-top.html	Get hash	malicious	HTMLPhisher	Browse
	https://clever-link-safeguard.lovable.app/	Get hash	malicious	Unknown	Browse
	Yasmine Hilal W2, 401(k).pdf	Get hash	malicious	Unknown	Browse
	https://allegrolokalnie.pi-63434845.cfd/	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
static.cloudflareinsights.com	https://rpc-cryptolive.com	Get hash	malicious	Unknown	Browse	104.16.79.73
	https://opensea-nftpro5-eight.vercel.app	Get hash	malicious	Unknown	Browse	104.16.80.73
	https://tokennodelink.pages.dev	Get hash	malicious	HTMLPhisher	Browse	104.16.79.73
	https://solaxxy.click	Get hash	malicious	HTMLPhisher	Browse	104.16.79.73
	https://jupp.ac	Get hash	malicious	HTMLPhisher	Browse	104.16.80.73
	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.80.73
	https://ethernity-activity.info	Get hash	malicious	HTMLPhisher	Browse	104.16.80.73
	https://pell-network.website	Get hash	malicious	HTMLPhisher	Browse	104.16.79.73
	https://trias-migration.org	Get hash	malicious	HTMLPhisher	Browse	104.16.80.73
	https://clever-link-safeguard.lovable.app/	Get hash	malicious	Unknown	Browse	104.16.80.73
s-0005.dual-s-dc-msedge.net	https://ecidf91-my.sharepoint.com/:o:/g/personal/coord_etudesetchantiers_org/EUmQMWGSyWxJn1UxHBfM5-0BIQy5Pwz-5xitaPNPxYfBxQ?rtime=HcHK-dRm3Ug	Get hash	malicious	Unknown	Browse	52.123.131.14
	New Purchase Order.exe	Get hash	malicious	MSIL Logger, MassLogger RAT, XRed	Browse	52.123.130.14
	message__0XSkcQEiS5ehXOfhSk9JKw_geopod_ismtpd_30_.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	52.123.131.14
	Pre DA Lodgement and Contract.docx	Get hash	malicious	Unknown	Browse	52.123.130.14
	PO-465514-180820.doc.doc	Get hash	malicious	Unknown	Browse	52.123.131.14
	Pre DA Lodgement and Contract.docx	Get hash	malicious	Unknown	Browse	52.123.130.14
	Pre DA Lodgement and Contract.docx	Get hash	malicious	Unknown	Browse	52.123.131.14
	https://paste.ubuntu.com/p/2xjw98FbQJ	Get hash	malicious	Unknown	Browse	52.123.131.14
	Government of the People's Republic of China has invited nominations.docx.doc	Get hash	malicious	Unknown	Browse	52.123.130.14
	FW_ _Action Required__You have received a new shared DOC to be Completed On_Saturday March 2025.msg	Get hash	malicious	Unknown	Browse	52.123.130.14
beacons-handoff.gcp.gvt2.com	https://krakenzblogin.webflow.io	Get hash	malicious	HTMLPhisher	Browse	142.250.185.131
	https://kraken-logins.webflow.io	Get hash	malicious	HTMLPhisher	Browse	142.251.143.35
	https://pfveo.cn/eccjaspenjta/	Get hash	malicious	Unknown	Browse	142.251.143.35
	https://opensea-nftpro5-eight.vercel.app	Get hash	malicious	Unknown	Browse	172.217.18.99
	https://commercialmortgagealert.com/login	Get hash	malicious	Unknown	Browse	142.251.143.35
	http://girouardelectricien.ca	Get hash	malicious	Unknown	Browse	142.251.143.67
	https://enervit.freshdesk.com/en/support/solutions/articles/156000285380-prossimo-cambio-di-qualit%C3%A0	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	142.251.143.35
	https://mertibet.top	Get hash	malicious	Unknown	Browse	142.251.143.35
	https://aivptjn.top/hwujk	Get hash	malicious	Unknown	Browse	142.251.143.35
	https://lavime.bet	Get hash	malicious	Unknown	Browse	142.251.143.35
s-part-0044.t-0009.fb-t-msedge.net	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.107.253.72
	Message.eml	Get hash	malicious	Unknown	Browse	13.107.253.72
	New Purchase Order.exe	Get hash	malicious	MSIL Logger, MassLogger RAT, XRed	Browse	13.107.253.72
	https://mab.to/t/ZuukBeOHjSQ/eu1	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	https://mab.to/t/ZuukBeOHjSQ/eu1	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fuser.mxhemlock.com.mcas.ms%2F67cf5cc2c98f50010c977283%2Fl%2FHv7qKvsUB0cRchSlE%3Frn%3D%26re%3DgIt92YuwWah12ZARjMn5WarRWYlxWZoRnI%26sc%3Dfalse%26McasTsid%3D20596%23user_email%3Dcassandra.calpe%40cfainstitute.org%26fname%3DCassandra%26lname%3DBecerra&McasCSRF=57c9b97c65d2c90c6a2c27b6584a511a97f57752289aca897fe7252a6b88ff8f	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	https://public-usa.mkt.dynamics.com/api/orgs/f8d62d3a-5b03-f011-b015-6045bd003905/r/FMPIXkRqqkmv-j_Li7QBAAEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fgamma.app%252Fdocs%252FJanel-Group-Completed-Document-x686r1ir4nghubz%253Fmode%253Dpresent%2523card-an1daph37h4un5p%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%220%22%3Anull%7D%7D&digest=O1MpDB0efooTe4PN%2BrbvabY6GTxgYZEijI2csju%2FBYg%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	https://geminilogfine.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	Confidential_Communication#3760_pdf.html	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.107.253.72
	https://dermatech-lab.com/wp/confirm.html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.107.253.72

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	random(9).exe	Get hash	malicious	LummaC Stealer	Browse	172.67.210.5
	https://krekoii-logi.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.160.117
	https://kreakeunlgien.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	imv-corp(ref0467) #U3010#U6ce8#U6587#U66f8#U3011sales Agreement WP2501001152 WP2501001159.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://fatty.io	Get hash	malicious	Unknown	Browse	104.21.84.205
	EFt_-Now(Laeyeandlaser)CLQD.svg	Get hash	malicious	Unknown	Browse	104.21.62.225
	https://krukcin-lcin.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	Spacey Sun 11.12.411 (1).exe	Get hash	malicious	Vidar	Browse	172.67.140.127
	https://krserakenlogi.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	original (1).eml	Get hash	malicious	Unknown	Browse	188.114.97.3
CLOUDFLARENETUS	random(9).exe	Get hash	malicious	LummaC Stealer	Browse	172.67.210.5
	https://krekoii-logi.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.160.117
	https://kreakeunlgien.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	imv-corp(ref0467) #U3010#U6ce8#U6587#U66f8#U3011sales Agreement WP2501001152 WP2501001159.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://fatty.io	Get hash	malicious	Unknown	Browse	104.21.84.205
	EFt_-Now(Laeyeandlaser)CLQD.svg	Get hash	malicious	Unknown	Browse	104.21.62.225
	https://krukcin-lcin.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	Spacey Sun 11.12.411 (1).exe	Get hash	malicious	Vidar	Browse	172.67.140.127
	https://krserakenlogi.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	original (1).eml	Get hash	malicious	Unknown	Browse	188.114.97.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	Spacey Sun 11.12.411 (1).exe	Get hash	malicious	Vidar	Browse	20.44.10.123
	original (1).eml	Get hash	malicious	Unknown	Browse	52.123.128.14
	https://mysterybox2.tesbw.app	Get hash	malicious	Unknown	Browse	52.152.143.207
	https://opensea-nftpro5-eight.vercel.app	Get hash	malicious	Unknown	Browse	20.105.41.175
	OVERDUE.eml	Get hash	malicious	HTMLPhisher	Browse	20.189.173.10
	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.107.253.72
	https://aivptjn.top/hwujk	Get hash	malicious	Unknown	Browse	150.171.28.10
	Message.eml	Get hash	malicious	Unknown	Browse	13.107.42.14
	https://ecidf91-my.sharepoint.com/:o:/g/personal/coord_etudesetchantiers_org/EUmQMWGSyWxJn1UxHBfM5-0BIQy5Pwz-5xitaPNPxYfBxQ?rtime=HcHK-dRm3Ug	Get hash	malicious	Unknown	Browse	52.111.229.20
	https://lunexnetwork.co	Get hash	malicious	Unknown	Browse	20.105.41.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	random(8).exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.72
	random(9).exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.72
	Spacey Sun 11.12.411 (1).exe	Get hash	malicious	Vidar	Browse	13.107.253.72
	New Purchase Order.exe	Get hash	malicious	MSIL Logger, MassLogger RAT, XRed	Browse	13.107.253.72
	Computer Environment Info Collection Tool.xlsm	Get hash	malicious	Unknown	Browse	13.107.253.72
	random.exe	Get hash	malicious	Unknown	Browse	13.107.253.72
	random.exe	Get hash	malicious	Unknown	Browse	13.107.253.72
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	13.107.253.72
	DEVM28.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.72
	Setup.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	13.107.253.72

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
File Type:	Microsoft PowerPoint 2007+
Category:	dropped
Size (bytes):	65090
Entropy (8bit):	7.7656140518880825
Encrypted:	false
SSDEEP:	1536:8ofgjZHsx5dEPbbD4AXoMKoy0vb7spH6Sm:sC5sRXpKsvmHs
MD5:	88263DADE73C638F56E70F599CAD26D5
SHA1:	251DD0E366804D7AD209D10F08DE1DCF66AA93F3
SHA-256:	1947EC622B8D082FE8061AC44E84F12C47BE128784044EFEF01B466D8527EC4C
SHA-512:	8151B1B6766092D053BBBCE7DB4CE42371728786BFEFD76226F4B2ADB91B0FC0FBCF14E4274006CC81DD8FBF1D0C98B7F4ADFE44212DCCE911B8C0F9C4FAAC9F
Malicious:	false
Reputation:	low
Preview:	PK..........!..Z..............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.........E;m...C..@..I...F6[n i'~..);U..r.........5.L...HV`..#.tL.P....g.....$.3U0..dd..\.^........ed.yO... .K...#...yl.95,...@...s.k.A....d6..%[..\|z...9I>T.C..p....m...,......=.0c...q.R...6.HQ...7..N..!........`y..5..;.8....P.....PuY..../%J....4S...b......9........}................@i.n.7k...w.SP^[m\._n4n#Xq.......y..o.W.mZ#...n.Z..W].>....z.7.E..'GU....O....O....Of...v.L..dz7@...2]..i2.".)3y.T.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47880)
Category:	downloaded
Size (bytes):	114930
Entropy (8bit):	5.323714371203011
Encrypted:	false
SSDEEP:	3072:IKQJD8nVmqKCpgbiTRXtFRWan6Ds0XQpuX:IK/VJKCpgbiTRXtFRWan6Q0XQpuX
MD5:	2EE6263D5EC8CE3071E4C7A3B3AB18CC
SHA1:	C7CABB86B7E7E945D13BF386C21023C4A4D0D88B
SHA-256:	B3525CBA9924BC6ABC7F9E92F23626207A902FA08365F22C6600559A3003B24D
SHA-512:	4890DB58B24C182471F75F4BFC5DF76C5A2608D8F0FF9E446E77D5AB3D366A17B177BD5D3299B835176309FECA94D3E8D3CFED9E5B69D67A4A7559C948DAE7FA
Malicious:	false
URL:	https://scanned.page/static/css/main.c588d2a4.css
Preview:	body{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background-color:#fff;font-family:Eudoxus Sans,sans-serif}code{font-family:source-code-pro,Menlo,Monaco,Consolas,Courier New,monospace}.react-pdf__Page>canvas{max-width:none}.wrap-overflow-text{display:inline-block;overflow-wrap:break-word}.step-def-text{font-size:clamp(24px,1.8vw,28px);line-height:1.25}.showcase{overflow:hidden;pointer-events:none}.b-share{max-height:350px;overflow-y:auto}.custom-scroll-bar::-webkit-scrollbar{width:5px}.custom-scroll-bar::-webkit-scrollbar-track{background:#f1f1f1}.custom-scroll-bar::-webkit-scrollbar-thumb{background:#888;border-radius:5px}.custom-scroll-bar::-webkit-scrollbar-thumb:hover{background:#555}.App{text-align:center}.App-logo{height:40vmin;pointer-events:none}body{font-family:Lato,sans-serif!important}@media (prefers-reduced-motion:no-preference){.App-logo{animation:App-logo-spin 20s linear infinite}}.app-pages{align-items:center;height:100vh;height:100%;justify-cont

File type:	Unicode text, UTF-8 (with BOM) text, with very long lines (790), with CRLF line terminators
Entropy (8bit):	6.125443657117063
TrID:	Text - UTF-8 encoded (3003/1) 100.00%
File name:	Message.eml
File size:	127'864 bytes
MD5:	08813298dac46c69f7f09675846cb1e5
SHA1:	ed17bc6c4034bc6ae28bb490e29c766d053af6b4
SHA256:	4e86bdff14cba66d2dff589d28c00ddbe1b2b6882e53eaebb9d27b2b7a72dd5c
SHA512:	35b468eee05b98943695ebfa00035739958e8173e37823bc2164ace57441664e84cca3ecf9473b828f2538ecc0c2c4c65405d3b8b831e447e31fe9c281e543de
SSDEEP:	3072:CQ86AMWx1Wjdckpg83hXlpeTr/uxy0ep7:Cp6W15tAVSjukV
TLSH:	EAC3CFB95FBA0EF4C91235E50C017D0A5CB92DB7E4B3A0C23D3819D3194B9BE8F1695A
File Content Preview:	..."Received: from PAXPR07MB7856.eurprd07.prod.outlook.com (2603:10a6:102:131::21).. by PAXPR07MB8891.eurprd07.prod.outlook.com with HTTPS; Tue, 18 Mar 2025.. 22:13:47 +0000..Received: from DU2P250CA0022.EURP250.PROD.OUTLOOK.COM (2603:10a6:10:231::27).. b

Subject:	Salary Adjustment Notice - Please Review 41
From:	"H.R" <notificaciones@humanquality.com.mx>
To:	naleena.gururani@hyperoptic.com
Cc:
BCC:
Date:	Tue, 18 Mar 2025 22:13:43 +0000
Communications:	Note: This email originated from outside Hyperoptic so please remember to only click on links or open attachments if you recognise the sender and know the content is safe.
Attachments:

Key	Value
"Received	from PAXPR07MB7856.eurprd07.prod.outlook.com (2603:10a6:102:131::21) by PAXPR07MB8891.eurprd07.prod.outlook.com with HTTPS; Tue, 18 Mar 2025 22:13:47 +0000
Received	from a27-57.smtp-out.us-west-2.amazonses.com (54.240.27.57) by DU6PEPF0000A7E1.mail.protection.outlook.com (10.167.8.40) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8534.20 via Frontend Transport; Tue, 18 Mar 2025 22:13:44 +0000
Authentication-Results	spf=pass (sender IP is 54.240.27.57) smtp.mailfrom=us-west-2.amazonses.com; dkim=pass (signature was verified) header.d=humanquality.com.mx;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=humanquality.com.mx;compauth=pass reason=100
Received-SPF	Pass (protection.outlook.com: domain of us-west-2.amazonses.com designates 54.240.27.57 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.27.57; helo=a27-57.smtp-out.us-west-2.amazonses.com; pr=C
DKIM-Signature	v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=gdwg2y3kokkkj5a55z2ilkup5wp5hhxx; d=amazonses.com; t=1742336023; h=Content-Type:Content-ID:Content-Transfer-Encoding:From:To:Subject:Message-ID:Date:MIME-Version:Feedback-ID; bh=jKrPw4k/qwMhWkO+dlYNe9NYlMDb9Anuo2TU17pJ9E0=; b=j9118LnM9X5mNmFtHFor8DVK040W9+IxrItm/fpVP4UvsekgMJA5+Js8Jt+jqNSW 6IBONjXJOvvFoL5zpMJfMV6PeYo5viQ12Koq8BIeZpL/82fdWBVuE/J2l8cCwZBj8BN elZZzmafgUWf1NESI3vM7aQc7YDlhmUPEWs9Gg+Y=
Content-ID	<11.15.24 ACH REMMITANCE.pdf>
X-Ma4-Node	false
From	"H.R" <notificaciones@humanquality.com.mx>
To	naleena.gururani@hyperoptic.com
Subject	Salary Adjustment Notice - Please Review 41
Message-ID	<01010195ab51dadb-29458bf2-e4ed-42a4-95e4-7986f49a2427-000000@us-west-2.amazonses.com>
Date	Tue, 18 Mar 2025 22:13:43 +0000
Feedback-ID	::1.us-west-2.9VuReFtW/zPSnUse+mUaDNrD4lfRn8v8najG2mR3CIM=:AmazonSES
X-SES-Outgoing	2025.03.18-54.240.27.57
Return-Path	01010195ab51dadb-29458bf2-e4ed-42a4-95e4-7986f49a2427-000000@us-west-2.amazonses.com
X-MS-Exchange-Organization-ExpirationStartTime	18 Mar 2025 22:13:45.3928 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	6562184b-a727-4bad-24ad-08dd666a2670
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	df58f807-1209-4a95-9c55-f71b3c95667b:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	DU6PEPF0000A7E1:EE_\|PAXPR07MB7856:EE_\|PAXPR07MB8891:EE_
X-MS-Exchange-Organization-AuthSource	DU6PEPF0000A7E1.eurprd02.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id	6562184b-a727-4bad-24ad-08dd666a2670
X-MS-Exchange-AtpMessageProperties	SA\|SL
Content-Type	multipart/mixed; boundary="_bd744895-68bc-468c-9772-af434c325a61_"
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|12012899012\|32142699015\|4053099003;
X-Forefront-Antispam-Report	CIP:54.240.27.57;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:a27-57.smtp-out.us-west-2.amazonses.com;PTR:a27-57.smtp-out.us-west-2.amazonses.com;CAT:NONE;SFS:(13230040)(12012899012)(32142699015)(4053099003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	18 Mar 2025 22:13:44.8772 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	6562184b-a727-4bad-24ad-08dd666a2670
X-MS-Exchange-CrossTenant-Id	df58f807-1209-4a95-9c55-f71b3c95667b
X-MS-Exchange-CrossTenant-AuthSource	DU6PEPF0000A7E1.eurprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	PAXPR07MB7856
X-MS-Exchange-Transport-EndToEndLatency	00:00:02.6993864
X-MS-Exchange-Processed-By-BccFoldering	15.20.8534.029
Importance	high
X-Priority	1
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(4710137)(4713040)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	7NO+f7axJsV69474DvAG0jrMbSFPd5H+uclvgBNNuOmZTcp2+lpvY6adIDZ03ooY/ekyfmDnbHoT9aV5xmeUSWByVDz3sKrfu/6YzGCfAnxleyTfHYTEDQpJzma/5wJzSZEPvuFg8UicZ6I3MOzxO2hzYfGp3oaePkxZpVimKBBbwxz3eGrpFMzPqoVF7pyzB2Ear55Tp0vX2vuX/YwGNo8EPt2BDpSDAymbJtJyJGTbDgEQ7sXEJI3OKx7/dfhm7orv8Hcn6xZ6E6mkztSmQeEd4qoAPsbZecIinkTbU53l9oMJr/9c+QC6X3EumdaVoGKVn51NyMt4NguD+KVFAQtUr3KXrgYuCoDHER2UynF7hlNJisQr4eS8xEQSPcxv6cQJ8EvMddjHf5tpGSE60prcNhIh8xzryFMV7VAIdHj93gOQU55mk3IMRUMnIrMzsEg5vQC9OeEpG1jr9+eUFWrIfzdKLlUfvcZS33l6fkJpWlIhVLgkemGC4gLyMVBQlQlVUlGbT1JOuDXD/ovDftZ4skYHQNQyGiYU2xz20Fs8GJR9BRlw7AF/bwJOku71MbbK5daPceyDnCtd/zJQgFcN63XVWOJFvtchLffdyJUkA2XpWVT3aEILHB+l6FyRbT9dnIOUoQYxvGy6dZ7nl6tiC1KVibGPsjs2IdQVcjxTV8+l5I4eGBz14CwUMCkm1xsECs7ThwuDVPD5kgh1iGzXIRuC/whH0Hr1Yg1XchEWev8sB6Zfbomm4Jjiqx92418nXnoFo2LJu3wH5lmKs0qA1eA1dqFTlGEM/6gIl90chrdRQeu81kpylzmUxMjy3tF+cYib3GHxj75iHxYGt7W67QNtTakYZnXXRHbakeCxznDJxxr68NZEERynQ6KcVwPjm4FAM5WFqbZQnuVxWOvKRjycyHjSLxV8uZ7tYhibYXhfAYcX/0diOmBStTvGxO12TPBZLGqsFFDicp8CECAxyzkTX6U/5NG6lPyS46/wtECGfJ6NeIcCW+XxttrTOdV41o46xdu/TwHItobRS/3XwwtEnSlgT1JllEBqtw+TE66+ud5CtRgj+C0EIQrsVJhQFtebwqELTnCzX6uu4g/xC3+s/bMGjBQ6O+4/EAJEhS7rnMSE9OTppxYEZipsN8BUtZNBk1FeZKsT4/W42JUB/R5KHbovcjxjY53DUDUWsOYlMgJb4nuyy4TQYxq409mExymw9ZkMYwDJR/i/eITPgXZKLKhiQjtX49uVxl1V/hdz9X1hhBbjz4lPjShBZojcrlzKRQhLjJUgzCtgHJpwos2RDeyUbsM4tBokxlTCdjLLej58S4MN/65cCj1Hc9fyOu+0s9FvMLJrZsI53m77iDA+nH4eYi83NmO6YbrKHEbHDi4vIgexEiMjTyOw3mCFzLp8nRC3y6n184CoPCtpWxd0ZOqLaoE7hF06M3nOfuiwBLDhj9qbemoIYnjuk0QF9HEjG4JEHaWNr6X0i/jR8nz3uMjGHI7+HR2xzL4Jd7dMkMR7f2e+v60XScQOlcDs3U3YfdCw8vc6fVn5APqKnCT1BwvgL/b8dTASCTaBlOwo49gp7g+eO7TzPj6AnNWl5pITUvWUif26YObVv2xr7J7xbALeLSv1DTktg5GdI0z/a6OfxIDsu14Gq0k74+Zra8MpqJGt4A47MHwdZx2tAm3KqrMuXmnshYqwKbL/sVmKWj7DV8TElxQLPaxqVcUM7CqrOUkZu/j0FzSrzETOBlOX8+r7n2ndLo84dmKol+AXwg7pz3G/Bxx0Tt1FjWD+V5UG40WacAnyRbeU5Vf4s+fBAV2wz+IXs6H6+jaHE2hPDXhBRtjTJeNPcVSaRSNc4JKN+8kUA0GC/NnttM4jqysTMANxcfdDjrb+7kSQGaLhUeOUQtdd1beJtviO
MIME-Version	1.0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 14:01:26.672741890 CET	51925	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:26.714946032 CET	53	51925	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:43.844829082 CET	57041	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:43.845413923 CET	55947	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:43.849728107 CET	53	62437	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:43.854173899 CET	53	55947	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:43.855849981 CET	53	57041	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:43.890069962 CET	53	59657	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:46.059684038 CET	62954	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:46.060314894 CET	60242	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:46.066754103 CET	53	62954	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:46.069503069 CET	53	60242	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:46.111655951 CET	53	51974	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:46.528403044 CET	51283	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:46.528690100 CET	60641	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:46.535744905 CET	53	51283	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:46.535778046 CET	53	60641	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:47.558053017 CET	60268	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:47.559530973 CET	60602	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:47.560601950 CET	56682	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:47.560746908 CET	60452	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:47.564841032 CET	53	60268	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:47.566621065 CET	53	60602	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:47.567197084 CET	53	56682	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:47.567715883 CET	53	60452	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:48.378659010 CET	51496	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:48.378822088 CET	60943	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:48.388279915 CET	53	60943	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:48.434413910 CET	53	51496	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:48.541274071 CET	55490	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:48.541431904 CET	53213	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:48.549006939 CET	53	55490	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:48.549693108 CET	53	53213	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:48.604435921 CET	62159	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:48.604602098 CET	51174	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:01:48.612588882 CET	53	62159	1.1.1.1	192.168.2.16
Mar 19, 2025 14:01:48.613059044 CET	53	51174	1.1.1.1	192.168.2.16
Mar 19, 2025 14:02:03.190444946 CET	53	51072	1.1.1.1	192.168.2.16
Mar 19, 2025 14:02:22.144630909 CET	53	65136	1.1.1.1	192.168.2.16
Mar 19, 2025 14:02:25.655839920 CET	138	138	192.168.2.16	192.168.2.255
Mar 19, 2025 14:02:43.812912941 CET	53	49227	1.1.1.1	192.168.2.16
Mar 19, 2025 14:02:45.081053019 CET	53	64620	1.1.1.1	192.168.2.16
Mar 19, 2025 14:02:47.447202921 CET	53	51364	1.1.1.1	192.168.2.16
Mar 19, 2025 14:02:48.666909933 CET	59452	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:02:48.666963100 CET	56453	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:02:48.673360109 CET	53	59452	1.1.1.1	192.168.2.16
Mar 19, 2025 14:02:48.673542976 CET	53	56453	1.1.1.1	192.168.2.16
Mar 19, 2025 14:03:12.062840939 CET	51524	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:03:12.063031912 CET	50791	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:03:12.069423914 CET	53	51524	1.1.1.1	192.168.2.16
Mar 19, 2025 14:03:12.069645882 CET	53	50791	1.1.1.1	192.168.2.16
Mar 19, 2025 14:03:13.083565950 CET	56860	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:03:13.083728075 CET	57476	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:03:13.091825962 CET	53	57476	1.1.1.1	192.168.2.16
Mar 19, 2025 14:03:13.091860056 CET	53	56860	1.1.1.1	192.168.2.16
Mar 19, 2025 14:03:15.108889103 CET	61877	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:03:15.116425991 CET	53	61877	1.1.1.1	192.168.2.16
Mar 19, 2025 14:03:15.661416054 CET	53	62221	1.1.1.1	192.168.2.16
Mar 19, 2025 14:03:16.114156008 CET	61877	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:03:16.121514082 CET	53	61877	1.1.1.1	192.168.2.16
Mar 19, 2025 14:03:17.120287895 CET	61877	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:03:17.127262115 CET	53	61877	1.1.1.1	192.168.2.16
Mar 19, 2025 14:03:19.132152081 CET	61877	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:03:19.138799906 CET	53	61877	1.1.1.1	192.168.2.16
Mar 19, 2025 14:03:23.134191990 CET	61877	53	192.168.2.16	1.1.1.1
Mar 19, 2025 14:03:23.141398907 CET	53	61877	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 19, 2025 14:01:12.986008883 CET	1.1.1.1	192.168.2.16	0x4197	No error (0)	ecs-office.s-0005.dual-s-msedge.net	shed.s-0005.dual-s-dc-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:01:12.986008883 CET	1.1.1.1	192.168.2.16	0x4197	No error (0)	shed.s-0005.dual-s-dc-msedge.net	s-0005.dual-s-dc-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:01:12.986008883 CET	1.1.1.1	192.168.2.16	0x4197	No error (0)	s-0005.dual-s-dc-msedge.net		52.123.130.14	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:12.986008883 CET	1.1.1.1	192.168.2.16	0x4197	No error (0)	s-0005.dual-s-dc-msedge.net		52.123.131.14	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:26.714946032 CET	1.1.1.1	192.168.2.16	0x5820	No error (0)	otelrules.svc.static.microsoft	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:01:26.714946032 CET	1.1.1.1	192.168.2.16	0x5820	No error (0)	otelrules-bzhndjfje8dvh5fd.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:01:26.714946032 CET	1.1.1.1	192.168.2.16	0x5820	No error (0)	star-azurefd-prod.trafficmanager.net	shed.dual-low.s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:01:26.714946032 CET	1.1.1.1	192.168.2.16	0x5820	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:01:26.714946032 CET	1.1.1.1	192.168.2.16	0x5820	No error (0)	azurefd-t-fb-prod.trafficmanager.net	dual.s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:01:26.714946032 CET	1.1.1.1	192.168.2.16	0x5820	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:01:26.714946032 CET	1.1.1.1	192.168.2.16	0x5820	No error (0)	s-part-0044.t-0009.fb-t-msedge.net		13.107.253.72	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:43.854173899 CET	1.1.1.1	192.168.2.16	0x9432	No error (0)	scanned.page			65	IN (0x0001)	false
Mar 19, 2025 14:01:43.855849981 CET	1.1.1.1	192.168.2.16	0xa7a9	No error (0)	scanned.page		104.26.12.106	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:43.855849981 CET	1.1.1.1	192.168.2.16	0xa7a9	No error (0)	scanned.page		104.26.13.106	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:43.855849981 CET	1.1.1.1	192.168.2.16	0xa7a9	No error (0)	scanned.page		172.67.69.32	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:46.066754103 CET	1.1.1.1	192.168.2.16	0x27d8	No error (0)	static.cloudflareinsights.com		104.16.79.73	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:46.066754103 CET	1.1.1.1	192.168.2.16	0x27d8	No error (0)	static.cloudflareinsights.com		104.16.80.73	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:46.069503069 CET	1.1.1.1	192.168.2.16	0x8892	No error (0)	static.cloudflareinsights.com			65	IN (0x0001)	false
Mar 19, 2025 14:01:46.535744905 CET	1.1.1.1	192.168.2.16	0xaa5c	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:47.564841032 CET	1.1.1.1	192.168.2.16	0xf768	No error (0)	stats.g.doubleclick.net		74.125.71.154	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:47.564841032 CET	1.1.1.1	192.168.2.16	0xf768	No error (0)	stats.g.doubleclick.net		74.125.71.156	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:47.564841032 CET	1.1.1.1	192.168.2.16	0xf768	No error (0)	stats.g.doubleclick.net		74.125.71.157	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:47.564841032 CET	1.1.1.1	192.168.2.16	0xf768	No error (0)	stats.g.doubleclick.net		74.125.71.155	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:47.567197084 CET	1.1.1.1	192.168.2.16	0x7d2e	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:47.567715883 CET	1.1.1.1	192.168.2.16	0x6746	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 19, 2025 14:01:48.388279915 CET	1.1.1.1	192.168.2.16	0xed02	No error (0)	scanned.page			65	IN (0x0001)	false
Mar 19, 2025 14:01:48.434413910 CET	1.1.1.1	192.168.2.16	0xf041	No error (0)	scanned.page		104.26.12.106	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:48.434413910 CET	1.1.1.1	192.168.2.16	0xf041	No error (0)	scanned.page		104.26.13.106	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:48.434413910 CET	1.1.1.1	192.168.2.16	0xf041	No error (0)	scanned.page		172.67.69.32	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:48.549006939 CET	1.1.1.1	192.168.2.16	0xa9bf	No error (0)	www.google.com		142.250.181.228	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:48.549693108 CET	1.1.1.1	192.168.2.16	0x6147	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 19, 2025 14:01:48.612588882 CET	1.1.1.1	192.168.2.16	0xf433	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:48.613059044 CET	1.1.1.1	192.168.2.16	0x8bbb	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 19, 2025 14:02:48.673360109 CET	1.1.1.1	192.168.2.16	0xdf21	No error (0)	www.google.com		142.250.186.36	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:02:48.673542976 CET	1.1.1.1	192.168.2.16	0x6927	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 19, 2025 14:03:12.069423914 CET	1.1.1.1	192.168.2.16	0xd2d6	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:03:12.069423914 CET	1.1.1.1	192.168.2.16	0xd2d6	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:03:12.069645882 CET	1.1.1.1	192.168.2.16	0x135d	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:03:13.091825962 CET	1.1.1.1	192.168.2.16	0xe5b9	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:03:13.091860056 CET	1.1.1.1	192.168.2.16	0xfc9e	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:03:13.091860056 CET	1.1.1.1	192.168.2.16	0xfc9e	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:03:15.116425991 CET	1.1.1.1	192.168.2.16	0x4234	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:03:15.116425991 CET	1.1.1.1	192.168.2.16	0x4234	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:03:16.121514082 CET	1.1.1.1	192.168.2.16	0x4234	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:03:16.121514082 CET	1.1.1.1	192.168.2.16	0x4234	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:03:17.127262115 CET	1.1.1.1	192.168.2.16	0x4234	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:03:17.127262115 CET	1.1.1.1	192.168.2.16	0x4234	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:03:19.138799906 CET	1.1.1.1	192.168.2.16	0x4234	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:03:19.138799906 CET	1.1.1.1	192.168.2.16	0x4234	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:03:23.141398907 CET	1.1.1.1	192.168.2.16	0x4234	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2025 14:03:23.141398907 CET	1.1.1.1	192.168.2.16	0x4234	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:27 UTC	234	OUT	GET /rules/powerpnt.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-19 13:01:27 UTC	500	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:27 GMT Content-Type: text/plain Content-Length: 1185452 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 19 Mar 2025 03:16:04 GMT ETag: "0x8DD6694625749EF" x-ms-request-id: bef8f696-301e-0051-3bc9-9838bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20250319T130127Z-r1985965d795h9nshC1MNZwmvw00000007ag00000000093m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2025-03-19 13:01:27 UTC	15884	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2025-03-19 13:01:27 UTC	16384	IN	Data Raw: 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 Data Ascii: S T="1" /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C
2025-03-19 13:01:27 UTC	16384	IN	Data Raw: 20 20 20 3c 2f 41 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 Data Ascii: </A> </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C
2025-03-19 13:01:27 UTC	16384	IN	Data Raw: 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: "AND"> <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE">
2025-03-19 13:01:27 UTC	16384	IN	Data Raw: 54 3d 22 55 33 32 22 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 Data Ascii: T="U32" I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C>
2025-03-19 13:01:27 UTC	16384	IN	Data Raw: 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 Data Ascii: 1.0" encoding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e2
2025-03-19 13:01:27 UTC	16384	IN	Data Raw: 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 Data Ascii: ="2" E="TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S>
2025-03-19 13:01:27 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R>
2025-03-19 13:01:27 UTC	16384	IN	Data Raw: 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 Data Ascii: </F> <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownExcep
2025-03-19 13:01:27 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c Data Ascii: <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:31 UTC	219	OUT	GET /rules/rule840000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-19 13:01:32 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:31 GMT Content-Type: text/xml Content-Length: 2740 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBCAE5F7" x-ms-request-id: 598ffb17-001e-00a2-75cf-98d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20250319T130131Z-r1985965d79b84vfhC1MNZpg040000000ak0000000004bwk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2025-03-19 13:01:32 UTC	2740	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 38 34 30 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 46 6c 6f 6f 64 67 61 74 65 2e 43 6c 69 65 6e 74 2e 43 61 6d 70 61 69 67 6e 45 78 70 65 72 69 6d 65 6e 74 4c 6f 61 64 22 20 41 54 54 3d 22 64 35 32 36 61 39 30 35 32 65 34 34 34 66 31 64 38 37 30 36 35 32 39 65 66 31 31 31 62 31 30 31 2d 31 61 32 33 35 34 34 65 2d 65 66 37 34 2d 34 61 38 37 2d 39 39 37 39 2d 37 38 33 38 36 63 62 33 63 35 65 36 2d 36 37 36 32 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 45 78 70 65 72 69 6d 65 6e 74 61 74 69 6f 6e 22 20 44 4c 3d 22 4e 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="840000" V="1" DC="SM" EN="Office.Floodgate.Client.CampaignExperimentLoad" ATT="d526a9052e444f1d8706529ef111b101-1a23544e-ef74-4a87-9979-78386cb3c5e6-6762" SP="CriticalExperimentation" DL="N" DCa="PSU" xmln

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:31 UTC	218	OUT	GET /rules/rule68022v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-19 13:01:32 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:32 GMT Content-Type: text/xml Content-Length: 1531 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE568167E" x-ms-request-id: d0bd774d-e01e-0052-78cf-98d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20250319T130131Z-r1985965d795flsbhC1MNZ116s00000006d000000000drsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2025-03-19 13:01:32 UTC	1531	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 36 38 30 32 32 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 54 65 6c 6c 4d 65 44 2e 52 65 73 75 6c 74 47 72 6f 75 70 54 79 70 65 4f 72 64 65 72 22 20 41 54 54 3d 22 33 31 64 39 64 64 33 65 34 63 37 30 34 36 61 36 39 36 35 33 37 35 38 36 32 38 31 64 37 65 64 31 2d 30 36 64 31 31 64 64 36 2d 61 39 34 36 2d 34 32 38 31 2d 38 61 63 33 2d 61 37 63 32 61 62 34 37 37 36 66 35 2d 37 30 36 33 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 4e 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="68022" V="8" DC="SM" EN="Office.TellMe.TellMeD.ResultGroupTypeOrder" ATT="31d9dd3e4c7046a696537586281d7ed1-06d11dd6-a946-4281-8ac3-a7c2ab4776f5-7063" SP="CriticalBusinessImpact" DL="N" DCa="PSU" xmlns="">

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:31 UTC	218	OUT	GET /rules/rule63067v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-19 13:01:32 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:32 GMT Content-Type: text/xml Content-Length: 2871 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:05 GMT ETag: "0x8DC582BEC5E84E0" x-ms-request-id: 4d9df6f4-201e-000c-20cf-9879c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20250319T130131Z-r1985965d79d5zlqhC1MNZ8rt400000008s0000000000b46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2025-03-19 13:01:32 UTC	2871	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 36 33 30 36 37 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 49 64 65 6e 74 69 74 79 2e 53 73 70 69 50 72 6f 6d 70 74 57 69 6e 33 32 22 20 41 54 54 3d 22 35 63 36 35 62 62 63 34 65 64 62 66 34 38 30 64 39 36 33 37 61 63 65 30 34 64 36 32 62 64 39 38 2d 31 32 38 34 34 38 39 33 2d 38 61 62 39 2d 34 64 64 65 2d 62 38 35 30 2d 35 36 31 32 63 62 31 32 65 30 66 32 2d 37 38 32 32 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="63067" V="4" DC="SM" EN="Office.Identity.SspiPromptWin32" ATT="5c65bbc4edbf480d9637ace04d62bd98-12844893-8ab9-4dde-b850-5612cb12e0f2-7822" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <S>

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:44 UTC	675	OUT	GET /67d9e2d6eeffd HTTP/1.1 Host: scanned.page Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 13:01:44 UTC	1145	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 922d2900ffca42f2-EWR CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Age: 383528 Cache-Control: s-maxage=0 Content-Disposition: inline; filename="index.html" Last-Modified: Fri, 14 Mar 2025 03:08:28 GMT Strict-Transport-Security: max-age=63072000 Vary: accept-encoding x-vercel-cache: HIT x-vercel-id: iad1::9tqvl-1742389304525-da8be34b82fb Server-Timing: cfCacheStatus;desc="DYNAMIC" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZsJEyFbgsttCCr8cuBGdf%2FBmvZzqMA%2BwI2oy3mPoxQ5xzj0tDZu%2BAaa6q2RntHtXWRd0ns5GPuuaGbOb0FOPRcMd7QXIWRrgVIzYBnH94NPHuDrO0lzv1D0dAQgQVA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=8983&min_rtt=8634&rtt_var=3937&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1247&delivery_rate=255445&cwnd=187&unsent_bytes=0&cid=6dbd57b203d32c9e&ts=228&x=0"
2025-03-19 13:01:44 UTC	224	IN	Data Raw: 65 39 31 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 66 66 66 66 66 66 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c Data Ascii: e91<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.png"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#ffffff"/><link rel
2025-03-19 13:01:44 UTC	1369	IN	Data Raw: 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 20 68 72 65 66 3d 22 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 6d 61 6e 69 66 65 73 74 45 6c 65 6d 65 6e 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 5b 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 5d 27 29 2c 69 63 6f 6e 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 5b 72 65 6c 3d 22 69 63 6f 6e 22 5d 27 29 2c 61 70 70 6c 65 49 63 6f 6e 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 5b 72 65 6c Data Ascii: ="apple-touch-icon" href="/favicon.png"/><link rel="manifest" href="/manifest.json"/><title></title><script>const manifestElement=document.querySelector('[rel="manifest"]'),icon=document.querySelector('[rel="icon"]'),appleIcon=document.querySelector('[rel
2025-03-19 13:01:44 UTC	1369	IN	Data Raw: 61 5b 63 5d 2e 74 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 74 69 74 6c 65 22 29 5b 30 5d 2e 74 65 78 74 29 3b 61 5b 63 5d 2e 78 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 61 5b 63 5d 2e 77 3d 61 2e 73 63 72 65 65 6e 2e 77 69 64 74 68 3b 61 5b 63 5d 2e 68 3d 61 2e 73 63 72 65 65 6e 2e 68 65 69 67 68 74 3b 61 5b 63 5d 2e 6a 3d 61 2e 69 6e 6e 65 72 48 65 69 67 68 74 3b 61 5b 63 5d 2e 65 3d 61 2e 69 6e 6e 65 72 57 69 64 74 68 3b 61 5b 63 5d 2e 6c 3d 61 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 61 5b 63 5d 2e 72 3d 62 2e 72 65 66 65 72 72 65 72 3b 61 5b 63 5d 2e 6b 3d 61 2e 73 63 72 65 65 6e 2e 63 6f 6c 6f 72 44 65 70 74 68 3b 61 5b 63 5d 2e 6e 3d 62 2e 63 68 61 72 61 63 74 65 72 53 65 74 3b 61 5b 63 5d 2e 6f 3d 28 6e 65 Data Ascii: a[c].t=b.getElementsByTagName("title")[0].text);a[c].x=Math.random();a[c].w=a.screen.width;a[c].h=a.screen.height;a[c].j=a.innerHeight;a[c].e=a.innerWidth;a[c].l=a.location.href;a[c].r=b.referrer;a[c].k=a.screen.colorDepth;a[c].n=b.characterSet;a[c].o=(ne
2025-03-19 13:01:44 UTC	774	IN	Data Raw: 74 74 6c 65 64 28 28 62 73 2e 66 7c 7c 5b 5d 29 2e 6d 61 70 28 28 62 7a 3d 3e 66 65 74 63 68 28 62 7a 5b 30 5d 2c 62 7a 5b 31 5d 29 29 29 29 7d 62 74 28 29 7d 29 29 3b 7a 61 72 61 7a 2e 5f 70 28 7b 22 65 22 3a 5b 22 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 29 7b 7d 29 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 22 5d 7d 29 3b 7d 29 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 7d 63 61 74 63 68 28 65 29 7b 74 68 72 6f 77 20 66 65 74 63 68 28 22 2f 63 64 6e 2d 63 67 69 2f 7a 61 72 61 7a 2f 74 22 29 2c 65 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 6e 6f 73 63 72 69 70 74 3e 59 6f 75 20 6e 65 65 64 20 74 6f 20 65 6e 61 62 6c 65 20 4a 61 76 61 53 63 72 69 70 74 20 74 6f 20 72 75 6e 20 74 68 69 73 20 61 70 70 2e 3c Data Ascii: ttled((bs.f\|\|[]).map((bz=>fetch(bz[0],bz[1]))))}bt()}));zaraz._p({"e":["(function(w,d){})(window,document)"]});})(window,document)}catch(e){throw fetch("/cdn-cgi/zaraz/t"),e;};</script></head><body><noscript>You need to enable JavaScript to run this app.<
2025-03-19 13:01:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:45 UTC	571	OUT	GET /static/css/main.c588d2a4.css HTTP/1.1 Host: scanned.page Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://scanned.page/67d9e2d6eeffd Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 13:01:45 UTC	1173	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:45 GMT Content-Type: text/css; charset=utf-8 Content-Length: 114930 Connection: close access-control-allow-origin: * Cache-Control: max-age=14400, s-maxage=31536000, immutable content-disposition: inline; filename="main.c588d2a4.css" etag: "2ee6263d5ec8ce3071e4c7a3b3ab18cc" last-modified: Fri, 14 Mar 2025 03:10:14 GMT strict-transport-security: max-age=63072000 x-vercel-cache: HIT x-vercel-id: iad1::kqcfv-1742202171076-308dccc9f0c8 CF-Cache-Status: HIT Age: 185489 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YxuNBzFkak9ZXq8lPL94YKktyulyWOg%2FcCG1qGxTCm9o9A1QBUwRaDwV9nn6u3R9b1CgfukjkS7ofJWp%2B8YLSkbBwjnBXP322zuiTZzEZr%2BE8vL6N1KyrcZyfKXv%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare CF-RAY: 922d29088e375cb9-EWR server-timing: cfL4;desc="?proto=TCP&rtt=8597&min_rtt=8592&rtt_var=3233&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1143&delivery_rate=338080&cwnd=32&unsent_bytes=0&cid=66627ea4c8368795&ts=180&x=0"
2025-03-19 13:01:45 UTC	196	IN	Data Raw: 62 6f 64 79 7b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 3b 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 45 75 64 6f 78 75 73 20 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 7d 63 6f 64 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 6f 75 72 63 65 2d 63 6f 64 65 2d 70 72 6f 2c 4d 65 6e 6c 6f 2c 4d 6f 6e 61 63 6f 2c 43 6f 6e 73 6f 6c 61 73 2c 43 6f 75 72 69 65 72 20 4e Data Ascii: body{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background-color:#fff;font-family:Eudoxus Sans,sans-serif}code{font-family:source-code-pro,Menlo,Monaco,Consolas,Courier N
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 65 77 2c 6d 6f 6e 6f 73 70 61 63 65 7d 2e 72 65 61 63 74 2d 70 64 66 5f 5f 50 61 67 65 3e 63 61 6e 76 61 73 7b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 7d 2e 77 72 61 70 2d 6f 76 65 72 66 6c 6f 77 2d 74 65 78 74 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6f 76 65 72 66 6c 6f 77 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 7d 2e 73 74 65 70 2d 64 65 66 2d 74 65 78 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 6c 61 6d 70 28 32 34 70 78 2c 31 2e 38 76 77 2c 32 38 70 78 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 35 7d 2e 73 68 6f 77 63 61 73 65 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 2e 62 2d 73 68 61 72 65 7b 6d 61 78 2d 68 65 69 67 68 74 3a 33 35 30 70 78 3b Data Ascii: ew,monospace}.react-pdf__Page>canvas{max-width:none}.wrap-overflow-text{display:inline-block;overflow-wrap:break-word}.step-def-text{font-size:clamp(24px,1.8vw,28px);line-height:1.25}.showcase{overflow:hidden;pointer-events:none}.b-share{max-height:350px;
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 69 72 63 75 6c 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 68 65 69 67 68 74 3a 31 35 30 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 31 35 30 70 78 7d 2e 63 69 72 63 75 6c 61 72 20 69 6d 67 7b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6c 65 66 74 3a 35 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 3b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 63 61 72 64 6f 6b 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 30 2c 30 25 2c 39 36 25 2c 2e 39 37 33 29 3b 62 6f 72 64 65 72 Data Ascii: ircular{border-radius:50%;height:150px;overflow:hidden;position:relative;width:150px}.circular img{height:auto;left:50%;min-height:100%;position:absolute;top:50%;transform:translate(-50%,-50%);width:auto}.cardok{background-color:hsla(0,0%,96%,.973);border
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 73 3a 31 30 30 25 3b 62 6f 74 74 6f 6d 3a 2d 36 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 6a 73 73 34 2c 2e 6a 73 73 35 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 68 65 69 67 68 74 3a 38 30 70 78 3b 77 69 64 74 68 3a 38 30 70 78 7d 2e 6a 73 73 35 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 6a 73 73 35 2c 2e 6a 73 73 36 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 7d 2e 6a 73 73 36 7b 68 65 69 67 68 74 3a 36 36 70 78 3b 6f 62 6a 65 63 74 2d 66 69 74 3a 63 6f 76 65 72 3b 77 69 64 74 68 3a 36 36 70 78 7d 2e 6a 73 73 37 7b 6d 61 72 67 Data Ascii: s:100%;bottom:-60px;position:relative}.jss4,.jss5{align-items:center;flex-direction:row;height:80px;width:80px}.jss5{display:flex;justify-content:center;overflow:hidden}.jss5,.jss6{border-radius:50%}.jss6{height:66px;object-fit:cover;width:66px}.jss7{marg
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 64 74 68 3a 32 32 70 78 7d 2e 6a 73 73 32 31 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 70 78 7d 2e 6a 73 73 32 32 3a 6c 61 73 74 2d 63 68 69 6c 64 2c 2e 6a 73 73 32 33 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 6a 73 73 32 33 7b 63 6f 6c 6f 72 3a 23 32 32 30 65 32 37 21 69 6d 70 6f 72 74 61 6e 74 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 6a 73 73 32 34 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 6a 73 73 32 34 7b 63 6f 6c 6f 72 3a 23 38 62 38 63 61 35 3b Data Ascii: dth:22px}.jss21{padding-top:1px}.jss22:last-child,.jss23{margin-bottom:0}.jss23{color:#220e27!important;display:block;font-size:13px;font-weight:600;line-height:20px;margin-top:0;text-decoration:none}.jss24:last-child{margin-bottom:0}.jss24{color:#8b8ca5;
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 68 6f 76 65 72 7b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 73 6c 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 4c 61 74 6f 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6d 61 72 67 69 6e 3a 32 30 70 78 20 30 7d 2e 6f 71 67 5f 6d 6f 64 61 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 65 36 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 37 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 74 6f 70 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 6f 71 67 Data Ascii: hover{width:auto}.sl-title{font-family:Lato,sans-serif;font-size:13px;font-weight:600;margin:20px 0}.oqg_modal{background-color:#000;background-color:#000000e6;height:100%;left:0;overflow:auto;padding-top:70%;position:fixed;top:0;width:100%;z-index:1}.oqg
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 61 78 2d 77 69 64 74 68 3a 34 31 33 70 78 7d 2e 77 65 6c 63 6f 6d 65 5f 69 6d 67 7b 77 69 64 74 68 3a 36 35 30 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 33 30 30 70 78 29 7b 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 3a 30 20 31 30 70 78 7d 7d 2e 69 6d 61 67 65 2d 6c 6f 61 64 69 6e 67 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 69 6e 67 2d 61 6e 69 6d 61 74 65 20 32 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 20 2e 35 73 20 69 6e 66 69 6e 69 74 65 20 6e 6f 72 6d 61 6c 20 6e 6f 6e 65 20 72 75 6e 6e 69 6e 67 7d 40 6b 65 79 66 72 61 6d 65 73 20 6c 6f 61 64 69 6e 67 2d 61 6e 69 6d 61 74 65 7b 30 25 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 37 32 62 32 66 7d 35 Data Ascii: ax-width:413px}.welcome_img{width:650px!important}}@media (max-width:300px){.swiper-container{padding:0 10px}}.image-loading{animation:loading-animate 2s ease-in-out .5s infinite normal none running}@keyframes loading-animate{0%{background-color:#272b2f}5
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 61 6c 3b 62 6f 72 64 65 72 3a 30 7d 2e 72 61 74 69 6e 67 2d 73 74 61 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 4d 75 69 52 61 74 69 6e 67 2d 6c 61 62 65 6c 2e 4d 75 69 52 61 74 69 6e 67 2d 70 72 69 73 74 69 6e 65 2e 63 73 73 2d 64 71 72 39 68 2d 4d 75 69 52 61 74 69 6e 67 2d 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 77 69 64 74 68 3a 30 7d 2e 72 61 74 69 6e 67 2d 73 74 61 72 20 6c 61 62 65 6c 20 73 70 61 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 38 70 78 7d 2e 72 61 74 69 6e 67 2d 73 74 61 72 20 6c 61 62 65 6c 20 73 70 61 6e 20 73 76 67 7b 73 74 72 6f 6b 65 3a 30 7d 2e 73 61 76 65 2d 6d 6f 72 65 7b 62 61 63 6b 67 72 Data Ascii: al;border:0}.rating-star{display:flex;justify-content:space-between;width:100%}.MuiRating-label.MuiRating-pristine.css-dqr9h-MuiRating-label{display:none;width:0}.rating-star label span{font-size:48px}.rating-star label span svg{stroke:0}.save-more{backgr
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 30 32 34 70 78 29 7b 2e 64 65 66 61 75 6c 74 2d 73 65 63 74 69 6f 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 25 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 32 25 7d 2e 6c 65 66 74 2d 73 69 64 65 3e 69 6d 67 7b 77 69 64 74 68 3a 31 34 72 65 6d 7d 2e 6c 65 66 74 2d 73 69 64 65 20 2e 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 35 70 78 7d 2e 6c 65 66 74 2d 73 69 64 65 20 2e 70 61 72 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 37 70 78 7d 2e 6c 65 66 74 2d 73 69 64 65 20 2e 63 72 65 61 74 65 2d 62 74 6e 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 32 30 70 78 7d 2e 72 69 67 68 74 2d Data Ascii: ly screen and (max-width:1024px){.default-section{margin-left:5%;margin-right:5%;margin-top:12%}.left-side>img{width:14rem}.left-side .title{font-size:25px}.left-side .para{font-size:17px}.left-side .create-btn{padding-bottom:20px;padding-top:20px}.right-
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 71 72 2d 63 61 72 64 73 7b 77 69 64 74 68 3a 32 36 30 70 78 7d 2e 72 69 67 68 74 2d 73 69 64 65 20 2e 72 69 67 68 74 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 32 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 72 69 67 68 74 2d 73 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 36 35 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 34 33 39 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 70 61 64 64 69 6e 67 3a 31 38 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 66 2d 66 6f 6f 74 65 72 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 66 2d 66 6f 6f 74 65 72 3e 64 69 76 7b Data Ascii: qr-cards{width:260px}.right-side .right-title{font-size:26px;padding-top:20px;text-align:center}.right-side{display:none!important;margin-top:65px;max-height:439px!important;padding:18px!important}.df-footer{flex-direction:column!important}.df-footer>div{

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:45 UTC	555	OUT	GET /static/js/main.5dbfdb16.js HTTP/1.1 Host: scanned.page Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://scanned.page/67d9e2d6eeffd Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 13:01:45 UTC	1190	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:45 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 3103508 Connection: close access-control-allow-origin: * Cache-Control: max-age=14400, s-maxage=31536000, immutable content-disposition: inline; filename="main.5dbfdb16.js" etag: "9c5eb1769cb6e81f65b17b3c54cd89c2" last-modified: Fri, 14 Mar 2025 03:10:14 GMT strict-transport-security: max-age=63072000 x-vercel-cache: HIT x-vercel-id: iad1::xnq54-1742203288230-906f56c4978c CF-Cache-Status: HIT Age: 25842 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d5VQ53LFdzt3AI0V%2BLucrkgPO6sg8uSjJ5AgOkant4BdGeN1O4W%2BR%2B0dVzZiDhdCeWsAGs8ANFQnctaF5e1A%2FBw%2F%2BvpvaYcGSAhArOLP0iTp6n19rrotM3HsyLhycg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare CF-RAY: 922d2908b98c49aa-EWR server-timing: cfL4;desc="?proto=TCP&rtt=9429&min_rtt=9348&rtt_var=3563&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1127&delivery_rate=312366&cwnd=32&unsent_bytes=0&cid=cd5b7f16e3a78ba5&ts=183&x=0"
2025-03-19 13:01:45 UTC	179	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 61 69 6e 2e 35 64 62 66 64 62 31 36 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 28 29 3d 3e 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 32 30 38 3a 65 3d 3e 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 45 6c 65 6d 65 6e 74 2c 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 4d 61 70 2c 73 3d 22 66 75 6e 63 74 Data Ascii: /! For license information please see main.5dbfdb16.js.LICENSE.txt /(()=>{var __webpack_modules__={208:e=>{var t="undefined"!==typeof Element,n="function"===typeof Map,s="funct
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 53 65 74 2c 69 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 26 26 21 21 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 3b 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 61 29 7b 69 66 28 65 3d 3d 3d 61 29 72 65 74 75 72 6e 21 30 3b 69 66 28 65 26 26 61 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 29 7b 69 66 28 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 21 3d 3d 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6f 2c 6c 2c 63 2c 64 3b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 7b 69 66 28 28 6f 3d 65 2e 6c 65 6e 67 74 68 29 21 3d 61 2e 6c 65 6e 67 Data Ascii: ion"===typeof Set,i="function"===typeof ArrayBuffer&&!!ArrayBuffer.isView;function r(e,a){if(e===a)return!0;if(e&&a&&"object"==typeof e&&"object"==typeof a){if(e.constructor!==a.constructor)return!1;var o,l,c,d;if(Array.isArray(e)){if((o=e.length)!=a.leng
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 21 3d 3d 6c 2d 2d 3b 29 69 66 28 28 22 5f 6f 77 6e 65 72 22 21 3d 3d 63 5b 6c 5d 26 26 22 5f 5f 76 22 21 3d 3d 63 5b 6c 5d 26 26 22 5f 5f 6f 22 21 3d 3d 63 5b 6c 5d 7c 7c 21 65 2e 24 24 74 79 70 65 6f 66 29 26 26 21 72 28 65 5b 63 5b 6c 5d 5d 2c 61 5b 63 5b 6c 5d 5d 29 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 20 65 21 3d 3d 65 26 26 61 21 3d 3d 61 7d 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 72 28 65 2c 74 29 7d 63 61 74 63 68 28 6e 29 7b 69 66 28 28 6e 2e 6d 65 73 73 61 67 65 7c 7c 22 22 29 2e 6d 61 74 63 68 28 2f 73 74 61 63 6b 7c 72 65 63 75 72 73 69 6f 6e 2f 69 29 29 72 65 74 75 72 6e 20 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 72 65 61 63 74 2d 66 61 73 Data Ascii: !==l--;)if(("_owner"!==c[l]&&"__v"!==c[l]&&"__o"!==c[l]\|\|!e.$$typeof)&&!r(e[c[l]],a[c[l]]))return!1;return!0}return e!==e&&a!==a}e.exports=function(e,t){try{return r(e,t)}catch(n){if((n.message\|\|"").match(/stack\|recursion/i))return console.warn("react-fas
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 30 2c 6f 3d 61 2e 6e 61 76 69 67 61 74 6f 72 26 26 2f 4d 61 63 69 6e 74 6f 73 68 2f 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 26 26 2f 41 70 70 6c 65 57 65 62 4b 69 74 2f 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 26 26 21 2f 53 61 66 61 72 69 2f 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 2c 6c 3d 61 2e 73 61 76 65 41 73 7c 7c 28 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 7c 7c 77 69 6e 64 6f 77 21 3d 3d 61 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3a 22 64 6f 77 6e 6c 6f 61 64 22 69 6e 20 48 54 4d 4c 41 6e 63 68 6f 72 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 26 26 21 6f 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 Data Ascii: 0,o=a.navigator&&/Macintosh/.test(navigator.userAgent)&&/AppleWebKit/.test(navigator.userAgent)&&!/Safari/.test(navigator.userAgent),l=a.saveAs\|\|("object"!=typeof window\|\|window!==a?function(){}:"download"in HTMLAnchorElement.prototype&&!o?function(e,t,n)
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 3d 75 2e 63 72 65 61 74 65 4f 62 6a 65 63 74 55 52 4c 28 65 29 3b 69 3f 69 2e 6c 6f 63 61 74 69 6f 6e 3d 70 3a 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 70 2c 69 3d 6e 75 6c 6c 2c 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 75 2e 72 65 76 6f 6b 65 4f 62 6a 65 63 74 55 52 4c 28 70 29 7d 29 2c 34 65 34 29 7d 7d 29 3b 61 2e 73 61 76 65 41 73 3d 6c 2e 73 61 76 65 41 73 3d 6c 2c 65 2e 65 78 70 6f 72 74 73 3d 6c 7d 29 3f 73 2e 61 70 70 6c 79 28 74 2c 69 29 3a 73 29 7c 7c 28 65 2e 65 78 70 6f 72 74 73 3d 72 29 7d 2c 33 38 30 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 41 3a 28 29 3d 3e 69 7d 29 3b 76 61 72 20 73 3d 6e 28 38 32 39 38 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 69 66 28 Data Ascii: =u.createObjectURL(e);i?i.location=p:location.href=p,i=null,setTimeout((function(){u.revokeObjectURL(p)}),4e4)}});a.saveAs=l.saveAs=l,e.exports=l})?s.apply(t,i):s)\|\|(e.exports=r)},380:(e,t,n)=>{"use strict";n.d(t,{A:()=>i});var s=n(8298);function i(e){if(
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 65 2e 6c 65 6e 67 74 68 21 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 69 3d 65 5b 6e 5d 2c 72 3d 74 5b 6e 5d 2c 21 28 69 3d 3d 3d 72 7c 7c 73 28 69 29 26 26 73 28 72 29 29 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 69 2c 72 3b 72 65 74 75 72 6e 21 30 7d 63 6f 6e 73 74 20 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 69 29 3b 76 61 72 20 73 2c 72 3d 5b 5d 2c 61 3d 21 31 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6f 3d 30 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 69 5b 6f 5d 3d 61 72 67 75 6d 65 6e 74 73 5b Data Ascii: e.length!==t.length)return!1;for(var n=0;n<e.length;n++)if(i=e[n],r=t[n],!(i===r\|\|s(i)&&s(r)))return!1;var i,r;return!0}const r=function(e,t){var n;void 0===t&&(t=i);var s,r=[],a=!1;return function(){for(var i=[],o=0;o<arguments.length;o++)i[o]=arguments[
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 74 2e 70 75 73 68 28 65 5b 6e 3e 3e 3e 35 5d 3e 3e 3e 32 34 2d 6e 25 33 32 26 32 35 35 29 3b 72 65 74 75 72 6e 20 74 7d 2c 62 79 74 65 73 54 6f 48 65 78 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 2e 70 75 73 68 28 28 65 5b 6e 5d 3e 3e 3e 34 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 29 2c 74 2e 70 75 73 68 28 28 31 35 26 65 5b 6e 5d 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 29 3b 72 65 74 75 72 6e 20 74 2e 6a 6f 69 6e 28 22 22 29 7d 2c 68 65 78 54 6f 42 79 74 65 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 3d 32 29 74 2e 70 75 73 68 28 70 61 72 73 65 49 6e 74 28 65 2e 73 75 62 Data Ascii: t.push(e[n>>>5]>>>24-n%32&255);return t},bytesToHex:function(e){for(var t=[],n=0;n<e.length;n++)t.push((e[n]>>>4).toString(16)),t.push((15&e[n]).toString(16));return t.join("")},hexToBytes:function(e){for(var t=[],n=0;n<e.length;n+=2)t.push(parseInt(e.sub
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 2d 31 21 3d 3d 69 26 26 22 6e 75 6d 62 65 72 22 3d 3d 3d 74 79 70 65 6f 66 20 74 5b 64 5b 69 5d 5d 3f 74 5b 64 5b 69 5d 5d 3a 73 29 2d 6f 2f 31 30 30 7d 24 7b 6e 7d 29 60 7d 72 65 74 75 72 6e 28 30 2c 69 2e 41 29 28 7b 6b 65 79 73 3a 64 2c 76 61 6c 75 65 73 3a 63 2c 75 70 3a 75 2c 64 6f 77 6e 3a 70 2c 62 65 74 77 65 65 6e 3a 78 2c 6f 6e 6c 79 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 64 2e 69 6e 64 65 78 4f 66 28 65 29 2b 31 3c 64 2e 6c 65 6e 67 74 68 3f 78 28 65 2c 64 5b 64 2e 69 6e 64 65 78 4f 66 28 65 29 2b 31 5d 29 3a 75 28 65 29 7d 2c 6e 6f 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 64 2e 69 6e 64 65 78 4f 66 28 65 29 3b 72 65 74 75 72 6e 20 30 3d 3d 3d 74 3f 75 28 64 5b 31 5d 29 3a 74 3d 3d 3d 64 2e 6c 65 6e Data Ascii: -1!==i&&"number"===typeof t[d[i]]?t[d[i]]:s)-o/100}${n})`}return(0,i.A)({keys:d,values:c,up:u,down:p,between:x,only:function(e){return d.indexOf(e)+1<d.length?x(e,d[d.indexOf(e)+1]):u(e)},not:function(e){const t=d.indexOf(e);return 0===t?u(d[1]):t===d.len
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 6f 64 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 61 6f 73 22 29 2c 65 2e 6e 6f 64 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 61 6f 73 2d 65 61 73 69 6e 67 22 29 2c 65 2e 6e 6f 64 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 61 6f 73 2d 64 75 72 61 74 69 6f 6e 22 29 2c 65 2e 6e 6f 64 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 22 29 7d 29 29 7d 2c 76 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 30 3d 3d 3d 65 7c 7c 22 6d 6f 62 69 6c 65 22 3d 3d 3d 65 26 26 63 2e 64 65 66 61 75 6c 74 2e 6d 6f 62 69 6c 65 28 29 7c 7c 22 70 68 6f 6e 65 22 3d 3d 3d 65 26 26 63 2e 64 65 66 61 75 6c 74 2e 70 68 6f 6e 65 28 29 Data Ascii: ode.removeAttribute("data-aos"),e.node.removeAttribute("data-aos-easing"),e.node.removeAttribute("data-aos-duration"),e.node.removeAttribute("data-aos-delay")}))},v=function(e){return!0===e\|\|"mobile"===e&&c.default.mobile()\|\|"phone"===e&&c.default.phone()
2025-03-19 13:01:45 UTC	1369	IN	Data Raw: 7b 28 30 2c 64 2e 64 65 66 61 75 6c 74 29 28 78 2c 66 2e 6f 6e 63 65 29 7d 29 2c 66 2e 74 68 72 6f 74 74 6c 65 44 65 6c 61 79 29 29 2c 66 2e 64 69 73 61 62 6c 65 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 7c 7c 6c 2e 64 65 66 61 75 6c 74 2e 72 65 61 64 79 28 22 5b 64 61 74 61 2d 61 6f 73 5d 22 2c 67 29 2c 78 29 7d 3b 65 2e 65 78 70 6f 72 74 73 3d 7b 69 6e 69 74 3a 77 2c 72 65 66 72 65 73 68 3a 6d 2c 72 65 66 72 65 73 68 48 61 72 64 3a 67 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 7d 2c 2c 2c 2c 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 2c 74 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 73 28 74 29 7b 76 61 72 20 6e 3d 66 2c 73 3d 6d Data Ascii: {(0,d.default)(x,f.once)}),f.throttleDelay)),f.disableMutationObserver\|\|l.default.ready("[data-aos]",g),x)};e.exports={init:w,refresh:m,refreshHard:g}},function(e,t){},,,,,function(e,t){(function(t){"use strict";function n(e,t,n){function s(t){var n=f,s=m

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:46 UTC	619	OUT	GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1 Host: static.cloudflareinsights.com Connection: keep-alive Origin: https://scanned.page sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://scanned.page/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 13:01:46 UTC	373	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:46 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 19948 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 ETag: W/"2024.6.1" Last-Modified: Thu, 06 Jun 2024 15:52:56 GMT Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 922d290ebb5e0f37-EWR
2025-03-19 13:01:46 UTC	1369	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 33 34 33 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 32 35 36 3b 2b 2b 6e 29 74 5b 6e 5d 3d 28 6e 2b 32 35 36 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2e 73 75 62 73 74 72 28 31 29 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 7c 7c 30 2c 69 3d 74 3b 72 65 74 75 72 6e 5b 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 22 2d 22 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 22 2d 22 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 69 5b 65 5b 72 2b 2b 5d 5d 2c 22 2d 22 2c 69 5b 65 5b 72 2b Data Ascii: !function(){var e={343:function(e){"use strict";for(var t=[],n=0;n<256;++n)t[n]=(n+256).toString(16).substr(1);e.exports=function(e,n){var r=n\|\|0,i=t;return[i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r+
2025-03-19 13:01:46 UTC	1369	IN	Data Raw: 72 20 69 3d 6e 28 36 39 39 29 2c 6f 3d 6e 28 37 35 32 29 2c 61 3d 6e 28 31 30 34 29 2c 63 3d 6e 28 35 30 38 29 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 76 61 72 20 74 3d 22 22 3b 69 66 28 74 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 67 69 6e 3f 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 67 69 6e 3a 22 22 2e 63 6f 6e 63 61 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2c 22 3a 2f 2f 22 29 2e 63 6f 6e 63 61 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 29 2c 65 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 29 69 66 28 30 3d 3d 3d 65 2e 69 6e 64 65 78 4f 66 28 22 2f 22 29 29 74 2b 3d 65 3b 65 6c 73 65 20 74 72 79 7b 76 61 Data Ascii: r i=n(699),o=n(752),a=n(104),c=n(508);!function(){function e(e){var t="";if(t=window.location.origin?window.location.origin:"".concat(window.location.protocol,"://").concat(window.location.host),e&&"string"==typeof e)if(0===e.indexOf("/"))t+=e;else try{va
2025-03-19 13:01:46 UTC	1369	IN	Data Raw: 29 3d 3d 74 26 26 28 6e 75 6c 6c 3d 3d 77 3f 76 6f 69 64 20 30 3a 77 2e 74 72 69 67 67 65 72 65 64 29 7c 7c 50 28 29 2c 5f 28 74 29 7d 21 62 26 26 77 26 26 28 62 3d 21 30 2c 42 28 29 29 7d 65 6c 73 65 22 76 69 73 69 62 6c 65 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 26 26 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 7d 29 29 3b 76 61 72 20 45 3d 7b 7d 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 50 65 72 66 6f 72 6d 61 6e 63 65 4f 62 73 65 72 76 65 72 26 26 28 28 30 2c 61 2e 6f 6e 4c 43 50 29 28 78 29 2c 28 30 2c 61 2e 6f 6e 46 49 44 29 28 78 29 2c 28 30 2c 61 2e 6f 6e 46 43 50 29 28 78 29 2c 28 30 2c 61 2e 6f 6e 49 4e 50 29 28 78 29 2c 28 30 2c 61 2e 6f 6e 54 54 46 42 29 28 78 29 2c Data Ascii: )==t&&(null==w?void 0:w.triggered)\|\|P(),_(t)}!b&&w&&(b=!0,B())}else"visible"===document.visibilityState&&(new Date).getTime()}));var E={};"function"==typeof PerformanceObserver&&((0,a.onLCP)(x),(0,a.onFID)(x),(0,a.onFCP)(x),(0,a.onINP)(x),(0,a.onTTFB)(x),
2025-03-19 13:01:46 UTC	1369	IN	Data Raw: 2c 70 26 26 28 28 30 2c 6f 2e 73 65 6e 64 4f 62 6a 65 63 74 42 65 61 63 6f 6e 29 28 22 22 2c 61 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 21 31 2c 43 29 2c 76 6f 69 64 20 30 21 3d 3d 70 2e 66 6f 72 77 61 72 64 26 26 76 6f 69 64 20 30 21 3d 3d 70 2e 66 6f 72 77 61 72 64 2e 75 72 6c 26 26 28 30 2c 6f 2e 73 65 6e 64 4f 62 6a 65 63 74 42 65 61 63 6f 6e 29 28 22 22 2c 61 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 21 31 2c 70 2e 66 6f 72 77 61 72 64 2e 75 72 6c 29 29 29 7d 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 73 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 28 22 6e 61 76 69 67 61 74 69 6f 6e 22 29 5b 30 5d 2c 6e 3d 22 22 3b 74 72 79 7b 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 Data Ascii: ,p&&((0,o.sendObjectBeacon)("",a,(function(){}),!1,C),void 0!==p.forward&&void 0!==p.forward.url&&(0,o.sendObjectBeacon)("",a,(function(){}),!1,p.forward.url)))},B=function(){var t=function(){var t=s.getEntriesByType("navigation")[0],n="";try{n="function"
2025-03-19 13:01:46 UTC	1369	IN	Data Raw: 28 6f 2c 61 2c 63 29 7b 6e 3d 65 28 63 29 3b 76 61 72 20 75 3d 65 28 29 2c 73 3d 21 30 3b 72 65 74 75 72 6e 20 6e 3d 3d 75 26 26 28 73 3d 21 31 29 2c 73 26 26 28 41 28 29 26 26 28 28 6e 75 6c 6c 3d 3d 77 3f 76 6f 69 64 20 30 3a 77 2e 75 72 6c 29 3d 3d 75 26 26 28 6e 75 6c 6c 3d 3d 77 3f 76 6f 69 64 20 30 3a 77 2e 74 72 69 67 67 65 72 65 64 29 7c 7c 50 28 75 29 2c 5f 28 75 29 29 2c 69 28 29 29 2c 72 2e 61 70 70 6c 79 28 74 2c 5b 6f 2c 61 2c 63 5d 29 7d 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 6f 70 73 74 61 74 65 22 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 41 28 29 26 26 28 28 6e 75 6c 6c 3d 3d 77 3f 76 6f 69 64 20 30 3a 77 2e 75 72 6c 29 3d 3d 6e 26 26 28 6e 75 6c 6c 3d 3d 77 3f 76 6f 69 64 20 30 3a 77 2e 74 72 69 Data Ascii: (o,a,c){n=e(c);var u=e(),s=!0;return n==u&&(s=!1),s&&(A()&&((null==w?void 0:w.url)==u&&(null==w?void 0:w.triggered)\|\|P(u),_(u)),i()),r.apply(t,[o,a,c])},window.addEventListener("popstate",(function(t){A()&&((null==w?void 0:w.url)==n&&(null==w?void 0:w.tri
2025-03-19 13:01:46 UTC	1369	IN	Data Raw: 45 2e 69 6e 70 2e 65 6c 65 6d 65 6e 74 3d 63 2e 65 76 65 6e 74 54 61 72 67 65 74 2c 45 2e 69 6e 70 2e 6e 61 6d 65 3d 63 2e 65 76 65 6e 74 54 79 70 65 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 46 28 29 7b 72 65 74 75 72 6e 20 73 2e 74 69 6d 65 4f 72 69 67 69 6e 7d 66 75 6e 63 74 69 6f 6e 20 49 28 29 7b 69 66 28 70 26 26 70 2e 73 65 72 76 65 72 54 69 6d 69 6e 67 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 74 3d 30 2c 6e 3d 5b 22 6e 61 76 69 67 61 74 69 6f 6e 22 2c 22 72 65 73 6f 75 72 63 65 22 5d 3b 74 3c 6e 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 66 6f 72 28 76 61 72 20 72 3d 6e 5b 74 5d 2c 69 3d 30 2c 6f 3d 73 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 28 72 29 3b 69 3c 6f 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 76 61 72 20 61 3d 6f 5b 69 5d 2c 63 3d 61 Data Ascii: E.inp.element=c.eventTarget,E.inp.name=c.eventType))}}function F(){return s.timeOrigin}function I(){if(p&&p.serverTiming){for(var e=[],t=0,n=["navigation","resource"];t<n.length;t++)for(var r=n[t],i=0,o=s.getEntriesByType(r);i<o.length;i++){var a=o[i],c=a
2025-03-19 13:01:46 UTC	1369	IN	Data Raw: 29 7d 28 29 7d 2c 37 35 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 74 2e 73 65 6e 64 4f 62 6a 65 63 74 42 65 61 63 6f 6e 3d 76 6f 69 64 20 30 2c 74 2e 73 65 6e 64 4f 62 6a 65 63 74 42 65 61 63 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 29 7b 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 21 31 29 2c 76 6f 69 64 20 30 3d 3d 3d 69 26 26 28 69 3d 6e 75 6c 6c 29 3b 76 61 72 20 6f 3d 69 7c 7c 28 74 2e 73 69 74 65 54 6f 6b 65 6e 26 26 74 2e 76 65 72 73 69 6f 6e 73 2e 66 6c 3f 22 2f 63 64 6e 2d 63 67 69 2f 72 75 6d 3f 22 2e 63 6f 6e 63 61 74 28 65 29 3a 22 2f 63 64 6e 2d 63 67 69 2f 62 65 61 63 6f 6e 2f 70 65 72 66 6f 72 6d 61 6e 63 65 3f 22 2e 63 6f 6e Data Ascii: )}()},752:function(e,t){"use strict";t.__esModule=!0,t.sendObjectBeacon=void 0,t.sendObjectBeacon=function(e,t,n,r,i){void 0===r&&(r=!1),void 0===i&&(i=null);var o=i\|\|(t.siteToken&&t.versions.fl?"/cdn-cgi/rum?".concat(e):"/cdn-cgi/beacon/performance?".con
2025-03-19 13:01:46 UTC	1369	IN	Data Raw: 69 6e 67 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 29 72 65 74 75 72 6e 22 6c 6f 61 64 69 6e 67 22 3b 76 61 72 20 74 3d 61 28 29 3b 69 66 28 74 29 7b 69 66 28 65 3c 74 2e 64 6f 6d 49 6e 74 65 72 61 63 74 69 76 65 29 72 65 74 75 72 6e 22 6c 6f 61 64 69 6e 67 22 3b 69 66 28 30 3d 3d 3d 74 2e 64 6f 6d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 45 76 65 6e 74 53 74 61 72 74 7c 7c 65 3c 74 2e 64 6f 6d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 45 76 65 6e 74 53 74 61 72 74 29 72 65 74 75 72 6e 22 64 6f 6d 2d 69 6e 74 65 72 61 63 74 69 76 65 22 3b 69 66 28 30 3d 3d 3d 74 2e 64 6f 6d 43 6f 6d 70 6c 65 74 65 7c 7c 65 3c 74 2e 64 6f 6d 43 6f 6d 70 6c 65 74 65 29 72 65 74 75 72 6e 22 64 6f 6d 2d 63 6f 6e 74 65 6e 74 2d 6c 6f 61 64 65 64 22 7d 72 Data Ascii: ing"===document.readyState)return"loading";var t=a();if(t){if(e<t.domInteractive)return"loading";if(0===t.domContentLoadedEventStart\|\|e<t.domContentLoadedEventStart)return"dom-interactive";if(0===t.domComplete\|\|e<t.domComplete)return"dom-content-loaded"}r
2025-03-19 13:01:46 UTC	1369	IN	Data Raw: 65 29 7b 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 65 2e 67 65 74 45 6e 74 72 69 65 73 28 29 29 7d 29 29 7d 29 29 3b 72 65 74 75 72 6e 20 72 2e 6f 62 73 65 72 76 65 28 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 74 79 70 65 3a 65 2c 62 75 66 66 65 72 65 64 3a 21 30 7d 2c 6e 7c 7c 7b 7d 29 29 2c 72 7d 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 69 2c 6f 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 2e 76 61 6c 75 65 3e 3d 30 26 26 28 61 7c 7c 72 29 26 26 28 28 6f 3d 74 2e 76 61 6c 75 65 2d 28 69 7c 7c 30 29 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 29 26 26 28 69 3d 74 2e 76 61 6c 75 65 2c 74 2e 64 65 6c 74 Data Ascii: e){Promise.resolve().then((function(){t(e.getEntries())}))}));return r.observe(Object.assign({type:e,buffered:!0},n\|\|{})),r}}catch(e){}},g=function(e,t,n,r){var i,o;return function(a){t.value>=0&&(a\|\|r)&&((o=t.value-(i\|\|0))\|\|void 0===i)&&(i=t.value,t.delt
2025-03-19 13:01:46 UTC	1369	IN	Data Raw: 7b 7d 2c 50 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 72 3d 43 28 29 2c 69 3d 70 28 22 46 43 50 22 29 2c 6f 3d 6d 28 22 70 61 69 6e 74 22 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 66 69 72 73 74 2d 63 6f 6e 74 65 6e 74 66 75 6c 2d 70 61 69 6e 74 22 3d 3d 3d 65 2e 6e 61 6d 65 26 26 28 6f 2e 64 69 73 63 6f 6e 6e 65 63 74 28 29 2c 65 2e 73 74 61 72 74 54 69 6d 65 3c 72 2e 66 69 72 73 74 48 69 64 64 65 6e 54 69 6d 65 26 26 28 69 2e 76 61 6c 75 65 3d 4d 61 74 68 2e 6d 61 78 28 65 2e 73 74 61 72 74 54 69 6d 65 2d 76 28 29 2c 30 29 2c 69 2e 65 6e 74 72 69 65 73 2e 70 75 73 68 28 65 29 2c 6e 28 21 30 29 29 29 7d 29 29 7d 29 29 3b 6f 26 26 28 6e 3d 67 28 65 2c 69 2c 42 2c 74 2e Data Ascii: {},P((function(){var n,r=C(),i=p("FCP"),o=m("paint",(function(e){e.forEach((function(e){"first-contentful-paint"===e.name&&(o.disconnect(),e.startTime<r.firstHiddenTime&&(i.value=Math.max(e.startTime-v(),0),i.entries.push(e),n(!0)))}))}));o&&(n=g(e,i,B,t.

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:47 UTC	543	OUT	OPTIONS /report/v4?s=d5VQ53LFdzt3AI0V%2BLucrkgPO6sg8uSjJ5AgOkant4BdGeN1O4W%2BR%2B0dVzZiDhdCeWsAGs8ANFQnctaF5e1A%2FBw%2F%2BvpvaYcGSAhArOLP0iTp6n19rrotM3HsyLhycg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://scanned.page Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 13:01:47 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Wed, 19 Mar 2025 13:01:46 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:47 UTC	937	OUT	GET /cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyJTIyJTJDJTIyeCUyMiUzQTAuNTM5NjYxOTI4NDQ1ODgxMiUyQyUyMnclMjIlM0ExMjgwJTJDJTIyaCUyMiUzQTEwMjQlMkMlMjJqJTIyJTNBODk3JTJDJTIyZSUyMiUzQTEyODAlMkMlMjJsJTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZzY2FubmVkLnBhZ2UlMkY2N2Q5ZTJkNmVlZmZkJTIyJTJDJTIyciUyMiUzQSUyMiUyMiUyQyUyMmslMjIlM0EyNCUyQyUyMm4lMjIlM0ElMjJVVEYtOCUyMiUyQyUyMm8lMjIlM0EyNDAlMkMlMjJxJTIyJTNBJTVCJTVEJTdE HTTP/1.1 Host: scanned.page Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://scanned.page/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 13:01:47 UTC	1314	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:47 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 6508 Connection: close Access-Control-Allow-Origin: https://scanned.page Set-Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; Domain=scanned.page; Path=/; HttpOnly; Secure; SameSite=Lax Vary: Origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Set-Cookie, Cache-Control Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS Access-Control-Max-Age: 600 set-cookie: google-analytics_v4_eEXS__pageviewCounter=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie: google-analytics_v4_eEXS__engagementDuration=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie: google-analytics_v4_eEXS__engagementStart=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie: google-analytics_v4_eEXS__counter=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie: google-analytics_v4_eEXS__ga4sid=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie: google-analytics_v4_eEXS__session_counter=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax
2025-03-19 13:01:47 UTC	1193	IN	Data Raw: 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 5f 76 34 5f 65 45 58 53 5f 5f 67 61 34 3d 3b 20 44 6f 6d 61 69 6e 3d 73 63 61 6e 6e 65 64 2e 70 61 67 65 3b 20 50 61 74 68 3d 2f 3b 20 4d 61 78 2d 41 67 65 3d 30 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 5f 76 34 5f 65 45 58 53 5f 5f 5f 7a 5f 67 61 5f 61 75 64 69 65 6e 63 65 73 3d 3b 20 44 6f 6d 61 69 6e 3d 73 63 61 6e 6e 65 64 2e 70 61 67 65 3b 20 50 61 74 68 3d 2f 3b 20 4d 61 78 2d 41 67 65 3d 30 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a Data Ascii: set-cookie: google-analytics_v4_eEXS__ga4=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Laxset-cookie: google-analytics_v4_eEXS___z_ga_audiences=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Laxset-cookie:
2025-03-19 13:01:47 UTC	622	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 64 6c 63 75 48 6a 65 31 49 41 32 42 37 25 32 42 71 4e 75 34 50 5a 34 34 74 4d 74 71 6e 67 4e 54 4d 6d 38 46 72 56 30 59 43 37 7a 45 46 5a 6b 6b 4a 43 63 43 59 77 33 6b 55 70 54 52 6f 7a 67 6e 25 32 46 63 42 42 48 25 32 46 71 44 61 50 4f 6c 5a 41 74 47 4c 71 68 32 5a 7a 53 50 4c 4a 30 73 41 4a 6a 38 4f 25 32 46 4e 34 45 42 74 64 6b 35 6c 32 34 66 59 52 63 4d 4b 6f 78 5a 31 58 61 79 4c 72 5a 78 57 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dlcuHje1IA2B7%2BqNu4PZ44tMtqngNTMm8FrV0YC7zEFZkkJCcCYw3kUpTRozgn%2FcBBH%2FqDaPOlZAtGLqh2ZzSPLJ0sAJj8O%2FN4EBtdk5l24fYRcMKoxZ1XayLrZxWQ%3D%3D"}],"group":"cf-nel","max_age":604800
2025-03-19 13:01:47 UTC	978	IN	Data Raw: 74 72 79 7b 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 29 7b 7a 61 72 61 7a 2e 64 65 62 75 67 3d 28 65 58 3d 22 22 29 3d 3e 7b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 60 7a 61 72 61 7a 44 65 62 75 67 3d 24 7b 65 58 7d 3b 20 70 61 74 68 3d 2f 60 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 7d 3b 77 69 6e 64 6f 77 2e 7a 61 72 61 7a 2e 5f 61 6c 3d 66 75 6e 63 74 69 6f 6e 28 64 5a 2c 64 24 2c 65 61 29 7b 77 2e 7a 61 72 61 7a 2e 6c 69 73 74 65 6e 65 72 73 2e 70 75 73 68 28 7b 69 74 65 6d 3a 64 5a 2c 74 79 70 65 3a 64 24 2c 63 61 6c 6c 62 61 63 6b 3a 65 61 7d 29 3b 64 5a 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 64 24 2c 65 61 29 7d 3b 7a 61 72 61 7a 2e 70 72 65 76 69 65 77 3d 28 64 62 3d 22 22 29 3d 3e 7b 64 6f 63 75 6d 65 6e 74 2e 63 Data Ascii: try{(function(w,d){zaraz.debug=(eX="")=>{document.cookie=`zarazDebug=${eX}; path=/`;location.reload()};window.zaraz._al=function(dZ,d$,ea){w.zaraz.listeners.push({item:dZ,type:d$,callback:ea});dZ.addEventListener(d$,ea)};zaraz.preview=(db="")=>{document.c
2025-03-19 13:01:47 UTC	1369	IN	Data Raw: 7d 7d 72 65 74 75 72 6e 20 61 77 61 69 74 20 66 65 74 63 68 28 65 62 2c 65 64 29 7d 3b 77 69 6e 64 6f 77 2e 7a 61 72 61 7a 2e 5f 70 3d 61 73 79 6e 63 20 62 73 3d 3e 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 62 74 3d 3e 7b 69 66 28 62 73 29 7b 62 73 2e 65 26 26 62 73 2e 65 2e 66 6f 72 45 61 63 68 28 28 62 75 3d 3e 7b 74 72 79 7b 63 6f 6e 73 74 20 62 76 3d 64 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 73 63 72 69 70 74 5b 6e 6f 6e 63 65 5d 22 29 2c 62 77 3d 62 76 3f 2e 6e 6f 6e 63 65 7c 7c 62 76 3f 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 29 2c 62 78 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 62 77 26 26 28 62 78 2e 6e 6f 6e 63 65 3d 62 77 29 3b 62 78 2e 69 6e 6e 65 72 48 54 4d 4c 3d 62 75 3b 62 Data Ascii: }}return await fetch(eb,ed)};window.zaraz._p=async bs=>new Promise((bt=>{if(bs){bs.e&&bs.e.forEach((bu=>{try{const bv=d.querySelector("script[nonce]"),bw=bv?.nonce\|\|bv?.getAttribute("nonce"),bx=d.createElement("script");bw&&(bx.nonce=bw);bx.innerHTML=bu;b
2025-03-19 13:01:47 UTC	1369	IN	Data Raw: 73 6f 6e 22 7d 2c 62 6f 64 79 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 6d 29 7d 29 2e 63 61 74 63 68 28 28 28 29 3d 3e 7b 0a 2f 2f 0a 72 65 74 75 72 6e 20 66 65 74 63 68 28 22 2f 63 64 6e 2d 63 67 69 2f 7a 61 72 61 7a 2f 74 22 2c 7b 63 72 65 64 65 6e 74 69 61 6c 73 3a 22 69 6e 63 6c 75 64 65 22 2c 6d 65 74 68 6f 64 3a 22 50 4f 53 54 22 2c 68 65 61 64 65 72 73 3a 7b 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 7d 2c 62 6f 64 79 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 6d 29 7d 29 7d 29 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 65 76 29 7b 7a 61 72 61 7a 44 61 74 61 2e 5f 6c 65 74 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 65 76 2e 6f 6b 7c 7c 65 6c 28 Data Ascii: son"},body:JSON.stringify(em)}).catch((()=>{//return fetch("/cdn-cgi/zaraz/t",{credentials:"include",method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(em)})})).then((function(ev){zarazData._let=(new Date).getTime();ev.ok\|\|el(
2025-03-19 13:01:47 UTC	1369	IN	Data Raw: 22 2a 22 2b 64 7a 2b 22 2a 22 3b 7a 61 72 61 7a 2e 74 72 61 63 6b 28 22 5f 5f 7a 61 72 61 7a 45 6d 70 74 79 22 2c 7b 2e 2e 2e 64 41 2c 5f 5f 7a 61 72 61 7a 43 6c 69 65 6e 74 54 72 69 67 67 65 72 73 3a 7a 61 72 61 7a 2e 5f 5f 7a 61 72 61 7a 54 72 69 67 67 65 72 4d 61 70 5b 64 79 5d 7d 2c 64 42 29 7d 3b 7a 61 72 61 7a 2e 5f 70 72 6f 63 65 73 73 44 61 74 61 4c 61 79 65 72 3d 65 51 3d 3e 7b 66 6f 72 28 63 6f 6e 73 74 20 65 52 20 6f 66 20 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 28 65 51 29 29 7a 61 72 61 7a 2e 73 65 74 28 65 52 5b 30 5d 2c 65 52 5b 31 5d 2c 7b 73 63 6f 70 65 3a 22 70 61 67 65 22 7d 29 3b 69 66 28 65 51 2e 65 76 65 6e 74 29 7b 69 66 28 7a 61 72 61 7a 44 61 74 61 2e 64 61 74 61 4c 61 79 65 72 49 67 6e 6f 72 65 26 26 7a 61 72 61 7a 44 61 74 61 Data Ascii: ""+dz+"";zaraz.track("__zarazEmpty",{...dA,__zarazClientTriggers:zaraz.__zarazTriggerMap[dy]},dB)};zaraz._processDataLayer=eQ=>{for(const eR of Object.entries(eQ))zaraz.set(eR[0],eR[1],{scope:"page"});if(eQ.event){if(zarazData.dataLayerIgnore&&zarazData
2025-03-19 13:01:47 UTC	1369	IN	Data Raw: 3b 7a 61 72 61 7a 2e 74 72 61 63 6b 28 63 24 2c 7b 2e 2e 2e 64 61 2c 5f 5f 7a 61 72 61 7a 43 6c 69 65 6e 74 45 76 65 6e 74 3a 21 30 7d 29 7d 3b 7a 61 72 61 7a 2e 5f 73 79 6e 63 65 64 41 74 74 72 69 62 75 74 65 73 3d 5b 22 61 6c 74 4b 65 79 22 2c 22 63 6c 69 65 6e 74 58 22 2c 22 63 6c 69 65 6e 74 59 22 2c 22 70 61 67 65 58 22 2c 22 70 61 67 65 59 22 2c 22 62 75 74 74 6f 6e 22 5d 3b 7a 61 72 61 7a 2e 5f 5f 7a 63 6c 2e 74 72 61 63 6b 3d 21 30 3b 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 28 62 42 3d 3e 7b 7a 61 72 61 7a 2e 5f 63 28 7b 65 76 65 6e 74 3a 22 76 69 73 69 62 69 6c 69 74 79 43 68 61 6e 67 65 22 2c 76 69 73 69 62 69 6c 69 74 79 43 68 61 6e 67 65 3a 5b 7b 73 74 61 74 65 3a 64 2e Data Ascii: ;zaraz.track(c$,{...da,__zarazClientEvent:!0})};zaraz._syncedAttributes=["altKey","clientX","clientY","pageX","pageY","button"];zaraz.__zcl.track=!0;d.addEventListener("visibilitychange",(bB=>{zaraz._c({event:"visibilityChange",visibilityChange:[{state:d.
2025-03-19 13:01:47 UTC	54	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 29 7d 63 61 74 63 68 28 65 29 7b 74 68 72 6f 77 20 66 65 74 63 68 28 22 2f 63 64 6e 2d 63 67 69 2f 7a 61 72 61 7a 2f 74 22 29 2c 65 3b 7d Data Ascii: document)}catch(e){throw fetch("/cdn-cgi/zaraz/t"),e;}

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:47 UTC	518	OUT	POST /report/v4?s=d5VQ53LFdzt3AI0V%2BLucrkgPO6sg8uSjJ5AgOkant4BdGeN1O4W%2BR%2B0dVzZiDhdCeWsAGs8ANFQnctaF5e1A%2FBw%2F%2BvpvaYcGSAhArOLP0iTp6n19rrotM3HsyLhycg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 478 Content-Type: application/reports+json Origin: https://scanned.page User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 13:01:47 UTC	478	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 39 32 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 61 6e 6e 65 64 2e 70 61 67 65 2f 36 37 64 39 65 32 64 36 65 65 66 66 64 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 36 2e 31 32 2e 31 30 36 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 72 65 73 70 6f 6e 73 65 2e 69 6e 76 61 6c 69 64 2e 63 6f 6e 74 65 6e 74 5f 6c 65 Data Ascii: [{"age":0,"body":{"elapsed_time":1925,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://scanned.page/67d9e2d6eeffd","sampling_fraction":1.0,"server_ip":"104.26.12.106","status_code":200,"type":"http.response.invalid.content_le
2025-03-19 13:01:47 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Wed, 19 Mar 2025 13:01:47 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:48 UTC	1457	OUT	POST /cdn-cgi/rum? HTTP/1.1 Host: scanned.page Connection: keep-alive Content-Length: 1827 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" content-type: application/json sec-ch-ua-mobile: ?0 Accept: / Origin: https://scanned.page Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://scanned.page/67d9e2d6eeffd Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
2025-03-19 13:01:48 UTC	1827	OUT	Data Raw: 7b 22 6d 65 6d 6f 72 79 22 3a 7b 22 74 6f 74 61 6c 4a 53 48 65 61 70 53 69 7a 65 22 3a 34 36 33 33 32 37 39 2c 22 75 73 65 64 4a 53 48 65 61 70 53 69 7a 65 22 3a 32 38 33 32 30 36 33 2c 22 6a 73 48 65 61 70 53 69 7a 65 4c 69 6d 69 74 22 3a 32 32 34 38 31 34 36 39 34 34 7d 2c 22 72 65 73 6f 75 72 63 65 73 22 3a 5b 5d 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 65 76 65 6e 74 54 79 70 65 22 3a 31 2c 22 66 69 72 73 74 50 61 69 6e 74 22 3a 30 2c 22 66 69 72 73 74 43 6f 6e 74 65 6e 74 66 75 6c 50 61 69 6e 74 22 3a 30 2c 22 73 74 61 72 74 54 69 6d 65 22 3a 31 37 34 32 33 38 39 33 30 32 33 38 30 2e 39 2c 22 76 65 72 73 69 6f 6e 73 22 3a 7b 22 66 6c 22 3a 22 32 30 32 35 2e 31 2e 30 22 2c 22 6a 73 22 3a 22 32 30 32 34 2e 36 2e 31 22 2c 22 74 69 6d 69 6e 67 73 Data Ascii: {"memory":{"totalJSHeapSize":4633279,"usedJSHeapSize":2832063,"jsHeapSizeLimit":2248146944},"resources":[],"referrer":"","eventType":1,"firstPaint":0,"firstContentfulPaint":0,"startTime":1742389302380.9,"versions":{"fl":"2025.1.0","js":"2024.6.1","timings
2025-03-19 13:01:48 UTC	369	IN	HTTP/1.1 204 No Content Date: Wed, 19 Mar 2025 13:01:48 GMT Connection: close access-control-allow-origin: https://scanned.page access-control-allow-methods: POST,OPTIONS access-control-max-age: 86400 vary: Origin access-control-allow-credentials: true Server: cloudflare CF-RAY: 922d2917faaeadca-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:48 UTC	1435	OUT	GET /favicon.png HTTP/1.1 Host: scanned.page Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://scanned.page/67d9e2d6eeffd Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
2025-03-19 13:01:48 UTC	1139	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:48 GMT Content-Type: image/png Content-Length: 18126 Connection: close access-control-allow-origin: * Cache-Control: public, max-age=14400, must-revalidate content-disposition: inline; filename="favicon.png" etag: "c41b1c50ef8a06c3317337b5ba496a62" last-modified: Fri, 14 Mar 2025 03:08:30 GMT strict-transport-security: max-age=63072000 x-vercel-cache: HIT x-vercel-id: iad1::pmxkr-1742361666207-1cbfea4b0019 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LauU6wsGAfaqfNQ%2FYWZAYwlbY3TZlh96vbNiD2D8bbeeonckI3gP%2B9jvFL2amN9ZK4RGiPpYMH02xDOKkV25DQqw4fp62sGzkyIvtY32kVKNjgWJmWaPA1UD4dSSHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare CF-RAY: 922d29182a754386-EWR server-timing: cfL4;desc="?proto=TCP&rtt=11712&min_rtt=8502&rtt_var=5481&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2007&delivery_rate=343448&cwnd=32&unsent_bytes=0&cid=f4446a3f6d508e2e&ts=159&x=0"
2025-03-19 13:01:48 UTC	230	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b4 00 00 00 b4 08 06 00 00 00 3d cd 06 32 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 20 00 49 44 41 54 78 5e ed 7d 07 98 1c c5 b1 ff af 7a 66 2f 4a 27 e9 74 51 3a 10 19 8c c8 c8 44 01 22 83 4c 70 92 30 fe 3b 3c bf 67 03 c6 60 2c 8c 91 90 10 7b 07 0a 48 64 30 f0 c0 f6 c3 60 e3 70 d8 60 b2 01 83 40 01 84 11 49 20 92 84 10 42 e1 92 b2 2e ed ce 74 fd bf 9e bd 3b dd de ce 6c f7 ee cd 1d 07 d6 f8 e3 fb ac eb de ee aa ea df d4 54 57 57 57 11 76 3e 3b 25 f0 25 92 00 7d 89 78 d9 c9 ca 4e 09 60 27 a0 77 82 e0 4b 25 81 9d 80 fe 52 2d e7 4e 66 76 02 7a 27 06 be 54 12 d8 09 e8 2f d5 72 ee 64 a6 ff 00 1d 8d 8a aa d3 87 e4 ca e1 5b 0b a9 Data Ascii: PNGIHDR=2sRGB IDATx^}zf/J'tQ:D"Lp0;<g`,{Hd0`p`@I B.t;lTWWWv>;%%}xN`'wK%R-Nfvz'T/rd[
2025-03-19 13:01:48 UTC	1369	IN	Data Raw: 8d f3 e2 c2 cd 8d d8 96 25 5b 5c 0b 39 7d bc 10 31 80 6c c8 b8 63 b9 36 b7 c5 64 7b 7e 1b 06 6d 6f ae 3f a8 b0 15 54 23 fb 78 f6 cf 67 f8 68 54 8c 38 9b f2 64 4b 7b a1 c8 13 79 71 c7 cd 8d 44 6c 8b 1d 88 fe 20 88 5c c8 b8 70 dc 88 6d b5 4b 5b b6 09 99 db bc ee 70 6e eb 6b 79 f7 2d a0 6b 27 58 e5 fb 8e ca a3 82 48 81 6c b3 8a 44 dc ad 12 11 7b 4f e9 f2 48 80 cb 18 28 10 a0 5c 10 a5 d2 61 0a 33 36 58 1e c9 70 89 63 82 a9 15 40 13 11 d6 82 f1 49 dc 76 57 09 8b b6 c8 2d 43 5a 9a e2 2d ad 38 b1 c6 31 18 6d e0 76 a9 ad b5 4a 4b 97 e5 8b 62 2a e0 b8 33 98 5c 8c 02 b0 3b 41 56 81 45 a9 04 17 12 51 44 a0 9b bc 4d e5 9c 09 d7 0c 30 71 3b 24 da 20 d0 20 1d b9 8e 2c 7c ec ba 91 cf 44 7b 7c 8b 6c 76 5a 9a 8a f2 fb 44 de 7d 02 e8 c3 97 5c 10 f9 64 48 6e be 68 1e 54 61 Data Ascii: %[\9}1lc6d{~mo?T#xghT8dK{yqDl \pmK[pnky-k'XHlD{OH(\a36Xpc@IvW-CZ-81mvJKb*3\;AVEQDM0q;$ ,\|D{\|lvZD}\dHnhTa
2025-03-19 13:01:48 UTC	1369	IN	Data Raw: 79 0d 08 87 7a a7 4f 3d 1f 13 c6 4d 18 33 d5 06 a6 63 85 43 97 4b c0 0a c9 f2 c6 16 f0 23 db 8e 9c bd 21 63 90 66 f0 83 e2 c5 d1 a2 5c e1 9e c2 c0 14 00 87 80 bb c9 db 84 9f 30 fa 84 31 86 e9 5a a6 cc c5 4a 2b 7f 08 e6 39 8e e5 3c d2 34 76 ee 36 9d f8 32 01 34 95 bc 7d f5 3e 16 f3 e5 04 f1 1d 80 8b 7c 07 0f 4b 00 26 e3 98 80 39 ac 71 76 2c 8a 3a 32 7f 81 6d 39 a3 fe 30 7b 09 a8 8f e2 3f 54 1c 4c d5 7e fb 43 c8 69 20 3a 83 80 21 c9 da 5b b7 b4 06 5f 36 13 d9 e8 fa f4 b6 5d 0f f6 76 66 fc c3 25 39 b7 e9 b8 59 6f ea b4 b4 31 a0 95 b6 b0 73 db cf 26 b2 a3 04 ec 0e ef 58 b5 db a3 63 4c 4f b8 b9 79 61 02 64 d3 3e 26 fd ba f3 96 f8 14 36 81 30 d7 85 f5 60 e3 11 35 75 06 d0 ca b8 cb ae 4b a7 0c 6b 6f 15 df 22 88 28 a0 62 60 3a 4c 0d 9d 9c 75 ed 99 f2 1b 44 79 7f Data Ascii: yzO=M3cCK#!cf\01ZJ+9<4v624}>\|K&9qv,:2m90{?TL~Ci :![_6]vf%9Yo1s&XcLOyad>&60`5uKko"(b`:LuDy
2025-03-19 13:01:48 UTC	1369	IN	Data Raw: fe ed 6a b3 bd 06 90 d1 98 b5 ed e1 8d 47 de b1 ed f3 94 b7 ba 04 52 b6 b6 7e a2 05 fa 25 13 0e ee 85 d9 ea b2 e4 d7 41 b8 b9 be d1 7e 04 13 53 2f 33 6b 01 5d b9 cf 3e e7 00 74 b5 94 7c 30 75 06 22 e9 84 dc 53 bb 31 5c 10 2d 84 15 f9 59 dd c1 d7 bc f7 39 0a b7 4b 96 25 6f 44 47 d8 8e 73 33 58 1d 5c 50 61 57 43 46 bc 79 1b d9 8d 24 68 da fa 16 eb 77 61 00 ba fc 95 ab cf 21 c2 ed 60 ec 92 f6 b2 44 5a 3a 59 dd b0 7e d5 11 f2 c2 a6 23 66 2f 1f 00 f2 a6 8a 79 d1 51 80 7b 3d 88 bf ed 1b d0 66 26 77 f5 a2 7e 28 59 de 5a d4 b6 ed fe 15 e3 ef 68 ef f9 72 68 4c 8e 5a ab fc ed b7 bf 4d 4c 51 66 de 87 90 26 b2 2e cd 27 9a 81 2d c4 78 94 23 f6 af ea 0f ae 6e e8 43 ed 6b 3c f4 d0 79 bf 18 9a 57 30 e8 17 00 fd 08 e0 5d b3 db 1c 26 ee c4 a9 e0 a1 fa 36 eb ee 30 00 5d f9 Data Ascii: jGR~%A~S/3k]>t\|0u"S1\-Y9K%oDGs3X\PaWCFy$hwa!`DZ:Y~#f/yQ{=f&w~(YZhrhLZMLQf&.'-x#nCk<yW0]&60]
2025-03-19 13:01:48 UTC	1369	IN	Data Raw: 4e f9 f9 a1 75 02 e8 f4 72 20 c0 cb 11 8d 8a a1 e7 3a bb e4 32 df 4e 10 e7 a4 d5 ce ba b9 7a b6 13 16 80 71 4d 1d 35 2c ea e9 81 30 06 b4 6e ce b0 37 85 9d 6e 3b 53 2f 87 3f 7d c1 80 ae ad b5 4a 2a de 3a d8 22 eb 6a 82 54 a7 c0 89 b4 08 3a 3e cd da 5f 93 92 7e d2 d0 f4 c1 bb 3d 15 88 07 68 38 17 81 71 29 51 2f bd 1c 84 5b f3 a8 37 6e 3b 3f 40 eb 18 ec 66 4f 7b 1a 3a 0d a0 4b cf 69 df 43 c0 ba 95 40 5f f3 05 b4 c9 5c 3e 7d 98 f1 0a 0b 54 37 ac b4 5e ec 79 ee af 05 b4 c9 9c 09 20 24 fc d0 ef d4 df e6 17 2c 63 64 3e 75 eb d4 e5 87 d6 6d 0a d3 83 30 8d 86 ae b5 ca 17 be 33 06 90 d3 88 31 be 0b d0 41 84 9a cb 41 8d f0 3a d9 7c d1 fa b8 fd 56 cf 43 26 23 40 6b e7 ea d8 14 86 0a 68 ed a4 1d 92 e9 d6 4f 0b e8 af bb 7b 0a c9 b7 f8 02 da 64 be 80 3e 0c 05 68 51 d3 Data Ascii: Nur :2NzqM5,0n7n;S/?}J*:"jT:>_~=h8q)Q/[7n;?@fO{:KiC@_\>}T7^y $,cd>um031AA:\|VC&#@khO{d>hQ
2025-03-19 13:01:48 UTC	1369	IN	Data Raw: 58 15 7b ef bf 0b 62 ce 44 08 fa 1e 98 be 02 a4 c9 5c 1f 2c 8c 4f 41 fc 77 69 f1 1f 1a 72 23 1f e0 80 d4 74 51 6a ba ac 00 ed 3f 67 df 03 5a b7 f0 a9 20 d4 02 1a f7 5c 10 29 19 5d b6 87 70 30 51 10 ce 07 63 5f 9d 65 e7 b5 77 de bc 57 34 11 a9 4c 46 ab 89 f0 17 b6 9d 07 eb dc 9c 8f 82 72 93 a4 00 5a c7 93 6f 7b 98 80 36 71 db f5 06 d0 4a 58 ea 26 f2 37 dd 51 22 c6 87 b1 a4 03 98 30 52 00 85 dc f3 93 e8 9f ce a0 95 80 3a 26 f9 01 c8 7a bd 78 95 58 fe 9e 4f ee b3 ce 45 4b 02 b4 ce cb 91 5e 6b f5 2d a0 75 0b ef 4f 9b 1e d0 00 0e 5f 72 41 64 f5 b6 e2 51 02 91 31 10 18 4d 2c 47 10 28 5f 5d dc 0b 04 b7 2a e1 a3 8e 50 2c 6e 25 89 3a 57 ba ef 59 6c bf b1 7e 65 c3 8a 74 f1 e0 5d 80 56 01 fe bd 39 fa 56 77 0a 81 5b f3 ec 6c 03 fc 3b 37 85 41 80 36 10 b8 a7 a1 5d fe Data Ascii: X{bD\,OAwir#tQj?gZ \)]p0Qc_ewW4LFrZo{6qJX&7Q"0R:&zxXOEK^k-uO_rAdQ1M,G(_]*P,n%:WYl~et]V9Vw[l;7A6]
2025-03-19 13:01:48 UTC	1369	IN	Data Raw: fd 7e a1 f3 2d 82 98 0b 96 bb 78 1b 15 9d 30 35 9a 8d 08 31 66 ac f7 ec 4f 89 ad 10 06 02 4e 93 1b 3a 65 6d 52 37 a5 aa 8a ec 20 66 8c 24 42 15 18 3b 72 4e 07 2d ac 19 8f 5b 08 5c 9d 5f e0 dc b7 72 cc 1c 55 ef db ec 57 69 c0 a4 12 b1 db b6 f3 0d 96 e2 e6 84 a7 a3 c7 21 87 6e 06 7f db 33 06 41 6b c0 ee 5a b0 b5 15 e0 5e 57 eb ea e2 d4 6f 5d 94 16 96 28 62 e2 2a f2 72 7c 07 7c 69 32 e7 a5 9e 98 af 5f 9f 6b ff 3a 68 bf a2 05 b4 92 7d e9 e2 69 63 2d 52 1a 9a 4e 00 1b 6c 0c 8d 3e 89 9e 93 5c 26 30 90 3e fb bb b7 fe 99 33 bf 03 36 cc 1e 9f 44 de cb 18 5c 09 d7 64 9e 1d 2f ab 5a ca 0f 85 85 29 eb 8e b5 9e 08 c3 dc f0 86 8e 46 45 e5 49 ce 58 06 dd c2 e0 03 bb f6 2d bd e1 3f c1 97 e4 ae 6a bd 1a 79 eb e6 d2 c9 c9 93 37 a9 37 31 51 92 da ef c9 6e 8e 57 05 f3 ec 75 Data Ascii: ~-x051fON:emR7 f$B;rN-[\_rUWi!n3AkZ^Wo](b*r\|\|i2_k:h}ic-RNl>\&0>36D\d/Z)FEIX-?jy771QnWu
2025-03-19 13:01:48 UTC	1369	IN	Data Raw: f2 36 e1 5d d7 47 d7 6e ba 56 c9 e3 a8 f3 72 75 11 e4 43 22 ba cb 16 e2 b1 cf 4e 45 5d a6 21 05 d9 03 da 23 3a 2a aa 5e c1 50 87 dd 93 40 fc df 20 fa 2a 24 86 81 7a 9b 28 a6 87 ba 09 4b 80 26 82 4e cc a5 02 c9 9b 01 7a 0f cc f7 0b e2 27 d6 49 7b bd ef 26 50 a5 32 5b 30 b5 84 d9 3e 95 88 bf a1 d2 01 30 f3 60 12 64 79 a3 68 1f 76 20 d1 02 12 1f 4b f0 93 d2 ca 7f ac e9 b8 58 bd ff 8b 13 15 15 0b 62 c3 39 2e 4e 21 81 1f 32 d3 91 94 38 1a df f1 e2 a4 9b 2f 0c 39 86 31 46 cf 75 48 04 ee 6f 01 b0 0c c4 bf 75 c8 7e ae 29 82 86 6c 36 dd 06 02 d7 ae 08 ed 36 2f 3a a4 3d df 39 40 4a 71 1e 31 9f 8b 44 44 9b e6 f2 80 76 dc 44 87 be 10 a0 7e d1 9b 98 f0 2c 24 fe 2c d1 be a4 71 dc 0d f5 be 3b 6c 75 73 f8 c5 68 6e 9b 15 ff 0e 4b e5 f5 a1 83 28 11 f2 99 e0 3d 13 da 19 2d Data Ascii: 6]GnVruC"NE]!#:^P@ $z(K&Nz'I{&P2[0>0`dyhv KXb9.N!28/91FuHou~)l66/:=9@Jq1DDvD~,$,q;lushnK(=-
2025-03-19 13:01:48 UTC	1369	IN	Data Raw: e8 6c c1 bc 53 43 67 bd 24 3b 35 74 6f 44 97 0e d0 3a 30 eb da 77 6a e8 ac 57 e6 f3 35 39 bc 80 a5 68 3f d1 a0 aa 6a 78 72 d2 c1 c9 4c 98 3d 01 6d 32 aa 69 1f 05 68 69 5d 51 18 0f d1 0f 6d c6 d5 17 be 57 ff 80 89 a3 aa 2c a3 3d a2 8d ec 58 5b 8b e5 14 e6 5b 79 db 62 11 2b 27 27 37 06 37 5f 4a d7 2c 9e 37 13 71 ab 94 ea 1d 0f d9 90 11 e4 b4 b9 91 78 7b 7b 5c c6 ac 6d b9 6e c4 6a 76 07 bb ed ce 8a ed 75 8e f1 71 77 f7 f9 6b 27 58 65 c5 fb 8f 16 c2 9d 03 c2 19 da d7 c4 14 cc 89 57 6e 31 83 27 0d df 64 bf f1 b9 e5 75 ce 44 d6 03 a8 6f df 03 9a a3 a2 fc 59 2a 91 05 f1 7d 84 25 f6 21 49 bb 31 b9 15 44 34 94 98 72 98 39 02 24 92 29 1a 3d 26 c0 48 89 33 f0 92 13 3a 00 c5 99 bc 24 31 f5 e4 f2 6a c9 58 1e 81 f5 c1 5a 55 93 e4 c4 f4 f9 1e 52 68 8b 46 45 d9 d8 f6 dd Data Ascii: lSCg$;5toD:0wjW59h?jxrL=m2ihi]QmW,=X[[yb+''77_J,7qx{{\mnjvuqwk'XeWn1'duDoY*}%!I1D4r9$)=&H3:$1jXZURhFE
2025-03-19 13:01:48 UTC	1369	IN	Data Raw: de 9f 05 a9 b4 10 43 bc d4 10 41 85 2c 75 65 f0 ba c9 84 00 87 89 5a 04 78 03 80 4f 88 f8 9d 76 d7 7e 6b e3 99 35 db 42 d1 d8 d1 a8 a8 f8 6a fc 04 90 88 82 71 42 0a c7 9a f5 61 b0 2a 70 fa 4f 22 79 c3 fa af e5 2c 0a 13 d0 54 b2 30 5a 69 41 fe 17 41 fe 02 20 65 0b a5 e6 a2 08 07 40 e9 57 da 64 0e 13 b0 9b f4 d9 31 d7 76 10 3f e0 80 6e 6f 3a f1 3a 55 68 53 07 1b 03 b4 a6 e9 c2 4c c3 fe 35 a5 28 e2 58 47 59 b6 35 8e 99 c7 82 31 1a cc 45 81 40 36 91 8b 6f 1f 52 19 99 95 4f be 0e a0 25 00 3f cf 52 2e 18 2c 2a 96 f7 7a 93 9a 0e d0 06 f4 f6 19 a0 95 dd 1c b1 8a 4f 61 8b a7 4b f6 d2 5e a5 de d6 36 20 50 fb 21 d3 8d a1 6b 37 b5 c9 33 03 b3 ea ad bc 1f ab 98 c4 9c 88 74 fe be f6 94 d9 4a a3 f5 cd c3 51 51 fa 54 4b 99 b0 f3 c6 11 f8 87 00 8e 61 a0 c0 37 33 52 58 fc Data Ascii: CA,ueZxOv~k5BjqBapO"y,T0ZiAA e@Wd1v?no::UhSL5(XGY51E@6oRO%?R.,zOaK^6 P!k73tJQQTKa73RX

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:48 UTC	712	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369f-4183-9911-825e1b6a8be7&_u=KGDAAEADQAAAAC%7E&z=1276851356&slf_rd=1 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://scanned.page X-Client-Data: CLbgygE= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://scanned.page/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 13:01:48 UTC	630	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Wed, 19 Mar 2025 13:01:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Access-Control-Allow-Origin: https://scanned.page Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-19 13:01:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Message.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_2476\AC\Temp\C1852620.pptx

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_2476\AC\Temp\C1852620.pptx:Zone.Identifier

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_2476\AC\Temp\Diagnostics\POWERPNT\App1742389284393606500_6DE0B23E-5FDE-4548-869E-B26D24967687.log

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_2476\AC\Temp\Diagnostics\POWERPNT\App1742389284394278600_6DE0B23E-5FDE-4548-869E-B26D24967687.log

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_2476\AC\Temp\msoE51B.tmp

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250319T0901090877-6276.etl

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 703

Chrome Cache Entry: 704

Chrome Cache Entry: 705

Chrome Cache Entry: 706

Chrome Cache Entry: 707

Chrome Cache Entry: 708

Chrome Cache Entry: 709

Chrome Cache Entry: 710

Chrome Cache Entry: 711

Chrome Cache Entry: 712

Chrome Cache Entry: 713

Chrome Cache Entry: 714

Static File Info

General

Static Mail

General

Windows Analysis Report
Message.eml

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:48 UTC	759	OUT	POST /g/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369f-4183-9911-825e1b6a8be7&_u=KGDAAEADQAAAAC%7E&z=1276851356 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://scanned.page X-Client-Data: CLbgygE= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://scanned.page/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 13:01:48 UTC	847	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://scanned.page Date: Wed, 19 Mar 2025 13:01:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:112:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=ascnsrsggc:112:0 Report-To: {"group":"ascnsrsggc:112:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:112:0"}],} Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:48 UTC	541	OUT	GET /manifest.json HTTP/1.1 Host: scanned.page Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://scanned.page/67d9e2d6eeffd Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 13:01:49 UTC	1170	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 698 Connection: close accept-ranges: bytes access-control-allow-origin: * Age: 467598 Cache-Control: public, max-age=0, must-revalidate content-disposition: inline; filename="manifest.json" etag: "80861a3fdc6289183c6daac930f0e4a4" last-modified: Fri, 14 Mar 2025 03:08:30 GMT strict-transport-security: max-age=63072000 x-vercel-cache: HIT x-vercel-id: iad1::f5q4l-1742389309045-e48ef70f23f0 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eUrEnYg13qauTmzQLdHyfINfdSmZLsjCbVmwJf2%2Bd1kE1C%2BdS0vFi7PI53G5J%2FU67DRZWKni2czhJXjA6%2FY7IZ5dSLN10QpnqAW3O4sXuZpmmmGhnFlrP4rImTsNaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare CF-RAY: 922d291d49f042ef-EWR server-timing: cfL4;desc="?proto=TCP&rtt=8236&min_rtt=8174&rtt_var=3109&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1113&delivery_rate=357230&cwnd=107&unsent_bytes=0&cid=e8b62b656a3722f5&ts=214&x=0"
2025-03-19 13:01:49 UTC	199	IN	Data Raw: 7b 0a 20 20 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 20 22 4f 51 47 22 2c 0a 20 20 22 6e 61 6d 65 22 3a 20 22 4f 6e 6c 69 6e 65 20 51 52 20 47 65 6e 65 72 61 74 6f 72 22 2c 0a 20 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4f 6e 6c 69 6e 65 20 51 52 20 43 6f 64 65 20 47 65 6e 65 72 61 74 6f 72 20 77 69 74 68 20 79 6f 75 72 20 6c 6f 67 6f 2c 20 66 72 61 6d 65 2c 20 63 6f 6c 6f 72 73 20 26 20 6d 6f 72 65 2e 20 43 72 65 61 74 65 2c 20 6d 61 6e 61 67 65 20 61 6e 64 20 73 74 61 74 69 73 74 69 63 61 6c 6c 79 20 74 72 61 63 6b 20 79 6f 75 72 20 51 52 20 63 6f 64 65 73 2e 20 46 6f 72 20 55 52 4c Data Ascii: { "short_name": "OQG", "name": "Online QR Generator", "description":"Online QR Code Generator with your logo, frame, colors & more. Create, manage and statistically track your QR codes. For URL
2025-03-19 13:01:49 UTC	499	IN	Data Raw: 2c 20 76 43 61 72 64 2c 20 50 44 46 20 61 6e 64 20 6d 6f 72 65 22 2c 0a 20 20 22 69 63 6f 6e 73 22 3a 20 5b 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 22 73 72 63 22 3a 20 22 6c 6f 67 6f 5f 36 34 78 36 34 2e 70 6e 67 22 2c 0a 20 20 20 20 20 20 22 73 69 7a 65 73 22 3a 20 22 36 34 78 36 34 22 2c 0a 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 69 6d 61 67 65 2f 70 6e 67 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 22 73 72 63 22 3a 20 22 6c 6f 67 6f 5f 31 39 32 78 31 39 32 2e 70 6e 67 22 2c 0a 20 20 20 20 20 20 22 74 79 70 65 22 3a 20 22 69 6d 61 67 65 2f 70 6e 67 22 2c 0a 20 20 20 20 20 20 22 73 69 7a 65 73 22 3a 20 22 31 39 32 78 31 39 32 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 22 73 72 63 22 3a 20 22 6c 6f 67 6f 5f 35 Data Ascii: , vCard, PDF and more", "icons": [ { "src": "logo_64x64.png", "sizes": "64x64", "type": "image/png" }, { "src": "logo_192x192.png", "type": "image/png", "sizes": "192x192" }, { "src": "logo_5

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:48 UTC	1449	OUT	GET /static/media/regular.1fd3cd7ade0f79b2152a.ttf HTTP/1.1 Host: scanned.page Connection: keep-alive Origin: https://scanned.page sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://scanned.page/static/css/main.c588d2a4.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
2025-03-19 13:01:49 UTC	1121	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:48 GMT Content-Type: font/ttf Content-Length: 134768 Connection: close access-control-allow-origin: * cache-control: max-age=14400, s-maxage=31536000, immutable content-disposition: inline; filename="regular.1fd3cd7ade0f79b2152a.ttf" etag: "550c7b057b4c5e92c648fb468dc9fb08" strict-transport-security: max-age=63072000 x-vercel-cache: HIT x-vercel-id: sfo1::2jtkx-1717131526310-9f42e2cd010c CF-Cache-Status: HIT Age: 184763 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0tQLlGuJMRkzy5kTs2jAh1XJjZd8t5C9HmG5XbIdTiCPu5EUVeA%2FIVcaSEbQYyyIZtsP8CsP7irek0nLaFvLboSfZ9pCAQMp3QIrnmqjyBzGWkKOEMByt4V8af8GNQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare CF-RAY: 922d291d09d6005e-EWR server-timing: cfL4;desc="?proto=TCP&rtt=9296&min_rtt=9235&rtt_var=3507&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2021&delivery_rate=316188&cwnd=32&unsent_bytes=0&cid=d3c4a9d325d46076&ts=135&x=0"
2025-03-19 13:01:49 UTC	248	IN	Data Raw: 00 01 00 00 00 0f 00 80 00 03 00 70 46 46 54 4d 80 06 c1 b9 00 02 0e 54 00 00 00 1c 47 44 45 46 23 82 27 24 00 01 74 70 00 00 00 ac 47 50 4f 53 d4 4c 01 91 00 01 88 b4 00 00 85 9e 47 53 55 42 da 67 6b 17 00 01 75 1c 00 00 13 96 4f 53 2f 32 6a 1a 81 3a 00 00 01 78 00 00 00 60 63 6d 61 70 d4 85 a5 f1 00 00 10 fc 00 00 04 ae 67 61 73 70 ff ff 00 03 00 01 74 68 00 00 00 08 67 6c 79 66 58 58 18 ce 00 00 1d 40 00 01 2f b8 68 65 61 64 0b f2 de 76 00 00 00 fc 00 00 00 36 68 68 65 61 05 f7 06 a0 00 00 01 34 00 00 00 24 68 6d 74 78 0e 3c 95 e5 00 00 01 d8 00 00 0f 24 6c 6f 63 61 cc c7 19 a4 00 00 15 ac 00 00 07 94 6d 61 78 70 04 14 00 6e 00 00 01 58 00 00 00 20 6e 61 6d 65 fa 07 81 9a 00 01 4c f8 00 00 04 74 70 6f 73 74 6a 91 2c 09 00 01 51 6c Data Ascii: pFFTMTGDEF#'$tpGPOSLGSUBgkuOS/2j:x`cmapgaspthglyfXX@/headv6hhea4$hmtx<$locamaxpnX nameLtpostj,Ql
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 00 00 22 fa 00 01 00 00 00 02 00 41 a4 5b 5f 57 5f 0f 3c f5 00 0b 03 e8 00 00 00 00 d5 31 4d 58 00 00 00 00 d5 31 4d 58 fd fe ff 1d 04 72 03 83 00 00 00 08 00 02 00 00 00 00 00 00 00 01 00 00 03 84 ff 0b 00 00 04 87 fd fe ff 44 04 72 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 c9 00 01 00 00 03 c9 00 6b 00 09 00 00 00 00 00 02 00 00 00 01 00 01 00 00 00 40 00 00 00 00 00 00 00 03 02 37 01 90 00 05 00 00 02 8a 02 58 00 00 00 4b 02 8a 02 58 00 00 01 5e 00 32 01 14 00 00 00 00 05 00 00 00 00 00 00 00 00 00 02 07 00 00 00 01 00 00 00 00 00 00 00 00 55 4b 57 4e 00 40 00 0d fb 02 02 bc fe d4 00 91 03 84 00 f5 20 00 00 97 00 00 00 00 01 cd 02 bc 00 00 00 20 00 06 03 20 00 24 00 00 00 00 01 4d 00 00 00 fa 00 00 00 fd 00 00 01 0c 00 3d 01 9e 00 37 02 19 00 Data Ascii: "A[_W_<1MX1MXrDrk@7XKX^2UKWN@ $M=7
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: c2 00 26 02 2d 00 23 01 c2 00 26 02 2d 00 23 01 c2 00 26 02 2d 00 23 01 c2 00 26 02 09 00 06 01 64 00 18 02 09 00 06 01 7a 00 18 02 09 00 06 01 68 00 18 02 7b 00 3f 02 32 00 46 02 7b 00 3f 02 32 00 46 02 7b 00 3f 02 32 00 46 02 7b 00 3f 02 32 00 46 02 7b 00 3f 02 32 00 46 02 7b 00 3f 02 32 00 46 03 be 00 03 02 e9 00 08 02 28 ff f6 02 37 00 46 02 28 ff f6 02 3d 00 17 01 b8 00 0d 02 3d 00 17 01 b8 00 0d 02 3d 00 17 01 b8 00 0d 01 ae ff be 03 49 00 0d 03 67 00 2b 03 1d 00 26 02 2c 00 26 02 2d 00 23 01 c2 00 26 02 09 00 06 01 64 00 18 00 f0 ff ec 02 46 00 50 01 14 00 41 02 58 00 22 02 58 00 22 02 58 00 3c 02 58 00 e5 02 58 00 2f 02 58 00 23 02 58 00 2c 02 58 00 2f 00 00 fe 99 00 00 fe c7 00 00 fe 80 00 00 fe 7f 00 00 fe 7e 00 00 fe 67 00 00 ff 4a 00 00 fe 75 Data Ascii: &-#&-#&-#&dzh{?2F{?2F{?2F{?2F{?2F{?2F(7F(===Ig+&,&-#&dFPAX"X"X<XX/X#X,X/~gJu
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 00 22 01 83 00 26 01 86 00 35 01 8b 00 33 01 86 00 29 01 60 00 27 01 8c 00 2c 01 86 00 29 01 8f 00 3f 01 8f 00 3f 01 8e 00 3a 00 f3 00 33 00 f3 00 10 02 f6 00 10 02 53 00 15 02 09 00 06 02 32 00 1e 02 09 00 06 02 0c 00 3a 01 df 00 1d 02 52 ff ff 01 9b 00 01 04 59 00 50 03 40 00 06 02 be 00 26 02 04 00 26 03 11 00 1f 03 7c 00 22 02 d0 00 0a 01 e7 00 1c 02 d0 00 0a 01 e7 00 1c 02 3a 00 19 02 3a 00 19 02 3a 00 19 02 3a 00 19 02 41 00 32 02 80 00 58 02 48 00 12 02 d0 00 32 02 6c 00 32 01 f8 00 35 03 0c 00 32 03 6e 00 32 01 6e 00 32 02 12 00 35 02 11 00 35 01 f8 00 34 01 f8 00 35 03 1d 00 26 03 1d 00 26 03 1d 00 26 03 1d 00 26 03 1d 00 26 03 1d 00 26 03 1d 00 26 03 1d 00 26 03 1d 00 26 03 1d 00 26 03 1d 00 26 02 35 00 32 03 1d 00 26 03 1d 00 26 03 1d 00 26 03 Data Ascii: "&53)`',)??:3S2:RYP@&&\|"::::A2XH2l252n2n25545&&&&&&&&&&&52&&&
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 03 00 00 00 1c 00 01 00 00 00 00 02 a4 00 03 00 01 00 00 00 1c 00 04 02 88 00 00 00 9e 00 80 00 06 00 1e 00 0d 00 7e 01 7e 01 92 01 ff 02 1b 02 37 02 43 02 bc 02 c7 02 dd 03 04 03 08 03 0c 03 12 03 28 03 94 03 a9 03 bc 03 c0 04 0c 04 4f 04 5c 04 5f 04 63 04 75 04 f9 04 fd 05 13 05 1d 05 27 0e 3f 1e 85 1e f3 20 05 20 0a 20 14 20 1a 20 1e 20 22 20 26 20 30 20 3a 20 44 20 70 20 7e 20 8e 20 a9 20 ac 20 ae 20 b4 20 ba 20 bd 21 13 21 16 21 22 21 26 21 2e 21 54 21 93 21 99 22 02 22 06 22 0f 22 12 22 1a 22 1e 22 2b 22 48 22 60 22 65 24 68 24 ea 24 ff 25 ca 27 7e f8 ff fb 02 ff ff 00 00 00 0d 00 20 00 a0 01 92 01 fc 02 18 02 37 02 43 02 bc 02 c6 02 d8 03 00 03 06 03 0a 03 12 03 26 03 94 03 a9 03 bc 03 c0 04 01 04 0e 04 51 04 5e 04 62 04 72 04 8a 04 fc 05 10 05 1c Data Ascii: ~~7C(O\_cu'? " & 0 : D p ~ !!!"!&!.!T!!"""""""+"H"`"e$h$$%'~ 7C&Q^br
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 0b 54 0b 78 0b 96 0b a8 0b c4 0b dc 0c 0a 0c 1e 0c 4e 0c 5c 0c 8c 0c b0 0c b0 0c ca 0c f6 0d 24 0d 5e 0d 82 0d 96 0d ea 0e 08 0e 4a 0e 74 0e 8e 0e 9e 0e aa 0e ea 0e f8 0f 16 0f 30 0f 5c 0f 90 0f 9e 0f be 0f de 0f f2 10 18 10 2c 10 4c 10 66 10 92 10 d2 11 20 11 58 11 7a 11 9c 11 c2 11 f4 12 26 12 5e 12 82 12 c6 12 e6 13 06 13 28 13 58 13 6e 13 84 13 9c 13 c2 13 ea 14 1a 14 44 14 6e 14 9c 14 d4 15 0e 15 28 15 6c 15 90 15 b4 15 dc 16 10 16 2e 16 50 16 8a 16 be 16 f2 17 28 17 6a 17 ac 17 ee 18 40 18 82 18 b8 18 ee 19 26 19 6a 19 80 19 96 19 ae 19 d8 1a 0e 1a 44 1a 70 1a 9a 1a c8 1b 02 1b 3c 1b 60 1b 9e 1b c6 1b ee 1c 18 1c 4e 1c 84 1c b2 1c f8 1d 1a 1d 4c 1d 78 1d b8 1d e6 1e 26 1e 56 1e 82 1e b4 1e e2 1f 18 1f 4a 1f 7c 1f aa 1f d4 20 22 20 4a 20 80 20 9e 20 Data Ascii: TxN\$^Jt0\,Lf Xz&^(XnDn(l.P(j@&jDp<`NLx&VJ\| " J
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: c8 7c f2 7d 0c 7d 3c 7d 5c 7d 7a 7d 8c 7d a6 7d be 7d e6 7d f8 7e 14 7e 26 7e 5c 7e 96 7e ca 7f 06 7f 26 7f 5e 7f 7c 7f ae 7f c6 7f d8 7f f6 80 20 80 44 80 70 80 a0 80 ce 81 08 81 3e 81 88 81 d6 81 f6 82 2a 82 52 82 8a 82 ba 82 da 82 ec 83 16 83 4e 83 66 83 94 83 bc 83 ce 84 0e 84 34 84 5e 84 86 84 9e 84 ca 85 02 85 1a 85 46 85 6e 85 80 85 c2 85 ea 86 1c 86 38 86 4a 86 74 86 a8 86 c0 86 ea 87 12 87 22 87 5e 87 86 87 a2 87 b6 87 e2 88 16 88 2e 88 5a 88 82 88 94 88 d2 88 fa 89 1c 89 36 89 6e 89 96 89 ae 89 e0 89 ec 8a 0e 8a 30 8a 44 8a 76 8a 84 8a 90 8a c0 8a f0 8b 02 8b 12 8b 2a 8b 42 8b 5a 8b 72 8b 80 8b 8e 8b 9c 8b a8 8b c2 8b dc 8b ec 8b fc 8c 16 8c 30 8c 4a 8c 64 8c 9e 8c ca 8d 0a 8d 4a 8d 7c 8d c4 8d ec 8e 1a 8e 48 8e 74 8e 8e 8e c8 8e f4 8f 34 8f 74 Data Ascii: \|}}<}\}z}}}}}~~&~\~~&^\| Dp>RNf4^Fn8Jt"^.Z6n0DvBZr0JdJ\|Ht4t
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 01 4a 02 e2 00 0a 00 00 05 26 11 10 37 17 0e 01 14 16 17 01 15 db db 35 5d 5d 5d 5d c1 bd 01 14 01 13 bf 32 5a c8 fc c8 5a 00 00 01 ff f4 ff 3f 01 04 02 e2 00 0a 00 00 17 27 3e 01 34 26 27 37 16 11 10 29 35 5d 5d 5d 5d 35 db c1 31 5a c8 fc c8 5a 32 bf fe ed fe ec 00 00 00 01 00 19 01 61 01 8c 02 cd 00 0e 00 00 13 27 37 27 37 17 27 33 07 37 17 07 17 07 27 7d 39 66 91 15 8c 09 44 0a 8c 15 91 66 39 55 01 61 28 7e 27 3e 37 98 98 37 3e 27 7e 28 88 00 00 01 00 35 00 74 01 c4 02 03 00 0b 00 00 37 35 23 35 33 35 33 15 33 15 23 15 d3 9e 9e 53 9e 9e 74 a0 4d a2 a2 4d a0 00 00 01 00 46 ff 88 00 e9 00 87 00 15 00 00 17 22 27 35 16 33 32 37 36 35 06 23 22 26 34 36 33 32 16 15 14 06 6a 14 0e 0c 19 29 0f 0d 0d 1c 1d 26 29 1f 24 37 43 78 03 2a 02 22 15 21 10 26 3e 28 3b Data Ascii: J&75]]]]2ZZ?'>4&'7)5]]]]51ZZ2a'7'7'37'}9fDf9Ua(~'>77>'~(5t75#53533#StMMF"'532765#"&4632j)&)$7Cx*"!&>(;
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 35 00 70 01 bf 02 0a 00 06 00 00 37 35 2d 01 35 05 15 35 01 12 fe ee 01 8a 70 52 7b 7a 53 ae 3f 00 00 02 00 09 ff f9 01 bf 02 cd 00 1c 00 24 00 00 37 35 34 36 3f 01 36 35 34 26 23 22 06 15 23 34 36 33 32 16 15 14 06 0f 01 0e 01 1d 01 06 22 26 34 36 32 16 14 a9 1a 27 33 43 3f 36 3e 49 5b 7b 6b 62 6e 35 30 2b 1c 13 0d 3e 2a 2a 3e 2a d3 0f 32 3c 1d 23 30 4d 32 3e 4a 45 69 76 68 55 3c 52 26 1f 15 25 20 10 da 2b 3c 2b 2b 3c 00 02 00 26 ff 3e 03 54 02 6e 00 2f 00 38 00 00 05 22 26 35 34 36 33 32 16 15 14 06 23 22 26 27 0e 01 23 22 26 35 34 36 33 32 17 35 33 11 14 33 32 36 35 34 26 23 22 06 15 14 16 33 32 37 17 06 02 32 36 34 26 22 06 15 14 01 c9 c5 de e1 bc b7 da 52 50 3d 40 0a 12 4b 33 56 6e 6f 57 63 2b 49 41 27 32 af 9c 9e ba b9 a6 6c 5b 1b 64 de 76 4b 4b 76 Data Ascii: 5p75-55pR{zS?$7546?654&#"#4632"&462'3C?6>I[{kbn50+>*>2<#0M2>JEivhU<R&% +<++<&>Tn/8"&54632#"&'#"&546325332654&#"327264&"RP=@K3VnoWc+IA'2l[dvKKv
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 5a 45 46 5a 00 01 00 23 ff f0 02 05 02 cc 00 25 00 00 05 22 26 35 33 14 16 33 32 36 35 34 26 2f 01 26 35 34 36 33 32 16 15 23 34 26 23 22 06 15 14 16 1f 01 16 15 14 06 01 20 77 86 5b 57 4a 42 48 33 3d 74 8d 7a 62 67 7c 5b 48 43 3a 43 3a 41 6c 8a 7d 10 7e 71 49 56 3d 37 2e 38 15 29 2d 8b 54 68 74 62 41 47 39 30 2c 3a 16 26 31 8c 59 6d 00 01 00 06 00 00 02 03 02 bc 00 07 00 00 33 11 23 35 21 15 23 11 d7 d1 01 fd d1 02 66 56 56 fd 9a 00 00 00 00 01 00 3f ff f0 02 3d 02 bc 00 0f 00 00 04 22 26 35 11 33 11 14 16 32 36 35 11 33 11 14 01 b4 ec 89 5b 58 98 57 5c 10 80 76 01 d6 fe 2f 52 57 57 52 01 d1 fe 2a 76 00 00 01 00 01 00 00 02 34 02 bc 00 06 00 00 33 03 33 1b 01 33 03 ef ee 63 b7 b6 63 ed 02 bc fd d2 02 2e fd 44 00 01 00 03 00 00 03 bc 02 bc 00 0c 00 00 33 Data Ascii: ZEFZ#%"&5332654&/&54632#4&#" w[WJBH3=tzbg\|[HC:C:Al}~qIV=7.8)-ThtbAG90,:&1Ym3#5!#fVV?="&532653[XW\v/RWWR*v4333cc.D3

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:48 UTC	1222	OUT	GET /favicon.png HTTP/1.1 Host: scanned.page Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
2025-03-19 13:01:49 UTC	1141	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:49 GMT Content-Type: image/png Content-Length: 18126 Connection: close access-control-allow-origin: * Cache-Control: public, max-age=14400, must-revalidate content-disposition: inline; filename="favicon.png" etag: "c41b1c50ef8a06c3317337b5ba496a62" last-modified: Fri, 14 Mar 2025 03:08:30 GMT strict-transport-security: max-age=63072000 x-vercel-cache: HIT x-vercel-id: iad1::pmxkr-1742361666207-1cbfea4b0019 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mkcTsVUa5ycSLwKbGCW7unV1CCtIxBofu8d2CT9OV4blDKLumP8stz%2FxlOK0jJdEEfKPtzF%2BmZTgjEx4IdztCwNly8k3FjRqxgyC6Y7Zg3Yyou%2BaDmcihX5axOfwZw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare CF-RAY: 922d291d8b8fc457-EWR server-timing: cfL4;desc="?proto=TCP&rtt=8097&min_rtt=8081&rtt_var=3042&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1794&delivery_rate=361341&cwnd=149&unsent_bytes=0&cid=0587d5035d5c8cd5&ts=171&x=0"
2025-03-19 13:01:49 UTC	228	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b4 00 00 00 b4 08 06 00 00 00 3d cd 06 32 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 20 00 49 44 41 54 78 5e ed 7d 07 98 1c c5 b1 ff af 7a 66 2f 4a 27 e9 74 51 3a 10 19 8c c8 c8 44 01 22 83 4c 70 92 30 fe 3b 3c bf 67 03 c6 60 2c 8c 91 90 10 7b 07 0a 48 64 30 f0 c0 f6 c3 60 e3 70 d8 60 b2 01 83 40 01 84 11 49 20 92 84 10 42 e1 92 b2 2e ed ce 74 fd bf 9e bd 3b dd de ce 6c f7 ee cd 1d 07 d6 f8 e3 fb ac eb de ee aa ea df d4 54 57 57 57 11 76 3e 3b 25 f0 25 92 00 7d 89 78 d9 c9 ca 4e 09 60 27 a0 77 82 e0 4b 25 81 9d 80 fe 52 2d e7 4e 66 76 02 7a 27 06 be 54 12 d8 09 e8 2f d5 72 ee 64 a6 ff 00 1d 8d 8a aa d3 87 e4 ca e1 5b Data Ascii: PNGIHDR=2sRGB IDATx^}zf/J'tQ:D"Lp0;<g`,{Hd0`p`@I B.t;lTWWWv>;%%}xN`'wK%R-Nfvz'T/rd[
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 0b a9 8d f3 e2 c2 cd 8d d8 96 25 5b 5c 0b 39 7d bc 10 31 80 6c c8 b8 63 b9 36 b7 c5 64 7b 7e 1b 06 6d 6f ae 3f a8 b0 15 54 23 fb 78 f6 cf 67 f8 68 54 8c 38 9b f2 64 4b 7b a1 c8 13 79 71 c7 cd 8d 44 6c 8b 1d 88 fe 20 88 5c c8 b8 70 dc 88 6d b5 4b 5b b6 09 99 db bc ee 70 6e eb 6b 79 f7 2d a0 6b 27 58 e5 fb 8e ca a3 82 48 81 6c b3 8a 44 dc ad 12 11 7b 4f e9 f2 48 80 cb 18 28 10 a0 5c 10 a5 d2 61 0a 33 36 58 1e c9 70 89 63 82 a9 15 40 13 11 d6 82 f1 49 dc 76 57 09 8b b6 c8 2d 43 5a 9a e2 2d ad 38 b1 c6 31 18 6d e0 76 a9 ad b5 4a 4b 97 e5 8b 62 2a e0 b8 33 98 5c 8c 02 b0 3b 41 56 81 45 a9 04 17 12 51 44 a0 9b bc 4d e5 9c 09 d7 0c 30 71 3b 24 da 20 d0 20 1d b9 8e 2c 7c ec ba 91 cf 44 7b 7c 8b 6c 76 5a 9a 8a f2 fb 44 de 7d 02 e8 c3 97 5c 10 f9 64 48 6e be 68 1e Data Ascii: %[\9}1lc6d{~mo?T#xghT8dK{yqDl \pmK[pnky-k'XHlD{OH(\a36Xpc@IvW-CZ-81mvJKb*3\;AVEQDM0q;$ ,\|D{\|lvZD}\dHnh
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: e3 00 79 0d 08 87 7a a7 4f 3d 1f 13 c6 4d 18 33 d5 06 a6 63 85 43 97 4b c0 0a c9 f2 c6 16 f0 23 db 8e 9c bd 21 63 90 66 f0 83 e2 c5 d1 a2 5c e1 9e c2 c0 14 00 87 80 bb c9 db 84 9f 30 fa 84 31 86 e9 5a a6 cc c5 4a 2b 7f 08 e6 39 8e e5 3c d2 34 76 ee 36 9d f8 32 01 34 95 bc 7d f5 3e 16 f3 e5 04 f1 1d 80 8b 7c 07 0f 4b 00 26 e3 98 80 39 ac 71 76 2c 8a 3a 32 7f 81 6d 39 a3 fe 30 7b 09 a8 8f e2 3f 54 1c 4c d5 7e fb 43 c8 69 20 3a 83 80 21 c9 da 5b b7 b4 06 5f 36 13 d9 e8 fa f4 b6 5d 0f f6 76 66 fc c3 25 39 b7 e9 b8 59 6f ea b4 b4 31 a0 95 b6 b0 73 db cf 26 b2 a3 04 ec 0e ef 58 b5 db a3 63 4c 4f b8 b9 79 61 02 64 d3 3e 26 fd ba f3 96 f8 14 36 81 30 d7 85 f5 60 e3 11 35 75 06 d0 ca b8 cb ae 4b a7 0c 6b 6f 15 df 22 88 28 a0 62 60 3a 4c 0d 9d 9c 75 ed 99 f2 1b 44 Data Ascii: yzO=M3cCK#!cf\01ZJ+9<4v624}>\|K&9qv,:2m90{?TL~Ci :![_6]vf%9Yo1s&XcLOyad>&60`5uKko"(b`:LuD
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 4e ce fe ed 6a b3 bd 06 90 d1 98 b5 ed e1 8d 47 de b1 ed f3 94 b7 ba 04 52 b6 b6 7e a2 05 fa 25 13 0e ee 85 d9 ea b2 e4 d7 41 b8 b9 be d1 7e 04 13 53 2f 33 6b 01 5d b9 cf 3e e7 00 74 b5 94 7c 30 75 06 22 e9 84 dc 53 bb 31 5c 10 2d 84 15 f9 59 dd c1 d7 bc f7 39 0a b7 4b 96 25 6f 44 47 d8 8e 73 33 58 1d 5c 50 61 57 43 46 bc 79 1b d9 8d 24 68 da fa 16 eb 77 61 00 ba fc 95 ab cf 21 c2 ed 60 ec 92 f6 b2 44 5a 3a 59 dd b0 7e d5 11 f2 c2 a6 23 66 2f 1f 00 f2 a6 8a 79 d1 51 80 7b 3d 88 bf ed 1b d0 66 26 77 f5 a2 7e 28 59 de 5a d4 b6 ed fe 15 e3 ef 68 ef f9 72 68 4c 8e 5a ab fc ed b7 bf 4d 4c 51 66 de 87 90 26 b2 2e cd 27 9a 81 2d c4 78 94 23 f6 af ea 0f ae 6e e8 43 ed 6b 3c f4 d0 79 bf 18 9a 57 30 e8 17 00 fd 08 e0 5d b3 db 1c 26 ee c4 a9 e0 a1 fa 36 eb ee 30 00 Data Ascii: NjGR~%A~S/3k]>t\|0u"S1\-Y9K%oDGs3X\PaWCFy$hwa!`DZ:Y~#f/yQ{=f&w~(YZhrhLZMLQf&.'-x#nCk<yW0]&60
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 58 45 4e f9 f9 a1 75 02 e8 f4 72 20 c0 cb 11 8d 8a a1 e7 3a bb e4 32 df 4e 10 e7 a4 d5 ce ba b9 7a b6 13 16 80 71 4d 1d 35 2c ea e9 81 30 06 b4 6e ce b0 37 85 9d 6e 3b 53 2f 87 3f 7d c1 80 ae ad b5 4a 2a de 3a d8 22 eb 6a 82 54 a7 c0 89 b4 08 3a 3e cd da 5f 93 92 7e d2 d0 f4 c1 bb 3d 15 88 07 68 38 17 81 71 29 51 2f bd 1c 84 5b f3 a8 37 6e 3b 3f 40 eb 18 ec 66 4f 7b 1a 3a 0d a0 4b cf 69 df 43 c0 ba 95 40 5f f3 05 b4 c9 5c 3e 7d 98 f1 0a 0b 54 37 ac b4 5e ec 79 ee af 05 b4 c9 9c 09 20 24 fc d0 ef d4 df e6 17 2c 63 64 3e 75 eb d4 e5 87 d6 6d 0a d3 83 30 8d 86 ae b5 ca 17 be 33 06 90 d3 88 31 be 0b d0 41 84 9a cb 41 8d f0 3a d9 7c d1 fa b8 fd 56 cf 43 26 23 40 6b e7 ea d8 14 86 0a 68 ed a4 1d 92 e9 d6 4f 0b e8 af bb 7b 0a c9 b7 f8 02 da 64 be 80 3e 0c 05 68 Data Ascii: XENur :2NzqM5,0n7n;S/?}J*:"jT:>_~=h8q)Q/[7n;?@fO{:KiC@_\>}T7^y $,cd>um031AA:\|VC&#@khO{d>h
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 6a 27 58 15 7b ef bf 0b 62 ce 44 08 fa 1e 98 be 02 a4 c9 5c 1f 2c 8c 4f 41 fc 77 69 f1 1f 1a 72 23 1f e0 80 d4 74 51 6a ba ac 00 ed 3f 67 df 03 5a b7 f0 a9 20 d4 02 1a f7 5c 10 29 19 5d b6 87 70 30 51 10 ce 07 63 5f 9d 65 e7 b5 77 de bc 57 34 11 a9 4c 46 ab 89 f0 17 b6 9d 07 eb dc 9c 8f 82 72 93 a4 00 5a c7 93 6f 7b 98 80 36 71 db f5 06 d0 4a 58 ea 26 f2 37 dd 51 22 c6 87 b1 a4 03 98 30 52 00 85 dc f3 93 e8 9f ce a0 95 80 3a 26 f9 01 c8 7a bd 78 95 58 fe 9e 4f ee b3 ce 45 4b 02 b4 ce cb 91 5e 6b f5 2d a0 75 0b ef 4f 9b 1e d0 00 0e 5f 72 41 64 f5 b6 e2 51 02 91 31 10 18 4d 2c 47 10 28 5f 5d dc 0b 04 b7 2a e1 a3 8e 50 2c 6e 25 89 3a 57 ba ef 59 6c bf b1 7e 65 c3 8a 74 f1 e0 5d 80 56 01 fe bd 39 fa 56 77 0a 81 5b f3 ec 6c 03 fc 3b 37 85 41 80 36 10 b8 a7 a1 Data Ascii: j'X{bD\,OAwir#tQj?gZ \)]p0Qc_ewW4LFrZo{6qJX&7Q"0R:&zxXOEK^k-uO_rAdQ1M,G(_]*P,n%:WYl~et]V9Vw[l;7A6
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: bc a8 fd 7e a1 f3 2d 82 98 0b 96 bb 78 1b 15 9d 30 35 9a 8d 08 31 66 ac f7 ec 4f 89 ad 10 06 02 4e 93 1b 3a 65 6d 52 37 a5 aa 8a ec 20 66 8c 24 42 15 18 3b 72 4e 07 2d ac 19 8f 5b 08 5c 9d 5f e0 dc b7 72 cc 1c 55 ef db ec 57 69 c0 a4 12 b1 db b6 f3 0d 96 e2 e6 84 a7 a3 c7 21 87 6e 06 7f db 33 06 41 6b c0 ee 5a b0 b5 15 e0 5e 57 eb ea e2 d4 6f 5d 94 16 96 28 62 e2 2a f2 72 7c 07 7c 69 32 e7 a5 9e 98 af 5f 9f 6b ff 3a 68 bf a2 05 b4 92 7d e9 e2 69 63 2d 52 1a 9a 4e 00 1b 6c 0c 8d 3e 89 9e 93 5c 26 30 90 3e fb bb b7 fe 99 33 bf 03 36 cc 1e 9f 44 de cb 18 5c 09 d7 64 9e 1d 2f ab 5a ca 0f 85 85 29 eb 8e b5 9e 08 c3 dc f0 86 8e 46 45 e5 49 ce 58 06 dd c2 e0 03 bb f6 2d bd e1 3f c1 97 e4 ae 6a bd 1a 79 eb e6 d2 c9 c9 93 37 a9 37 31 51 92 da ef c9 6e 8e 57 05 f3 Data Ascii: ~-x051fON:emR7 f$B;rN-[\_rUWi!n3AkZ^Wo](b*r\|\|i2_k:h}ic-RNl>\&0>36D\d/Z)FEIX-?jy771QnW
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 69 66 f2 36 e1 5d d7 47 d7 6e ba 56 c9 e3 a8 f3 72 75 11 e4 43 22 ba cb 16 e2 b1 cf 4e 45 5d a6 21 05 d9 03 da 23 3a 2a aa 5e c1 50 87 dd 93 40 fc df 20 fa 2a 24 86 81 7a 9b 28 a6 87 ba 09 4b 80 26 82 4e cc a5 02 c9 9b 01 7a 0f cc f7 0b e2 27 d6 49 7b bd ef 26 50 a5 32 5b 30 b5 84 d9 3e 95 88 bf a1 d2 01 30 f3 60 12 64 79 a3 68 1f 76 20 d1 02 12 1f 4b f0 93 d2 ca 7f ac e9 b8 58 bd ff 8b 13 15 15 0b 62 c3 39 2e 4e 21 81 1f 32 d3 91 94 38 1a df f1 e2 a4 9b 2f 0c 39 86 31 46 cf 75 48 04 ee 6f 01 b0 0c c4 bf 75 c8 7e ae 29 82 86 6c 36 dd 06 02 d7 ae 08 ed 36 2f 3a a4 3d df 39 40 4a 71 1e 31 9f 8b 44 44 9b e6 f2 80 76 dc 44 87 be 10 a0 7e d1 9b 98 f0 2c 24 fe 2c d1 be a4 71 dc 0d f5 be 3b 6c 75 73 f8 c5 68 6e 9b 15 ff 0e 4b e5 f5 a1 83 28 11 f2 99 e0 3d 13 da Data Ascii: if6]GnVruC"NE]!#:^P@ $z(K&Nz'I{&P2[0>0`dyhv KXb9.N!28/91FuHou~)l66/:=9@Jq1DDvD~,$,q;lushnK(=
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 4e 07 e8 6c c1 bc 53 43 67 bd 24 3b 35 74 6f 44 97 0e d0 3a 30 eb da 77 6a e8 ac 57 e6 f3 35 39 bc 80 a5 68 3f d1 a0 aa 6a 78 72 d2 c1 c9 4c 98 3d 01 6d 32 aa 69 1f 05 68 69 5d 51 18 0f d1 0f 6d c6 d5 17 be 57 ff 80 89 a3 aa 2c a3 3d a2 8d ec 58 5b 8b e5 14 e6 5b 79 db 62 11 2b 27 27 37 06 37 5f 4a d7 2c 9e 37 13 71 ab 94 ea 1d 0f d9 90 11 e4 b4 b9 91 78 7b 7b 5c c6 ac 6d b9 6e c4 6a 76 07 bb ed ce 8a ed 75 8e f1 71 77 f7 f9 6b 27 58 65 c5 fb 8f 16 c2 9d 03 c2 19 da d7 c4 14 cc 89 57 6e 31 83 27 0d df 64 bf f1 b9 e5 75 ce 44 d6 03 a8 6f df 03 9a a3 a2 fc 59 2a 91 05 f1 7d 84 25 f6 21 49 bb 31 b9 15 44 34 94 98 72 98 39 02 24 92 29 1a 3d 26 c0 48 89 33 f0 92 13 3a 00 c5 99 bc 24 31 f5 e4 f2 6a c9 58 1e 81 f5 c1 5a 55 93 e4 c4 f4 f9 1e 52 68 8b 46 45 d9 d8 Data Ascii: NlSCg$;5toD:0wjW59h?jxrL=m2ihi]QmW,=X[[yb+''77_J,7qx{{\mnjvuqwk'XeWn1'duDoY*}%!I1D4r9$)=&H3:$1jXZURhFE
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 28 1c de 9f 05 a9 b4 10 43 bc d4 10 41 85 2c 75 65 f0 ba c9 84 00 87 89 5a 04 78 03 80 4f 88 f8 9d 76 d7 7e 6b e3 99 35 db 42 d1 d8 d1 a8 a8 f8 6a fc 04 90 88 82 71 42 0a c7 9a f5 61 b0 2a 70 fa 4f 22 79 c3 fa af e5 2c 0a 13 d0 54 b2 30 5a 69 41 fe 17 41 fe 02 20 65 0b a5 e6 a2 08 07 40 e9 57 da 64 0e 13 b0 9b f4 d9 31 d7 76 10 3f e0 80 6e 6f 3a f1 3a 55 68 53 07 1b 03 b4 a6 e9 c2 4c c3 fe 35 a5 28 e2 58 47 59 b6 35 8e 99 c7 82 31 1a cc 45 81 40 36 91 8b 6f 1f 52 19 99 95 4f be 0e a0 25 00 3f cf 52 2e 18 2c 2a 96 f7 7a 93 9a 0e d0 06 f4 f6 19 a0 95 dd 1c b1 8a 4f 61 8b a7 4b f6 d2 5e a5 de d6 36 20 50 fb 21 d3 8d a1 6b 37 b5 c9 33 03 b3 ea ad bc 1f ab 98 c4 9c 88 74 fe be f6 94 d9 4a a3 f5 cd c3 51 51 fa 54 4b 99 b0 f3 c6 11 f8 87 00 8e 61 a0 c0 37 33 52 Data Ascii: (CA,ueZxOv~k5BjqBapO"y,T0ZiAA e@Wd1v?no::UhSL5(XGY51E@6oRO%?R.,zOaK^6 P!k73tJQQTKa73R

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:49 UTC	1440	OUT	GET /logo_192x192.png HTTP/1.1 Host: scanned.page Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://scanned.page/67d9e2d6eeffd Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
2025-03-19 13:01:49 UTC	1148	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:49 GMT Content-Type: image/png Content-Length: 4552 Connection: close access-control-allow-origin: * Cache-Control: public, max-age=14400, must-revalidate content-disposition: inline; filename="logo_192x192.png" etag: "06385b3e9b866483b1e378fba71c2a08" last-modified: Fri, 14 Mar 2025 03:08:27 GMT strict-transport-security: max-age=63072000 x-vercel-cache: HIT x-vercel-id: iad1::q56x7-1742275008478-4748884f747c CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vjKICG%2FKu96%2FPxDv9cDjvnGRYxzTFl7SKVr4dBnl%2BmCPbR1Cg%2BSsoAGyTQ4jQ61f0jhxm3ilpZIQdnxtPn3Af6ndZ9JdVRLBrcZGRJIVGjKDAfZfcsP3KWjlCpG8%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare CF-RAY: 922d2921dbdf4219-EWR server-timing: cfL4;desc="?proto=TCP&rtt=8876&min_rtt=8840&rtt_var=3388&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2825&recv_bytes=2012&delivery_rate=319754&cwnd=85&unsent_bytes=0&cid=647e5cc231a6c130&ts=169&x=0"
2025-03-19 13:01:49 UTC	221	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 03 00 00 00 65 02 9c 35 00 00 00 8a 50 4c 54 45 47 70 4c 17 ba 7b 16 bd 7b 17 b7 7b 17 c6 7c 17 be 7b 17 be 7c 16 c1 7b 16 bc 7a 17 bd 7b 17 b9 7b 17 c5 7c 17 c0 7c 17 bd 7c 17 cb 7b 17 bd 7b 17 c9 7c 17 ae 7c 17 be 7b 17 b5 7c 17 ba 7b 17 c1 7c 18 b7 7c 17 bd 7b 18 c4 7c 18 c5 7c 18 c0 7c 18 c9 7c 18 bc 7c 18 bb 7c 18 b6 7c 18 cc 7c 18 cb 7c 18 c2 7c 18 d0 7c 18 b4 7c 18 c7 7c 18 bd 7c 18 bf 7c 18 b9 7c 18 b1 7c 18 b7 7c 18 ab 7c 18 ce 7c 18 d1 7c 18 ae 7c 6c 8f 7e f7 00 00 00 18 74 52 4e 53 00 51 2b ca c4 62 e1 16 09 1f 3d cf fa 85 f8 98 e4 f1 75 dc b9 eb f4 a8 98 d4 19 7b 00 00 Data Ascii: PNGIHDRe5PLTEGpL{{{\|{\|{z{{\|\|\|{{\|\|{\|{\|\|{\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|l~tRNSQ+b=u{
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 10 d5 49 44 41 54 78 da d4 5c 87 92 a3 ba 12 35 98 1c bd 18 4c 70 c4 63 e3 99 9a 79 ff ff 7b 4f 60 82 42 4b 88 b0 7b 6b 1a fb de dd da 2a fa 9c 6e 85 0e 92 37 1b 40 6c 25 4a dd 5d 10 dc 83 1f ec 41 7f 6d 3f ad ec dc 50 57 cc cd 22 41 aa c2 5a 55 2f 1e f8 99 a2 ca 54 52 37 f8 61 e4 de 7f 9a 6f 23 e8 af 3b 2d 74 66 73 30 95 d0 4d 8e d7 db f1 31 c8 b1 fb 3c f2 f6 93 e7 19 fa 3e 8e 89 94 2a 3b 22 d0 df db ff 21 f9 ee 9e 41 ae d7 2b fa 87 40 d3 67 51 b0 23 2d 38 a2 57 1c 7b 79 40 92 77 82 fe e4 c5 23 aa 4c dd bd 63 e8 7b a1 80 f7 f0 6b f9 46 83 4a 53 ac c9 d6 d7 dd 23 25 42 f8 6f 0e 47 4f a8 ca 89 f9 f0 ef 30 fc 9a 01 fa 06 a1 3a 0d bf 13 07 c7 db 28 7c 0a 7f 23 5e ca 53 65 e9 3b 10 3e 28 57 4a ee ae 32 01 3e 52 35 dd fc 9d 64 2e ec 04 33 0c 00 f8 77 29 f8 b5 Data Ascii: IDATx\5Lpcy{O`BK{kn7@l%J]Am?PW"AZU/TR7ao#;-tfs0M1<>;"!A+@gQ#-8W{y@w#Lc{kFJS#%BoGO0:(\|#^Se;>(WJ2>R5d.3w)
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 0c 04 38 f8 2b 2c 1a 65 f1 b7 1e a0 cb fd 58 3e c0 e9 65 60 f9 00 14 a1 89 09 e0 5b 16 96 0f c0 f8 2b 2c 1f a0 e1 b7 1e 60 ba 15 57 2c 23 83 5b 31 57 2c 23 63 03 b4 52 4c 80 d8 72 b1 8c 0c 84 5f 15 a9 05 11 78 c3 6f 3c 00 74 5b f0 9c 18 ec c4 e0 39 31 d0 56 11 11 a0 62 b6 18 cb 89 01 f8 55 85 e7 c4 0c fe c6 03 ac 85 6f 78 55 62 a4 11 a9 1a 6c 80 26 f0 00 13 f3 e3 55 09 08 bf e7 6f 58 02 3d fc d3 6b 20 c0 e9 33 9a 61 c0 34 c2 88 ba 90 01 05 38 3c 02 a5 80 c0 c6 f4 13 1a 7e 65 44 16 4b a0 87 7f 3e 0f 43 88 df 28 ad cb 65 82 ca 9c 01 74 a4 79 04 80 a4 8b ae cc d5 15 39 a3 7b e8 ca 1c 65 7e 84 bf f3 80 b0 d3 6b d9 2a 2e 64 35 b6 25 90 65 b3 08 14 45 4c ab 42 4f f3 9f e6 0f 54 71 97 36 7f ef 81 a3 74 ab 1a a8 4e b3 f8 a5 09 14 45 31 a9 3a 4d 99 bf f3 00 db 67 Data Ascii: 8+,eX>e`[+,`W,#[1W,#cRLr_xo<t[91VbUoxUbl&UoX=k 3a48<~eDK>C(ety9{e~k*.d5%eELBOTq6tNE1:Mg
2025-03-19 13:01:49 UTC	1369	IN	Data Raw: 4c 6d 1d f3 37 22 ee b3 2a 06 5b 2f 67 e4 b2 77 a6 11 88 d6 32 7f 2d c2 46 a5 b3 1f 87 ff 75 b9 5c b6 aa 0c 81 cf 96 80 ed ce dd ba c0 b0 59 e0 02 33 96 82 8f 04 7a 09 4d e0 b3 23 10 79 f3 47 0f 10 37 0b 5c 10 c9 e2 bf 40 81 5f 4a c1 ef 08 98 f1 8a e6 af c3 36 ee 52 6a 6f 47 47 7f 27 1f b1 29 26 f0 39 10 70 bc 95 46 7f 7f b1 88 b7 9b 29 b2 f0 11 81 83 23 22 f0 f9 89 11 f0 57 34 7f 73 b1 88 bb 17 84 52 a3 a7 86 8f 84 6d fa fb 14 fc cf cf 66 a6 58 1a 17 be 27 16 6e a3 37 e4 6c c1 5b 59 f3 d7 c2 9e dd 54 f7 14 fe 83 f2 ce ff 40 f8 59 12 fb 75 dd 81 2f 7a b8 85 3b a5 4f 4e ea d8 11 f8 92 c1 ff 01 94 60 a2 3f 04 fe ff bd 27 9b ee 3d c0 93 6f 12 3f 85 6d 46 06 d8 a8 3e c0 3b a9 bd 97 36 3f 4c 60 a3 6f ff 1c 3a f9 b3 6f 33 3c 1f 1c 3d 92 81 b1 b3 67 e1 a3 04 4c Data Ascii: Lm7"*[/gw2-Fu\Y3zM#yG7\@_J6RjoGG')&9pF)#"W4sRmfX'n7l[YT@Yu/z;ON`?'=o?mF>;6?L`o:o3<=gL
2025-03-19 13:01:49 UTC	224	IN	Data Raw: 1a 00 b4 a1 9f 60 81 22 c3 01 96 a6 5e 8d 56 44 c8 ef dc ee 59 cd 2c f9 bd 66 5e 6f 0e 37 c1 ba 67 30 f9 0a d2 0f 65 99 3d 83 70 a5 30 f5 0f eb ec 4f 5e 60 57 01 34 a4 92 f0 0d 37 9f a9 bb c1 b7 a1 0f 6f ee ed 22 73 42 d8 57 b6 a0 0d 04 f8 d5 5a 44 78 0e c6 68 a6 3f 95 91 08 c6 f4 f3 c3 04 2d 6c ad c7 20 c8 5e a2 45 d2 3e 45 23 63 b7 bf e3 b4 bf 94 4e 93 67 38 94 a4 d4 dc d3 f8 77 a7 a9 f1 a9 aa c2 91 b7 cc e2 4e bf 3c ff ec 1c 28 7d 15 6d 16 7e 7a a4 c8 3f e8 85 11 55 2e be 82 b6 9f 9f 93 e2 f0 51 ab ac db 86 4b 79 f3 6f bf 64 59 93 a7 87 0f 5c 65 95 d6 f9 e2 75 8f ab d5 e6 75 5a fd 1f 2f 1b f9 e4 f5 0f 0d 59 bb d1 da bb 55 71 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: `"^VDY,f^o7g0e=p0O^`W47o"sBWZDxh?-l ^E>E#cNg8wN<(}m~z?U.QKyodY\euuZ/YUqIENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:50 UTC	1227	OUT	GET /logo_192x192.png HTTP/1.1 Host: scanned.page Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
2025-03-19 13:01:50 UTC	1144	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:50 GMT Content-Type: image/png Content-Length: 4552 Connection: close access-control-allow-origin: * Cache-Control: public, max-age=14400, must-revalidate content-disposition: inline; filename="logo_192x192.png" etag: "06385b3e9b866483b1e378fba71c2a08" last-modified: Fri, 14 Mar 2025 03:08:27 GMT strict-transport-security: max-age=63072000 x-vercel-cache: HIT x-vercel-id: iad1::q56x7-1742275008478-4748884f747c CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9evXslTXw16xVbXLAljdGCTqhnE8ADl3POp2xkGlbwl8xgMQRqooEC4KckiP4x2M38AH%2FrmUnpBo%2B9vi%2FIxUGGAtMynEfPI7mKuwA6rEcnvv78avc4UY2EZCNaqawg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare CF-RAY: 922d2926690428c9-EWR server-timing: cfL4;desc="?proto=TCP&rtt=9230&min_rtt=9225&rtt_var=3470&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=1799&delivery_rate=315096&cwnd=32&unsent_bytes=0&cid=79a35756229cf770&ts=201&x=0"
2025-03-19 13:01:50 UTC	225	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 03 00 00 00 65 02 9c 35 00 00 00 8a 50 4c 54 45 47 70 4c 17 ba 7b 16 bd 7b 17 b7 7b 17 c6 7c 17 be 7b 17 be 7c 16 c1 7b 16 bc 7a 17 bd 7b 17 b9 7b 17 c5 7c 17 c0 7c 17 bd 7c 17 cb 7b 17 bd 7b 17 c9 7c 17 ae 7c 17 be 7b 17 b5 7c 17 ba 7b 17 c1 7c 18 b7 7c 17 bd 7b 18 c4 7c 18 c5 7c 18 c0 7c 18 c9 7c 18 bc 7c 18 bb 7c 18 b6 7c 18 cc 7c 18 cb 7c 18 c2 7c 18 d0 7c 18 b4 7c 18 c7 7c 18 bd 7c 18 bf 7c 18 b9 7c 18 b1 7c 18 b7 7c 18 ab 7c 18 ce 7c 18 d1 7c 18 ae 7c 6c 8f 7e f7 00 00 00 18 74 52 4e 53 00 51 2b ca c4 62 e1 16 09 1f 3d cf fa 85 f8 98 e4 f1 75 dc b9 eb f4 a8 98 d4 19 7b 00 00 10 d5 49 44 Data Ascii: PNGIHDRe5PLTEGpL{{{\|{\|{z{{\|\|\|{{\|\|{\|{\|\|{\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|l~tRNSQ+b=u{ID
2025-03-19 13:01:50 UTC	1369	IN	Data Raw: 41 54 78 da d4 5c 87 92 a3 ba 12 35 98 1c bd 18 4c 70 c4 63 e3 99 9a 79 ff ff 7b 4f 60 82 42 4b 88 b0 7b 6b 1a fb de dd da 2a fa 9c 6e 85 0e 92 37 1b 40 6c 25 4a dd 5d 10 dc 83 1f ec 41 7f 6d 3f ad ec dc 50 57 cc cd 22 41 aa c2 5a 55 2f 1e f8 99 a2 ca 54 52 37 f8 61 e4 de 7f 9a 6f 23 e8 af 3b 2d 74 66 73 30 95 d0 4d 8e d7 db f1 31 c8 b1 fb 3c f2 f6 93 e7 19 fa 3e 8e 89 94 2a 3b 22 d0 df db ff 21 f9 ee 9e 41 ae d7 2b fa 87 40 d3 67 51 b0 23 2d 38 a2 57 1c 7b 79 40 92 77 82 fe e4 c5 23 aa 4c dd bd 63 e8 7b a1 80 f7 f0 6b f9 46 83 4a 53 ac c9 d6 d7 dd 23 25 42 f8 6f 0e 47 4f a8 ca 89 f9 f0 ef 30 fc 9a 01 fa 06 a1 3a 0d bf 13 07 c7 db 28 7c 0a 7f 23 5e ca 53 65 e9 3b 10 3e 28 57 4a ee ae 32 01 3e 52 35 dd fc 9d 64 2e ec 04 33 0c 00 f8 77 29 f8 b5 1f 76 91 f4 Data Ascii: ATx\5Lpcy{O`BK{kn7@l%J]Am?PW"AZU/TR7ao#;-tfs0M1<>;"!A+@gQ#-8W{y@w#Lc{kFJS#%BoGO0:(\|#^Se;>(WJ2>R5d.3w)v
2025-03-19 13:01:50 UTC	1369	IN	Data Raw: 2b 2c 1a 65 f1 b7 1e a0 cb fd 58 3e c0 e9 65 60 f9 00 14 a1 89 09 e0 5b 16 96 0f c0 f8 2b 2c 1f a0 e1 b7 1e 60 ba 15 57 2c 23 83 5b 31 57 2c 23 63 03 b4 52 4c 80 d8 72 b1 8c 0c 84 5f 15 a9 05 11 78 c3 6f 3c 00 74 5b f0 9c 18 ec c4 e0 39 31 d0 56 11 11 a0 62 b6 18 cb 89 01 f8 55 85 e7 c4 0c fe c6 03 ac 85 6f 78 55 62 a4 11 a9 1a 6c 80 26 f0 00 13 f3 e3 55 09 08 bf e7 6f 58 02 3d fc d3 6b 20 c0 e9 33 9a 61 c0 34 c2 88 ba 90 01 05 38 3c 02 a5 80 c0 c6 f4 13 1a 7e 65 44 16 4b a0 87 7f 3e 0f 43 88 df 28 ad cb 65 82 ca 9c 01 74 a4 79 04 80 a4 8b ae cc d5 15 39 a3 7b e8 ca 1c 65 7e 84 bf f3 80 b0 d3 6b d9 2a 2e 64 35 b6 25 90 65 b3 08 14 45 4c ab 42 4f f3 9f e6 0f 54 71 97 36 7f ef 81 a3 74 ab 1a a8 4e b3 f8 a5 09 14 45 31 a9 3a 4d 99 bf f3 00 db 67 9c d2 1f 48 Data Ascii: +,eX>e`[+,`W,#[1W,#cRLr_xo<t[91VbUoxUbl&UoX=k 3a48<~eDK>C(ety9{e~k*.d5%eELBOTq6tNE1:MgH
2025-03-19 13:01:50 UTC	1369	IN	Data Raw: 37 22 ee b3 2a 06 5b 2f 67 e4 b2 77 a6 11 88 d6 32 7f 2d c2 46 a5 b3 1f 87 ff 75 b9 5c b6 aa 0c 81 cf 96 80 ed ce dd ba c0 b0 59 e0 02 33 96 82 8f 04 7a 09 4d e0 b3 23 10 79 f3 47 0f 10 37 0b 5c 10 c9 e2 bf 40 81 5f 4a c1 ef 08 98 f1 8a e6 af c3 36 ee 52 6a 6f 47 47 7f 27 1f b1 29 26 f0 39 10 70 bc 95 46 7f 7f b1 88 b7 9b 29 b2 f0 11 81 83 23 22 f0 f9 89 11 f0 57 34 7f 73 b1 88 bb 17 84 52 a3 a7 86 8f 84 6d fa fb 14 fc cf cf 66 a6 58 1a 17 be 27 16 6e a3 37 e4 6c c1 5b 59 f3 d7 c2 9e dd 54 f7 14 fe 83 f2 ce ff 40 f8 59 12 fb 75 dd 81 2f 7a b8 85 3b a5 4f 4e ea d8 11 f8 92 c1 ff 01 94 60 a2 3f 04 fe ff bd 27 9b ee 3d c0 93 6f 12 3f 85 6d 46 06 d8 a8 3e c0 3b a9 bd 97 36 3f 4c 60 a3 6f ff 1c 3a f9 b3 6f 33 3c 1f 1c 3d 92 81 b1 b3 67 e1 a3 04 4c e1 13 c0 61 Data Ascii: 7"*[/gw2-Fu\Y3zM#yG7\@_J6RjoGG')&9pF)#"W4sRmfX'n7l[YT@Yu/z;ON`?'=o?mF>;6?L`o:o3<=gLa
2025-03-19 13:01:50 UTC	220	IN	Data Raw: 9f 60 81 22 c3 01 96 a6 5e 8d 56 44 c8 ef dc ee 59 cd 2c f9 bd 66 5e 6f 0e 37 c1 ba 67 30 f9 0a d2 0f 65 99 3d 83 70 a5 30 f5 0f eb ec 4f 5e 60 57 01 34 a4 92 f0 0d 37 9f a9 bb c1 b7 a1 0f 6f ee ed 22 73 42 d8 57 b6 a0 0d 04 f8 d5 5a 44 78 0e c6 68 a6 3f 95 91 08 c6 f4 f3 c3 04 2d 6c ad c7 20 c8 5e a2 45 d2 3e 45 23 63 b7 bf e3 b4 bf 94 4e 93 67 38 94 a4 d4 dc d3 f8 77 a7 a9 f1 a9 aa c2 91 b7 cc e2 4e bf 3c ff ec 1c 28 7d 15 6d 16 7e 7a a4 c8 3f e8 85 11 55 2e be 82 b6 9f 9f 93 e2 f0 51 ab ac db 86 4b 79 f3 6f bf 64 59 93 a7 87 0f 5c 65 95 d6 f9 e2 75 8f ab d5 e6 75 5a fd 1f 2f 1b f9 e4 f5 0f 0d 59 bb d1 da bb 55 71 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: `"^VDY,f^o7g0e=p0O^`W47o"sBWZDxh?-l ^E>E#cNg8wN<(}m~z?U.QKyodY\euuZ/YUqIENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:02:14 UTC	1586	OUT	GET /67d9e2d6eeffd HTTP/1.1 Host: scanned.page Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D If-Modified-Since: Fri, 14 Mar 2025 03:08:28 GMT
2025-03-19 13:02:14 UTC	922	IN	HTTP/1.1 304 Not Modified Date: Wed, 19 Mar 2025 13:02:14 GMT Connection: close CF-Ray: 922d29bb39a843d3-EWR CF-Cache-Status: DYNAMIC Cache-Control: s-maxage=0 ETag: "5e00f0a9917886608050beba1bb570e2" x-vercel-cache: HIT x-vercel-id: iad1::f2v8m-1742389334328-ac84f070ae9b Server-Timing: cfCacheStatus;desc="DYNAMIC" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qIpXrMbctFRQ1FiV2UVTA6sbukdirST%2Ffkk%2B4D8wGVhezDPFSoYrqd7B4cZaZT6hfS4%2BpQtkNElXofomWDWRcmd4%2Bwsp4rz5%2Ba3C76Mto88bL7ks70ptpQPzFS3fKw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=9599&min_rtt=9060&rtt_var=3783&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2158&delivery_rate=322295&cwnd=140&unsent_bytes=0&cid=7a18dc9a8db95964&ts=182&x=0"

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:02:14 UTC	1456	OUT	POST /cdn-cgi/rum? HTTP/1.1 Host: scanned.page Connection: keep-alive Content-Length: 978 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/json sec-ch-ua-mobile: ?0 Accept: / Origin: https://scanned.page Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://scanned.page/67d9e2d6eeffd Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
2025-03-19 13:02:14 UTC	978	OUT	Data Raw: 7b 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 65 76 65 6e 74 54 79 70 65 22 3a 33 2c 22 76 65 72 73 69 6f 6e 73 22 3a 7b 22 6a 73 22 3a 22 32 30 32 34 2e 36 2e 31 22 2c 22 66 6c 22 3a 22 32 30 32 35 2e 31 2e 30 22 7d 2c 22 70 61 67 65 6c 6f 61 64 49 64 22 3a 22 66 30 35 38 66 33 36 35 2d 39 37 39 65 2d 34 31 61 35 2d 39 31 39 65 2d 34 64 62 33 63 62 64 64 39 34 62 32 22 2c 22 6c 6f 63 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 61 6e 6e 65 64 2e 70 61 67 65 2f 36 37 64 39 65 32 64 36 65 65 66 66 64 22 2c 22 6c 61 6e 64 69 6e 67 50 61 74 68 22 3a 22 2f 36 37 64 39 65 32 64 36 65 65 66 66 64 22 2c 22 73 74 61 72 74 54 69 6d 65 22 3a 31 37 34 32 33 38 39 33 30 32 33 38 30 2e 39 2c 22 6e 74 22 3a 22 6e 61 76 69 67 61 74 65 22 2c 22 73 65 72 76 65 Data Ascii: {"referrer":"","eventType":3,"versions":{"js":"2024.6.1","fl":"2025.1.0"},"pageloadId":"f058f365-979e-41a5-919e-4db3cbdd94b2","location":"https://scanned.page/67d9e2d6eeffd","landingPath":"/67d9e2d6eeffd","startTime":1742389302380.9,"nt":"navigate","serve
2025-03-19 13:02:14 UTC	369	IN	HTTP/1.1 204 No Content Date: Wed, 19 Mar 2025 13:02:14 GMT Connection: close access-control-allow-origin: https://scanned.page access-control-allow-methods: POST,OPTIONS access-control-max-age: 86400 vary: Origin access-control-allow-credentials: true Server: cloudflare CF-RAY: 922d29bc697f42ec-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:02:14 UTC	1459	OUT	POST /cdn-cgi/zaraz/t HTTP/1.1 Host: scanned.page Connection: keep-alive Content-Length: 426 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/json sec-ch-ua-mobile: ?0 Accept: / Origin: https://scanned.page Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://scanned.page/67d9e2d6eeffd Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
2025-03-19 13:02:14 UTC	426	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 76 69 73 69 62 69 6c 69 74 79 43 68 61 6e 67 65 22 2c 22 64 61 74 61 22 3a 7b 22 5f 5f 7a 63 6c 5f 74 72 61 63 6b 22 3a 74 72 75 65 2c 22 5f 5f 7a 63 6c 5f 76 69 73 69 62 69 6c 69 74 79 43 68 61 6e 67 65 22 3a 74 72 75 65 2c 22 5f 5f 7a 61 72 61 7a 4d 43 4c 69 73 74 65 6e 65 72 73 22 3a 7b 22 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 5f 76 34 5f 65 45 58 53 22 3a 5b 22 76 69 73 69 62 69 6c 69 74 79 43 68 61 6e 67 65 22 5d 7d 2c 22 76 69 73 69 62 69 6c 69 74 79 43 68 61 6e 67 65 22 3a 5b 7b 22 73 74 61 74 65 22 3a 22 68 69 64 64 65 6e 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 34 32 33 38 39 33 33 33 30 37 35 7d 5d 2c 22 5f 5f 7a 61 72 61 7a 43 6c 69 65 6e 74 45 76 65 6e 74 22 3a 74 72 75 65 7d 2c 22 7a 61 72 61 7a 44 Data Ascii: {"name":"visibilityChange","data":{"__zcl_track":true,"__zcl_visibilityChange":true,"__zarazMCListeners":{"google-analytics_v4_eEXS":["visibilityChange"]},"visibilityChange":[{"state":"hidden","timestamp":1742389333075}],"__zarazClientEvent":true},"zarazD
2025-03-19 13:02:15 UTC	1299	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:02:15 GMT Content-Type: application/json Content-Length: 334 Connection: close Access-Control-Allow-Origin: https://scanned.page Set-Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; Domain=scanned.page; Path=/; HttpOnly; Secure; SameSite=Lax Vary: Origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Set-Cookie, Cache-Control Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS Access-Control-Max-Age: 600 set-cookie: google-analytics_v4_eEXS__pageviewCounter=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie: google-analytics_v4_eEXS__engagementDuration=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie: google-analytics_v4_eEXS__engagementStart=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie: google-analytics_v4_eEXS__counter=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie: google-analytics_v4_eEXS__ga4sid=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie: google-analytics_v4_eEXS__session_counter=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax
2025-03-19 13:02:15 UTC	1193	IN	Data Raw: 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 5f 76 34 5f 65 45 58 53 5f 5f 67 61 34 3d 3b 20 44 6f 6d 61 69 6e 3d 73 63 61 6e 6e 65 64 2e 70 61 67 65 3b 20 50 61 74 68 3d 2f 3b 20 4d 61 78 2d 41 67 65 3d 30 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 5f 76 34 5f 65 45 58 53 5f 5f 5f 7a 5f 67 61 5f 61 75 64 69 65 6e 63 65 73 3d 3b 20 44 6f 6d 61 69 6e 3d 73 63 61 6e 6e 65 64 2e 70 61 67 65 3b 20 50 61 74 68 3d 2f 3b 20 4d 61 78 2d 41 67 65 3d 30 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a Data Ascii: set-cookie: google-analytics_v4_eEXS__ga4=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Laxset-cookie: google-analytics_v4_eEXS___z_ga_audiences=; Domain=scanned.page; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Laxset-cookie:
2025-03-19 13:02:15 UTC	627	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 46 73 74 62 77 74 4a 61 36 55 6f 5a 64 68 6b 4f 32 42 77 66 63 52 4c 6b 71 34 39 34 4d 35 6d 36 7a 77 79 4d 54 35 4e 43 25 32 46 66 75 73 6e 35 37 66 33 6b 63 25 32 42 48 55 71 30 78 33 39 4d 6e 44 64 38 47 64 7a 46 52 76 25 32 42 4b 25 32 46 61 42 5a 32 71 61 6b 46 44 25 32 46 39 55 7a 55 4e 78 75 30 47 6c 57 31 4f 77 35 7a 4d 72 39 31 25 32 42 6a 74 61 7a 58 4c 65 78 41 4f 4b 45 79 53 64 41 39 62 67 69 30 77 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FstbwtJa6UoZdhkO2BwfcRLkq494M5m6zwyMT5NC%2Ffusn57f3kc%2BHUq0x39MnDd8GdzFRv%2BK%2FaBZ2qakFD%2F9UzUNxu0GlW1Ow5zMr91%2BjtazXLexAOKEySdA9bgi0w%3D%3D"}],"group":"cf-nel","max_age":60
2025-03-19 13:02:15 UTC	334	IN	Data Raw: 7b 22 66 22 3a 5b 5b 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 73 2e 67 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 67 2f 63 6f 6c 6c 65 63 74 3f 74 3d 64 63 26 61 69 70 3d 31 26 5f 72 3d 33 26 76 3d 31 26 5f 76 3d 6a 38 36 26 74 69 64 3d 47 2d 45 4d 50 54 37 34 46 48 4a 46 26 63 69 64 3d 31 63 66 33 38 32 31 64 2d 33 36 39 66 2d 34 31 38 33 2d 39 39 31 31 2d 38 32 35 65 31 62 36 61 38 62 65 37 26 5f 75 3d 4b 47 44 41 41 45 41 44 51 41 41 41 41 43 25 37 45 26 7a 3d 31 32 37 37 32 36 30 31 39 37 22 2c 7b 7d 5d 5d 2c 22 65 22 3a 5b 22 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 29 7b 7b 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 29 7b 7a 61 72 61 7a 2e 5f 5f 7a 61 72 61 7a 4d 43 4c 69 73 74 65 6e 65 72 73 3d 7b 5c 22 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 Data Ascii: {"f":[["https://stats.g.doubleclick.net/g/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=G-EMPT74FHJF&cid=1cf3821d-369f-4183-9911-825e1b6a8be7&_u=KGDAAEADQAAAAC%7E&z=1277260197",{}]],"e":["(function(w,d){{(function(w,d){zaraz.__zarazMCListeners={\"google-analytic

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:02:14 UTC	1507	OUT	GET /static/css/main.c588d2a4.css HTTP/1.1 Host: scanned.page Connection: keep-alive sec-ch-ua-platform: "Windows" If-None-Match: "2ee6263d5ec8ce3071e4c7a3b3ab18cc" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" If-Modified-Since: Fri, 14 Mar 2025 03:10:14 GMT sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://scanned.page/67d9e2d6eeffd Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: cfzs_google-analytics_v4=%7B%22eEXS_pageviewCounter%22%3A%7B%22v%22%3A%221%22%7D%7D; cfz_google-analytics_v4=%7B%22eEXS_engagementDuration%22%3A%7B%22v%22%3A%220%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_engagementStart%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4sid%22%3A%7B%22v%22%3A%221093899312%22%2C%22e%22%3A1742391107491%7D%2C%22eEXS_session_counter%22%3A%7B%22v%22%3A%221%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_ga4%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS__z_ga_audiences%22%3A%7B%22v%22%3A%221cf3821d-369f-4183-9911-825e1b6a8be7%22%2C%22e%22%3A1773925307491%7D%2C%22eEXS_let%22%3A%7B%22v%22%3A%221742389307491%22%2C%22e%22%3A1773925307491%7D%7D
2025-03-19 13:02:15 UTC	1102	IN	HTTP/1.1 304 Not Modified Date: Wed, 19 Mar 2025 13:02:15 GMT Connection: close access-control-allow-origin: * Cache-Control: max-age=14400, s-maxage=31536000, immutable content-disposition: inline; filename="main.c588d2a4.css" etag: "2ee6263d5ec8ce3071e4c7a3b3ab18cc" last-modified: Fri, 14 Mar 2025 03:10:14 GMT strict-transport-security: max-age=63072000 x-vercel-cache: HIT x-vercel-id: iad1::kqcfv-1742202171076-308dccc9f0c8 CF-Cache-Status: HIT Age: 185519 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=goGVFHutekyS%2ForHb8fmgnNuGa%2BWihQOyXX6sZzT1Zqq2coN%2FmcsK6dlIAJhIf9SVsaPyJQSoBvFDN5i6TTTlJprU%2FAeRxS0M00Idvhqyqh%2B958Lh89y0o2bZXlKwQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-robots-tag: noindex,nofollow Server: cloudflare CF-RAY: 922d29bfdb2723ce-EWR server-timing: cfL4;desc="?proto=TCP&rtt=14609&min_rtt=14077&rtt_var=5659&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2079&delivery_rate=207430&cwnd=32&unsent_bytes=0&cid=9a7d6675b6767b48&ts=141&x=0"