Edit tour

Windows Analysis Report
https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html

Overview

General Information

Sample URL:	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdh
Analysis ID:	1644348
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

AI detected landing page (webpage, office document or email)

Detected use of open redirect vulnerability

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,18384077880927218207,11992465762872697990,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2156 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,18384077880927218207,11992465762872697990,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3272 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.8.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'office.endangered.it.com' does not match the legitimate domain 'microsoft.com'., The domain 'it.com' is not associated with Microsoft and could be used to mislead users., The presence of 'office' in the subdomain could be an attempt to mimic Microsoft's Office product line., The email domain 'dnsim.net' does not appear to be associated with Microsoft, which raises suspicion. DOM: 1.8.pages.csv

Yara detected HtmlPhish10

Source: Yara match

File source: 1.8.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html

Joe Sandbox AI: Page contains button: 'Verify your email address' Source: '0.0.pages.csv'

Detected use of open redirect vulnerability

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Proxy from: protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html to https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html

Source: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html	HTTP Parser: Number of links: 0
Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	HTTP Parser: Number of links: 0

Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html

HTTP Parser: Base64 decoded: https://office.endangered.it.com/8kfUZ#

Source: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html	HTTP Parser: Title: D0CUSIGN does not match URL
Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html	HTTP Parser: Invalid link: Terms
Source: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html	HTTP Parser: Invalid link: Privacy Policy
Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	HTTP Parser: Invalid link: Privacy statement

Source: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html

HTTP Parser: Iframe src: https://i.pinimg.com/736x/d1/3e/64/d13e649549d58b162cf918118d9ed562.jpg

Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net

HTTP Parser: <input type="password" .../> found

Source: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html	HTTP Parser: No favicon
Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	HTTP Parser: No favicon
Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	HTTP Parser: No favicon
Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	HTTP Parser: No favicon
Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	HTTP Parser: No favicon
Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	HTTP Parser: No favicon

Source: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html	HTTP Parser: No <meta name="author".. found
Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	HTTP Parser: No <meta name="author".. found

Source: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html	HTTP Parser: No <meta name="copyright".. found
Source: https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.250.80.100:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.246.125:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.246.125:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 16.182.97.178:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.0.84:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.106.48:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.40.179.19:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.116.92:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.106.75:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.40.179.76:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.116.92:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.124.183:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.123.183:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.202:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.19:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.58:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.28.146.206:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.202.1:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.202:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.56.162.51:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.202:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.5:49799 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: protect2.fireeye.com to https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	TCP traffic detected without corresponding DNS query: 43.152.134.210
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.40.150
Source: unknown	TCP traffic detected without corresponding DNS query: 43.152.134.210
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html HTTP/1.1Host: protect2.fireeye.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /docnwhdheb.html HTTP/1.1Host: hyj48i39.s3.us-east-1.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /736x/d1/3e/64/d13e649549d58b162cf918118d9ed562.jpg HTTP/1.1Host: i.pinimg.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://hyj48i39.s3.us-east-1.amazonaws.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3fcisxc3a6xz/docusign_logo_black_text_on_white_0.png/90872cd475f92acafc7c490c93976e40/ds-logo-on-white.png HTTP/1.1Host: images.ctfassets.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://hyj48i39.s3.us-east-1.amazonaws.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /512/847/847969.png HTTP/1.1Host: cdn-icons-png.flaticon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://hyj48i39.s3.us-east-1.amazonaws.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5be974e/build/signer.css HTTP/1.1Host: cdn.hellosign.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://hyj48i39.s3.us-east-1.amazonaws.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3fcisxc3a6xz/docusign_logo_black_text_on_white_0.png/90872cd475f92acafc7c490c93976e40/ds-logo-on-white.png HTTP/1.1Host: images.ctfassets.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /512/847/847969.png HTTP/1.1Host: cdn-icons-png.flaticon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiJo8sBCIWgzQEI9s/OAQiA1s4BCMDYzgEIq97OAQjS4M4BCK/kzgEI4uTOAQiL5c4BSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5be974e/build/a6d09f4028ea300af1bd.ttf HTTP/1.1Host: cdn.hellosign.comConnection: keep-aliveOrigin: https://hyj48i39.s3.us-east-1.amazonaws.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.hellosign.com/5be974e/build/signer.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f1718227932057x822365466237625200/DOCU-60cafc67.png HTTP/1.1Host: meta-q.cdn.bubble.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://hyj48i39.s3.us-east-1.amazonaws.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f1718227932057x822365466237625200/DOCU-60cafc67.png HTTP/1.1Host: meta-q.cdn.bubble.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /8kfUZ HTTP/1.1Host: office.endangered.it.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://hyj48i39.s3.us-east-1.amazonaws.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /8kfUZ/ HTTP/1.1Host: office.endangered.it.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/assets/PNG/Microsoft_Logo_512px.png HTTP/1.1Host: mailmeteor.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/assets/PNG/Microsoft_Logo_512px.png HTTP/1.1Host: mailmeteor.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=92358b47afc40f63&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: office.endangered.it.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://office.endangered.it.com/8kfUZ/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=ihf6a32hd8trftdvhagpnglago
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1414348410:1742472878:yecUZmDbN8up8L1looyXyvk3UZZiWClMcjK2TzNEz6M/92358b47afc40f63/FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMr HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/92358b47afc40f63/1742477217518/MVkB8_5L5hzmSA_ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/92358b47afc40f63/1742477217518/MVkB8_5L5hzmSA_ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/92358b47afc40f63/1742477217522/f66b3bf5b729985606b08bc1e8cd061b00221200606694c1867f2177f0d465a9/Ev6mBFcA9R_K-Lr HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1414348410:1742472878:yecUZmDbN8up8L1looyXyvk3UZZiWClMcjK2TzNEz6M/92358b47afc40f63/FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMr HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1414348410:1742472878:yecUZmDbN8up8L1looyXyvk3UZZiWClMcjK2TzNEz6M/92358b47afc40f63/FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMr HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveOrigin: https://office.endangered.it.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://office.endangered.it.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://office.endangered.it.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap.min.js HTTP/1.1Host: 5726893377-1317754460.cos.ap-seoul.myqcloud.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1Host: res.cloudinary.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png HTTP/1.1Host: res.cloudinary.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: kvri.endangered.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://office.endangered.it.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: kvri.endangered.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: kvri.endangered.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: protect2.fireeye.com
Source: global traffic	DNS traffic detected: DNS query: hyj48i39.s3.us-east-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: cdn.hellosign.com
Source: global traffic	DNS traffic detected: DNS query: images.ctfassets.net
Source: global traffic	DNS traffic detected: DNS query: cdn-icons-png.flaticon.com
Source: global traffic	DNS traffic detected: DNS query: i.pinimg.com
Source: global traffic	DNS traffic detected: DNS query: meta-q.cdn.bubble.io
Source: global traffic	DNS traffic detected: DNS query: office.endangered.it.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: mailmeteor.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: 5726893377-1317754460.cos.ap-seoul.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: kvri.endangered.it.com
Source: global traffic	DNS traffic detected: DNS query: res.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1414348410:1742472878:yecUZmDbN8up8L1looyXyvk3UZZiWClMcjK2TzNEz6M/92358b47afc40f63/FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMr HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3663sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8cf-chl: FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMrcf-chl-ra: 0sec-ch-ua-mobile: ?0Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 20 Mar 2025 13:26:57 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeServer: cloudflareCache-Control: max-age=14400Cf-Cache-Status: EXPIREDCF-RAY: 92358b517f8e32fc-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_124.3.dr	String found in binary or memory: http://creativecommons.org/licenses/by/4.0/
Source: chromecache_124.3.dr	String found in binary or memory: http://ionicons.com/
Source: chromecache_128.3.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_142.3.dr	String found in binary or memory: http://www.ascendercorp.com/0
Source: chromecache_142.3.dr	String found in binary or memory: http://www.ascendercorp.com/eula10.html
Source: chromecache_142.3.dr	String found in binary or memory: http://www.ascendercorp.com/eula10.htmlNormaloby
Source: chromecache_142.3.dr	String found in binary or memory: http://www.ascendercorp.com/http://ascendercorp.com/eula10.htmlNormaaliNorm
Source: chromecache_142.3.dr	String found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlThis
Source: chromecache_118.3.dr	String found in binary or memory: https://cdn-icons-png.flaticon.com/512/847/847969.png
Source: chromecache_118.3.dr	String found in binary or memory: https://cdn.hellosign.com/5be974e/build/signer.css
Source: chromecache_132.3.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_148.3.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_124.3.dr	String found in binary or memory: https://github.com/driftyco/ionicons
Source: chromecache_124.3.dr	String found in binary or memory: https://github.com/google/material-design-icons
Source: chromecache_148.3.dr, chromecache_132.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_148.3.dr, chromecache_132.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_118.3.dr	String found in binary or memory: https://i.pinimg.com/736x/d1/3e/64/d13e649549d58b162cf918118d9ed562.jpg
Source: chromecache_118.3.dr	String found in binary or memory: https://images.ctfassets.net/3fcisxc3a6xz/docusign_logo_black_text_on_white_0.png/90872cd475f92acafc
Source: chromecache_118.3.dr	String found in binary or memory: https://meta-q.cdn.bubble.io/f1718227932057x822365466237625200/DOCU-60cafc67.png
Source: chromecache_124.3.dr	String found in binary or memory: https://twitter.com/benjsperry
Source: chromecache_124.3.dr	String found in binary or memory: https://twitter.com/ionicframework

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 142.250.80.100:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.246.125:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.246.125:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 16.182.97.178:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.0.84:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.106.48:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.40.179.19:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.116.92:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.138.106.75:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.40.179.76:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.116.92:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.124.183:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.123.183:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.202:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.19:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.92.58:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.28.146.206:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.202.1:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.202:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.56.162.51:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.202:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.5:49799 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir3652_2033722750

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir3652_2033722750

Jump to behavior

Source: classification engine

Classification label: mal64.phis.win@29/60@60/26

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,18384077880927218207,11992465762872697990,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2156 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,18384077880927218207,11992465762872697990,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3272 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,18384077880927218207,11992465762872697990,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2156 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,18384077880927218207,11992465762872697990,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3272 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Web Protocols	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://kvri.endangered.it.com/google.php	0%	Avira URL Cloud	safe
https://office.endangered.it.com/favicon.ico	0%	Avira URL Cloud	safe
https://5726893377-1317754460.cos.ap-seoul.myqcloud.com/bootstrap.min.js	0%	Avira URL Cloud	safe
http://ionicons.com/	0%	Avira URL Cloud	safe
https://office.endangered.it.com/8kfUZ	0%	Avira URL Cloud	safe
https://office.endangered.it.com/8kfUZ/	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
mailmeteor.com	172.67.187.19	true	false	high
stackpath.bootstrapcdn.com	104.18.10.207	true	false	high
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
d3orhvfyxudxxq.cloudfront.net	108.138.106.48	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
e329293.dscd.akamaiedge.net	23.209.72.9	true	false	high
kvri.endangered.it.com	172.67.151.202	true	false	unknown
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
a1990.dscd.akamai.net	23.40.179.19	true	false	high
cos.ap-seoul.myqcloud.com	119.28.146.206	true	false	high
s3-r-w.us-east-1.amazonaws.com	16.182.97.178	true	false	high
s-part-0010.t-0009.t-msedge.net	13.107.246.38	true	false	high
meta-q.cdn.bubble.io	104.17.124.183	true	false	high
code.jquery.com	151.101.2.137	true	false	high
office.endangered.it.com	172.67.151.202	true	true	unknown
dualstack.pinterest.map.fastly.net	151.101.0.84	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
protect2.fireeye.com	162.159.246.125	true	false	high
d3d564pv0p4759.cloudfront.net	18.164.116.92	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
resc.cloudinary.com.cdn.cloudflare.net	104.17.202.1	true	false	high
e1315.dsca.akamaiedge.net	23.56.162.51	true	false	high
www.google.com	142.250.80.100	true	false	high
hyj48i39.s3.us-east-1.amazonaws.com	unknown	unknown	true	unknown
res.cloudinary.com	unknown	unknown	false	high
cdn-icons-png.flaticon.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
images.ctfassets.net	unknown	unknown	false	high
5726893377-1317754460.cos.ap-seoul.myqcloud.com	unknown	unknown	false	unknown
cdn.hellosign.com	unknown	unknown	false	high
i.pinimg.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1414348410:1742472878:yecUZmDbN8up8L1looyXyvk3UZZiWClMcjK2TzNEz6M/92358b47afc40f63/FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMr	false		high
https://cdn.hellosign.com/5be974e/build/a6d09f4028ea300af1bd.ttf	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=92358b47afc40f63&lang=auto	false		high
https://cdn-icons-png.flaticon.com/512/847/847969.png	false		high
https://images.ctfassets.net/3fcisxc3a6xz/docusign_logo_black_text_on_white_0.png/90872cd475f92acafc7c490c93976e40/ds-logo-on-white.png	false		high
https://cdn.hellosign.com/5be974e/build/signer.css	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false		high
https://office.endangered.it.com/8kfUZ	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=LmCAFtXM6vi%2BN3AqpAe0isy09cO%2FgWoYYwdBgVmsl9Tb0EaHxtTDatkwosc0YbAYQC%2FXOULKJIruXDeAOuIOUEaXV1xYQ2U0RzgXgjpllSwyAutGUH1GlAq%2BCn4a4OrR0E%2BhqJ6tHYlYQ2I%3D	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/b/708f7a809116/api.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/92358b47afc40f63/1742477217522/f66b3bf5b729985606b08bc1e8cd061b00221200606694c1867f2177f0d465a9/Ev6mBFcA9R_K-Lr	false		high
https://office.endangered.it.com/8kfUZ/#75bdqy@dnsim.net	true		unknown
https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html	true		unknown
https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html	false		high
https://i.pinimg.com/736x/d1/3e/64/d13e649549d58b162cf918118d9ed562.jpg	false		high
https://5726893377-1317754460.cos.ap-seoul.myqcloud.com/bootstrap.min.js	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/92358b47afc40f63/1742477217518/MVkB8_5L5hzmSA_	false		high
https://kvri.endangered.it.com/google.php	false	Avira URL Cloud: safe	unknown
https://office.endangered.it.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://res.cloudinary.com/dxetjqzbe/image/upload/v1742052868/6059C6BA-9C9F-4199-8218-8895A9F0C3C8_ctielh.png	false		high
https://meta-q.cdn.bubble.io/f1718227932057x822365466237625200/DOCU-60cafc67.png	false		high
https://mailmeteor.com/logos/assets/PNG/Microsoft_Logo_512px.png	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false		high
https://office.endangered.it.com/8kfUZ/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.ascendercorp.com/0	chromecache_142.3.dr	false		high
https://images.ctfassets.net/3fcisxc3a6xz/docusign_logo_black_text_on_white_0.png/90872cd475f92acafc	chromecache_118.3.dr	false		high
http://www.ascendercorp.com/eula10.html	chromecache_142.3.dr	false		high
https://github.com/google/material-design-icons	chromecache_124.3.dr	false		high
https://twitter.com/benjsperry	chromecache_124.3.dr	false		high
http://www.ascendercorp.com/http://ascendercorp.com/eula10.htmlNormaaliNorm	chromecache_142.3.dr	false		high
http://ionicons.com/	chromecache_124.3.dr	false	Avira URL Cloud: safe	unknown
https://getbootstrap.com/)	chromecache_148.3.dr	false		high
https://github.com/driftyco/ionicons	chromecache_124.3.dr	false		high
https://twitter.com/ionicframework	chromecache_124.3.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_148.3.dr, chromecache_132.3.dr	false		high
https://getbootstrap.com)	chromecache_132.3.dr	false		high
http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlThis	chromecache_142.3.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_148.3.dr, chromecache_132.3.dr	false		high
http://www.ascendercorp.com/eula10.htmlNormaloby	chromecache_142.3.dr	false		high
http://opensource.org/licenses/MIT).	chromecache_128.3.dr	false		high
http://creativecommons.org/licenses/by/4.0/	chromecache_124.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.0.84	dualstack.pinterest.map.fastly.net	United States	54113	FASTLYUS	false
104.17.124.183	meta-q.cdn.bubble.io	United States	13335	CLOUDFLARENETUS	false
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
172.67.187.19	mailmeteor.com	United States	13335	CLOUDFLARENETUS	false
108.138.106.75	unknown	United States	16509	AMAZON-02US	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
23.56.162.51	e1315.dsca.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
23.40.179.19	a1990.dscd.akamai.net	United States	16625	AKAMAI-ASUS	false
162.159.246.125	protect2.fireeye.com	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
119.28.146.206	cos.ap-seoul.myqcloud.com	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
23.209.72.31	unknown	United States	20940	AKAMAI-ASN1EU	false
104.21.92.58	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.151.202	kvri.endangered.it.com	United States	13335	CLOUDFLARENETUS	true
23.209.72.9	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
142.250.80.100	www.google.com	United States	15169	GOOGLEUS	false
16.182.97.178	s3-r-w.us-east-1.amazonaws.com	United States	unknown	unknown	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
108.138.106.48	d3orhvfyxudxxq.cloudfront.net	United States	16509	AMAZON-02US	false
23.40.179.76	unknown	United States	16625	AKAMAI-ASUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
104.17.123.183	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.202.1	resc.cloudinary.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
18.164.116.92	d3d564pv0p4759.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1644348
Start date and time:	2025-03-20 14:25:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@29/60@60/26

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, BackgroundTransferHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.35.163, 142.251.40.142, 142.250.65.174, 192.178.155.84, 142.250.80.78, 142.250.65.238, 142.250.65.234, 142.251.40.106, 142.250.65.202, 142.251.40.234, 142.251.41.10, 142.250.65.170, 142.250.80.74, 142.250.80.106, 142.250.80.10, 142.250.176.202, 142.251.32.106, 142.250.81.234, 142.251.40.202, 142.250.80.42, 142.251.35.170, 172.217.165.138, 199.232.214.172, 142.250.64.110, 142.251.40.110, 142.250.64.74, 142.251.40.170, 142.250.72.106, 142.250.64.106, 142.250.64.99, 142.251.32.110, 34.104.35.123, 142.251.41.14, 142.250.81.227, 184.31.69.3, 52.149.20.212, 23.101.168.44, 150.171.28.10, 23.57.90.139, 13.107.246.40, 13.107.246.38
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, g.bing.com, aadcdn.msauth.net, arc.msn.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, clients2.google.com, redirector.gvt1.com, edgedl.me.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17531
Entropy (8bit):	7.8782997758684346
Encrypted:	false
SSDEEP:	384:KQhjZSW7lNcDQYxNTlJ6lS3y6dMNw1DDK9LbqpzS3lSx:7SW7ZYhJ6lSC6dMsDDdpzS34x
MD5:	5405D77C51FB46A0CBF26CB96FE4DA4D
SHA1:	32454DFA1AF07952738C877992EFF9D975C36B94
SHA-256:	A0F8CE7A5D5970E38741BAE9BAB7008CE3667987B8F0CF07A902DD9A25F9D0CB
SHA-512:	E1624D12C8C12B1F2A366FA0122C84043D01F3323F9769BAF3DD34A31D6A76BA0328D8F6D96E1EDD24A85E1AD9CE621A3707F250937FDE7EC98291141429DE23
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............x......sBIT....\|.d.....pHYs...F...F.hS .....tEXtSoftware.www.inkscape.org..<... .IDATx...w.dy]..w.....z.&.......!("\.%...k...I?....CP..%.@...J.`.z..E$..{..d........].}.OW....jvgf;VW.........Uof......B.VK...3.R..HJJH.w~..%."...y3..H...a..~.=.....`.cg..K:(.+~.......]+..`N.YIg.....JW........#..%.......H..Ig\S..n......J7.e.\|.......LK.E...o.t\.....%I?.tG...$.a..FS.>A..lQg....(...n...dVW4...w.8.....`....A.c$=V.%...5...K.[..$}Y.W.T...H.....Wp.LT...@.......=s...NC .T.n6...4..4......r......../EI......T:k6.`.....3+..%=E.OIz..;.?..%._%}F.7Yu. ....9vf..'.].$i.l"......\|.J...........y...j....tBR.h(xMK.w.n..U.W.?...../8vfB..$=U..$..M...J...OJ...J....l...<.3cj.._V{.?n6...*..Q.'.T:g8.....x.cg..~V...ICf.!..jO .GI.l....y.M....uN..i....ezp...O.....'"..h..J..zO..lI?'i.l"`K.>%..>..B....\.3.$....}...u.%._._[..E.a..h.`.cg"j..P........h.=_.>m....y.p4.0.3.....<I{....iF..$..J....`...@9v&&..%.H...l. k....{$}.J.k.. @h.0........~S.N.q.7...NI

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 14:26:25.115446091 CET	53	53266	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:25.305434942 CET	53	64454	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:26.009804964 CET	53	55659	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:29.584712982 CET	55704	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:29.584712982 CET	58331	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:29.686369896 CET	53	58331	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:29.688122034 CET	53	55704	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:30.767250061 CET	52474	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:30.790421009 CET	55802	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:30.893990040 CET	53	52474	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:30.894701958 CET	53	55802	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:32.217385054 CET	63828	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:32.217385054 CET	59584	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:32.323493004 CET	53	63828	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:32.360352993 CET	53	59584	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:32.936518908 CET	57269	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:32.936757088 CET	58725	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:32.937091112 CET	50564	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:32.937233925 CET	50657	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:32.937580109 CET	65015	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:32.937838078 CET	64687	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:32.938183069 CET	50864	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:32.938306093 CET	62077	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:33.036983013 CET	53	58725	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.039726019 CET	53	62077	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.041627884 CET	53	50564	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.041646004 CET	53	50657	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.041661978 CET	53	50864	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.041680098 CET	53	64687	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.043314934 CET	53	65015	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.069890022 CET	53	57269	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.454866886 CET	63810	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:33.454866886 CET	60445	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:33.456682920 CET	49968	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:33.456682920 CET	54948	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:33.556615114 CET	53	63810	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.559103012 CET	53	60445	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.561671972 CET	53	49968	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:33.564865112 CET	53	54948	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:34.358814001 CET	53	54620	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:35.352576971 CET	58083	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:35.352947950 CET	57248	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:35.455434084 CET	53	58083	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:35.457878113 CET	53	57248	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:35.965498924 CET	57265	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:35.965609074 CET	54555	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:36.068928957 CET	53	54555	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:36.072166920 CET	53	57265	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:42.923686028 CET	53	49407	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:51.951628923 CET	59570	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:51.951628923 CET	64496	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:52.061584949 CET	53	59570	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:52.091384888 CET	53	64496	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:53.453490019 CET	60880	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:53.453490019 CET	54948	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:53.454161882 CET	62993	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:53.455151081 CET	58227	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:53.551892042 CET	53	60880	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:53.551923037 CET	53	54948	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:53.554399014 CET	53	58227	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:53.562058926 CET	53	62993	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:54.050780058 CET	58743	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:54.051130056 CET	49660	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:54.152662039 CET	53	58743	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:54.157366037 CET	53	49660	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:55.471029043 CET	50073	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:55.471029043 CET	57121	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:55.569181919 CET	53	50073	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:55.570133924 CET	53	57121	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:56.580396891 CET	58710	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:56.580658913 CET	62896	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:56.682331085 CET	53	58710	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:56.685338020 CET	53	62896	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:57.767748117 CET	61747	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:57.767983913 CET	54442	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:26:57.865089893 CET	53	61747	1.1.1.1	192.168.2.5
Mar 20, 2025 14:26:57.866581917 CET	53	54442	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:01.847748995 CET	53	56947	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:06.571017027 CET	50402	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:06.571151018 CET	52460	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:06.680211067 CET	53	50402	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:06.684493065 CET	53	52460	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:07.628700018 CET	55622	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:07.628887892 CET	62401	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:07.629623890 CET	60535	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:07.629935980 CET	61031	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:07.630348921 CET	59528	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:07.630497932 CET	59022	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:07.631823063 CET	61677	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:07.631968021 CET	60999	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:07.632467985 CET	61523	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:07.632637024 CET	58368	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:07.728666067 CET	53	62401	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:07.728692055 CET	53	61031	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:07.729151011 CET	53	60535	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:07.729510069 CET	53	55622	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:07.730142117 CET	53	59528	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:07.731394053 CET	53	57581	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:07.731410980 CET	53	59022	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:07.732491970 CET	53	61677	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:07.733556032 CET	53	60999	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:07.975791931 CET	53	58368	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:08.336833000 CET	53	61523	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:11.440833092 CET	63298	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:11.440913916 CET	52715	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:11.448528051 CET	53692	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:11.448528051 CET	62362	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:11.544241905 CET	53	52715	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:11.550767899 CET	53	53692	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:11.551881075 CET	53	62362	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:11.553200960 CET	53	63298	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:12.123958111 CET	53916	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:12.124231100 CET	57723	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:12.222700119 CET	53	53916	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:12.223279953 CET	53	57723	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:16.337788105 CET	63660	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:16.337934017 CET	50356	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:16.443170071 CET	53	63660	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:16.448992968 CET	53	50356	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:19.370642900 CET	64482	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:19.370913029 CET	49386	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:19.468667984 CET	53	49386	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:19.470387936 CET	53	64482	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:19.570274115 CET	53	60466	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:20.072050095 CET	49819	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:20.072196960 CET	61026	53	192.168.2.5	1.1.1.1
Mar 20, 2025 14:27:20.172831059 CET	53	61026	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:20.173316002 CET	53	49819	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:22.947196007 CET	138	138	192.168.2.5	192.168.2.255
Mar 20, 2025 14:27:24.660404921 CET	53	62308	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:24.985548019 CET	53	58428	1.1.1.1	192.168.2.5
Mar 20, 2025 14:27:28.061091900 CET	53	60731	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 20, 2025 14:26:52.093368053 CET	192.168.2.5	1.1.1.1	c283	(Port unreachable)	Destination Unreachable
Mar 20, 2025 14:27:19.542068005 CET	192.168.2.5	1.1.1.1	c2dd	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:31 UTC	848	OUT	GET /v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html HTTP/1.1 Host: protect2.fireeye.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:32 UTC	309	IN	HTTP/1.1 302 Found Date: Thu, 20 Mar 2025 13:26:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close location: https://hyj48i39.s3.us-east-1.amazonaws.com/docnwhdheb.html x-fireeye-faude: Benign cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 92358aad9e2dc3eb-EWR

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:32 UTC	700	OUT	GET /docnwhdheb.html HTTP/1.1 Host: hyj48i39.s3.us-east-1.amazonaws.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:32 UTC	466	IN	HTTP/1.1 200 OK x-amz-id-2: pxXNtbW7MDL6OChCyXLz91zdvyqV23biBXnhSg/wCg6dm319JXxJB76pCmjbEJiyamTyu/Vi7fU= x-amz-request-id: 4B27XA6P3YWCHY9M Date: Thu, 20 Mar 2025 13:26:33 GMT Last-Modified: Wed, 19 Mar 2025 20:14:28 GMT ETag: "4835dedd4311f7790b2952406cb59091" x-amz-server-side-encryption: AES256 x-amz-version-id: 2TCgbbOFR2LFkleGYJ9QLhiTwN1kjkE3 Accept-Ranges: bytes Content-Type: text/html Content-Length: 8919 Server: AmazonS3 Connection: close
2025-03-20 13:26:32 UTC	8919	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 0d 0a 20 20 20 20 20 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0d 0a 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 0d 0a 20 20 20 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 44 30 43 55 53 49 47 4e 3c 2f 74 69 74 6c 65 3e 0d Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, maximum-scale=1, user-scalable=no" /> <title>D0CUSIGN</title>

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:33 UTC	785	OUT	GET /736x/d1/3e/64/d13e649549d58b162cf918118d9ed562.jpg HTTP/1.1 Host: i.pinimg.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://hyj48i39.s3.us-east-1.amazonaws.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:33 UTC	292	IN	HTTP/1.1 200 OK Connection: close Content-Length: 122606 ETag: "ef69419ac82f56c51b3b39522de73409" Content-Type: image/jpeg Cache-Control: max-age=31536000, immutable Accept-Ranges: bytes Vary: Origin X-CDN: fastly alt-svc: h3=":443";ma=604800 date: Thu, 20 Mar 2025 13:26:33 GMT
2025-03-20 13:26:33 UTC	1378	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 ff c2 00 11 08 03 b8 02 e0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1b 00 01 00 03 01 01 01 01 00 00 00 00 00 00 00 00 00 00 04 05 06 03 02 01 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 01 fd 50 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: JFIF,,C%# , #&')*)-0-(0%()(C((((((((((((((((((((((((((((((((((((((((((((((((((("P
2025-03-20 13:26:33 UTC	1378	IN	Data Raw: 00 00 1c b2 da e8 a6 52 4d bf 53 3d de e7 e1 06 3d d7 92 af 41 07 b9 97 9d 77 c0 b0 ce e8 63 95 55 d7 b2 4c 6d a6 83 d9 47 06 f2 71 87 99 a7 15 54 fa ce 45 5f 49 dd 4a 0f 37 fc 4c f5 c5 8f 33 8d 7e 83 81 45 de db e1 47 d2 eb c9 53 e6 e3 d9 c2 be f2 21 e3 3d b0 8c 52 de 71 b2 32 b5 9b 3f 25 5d 56 9b a9 9a a8 de 79 28 3c 68 ba 99 16 a7 89 49 07 6b c8 87 f2 de 31 2d e3 d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 7a 73 f4 7a 78 f0 76 79 f8 7b 78 1e dc fd 9f 5e 3c 9d 5e 7c 1d 5e 3e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac b3 84 7e 71 fa 4d 0f 72 0c 3b 01 6b 94 bc f8 45 b8 ad fa 54 e8 6b fb 9f 69 6e 63 9a 0c ad af 02 3f 39 9e 4d 04 ea 7b 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: RMS==AwcULmGqTE_IJ7L3~EGS!=Rq2?%]Vy(<hIk1-zszxvy{x^<^\|^>~qMr;kETkinc?9M{
2025-03-20 13:26:33 UTC	1378	IN	Data Raw: 49 00 00 00 00 00 00 00 00 00 00 03 e5 45 96 54 bd eb 59 c4 b8 55 79 2d f9 52 48 2d fe d4 7a 2d a2 55 7a 34 9c 2b b8 96 9e aa 6b 4d 5f aa 4f 06 9f d4 39 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c fa 0f 9f 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 1e 2c ea 49 35 77 31 0b 68 9d fd 94 52 bd 75 20 46 b1 8a 7a f7 db a9 c2 0d c5 71 e6 ca 0c f2 65 7c ba f2 c7 d4 38 e4 f8 f1 be 96 1d ab bb 92 79 c6 8c 4e e9 53 e8 93 22 a6 41 63 1b 87 82 cf d5 5f 62 7c 3e 52 c8 56 35 bc cb 7e 7e ea 8b 0f b0 3e 97 3d 29 a5 1d 39 73 86 48 f7 57 28 b1 57 7b 2c 25 67 ae 0e 51 e1 f2 34 d0 fd 40 2c 79 41 f0 59 a8 ef 8b 10 00 00 00 00 00 00 00 00 00 23 7c a3 2f 54 9e 4b cf 79 6e Data Ascii: IETYUy-RH-z-Uz4+kM_O9\|@,I5w1hRu Fzqe\|8yNS"Ac_b\|>RV5~~>=)9sHW(W{,%gQ4@,yAY#\|/TKyn
2025-03-20 13:26:33 UTC	1378	IN	Data Raw: f2 e4 78 f9 79 f4 a7 e7 78 28 ec a5 0a 9f 37 02 86 7c f1 49 ea e4 41 ac d0 88 35 1a 51 47 0f 50 29 bc dd 8a bf 36 c2 bf 95 a8 a4 f9 78 2a e3 de 0c ff 00 2d 28 ac 8d 78 33 d6 53 c6 77 e6 8c 51 7a bb 00 00 00 00 00 00 00 00 00 00 01 97 91 a0 14 d1 f4 23 39 55 b8 14 13 2c c6 6e 36 b4 54 c1 d2 0a 1e 1a 51 9a b6 9e 31 93 f4 83 29 db 4a 28 97 a3 37 22 f0 67 78 ea 04 59 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 e6 9c ba 00 06 73 c1 a6 53 59 9d 94 de 8b 75 4f d2 d5 5b d0 9c aa 98 49 53 8b 85 2f 72 cd 49 e0 be 54 4d 25 23 41 2d d4 5d 0b 95 40 b7 47 80 5b a9 fe 17 28 70 0b b5 07 c3 40 a1 90 5b 28 3a 17 6c bc 92 fd 4d e8 b7 64 6e 0b 65 0f 52 e5 5d c8 b6 53 cd 25 b3 d3 8b 35 2c e2 63 37 3c b5 42 af 2f 55 1d 8b 16 76 49 72 a9 b6 00 00 00 00 Data Ascii: xyx(7\|IA5QGP)6x*-(x3SwQz#9U,n6TQ1)J(7"gxY@sSYuO[IS/rITM%#A-]@G[(p@[(:lMdneR]S%5,c7<B/UvIr
2025-03-20 13:26:33 UTC	1378	IN	Data Raw: 82 41 8e d7 7a f6 65 f8 ea 22 14 5d f4 5f 0c e7 1d 57 22 1d 7e 87 e1 8e b0 d0 7d 33 5c b5 7d 0c 65 86 8b c1 8e 91 a2 8c 57 59 4d ea 65 21 ec fe 15 95 ba 9e 65 0f 2d 37 23 1d 79 63 24 a9 a8 d7 f3 2b eb f4 9e 4c 9f 6b 89 c6 42 6e 8b e1 8f ef a7 f6 62 6c f4 51 8e 34 fa ce 26 66 1e c7 e9 59 77 cf a0 00 00 00 00 00 00 00 00 00 00 00 01 47 0e de 29 0a b6 fe 59 1e 9a f7 d9 98 d4 7a f6 50 2e 7a 11 e0 5f c5 33 76 d3 b9 95 be 2e bc 94 5a 0f 13 0c 5f 3d af 03 ce 73 49 e0 8f 06 e3 b1 98 93 a0 8e 53 f0 d1 c5 3a 67 b5 1c ca 8e 37 3e 8a 2b 19 1d 4a de d3 24 99 a9 96 5d 4c dc db 5f 25 4e 8e 0f 43 33 d2 e3 c9 5f da c6 31 5d 77 5d 30 55 68 39 90 ab 74 55 e5 5c b9 9d 8e 55 d7 9c ce 54 da 6a b2 0c a9 32 ca 58 f7 fc 8f b5 3a 28 a7 cb 0e 7d 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Aze"]_W"~}3\}eWYMe!e-7#yc$+LkBnblQ4&fYwG)YzP.z_3v.Z_=sIS:g7>+J$]L_%NC3_1]w]0Uh9tU\UTj2X:(}
2025-03-20 13:26:33 UTC	1378	IN	Data Raw: 7b 3a b6 b4 ee ea 4d ce ae 16 95 8a ea 9e be 49 19 ab b1 18 0b 7a f0 43 7d 8e 97 37 21 fc 6b 04 ea 89 cc df 49 ba 3b 03 fe 93 2f 41 5e 85 65 87 25 24 f1 8d fe 55 48 d0 68 c2 cf 13 92 e6 75 59 2b 72 9a 7f a7 70 be b2 91 2c ea df ea a7 ae 68 5a 8e bd b9 d6 c0 06 b8 ff 00 8f f3 9c f9 ce 55 6e 4f c4 d5 8d 67 33 73 79 f3 9f 34 56 08 7b eb 04 d3 f3 9c f9 cf 8f 9c e4 f4 63 8d b6 02 f7 e7 3e 38 c2 fa 87 3e 78 9a d6 fe 7c fe 9f 39 c6 d3 82 ff 00 9f d3 e7 3e 26 7e 3f 01 80 61 cf 9c f8 22 c0 15 d2 0c a3 e7 fa d5 4e 4f c5 d3 87 59 54 0b af 2d fb 2b 2c d3 d5 d8 b2 af dd ce 6d a3 f0 cb c1 60 9b 05 8d 5d a2 63 f3 f3 9f 3f d0 8b ea 29 a0 19 20 52 25 4f 2a a7 c0 cd b7 45 f4 d0 13 8e d9 80 73 f6 00 dd 67 64 20 b1 a8 7c fb 4a f2 cf ec 0f cf 94 4d 03 44 1b 35 5b 1b e6 a0 f6 Data Ascii: {:MIzC}7!kI;/A^e%$UHhuY+rp,hZUnOg3sy4V{c>8>x\|9>&~?a"NOYT-+,m`]c?) R%O*Esgd \|JMD5[
2025-03-20 13:26:33 UTC	1378	IN	Data Raw: 3d cf 6a af b2 f7 49 62 bd 2e cb ad 01 0e c3 37 37 3b 25 e0 38 e5 0f 76 84 10 56 d0 73 5b 2b be b6 5b 30 51 c7 d4 25 d8 89 30 60 93 fc 84 e2 f2 55 3d cc 96 46 d3 5a 89 74 d0 6c 45 4d f9 2e c9 be 9d 9a 78 df 61 fa e8 1c e7 e7 bc fc da 8a 83 e2 28 6e 8a eb ad 99 ef bb c4 8f b6 f6 cf b1 a8 7a 1c 7e e6 da df 62 0a 76 80 d3 73 5c ab 9e d0 20 f6 65 aa 75 85 fd 8e 78 f8 09 f8 e7 52 83 d5 29 e4 1d 8d 7f 19 47 77 3a f2 3e ce 5c 0e 31 83 65 f0 a7 e4 5a 25 35 55 25 1b d0 6c 08 31 2d f0 5f fd 8c 27 50 37 3a f9 70 4e 34 1f 06 29 c4 b6 19 b7 83 22 47 85 1c e4 b3 86 73 15 a0 16 e5 a1 6b 6e c4 8d 21 1c 01 c4 2f 19 90 cd 8e 54 eb 56 02 40 01 6b 15 03 61 99 cd 25 89 10 ce a1 62 e7 52 c9 88 13 67 a7 3f 06 19 c4 76 54 6d 03 1a 07 77 af 97 47 d5 4f 3d 29 fc 89 50 24 76 44 6a Data Ascii: =jIb.77;%8vVs[+[0Q%0`U=FZtlEM.xa(nz~bvs\ euxR)Gw:>\1eZ%5U%l1-_'P7:pN4)"Gskn!/TV@ka%bRg?vTmwGO=)P$vDj
2025-03-20 13:26:33 UTC	1378	IN	Data Raw: 50 ce 5c fc 7c bc 28 d0 5c 18 d0 2d 4c 68 49 b2 34 33 99 1a 31 db 0c fa 92 8e 72 d5 24 17 fc 82 df 81 de cb e0 02 ef b3 3a e2 33 eb 62 b9 b9 34 b4 e5 38 57 e8 95 55 38 b1 35 7c 6a bb 12 62 db d9 90 67 b5 bb b2 d7 af 3a 7b 0d 49 e5 85 f3 b7 fb 13 22 ed f5 de dd 57 3d cc de b7 2f 2f bf e4 74 b6 07 9b d7 0d c4 b5 9f 65 a2 bd b8 f3 46 fc dc eb cd cc ca 9f a8 c6 76 9f 50 b2 92 3f ef ed 0c 6a bf 18 bf ae c0 bd 64 f3 8a 12 33 64 cb 85 1e 05 14 2a 20 d8 84 b0 23 10 6f e3 d7 8a 6f 5e b6 70 22 00 74 92 0c d8 e8 16 dd 64 0b 36 0f 58 a1 e0 75 eb 59 51 38 b8 db 2f 8f a9 c8 05 8a 5c 0b 5b 67 40 a3 83 d7 ab 33 f1 c1 e0 38 c4 a8 08 94 1c 19 3c 6b a6 51 79 fe 31 5e 22 eb d7 a5 ff 00 3e 76 3a 33 5b d6 6e b4 7e e7 9d 4e 8f fd 52 cf 85 39 9f 7f c3 a3 ea 9d eb 68 2f 6e 6f 94 Data Ascii: P\\|(\-LhI431r$:3b48WU85\|jbg:{I"W=//teFvP?jd3d* #oo^p"td6XuYQ8/\[g@38<kQy1^">v:3[n~NR9h/no
2025-03-20 13:26:33 UTC	1378	IN	Data Raw: 56 76 9a d0 c7 b6 7a 24 ec 9c c0 17 e8 71 ef 5a 33 f2 13 7d 7d b4 fd 97 7c cc dd be 7c e6 76 29 e1 d0 b0 e3 5a 0a c2 be 6c 1b ee c4 c7 fd ba 85 63 91 f8 86 6a 81 05 9d 6e 75 0c 1c 67 50 d3 54 e9 d5 ce be 9d fa 4e 82 97 75 aa 84 bd b2 ea d9 f8 c7 f5 8e 31 0e b4 c6 d5 40 52 f2 64 1e f4 ac eb da 4b b1 06 e4 14 2d de 43 23 27 db a4 7d 06 50 37 52 e9 1e c0 64 84 ce ba a8 58 f1 bd 05 4c 6c 89 c7 c9 64 62 5a f4 37 6e 64 f4 35 d3 4c e9 33 d7 76 5c a4 37 ef 34 6c 91 79 d6 7f 94 e7 63 a8 9b ad 64 eb ba 52 a7 9d bf ce 08 c4 cc a8 61 21 08 64 db 3a ed 89 e7 33 43 10 f9 54 e9 fa ea d6 d6 62 7a e7 2c 7f 1a fc 9f 3f f1 ff 00 35 d2 e6 2a f8 2a 6d 53 fe 40 c7 af 3a 58 37 be b3 59 b2 ca 33 ae 95 bf 63 82 a3 73 a2 a9 8d a3 7f ae 75 0e 65 1d 70 5c fe 57 ec a1 11 38 9d c5 5a Data Ascii: Vvz$qZ3}}\|\|v)ZlcjnugPTNu1@RdK-C#'}P7RdXLldbZ7nd5L3v\74lycdRa!d:3CTbz,?5**mS@:X7Y3csuep\W8Z
2025-03-20 13:26:33 UTC	1378	IN	Data Raw: 46 dd e8 eb 91 cf d2 95 db a1 1b 70 27 1f 5f ae 42 36 89 a9 91 d4 35 92 bf de 81 4c 52 0e 2a 98 87 4a fd ab af 53 17 c0 91 8b d2 8e 92 55 12 bc a8 d9 2a 66 d1 0b 5a 9c 99 9e d5 4b 76 54 d8 9b f5 38 dd e4 64 6f f1 36 5a 75 6a 99 a2 f1 92 81 8d 72 51 89 c8 5f e0 38 dd e4 b5 24 c7 e4 4d de 1a 29 6c 9e b1 fd fd 03 fa 6c cf 20 81 6c 5e ae 43 11 ea 95 81 8d 99 9b 63 23 a9 da e5 3e 84 c2 a3 51 42 83 7c 5b 1d 24 06 ac 1a 23 f2 a2 1b 96 6c d0 89 df 5e b5 06 bf e3 fc f2 87 e2 78 16 6b 0b 8b 3d 20 e7 cf eb 94 e1 53 c6 50 21 47 db 7c b4 50 29 fd 7e 79 43 f1 1b f3 9f 1c a1 e2 81 f9 fd 4e 81 0a 3e 7f 40 05 af 87 40 85 3f 3c 45 02 d2 f9 e5 74 0c c9 e4 94 e5 3c db d6 27 ed 17 26 b7 d8 52 6e 07 73 de cd e6 d6 3e 43 ec 56 2a 45 22 d6 fe 9e 71 f6 ce bf ad 65 d9 2f 01 f6 f8 Data Ascii: Fp'_B65LRJSUfZKvT8do6ZujrQ_8$M)ll l^Cc#>QB\|[$#l^xk= SP!G\|P)~yCN>@@?<Et<'&Rns>CV*E"qe/

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:33 UTC	746	OUT	GET /3fcisxc3a6xz/docusign_logo_black_text_on_white_0.png/90872cd475f92acafc7c490c93976e40/ds-logo-on-white.png HTTP/1.1 Host: images.ctfassets.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://hyj48i39.s3.us-east-1.amazonaws.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:33 UTC	538	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 11460 Connection: close Last-Modified: Mon, 10 Jun 2024 21:10:48 GMT Server: Contentful Images API Access-Control-Allow-Origin: * Date: Wed, 19 Mar 2025 14:03:39 GMT Cache-Control: max-age=31536000 ETag: "a74f925f8c71704166ffa3433e9b96d5" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 134f499632d1e15750219cb766bdc50c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P3 X-Amz-Cf-Id: OkMXVf2LpOaYuWIDX6OSN1q2DwYaDxJZqVyGHw9fvhUXI0nRs-gZ7Q== Age: 84175
2025-03-20 13:26:33 UTC	11460	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 53 00 00 01 87 08 06 00 00 00 7c b3 1d 0f 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 2c 59 49 44 41 54 78 01 ed dd 3f ac 5d c7 7d 27 f0 51 60 17 2b 03 6b aa b0 5a 92 59 60 1b 05 10 d5 38 5b 85 62 17 20 09 48 35 76 49 31 75 00 8a 4d 02 6c 61 92 ee 12 04 20 09 18 70 b1 08 28 36 09 e2 86 e4 22 ed 82 62 1a 23 49 41 09 1b 63 bb 50 5a 6c b1 31 10 50 2a ac 2d 52 78 f9 bd ca 38 4f f4 e3 e3 9b 7b e6 fc 7d 9f 0f f0 fc 28 99 7a f7 be 39 73 ce 3d f3 3d bf 99 79 ed 97 cf 15 00 00 00 00 8e e5 37 0a 00 00 00 00 c7 26 4c 01 00 00 00 68 20 4c 01 00 00 00 68 20 4c 01 00 00 00 68 20 4c 01 00 00 00 68 20 4c Data Ascii: PNGIHDRS\|pHYssRGBgAMAa,YIDATx?]}'Q`+kZY`8[b H5vI1uMla p(6"b#IAcPZl1P*-Rx8O{}(z9s==y7&Lh Lh Lh Lh L

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:33 UTC	664	OUT	GET /512/847/847969.png HTTP/1.1 Host: cdn-icons-png.flaticon.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://hyj48i39.s3.us-east-1.amazonaws.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:33 UTC	694	IN	HTTP/1.1 200 OK Last-Modified: Thu, 14 Oct 2021 22:11:26 GMT ETag: "5405d77c51fb46a0cbf26cb96fe4da4d" x-goog-generation: 1634249486697380 x-goog-metageneration: 1 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 17531 x-amz-meta-goog-reserved-file-mtime: 1525850581 x-amz-meta-x-goog-reserved-source-generation: 1627252422068116 Content-Type: image/png x-amz-checksum-crc32c: B8eOgw== Accept-Ranges: bytes Content-Length: 17531 Expires: Thu, 20 Mar 2025 13:26:33 GMT Date: Thu, 20 Mar 2025 13:26:33 GMT Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Pragma: public Cache-Control: public, max-age=31536000 X-default-rule: YES
2025-03-20 13:26:33 UTC	939	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 06 00 00 00 f4 78 d4 fa 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0f 46 00 00 0f 46 01 68 53 20 82 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 20 00 49 44 41 54 78 9c ed dd 77 9c 64 79 5d ff fb 77 e5 ee ae 0e a7 bb 7a a6 26 b3 b3 bb b3 93 d8 dd 21 28 22 5c 05 25 88 01 81 6b 84 9f 04 49 3f 14 af 8b f2 43 50 bc e0 25 fc 40 91 a0 02 4a 90 60 b8 7a e5 12 45 24 88 f8 7b 90 05 64 17 d8 dd d9 d9 d9 c9 dd 5d dd 7d ba 4f 57 ce f5 fb a3 6a 76 67 66 3b 56 57 d5 f7 84 d7 f3 f1 98 c7 cc b0 d3 55 6f 66 fa 9c cf a7 be e7 1b 42 ad 56 4b 00 dc cd b1 33 c3 92 52 1b fc 48 4a 4a 48 8a 77 7e de Data Ascii: PNGIHDRxsBIT\|dpHYsFFhS tEXtSoftwarewww.inkscape.org< IDATxwdy]wz&!("\%kI?CP%@J`zE${d]}OWjvgf;VWUofBVK3RHJJHw~
2025-03-20 13:26:33 UTC	16384	IN	Data Raw: 60 a2 01 c0 40 39 76 26 26 e9 e7 25 bd 48 ed f5 fa 6c d0 83 20 6b a9 bd bf c0 7b 24 7d c2 4a a5 6b 86 f3 20 40 68 00 30 10 8e 9d 99 96 f4 1b 92 7e 53 d2 4e c3 71 00 37 9a 97 f4 4e 49 ef b2 52 e9 45 d3 61 e0 7f 34 00 e8 2b c7 ce 1c 92 f4 3b 92 9e 23 69 d8 70 1c c0 0b 4a 92 3e 24 e9 ad 56 2a 7d ca 74 18 f8 17 0d 00 fa c2 b1 33 8f 95 f4 bb 6a ef d4 c7 69 7b c0 d6 35 d5 de 7a f8 4f ad 54 fa cb a6 c3 c0 7f 68 00 d0 33 9d d9 fc 4f 97 f4 72 49 8f 32 1c 07 f0 93 6f 48 7a 8b a4 8f b1 7a 00 bd 42 03 80 6d eb 6c cf fb eb 92 6e 93 74 bd e1 38 80 9f 9d 91 f4 36 b5 f7 14 60 db 61 6c 0b 0d 00 ba e6 d8 99 71 b5 8b fe 6d 92 26 0d c7 01 82 64 59 d2 db 25 bd dd 4a a5 b3 a6 c3 c0 9b 68 00 b0 65 9d 4f fc 2f 95 f4 0a 49 53 86 e3 00 41 b6 24 e9 8f 25 fd 05 23 02 d8 2a 1a 00 6c Data Ascii: `@9v&&%Hl k{$}Jk @h0~SNq7NIREa4+;#ipJ>$V}t3ji{5zOTh3OrI2oHzzBmlnt86`alqm&dY%JheO/ISA$%#l
2025-03-20 13:26:33 UTC	208	IN	Data Raw: 56 24 12 a9 47 22 91 4a 38 1c 29 86 c3 e1 95 50 28 34 17 0e 87 ee 0b 87 23 df 0f 87 c3 ff 99 48 0c 7d f3 c0 c1 43 25 d3 59 81 a0 a2 01 00 3c 60 31 73 69 24 9b 5d b9 b1 d1 68 dc d0 6c 36 af 6b b5 9a fb 9a cd d6 ae 56 ab b5 b3 d5 6a 4e b5 5a ad b1 56 4b 09 a9 15 6b b5 5a d1 56 4b d1 56 ab 15 69 b5 5a 11 a9 15 69 b5 5a e1 2b 7e 84 5a ad 56 a8 d9 6c 5f fb e1 70 48 a1 50 a8 d5 f9 d1 bc fc 43 0a 35 42 a1 cb 3f 54 0f 85 42 75 29 54 0b 85 54 09 85 42 b9 50 28 bc 14 0a 85 e6 c3 e1 d0 5c 28 14 be 18 0e 87 ce 45 22 d1 d3 23 23 c9 7b 77 ed 7d 48 c1 f0 5f 19 80 0d fc 6f 0f 70 95 74 c3 64 25 dd 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: V$G"J8)P(4#H}C%Y<`1si$]hl6kVjNZVKkZVKViZiZ+~ZVl_pHPC5B?TBu)TTBP(\(E"##{w}H_optd%IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:33 UTC	615	OUT	GET /5be974e/build/signer.css HTTP/1.1 Host: cdn.hellosign.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Referer: https://hyj48i39.s3.us-east-1.amazonaws.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:33 UTC	553	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1008617 Connection: close Date: Thu, 20 Mar 2025 13:26:34 GMT Last-Modified: Wed, 08 Jan 2025 07:36:16 GMT ETag: "b8843b5201e924093de6adbc9030bead" x-amz-server-side-encryption: AES256 x-amz-version-id: xPy3iaIzfH7jJUNjG6bxxeSHjjBHkell Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 b5b0850774f11b0c2514532a2d3bdc44.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: CksC7w6R_UoRunuGAz98ze7e3oR51vJNZnLPyRB72t98cVH1V10utg== Vary: Origin
2025-03-20 13:26:33 UTC	15831	IN	Data Raw: 2f 2a 21 20 43 6f 6d 6d 69 74 20 48 61 73 68 3a 20 35 62 65 39 37 34 65 39 62 35 20 2a 2f 2e 72 6f 77 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 6d 61 78 2d 77 69 64 74 68 3a 37 31 2e 32 35 72 65 6d 3b 77 69 64 74 68 3a 31 30 30 25 3b 2a 7a 6f 6f 6d 3a 31 7d 2e 72 6f 77 3a 61 66 74 65 72 2c 2e 72 6f 77 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 20 22 3b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 7d 2e 72 6f 77 3a 61 66 74 65 72 7b 63 6c 65 61 72 3a 62 6f 74 68 7d 2e 72 6f 77 2e 63 6f 6c 6c 61 70 73 65 3e 2e 63 6f 6c 75 6d 6e 2c 2e 72 6f 77 2e 63 6f 6c 6c 61 70 73 65 3e 2e 63 6f 6c 75 6d 6e 73 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 2e 72 6f 77 2e 63 6f 6c 6c 61 70 73 65 20 2e 72 6f 77 7b 6d 61 Data Ascii: /! Commit Hash: 5be974e9b5 /.row{margin:0 auto;max-width:71.25rem;width:100%;*zoom:1}.row:after,.row:before{content:" ";display:table}.row:after{clear:both}.row.collapse>.column,.row.collapse>.columns{padding-left:0;padding-right:0}.row.collapse .row{ma
2025-03-20 13:26:33 UTC	159	IN	Data Raw: 77 2d 66 6f 72 2d 78 78 6c 61 72 67 65 2d 64 6f 77 6e 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 2d 63 65 6c 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 34 30 2e 30 36 33 65 6d 29 7b 2e 68 69 64 65 2d 66 6f 72 2d 6c 61 72 67 65 2c 2e 68 69 64 65 2d 66 6f 72 2d 6c 61 72 67 65 2d 6f 6e 6c 79 2c 2e 68 69 64 65 2d 66 6f 72 2d 6c 61 72 67 65 2d 75 70 2c 2e 68 69 64 65 2d 66 6f 72 2d Data Ascii: w-for-xxlarge-down{display:table-cell!important}}@media only screen and (min-width:40.063em){.hide-for-large,.hide-for-large-only,.hide-for-large-up,.hide-for-
2025-03-20 13:26:33 UTC	937	IN	Data Raw: 73 6d 61 6c 6c 2c 2e 68 69 64 65 2d 66 6f 72 2d 73 6d 61 6c 6c 2d 64 6f 77 6e 2c 2e 68 69 64 65 2d 66 6f 72 2d 73 6d 61 6c 6c 2d 6f 6e 6c 79 2c 2e 68 69 64 65 2d 66 6f 72 2d 78 6c 61 72 67 65 2c 2e 68 69 64 65 2d 66 6f 72 2d 78 6c 61 72 67 65 2d 6f 6e 6c 79 2c 2e 68 69 64 65 2d 66 6f 72 2d 78 6c 61 72 67 65 2d 75 70 2c 2e 68 69 64 65 2d 66 6f 72 2d 78 78 6c 61 72 67 65 2c 2e 68 69 64 65 2d 66 6f 72 2d 78 78 6c 61 72 67 65 2d 6f 6e 6c 79 2c 2e 68 69 64 65 2d 66 6f 72 2d 78 78 6c 61 72 67 65 2d 75 70 2c 2e 73 68 6f 77 2d 66 6f 72 2d 6c 61 72 67 65 2d 64 6f 77 6e 2c 2e 73 68 6f 77 2d 66 6f 72 2d 6d 65 64 69 75 6d 2c 2e 73 68 6f 77 2d 66 6f 72 2d 6d 65 64 69 75 6d 2d 64 6f 77 6e 2c 2e 73 68 6f 77 2d 66 6f 72 2d 6d 65 64 69 75 6d 2d 6f 6e 6c 79 2c 2e 73 68 6f Data Ascii: small,.hide-for-small-down,.hide-for-small-only,.hide-for-xlarge,.hide-for-xlarge-only,.hide-for-xlarge-up,.hide-for-xxlarge,.hide-for-xxlarge-only,.hide-for-xxlarge-up,.show-for-large-down,.show-for-medium,.show-for-medium-down,.show-for-medium-only,.sho
2025-03-20 13:26:33 UTC	16384	IN	Data Raw: 64 65 2d 66 6f 72 2d 78 6c 61 72 67 65 2c 74 61 62 6c 65 2e 68 69 64 65 2d 66 6f 72 2d 78 6c 61 72 67 65 2d 6f 6e 6c 79 2c 74 61 62 6c 65 2e 68 69 64 65 2d 66 6f 72 2d 78 6c 61 72 67 65 2d 75 70 2c 74 61 62 6c 65 2e 68 69 64 65 2d 66 6f 72 2d 78 78 6c 61 72 67 65 2c 74 61 62 6c 65 2e 68 69 64 65 2d 66 6f 72 2d 78 78 6c 61 72 67 65 2d 6f 6e 6c 79 2c 74 61 62 6c 65 2e 68 69 64 65 2d 66 6f 72 2d 78 78 6c 61 72 67 65 2d 75 70 2c 74 61 62 6c 65 2e 73 68 6f 77 2d 66 6f 72 2d 6c 61 72 67 65 2d 64 6f 77 6e 2c 74 61 62 6c 65 2e 73 68 6f 77 2d 66 6f 72 2d 6d 65 64 69 75 6d 2c 74 61 62 6c 65 2e 73 68 6f 77 2d 66 6f 72 2d 6d 65 64 69 75 6d 2d 64 6f 77 6e 2c 74 61 62 6c 65 2e 73 68 6f 77 2d 66 6f 72 2d 6d 65 64 69 75 6d 2d 6f 6e 6c 79 2c 74 61 62 6c 65 2e 73 68 6f 77 Data Ascii: de-for-xlarge,table.hide-for-xlarge-only,table.hide-for-xlarge-up,table.hide-for-xxlarge,table.hide-for-xxlarge-only,table.hide-for-xxlarge-up,table.show-for-large-down,table.show-for-medium,table.show-for-medium-down,table.show-for-medium-only,table.show
2025-03-20 13:26:33 UTC	7420	IN	Data Raw: 61 64 2e 68 69 64 65 2d 66 6f 72 2d 74 6f 75 63 68 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 2d 68 65 61 64 65 72 2d 67 72 6f 75 70 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 74 6f 75 63 68 20 74 62 6f 64 79 2e 73 68 6f 77 2d 66 6f 72 2d 74 6f 75 63 68 2c 74 62 6f 64 79 2e 68 69 64 65 2d 66 6f 72 2d 74 6f 75 63 68 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 2d 72 6f 77 2d 67 72 6f 75 70 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 74 6f 75 63 68 20 74 72 2e 73 68 6f 77 2d 66 6f 72 2d 74 6f 75 63 68 2c 74 72 2e 68 69 64 65 2d 66 6f 72 2d 74 6f 75 63 68 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 2d 72 6f 77 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 74 6f 75 63 68 20 74 64 2e 73 68 6f 77 2d 66 6f 72 2d 74 6f 75 63 68 2c 2e 74 6f 75 63 68 20 74 68 2e 73 68 6f 77 2d 66 6f 72 2d 74 6f Data Ascii: ad.hide-for-touch{display:table-header-group!important}.touch tbody.show-for-touch,tbody.hide-for-touch{display:table-row-group!important}.touch tr.show-for-touch,tr.hide-for-touch{display:table-row!important}.touch td.show-for-touch,.touch th.show-for-to
2025-03-20 13:26:33 UTC	12742	IN	Data Raw: 64 69 73 70 6c 61 79 3a 69 6e 68 65 72 69 74 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 5b 63 6c 61 73 73 2a 3d 62 6c 6f 63 6b 2d 67 72 69 64 2d 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 20 2d 2e 36 32 35 72 65 6d 3b 70 61 64 64 69 6e 67 3a 30 3b 2a 7a 6f 6f 6d 3a 31 7d 5b 63 6c 61 73 73 2a 3d 62 6c 6f 63 6b 2d 67 72 69 64 2d 5d 3a 61 66 74 65 72 2c 5b 63 6c 61 73 73 2a 3d 62 6c 6f 63 6b 2d 67 72 69 64 2d 5d 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 20 22 3b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 7d 5b 63 6c 61 73 73 2a 3d 62 6c 6f 63 6b 2d 67 72 69 64 2d 5d 3a 61 66 74 65 72 7b 63 6c 65 61 72 3a 62 6f 74 68 7d 5b 63 6c 61 73 73 2a 3d 62 6c 6f 63 6b 2d 67 72 69 64 2d 5d 3e 6c 69 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b Data Ascii: display:inherit!important}}[class=block-grid-]{display:block;margin:0 -.625rem;padding:0;zoom:1}[class=block-grid-]:after,[class=block-grid-]:before{content:" ";display:table}[class=block-grid-]:after{clear:both}[class=block-grid-]>li{display:block;
2025-03-20 13:26:33 UTC	9000	IN	Data Raw: 3a 2e 35 72 65 6d 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 2e 34 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 2c 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 20 2e 34 35 73 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 2e 34 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 2c 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 20 2e 34 35 73 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 78 2d 73 68 61 64 6f 77 20 2e 34 35 73 2c 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 2e 34 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 78 2d 73 68 61 64 6f 77 20 2e 34 35 73 2c 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 2e 34 35 73 20 65 61 73 65 2d Data Ascii: :.5rem;-webkit-transition:border-color .45s ease-in-out,-webkit-box-shadow .45s;transition:border-color .45s ease-in-out,-webkit-box-shadow .45s;-o-transition:box-shadow .45s,border-color .45s ease-in-out;transition:box-shadow .45s,border-color .45s ease-
2025-03-20 13:26:33 UTC	12792	IN	Data Raw: 6f 6d 3a 32 30 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 37 35 70 78 7d 2e 6c 2d 6e 65 77 2d 6d 6f 64 61 6c 20 2e 6c 2d 6e 65 77 2d 6d 6f 64 61 6c 2d 2d 73 75 62 2d 73 75 62 2d 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 61 30 61 30 61 30 7d 2e 6c 2d 6e 65 77 2d 6d 6f 64 61 6c 20 2e 6c 2d 6e 65 77 2d 6d 6f 64 61 6c 2d 2d 73 75 62 2d 63 6f 6e 74 65 6e 74 2d 73 65 70 61 72 61 74 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 36 65 36 65 36 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 31 70 78 3b 6d 61 72 67 69 6e 3a 32 35 70 78 20 30 7d 2e 6c 2d 6e 65 77 2d 6d 6f 64 61 6c 20 2e 6c 2d 6e 65 77 2d 6d 6f 64 61 6c 2d 2d 61 63 74 69 6f 6e 73 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 37 66 38 66 39 3b 62 6f 74 74 6f 6d 3a 30 3b 66 Data Ascii: om:20px;padding:0 75px}.l-new-modal .l-new-modal--sub-sub-title{color:#a0a0a0}.l-new-modal .l-new-modal--sub-content-separator{background-color:#e6e6e6;display:block;height:1px;margin:25px 0}.l-new-modal .l-new-modal--actions{background:#f7f8f9;bottom:0;f
2025-03-20 13:26:33 UTC	3592	IN	Data Raw: 64 6f 63 73 2d 2d 70 61 67 65 2d 74 69 74 6c 65 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 36 65 36 65 36 3b 63 6f 6c 6f 72 3a 23 34 65 34 65 34 65 3b 66 6c 6f 61 74 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 33 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 34 35 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 33 35 70 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6c 2d 61 70 69 2d 64 6f 63 73 20 2e 6c 2d 61 70 69 2d 64 6f 63 73 2d 2d 63 6f 6e 74 65 6e 74 20 2e 6c 2d 61 70 69 2d 64 6f 63 73 2d 2d 69 6e 74 72 6f 7b 63 6f 6c 6f 72 3a 23 34 65 34 65 34 65 3b 66 6c 6f 61 74 3a 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 30 70 78 3b 77 69 64 74 Data Ascii: docs--page-title{border-bottom:1px solid #e6e6e6;color:#4e4e4e;float:left;font-size:34px;font-weight:400;margin-bottom:45px;padding-bottom:35px;width:100%}.l-api-docs .l-api-docs--content .l-api-docs--intro{color:#4e4e4e;float:left;margin-bottom:50px;widt
2025-03-20 13:26:33 UTC	10618	IN	Data Raw: 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 34 30 65 6d 29 7b 2e 6c 2d 61 70 69 2d 64 6f 63 73 2d 6d 65 6e 75 20 2e 6c 2d 61 70 69 2d 64 6f 63 73 2d 6d 65 6e 75 2d 2d 73 75 62 2d 69 74 65 6d 73 2d 2d 73 75 62 2d 69 74 65 6d 3e 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 7d 7d 2e 6c 2d 61 70 69 2d 64 6f 63 73 2d 6d 65 6e 75 20 2e 6c 2d 61 70 69 2d 64 6f 63 73 2d 6d 65 6e 75 2d 2d 73 75 62 2d 69 74 65 6d 73 2d 2d 73 75 62 2d 69 74 65 6d 2e 69 73 2d 61 63 74 69 76 65 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 2e 6c 2d 61 70 69 2d 64 6f 63 73 2d 6d 65 6e 75 20 2e 6c 2d 61 70 69 2d 64 6f 63 73 2d 6d 65 6e 75 2d 2d 73 75 62 2d 69 74 65 6d 73 2d 2d 73 75 62 2d 69 74 65 6d 2e 69 73 2d 61 63 74 69 76 65 3e 61 2c 2e 6c 2d 61 Data Ascii: y screen and (max-width:40em){.l-api-docs-menu .l-api-docs-menu--sub-items--sub-item>a{font-size:11px}}.l-api-docs-menu .l-api-docs-menu--sub-items--sub-item.is-active{font-weight:500}.l-api-docs-menu .l-api-docs-menu--sub-items--sub-item.is-active>a,.l-a

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:34 UTC	579	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiJo8sBCIWgzQEI9s/OAQiA1s4BCMDYzgEIq97OAQjS4M4BCK/kzgEI4uTOAQiL5c4B Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:34 UTC	1303	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:34 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-u18ifa59EVki49_FlianKQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-20 13:26:34 UTC	1303	IN	Data Raw: 62 32 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 69 6e 63 69 6e 6e 61 74 69 20 62 65 6e 67 61 6c 73 22 2c 22 63 61 72 72 69 65 20 75 6e 64 65 72 77 6f 6f 64 20 6f 70 72 79 20 31 30 30 20 72 61 6e 64 79 20 74 72 61 76 69 73 22 2c 22 65 67 79 70 74 69 61 6e 20 70 79 72 61 6d 69 64 73 22 2c 22 6b 61 6e 73 61 73 20 72 6f 61 64 20 63 6c 6f 73 75 72 65 73 20 69 20 37 30 22 2c 22 73 75 6e 72 69 73 65 20 73 6f 6c 61 72 20 65 63 6c 69 70 73 65 22 2c 22 70 61 6c 77 6f 72 6c 64 20 63 72 6f 73 73 70 6c 61 79 20 75 70 64 61 74 65 22 2c 22 6b 6f 68 6c 73 20 6e 6f 74 20 61 63 63 65 70 74 69 6e 67 20 61 6d 61 7a 6f 6e 20 72 65 74 75 72 6e 73 22 2c 22 6e 66 6c 20 64 72 61 66 74 20 6d 6f 63 6b 20 64 72 61 66 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 Data Ascii: b29)]}'["",["cincinnati bengals","carrie underwood opry 100 randy travis","egyptian pyramids","kansas road closures i 70","sunrise solar eclipse","palworld crossplay update","kohls not accepting amazon returns","nfl draft mock draft"],["","","","","","
2025-03-20 13:26:34 UTC	1303	IN	Data Raw: 52 75 62 30 6f 77 4e 57 6b 35 51 6e 6b 72 62 46 56 30 53 56 70 6c 64 55 4a 79 56 46 45 78 56 57 70 69 61 6a 56 45 4d 6b 5a 77 56 30 46 70 4f 48 68 44 4d 7a 5a 79 61 58 4d 78 53 54 49 79 4d 48 64 6f 64 32 67 30 51 32 74 44 55 6e 63 79 56 6b 4e 42 51 31 42 61 59 57 35 57 4d 6e 52 76 62 33 42 69 57 44 59 34 63 33 64 44 61 30 35 76 56 57 74 6c 4d 6c 52 50 61 48 5a 45 5a 6a 4a 55 56 32 45 7a 4d 47 6c 73 54 6c 6c 76 5a 44 5a 74 57 6c 68 4c 63 32 4a 46 5a 6e 42 52 54 57 35 76 53 32 4e 43 64 33 6c 76 51 54 46 55 51 56 42 72 4e 6d 74 55 52 55 35 52 51 56 4a 42 61 58 46 70 4f 48 59 7a 64 33 6c 70 4d 54 64 6d 4f 45 74 46 52 57 74 4e 5a 46 46 53 4f 45 35 4d 53 6a 6c 45 56 30 4a 4e 59 33 4a 43 4e 58 70 31 56 32 68 58 54 45 46 4a 55 6e 70 42 53 6c 55 78 59 54 46 57 64 Data Ascii: Rub0owNWk5QnkrbFV0SVpldUJyVFExVWpiajVEMkZwV0FpOHhDMzZyaXMxSTIyMHdod2g0Q2tDUncyVkNBQ1BaYW5WMnRvb3BiWDY4c3dDa05vVWtlMlRPaHZEZjJUV2EzMGlsTllvZDZtWlhLc2JFZnBRTW5vS2NCd3lvQTFUQVBrNmtURU5RQVJBaXFpOHYzd3lpMTdmOEtFRWtNZFFSOE5MSjlEV0JNY3JCNXp1V2hXTEFJUnpBSlUxYTFWd
2025-03-20 13:26:34 UTC	258	IN	Data Raw: 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d Data Ascii: ,1251,1250],"google:suggestsubtypes":[[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308]],"google:suggesttype":["ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}
2025-03-20 13:26:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:34 UTC	635	OUT	GET /5be974e/build/a6d09f4028ea300af1bd.ttf HTTP/1.1 Host: cdn.hellosign.com Connection: keep-alive Origin: https://hyj48i39.s3.us-east-1.amazonaws.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.hellosign.com/5be974e/build/signer.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:34 UTC	604	IN	HTTP/1.1 200 OK Content-Type: font/ttf Content-Length: 767752 Connection: close Date: Thu, 20 Mar 2025 13:26:35 GMT Last-Modified: Wed, 08 Jan 2025 07:36:13 GMT ETag: "a6895faa7a3a5985877a1e4900faadf2" x-amz-server-side-encryption: AES256 x-amz-version-id: bvdFDnYtiGfhcdkaD0Lfgn7ys7VgCUwP Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 05b3bdb53d1146d1176c185d2da0d530.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: z9YnzmkNu58FMwGydYmUdh40pQj31G0NByUGHH8my62AvCis1F3pPA== Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2025-03-20 13:26:34 UTC	8192	IN	Data Raw: 00 01 00 00 00 18 01 00 00 04 00 80 44 53 49 47 ac 59 19 4f 00 0a e3 48 00 00 15 70 47 44 45 46 89 d5 8d 49 00 0a f8 b8 00 00 02 c2 47 50 4f 53 8f e0 1e fb 00 0a fb 7c 00 00 9f f2 47 53 55 42 a1 ee fb a2 00 0b 9b 70 00 00 1b 76 4a 53 54 46 6d 2a 69 06 00 0b b6 e8 00 00 00 1e 4c 54 53 48 e4 93 6b 53 00 00 37 3c 00 00 0d 39 4f 53 2f 32 20 55 3a 67 00 00 02 08 00 00 00 60 50 43 4c 54 fd 7b 3e 43 00 0a e3 10 00 00 00 36 56 44 4d 58 50 92 6a f5 00 00 44 78 00 00 11 94 63 6d 61 70 82 e3 ce 2f 00 01 93 54 00 00 21 9e 63 76 74 20 a1 1c d7 eb 00 01 c7 24 00 00 06 54 66 70 67 6d cc 79 59 9a 00 01 b4 f4 00 00 06 6e 67 61 73 70 00 18 00 09 00 0a e3 00 00 00 00 10 67 6c 79 66 07 02 2d ca 00 02 02 50 00 08 22 cc 68 64 6d 78 11 10 25 d5 00 00 56 0c 00 01 3d 48 68 65 61 Data Ascii: DSIGYOHpGDEFIGPOS\|GSUBpvJSTFm*iLTSHkS7<9OS/2 U:g`PCLT{>C6VDMXPjDxcmap/T!cvt $TfpgmyYngaspglyf-P"hdmx%V=Hhea
2025-03-20 13:26:34 UTC	8736	IN	Data Raw: 04 00 00 24 04 00 00 50 04 00 00 24 04 00 00 50 06 39 00 63 04 40 00 88 04 0f 00 49 04 78 00 50 04 6b 00 88 03 2e 00 00 04 00 00 08 03 3b 00 88 04 73 00 48 04 00 00 24 04 00 00 50 07 b7 00 46 07 40 00 46 08 0b 00 46 05 b3 00 24 03 6f 00 24 05 c0 00 24 06 1c 00 13 05 4a 00 83 05 0f 00 83 03 e2 00 1e 04 38 00 63 03 11 00 64 03 11 00 64 01 46 ff ce 01 eb 00 64 01 eb 00 00 01 eb 00 00 02 ea 00 64 03 d9 00 00 02 91 00 00 01 87 00 5a 02 d7 00 5e 01 c7 00 80 01 c7 00 6c 01 c7 00 8a 02 aa 00 fb 02 aa 00 fb 02 ca 00 32 02 ca 00 32 04 ac 00 70 04 ac 00 70 04 ac 00 65 04 ac 00 65 02 aa 01 21 02 aa 00 de 02 aa 00 59 02 aa 01 21 02 aa 00 1d 02 aa 00 59 02 aa 00 de 02 39 00 b6 02 39 00 b6 02 aa 00 fb 02 aa 00 fb 02 aa 00 a6 02 aa 00 a6 02 aa 00 a6 02 aa 00 1d 02 aa ff Data Ascii: $P$P9c@IxPk.;sH$PF@FF$o$$J8cddFddZ^l22ppee!Y!Y99
2025-03-20 13:26:34 UTC	16384	IN	Data Raw: 01 01 29 29 29 29 24 24 29 29 95 95 29 01 01 01 01 01 2a 2a 2a 2a 2a 01 1b 01 01 0f 01 01 01 2e 2e 16 2e 04 0a 01 1c 01 01 01 01 01 01 01 01 01 01 01 22 01 01 01 09 09 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 03 01 01 0b 28 28 01 0b 01 01 01 01 16 37 24 01 01 01 01 0a 01 01 01 01 25 25 14 29 20 01 20 c6 a4 63 01 01 0f 26 01 37 01 01 37 01 01 01 01 0b 01 01 02 01 01 01 15 1c 31 2c 01 2b 12 01 2a 01 01 01 01 01 01 01 32 32 01 01 01 01 01 01 01 31 12 32 19 32 32 2a 1a 12 01 31 2b 01 31 2b 2a 01 11 01 01 12 2b 31 2b 01 01 11 01 24 01 2a 01 01 23 01 01 01 01 01 01 01 01 01 29 29 01 01 01 01 01 01 01 01 03 01 01 01 11 01 01 01 01 01 01 01 19 01 01 01 01 01 01 01 01 01 01 01 01 2e 01 01 01 01 01 01 2e 16 01 01 Data Ascii: ))))$$)))****..."((7$%%) c&771,+2212221+1++1+$*#))..
2025-03-20 13:26:34 UTC	16384	IN	Data Raw: 0b 0b 0b 0b 0b 02 0f 1e 0d 0a 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 0d 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 09 08 09 08 09 08 09 08 09 08 09 08 09 08 09 08 09 08 09 08 09 08 09 08 0a 08 0a 08 0a 08 0a 08 0a 08 0a 08 0a 08 0a 08 03 03 03 03 0c 08 0c 08 0c 08 0c 08 0c 08 0c 08 0c 08 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0a 08 0a 08 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 09 07 09 07 09 07 09 08 03 03 0c 08 0a 08 0a 08 0a 08 0a 08 0a 08 00 00 00 00 08 05 0e 0a 09 07 09 07 0b 08 08 08 08 08 0a 08 0a 08 0a 08 0b 08 0c 08 0b 04 04 04 09 04 04 04 04 04 04 04 00 00 05 05 00 00 00 00 03 03 03 03 03 03 03 03 06 06 06 06 0a 09 0b 0b 04 04 0b 0b 04 04 0b 0b 04 04 0b 0b 04 04 0b 0b 04 04 0b 0b 04 Data Ascii:
2025-03-20 13:26:34 UTC	1024	IN	Data Raw: 10 11 0e 0f 12 0f 12 10 16 17 13 15 10 11 18 11 0d 0e 0d 09 0e 0d 10 0b 0d 0d 0b 0e 11 0d 0d 0d 0e 0c 0b 0c 14 0b 0e 0d 13 14 0f 11 0d 0c 12 0d 0d 0e 09 0c 0c 05 06 06 16 14 0e 0b 0c 0d 0c 0a 18 1a 11 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 06 00 00 07 0e 0d 0a 0c 0e 06 09 0e 0e 06 0c 0b 0b 0e 0e 06 08 0e 0d 0e 0d 0b 0b 0d 0c 11 0f 0c 0c 0c 06 0a 15 06 0c 0c 0b 0b 0d 11 11 11 11 0e 0e 0e 0d 0a 0c 0e 07 0a 0e 07 0c 0b 0b 0e 08 0e 0e 0d 0b 0d 0c 11 0f 06 0d 0b 0d 0e 00 00 00 00 08 08 09 0a 05 00 00 00 00 00 00 00 00 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 08 0d 12 12 07 12 0d 0d 0d 12 12 12 12 12 00 12 12 12 12 12 12 12 12 0f 12 12 12 11 11 06 06 12 12 12 12 0e 0d 0d 0d 0c 0c 13 16 09 0c 13 16 09 0c 0f 0e 09 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 00 00 Data Ascii:
2025-03-20 13:26:34 UTC	15990	IN	Data Raw: 00 00 1b 1a 00 00 00 00 00 00 05 09 00 00 0e 00 00 00 14 14 0d 0d 1a 1a 14 14 0d 0b 0d 09 0a 08 07 06 08 06 06 06 06 06 13 16 06 00 08 0c 0d 0e 0d 0e 0d 0e 0d 0e 0d 0e 0d 0e 0d 0e 0d 0d 0d 0e 0d 12 10 0d 10 0d 11 11 0c 11 13 10 0d 0d 10 0f 0f 13 0f 15 05 07 10 0c 05 0c 15 11 0d 13 15 10 12 0d 10 10 0c 0f 09 07 0f 07 0f 12 11 13 0c 0f 0c 0f 0f 0d 0d 0d 0d 0b 0c 0d 06 0a 0e 08 20 1d 19 19 14 0b 1d 17 13 0d 0f 0d 00 0f 0d 18 15 13 0d 13 0e 10 0c 13 0d 13 0d 0f 0d 05 20 1d 19 13 0e 19 0f 11 0e 0f 0d 0f 0d 10 0d 10 0d 06 06 06 06 13 0d 13 0d 11 08 11 08 11 0e 11 0e 10 0c 0e 07 0d 0a 11 0e 11 0f 0e 0f 0c 0f 0d 10 0d 13 0d 00 13 0d 13 0d 13 0d 10 0c 0d 0d 0d 0d 0c 0c 0d 0d 0d 12 0b 0b 0f 0c 07 0d 0e 0d 0c 0f 0d 0d 0d 05 05 05 08 07 05 0e 14 14 14 0d 0d 0d 0d 13 Data Ascii:
2025-03-20 13:26:34 UTC	3148	IN	Data Raw: 16 09 13 11 11 16 16 09 0d 15 14 15 14 11 12 14 13 1a 18 12 12 12 09 0f 1e 09 13 13 11 11 14 1a 1a 1a 1a 15 15 15 14 0f 13 16 0b 0f 16 0b 13 11 11 16 0d 15 15 14 12 14 13 1a 18 09 14 11 14 15 00 00 00 00 0c 0c 0d 0f 08 00 00 00 00 00 00 00 00 13 13 13 13 13 13 13 13 13 13 13 0c 13 1c 1c 0a 1c 13 13 13 1c 1c 1c 1c 1c 00 1c 1c 1c 1c 1c 1c 1c 1c 18 1c 1c 1c 1a 1a 09 09 1c 1c 1c 1c 15 13 14 14 12 12 1e 23 0f 13 1e 23 0f 13 18 16 0e 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 00 00 00 00 00 1c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 25 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 1c 0c 0c 1c 17 0f 08 08 08 08 10 10 08 08 18 16 09 09 08 08 1a 1a 09 09 0a 0e 1a 1a 09 09 1a 1a 09 09 15 13 14 14 15 13 14 14 15 13 Data Ascii: ##%
2025-03-20 13:26:34 UTC	1024	IN	Data Raw: 17 1e 17 21 17 21 17 1e 0e 1c 14 1a 0c 1e 17 1e 17 1e 17 1e 17 2a 1d 1c 15 0a 1c 17 2a 25 21 1a 0c 2a 1d 2a 1d 2a 1d 1c 15 09 0e 17 19 23 23 23 23 0e 0e 0e 0e 1c 21 23 10 21 23 20 0a 1c 1c 1c 1c 1a 1e 0c 1c 1c 23 1e 1b 21 1e 1c 1a 1a 1c 1b 23 1f 0c 1c 18 13 17 0a 17 18 15 13 17 17 0a 15 15 18 17 13 17 18 14 17 16 1e 21 0a 17 17 17 21 1c 24 17 1e 1c 0c 0c 15 2c 2a 24 18 1b 1e 1c 1c 1c 17 1c 1c 27 19 1e 1e 18 1c 23 1e 21 1e 1c 1e 1a 1b 20 1b 1f 1c 27 27 21 25 1c 1e 2a 1e 17 18 16 0f 19 17 1c 13 17 17 12 19 1d 17 17 17 17 15 13 15 23 16 18 16 22 23 1a 1e 16 15 20 17 17 17 0f 15 14 0a 0c 0a 26 22 17 12 15 17 15 11 2a 2d 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 0a 00 00 0c 18 17 11 15 19 0a 10 19 19 0a 15 13 13 19 19 0a 0f 18 16 18 17 13 14 17 15 1d 1b Data Ascii: !!%!####!#!# #!#!!$,$'#! ''!%#"# &"-
2025-03-20 13:26:34 UTC	16384	IN	Data Raw: 21 0b 0b 21 21 0b 0b 21 21 0b 0b 21 21 0b 0b 21 21 0b 0b 18 18 18 18 31 31 26 26 22 27 11 16 19 19 11 11 19 19 11 11 19 19 11 11 22 27 11 16 22 27 11 16 22 27 11 16 22 27 11 16 22 27 11 16 15 15 09 09 15 15 09 09 15 15 09 09 15 15 09 09 16 16 0a 0a 16 16 16 16 16 16 0a 0a 16 16 18 16 16 16 0c 10 10 10 10 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 1b 19 1b 19 0a 0a 12 12 1b 19 0a 0a 1b 19 22 22 22 22 09 00 00 00 00 00 00 00 2f 2e 00 00 00 00 00 00 08 10 00 00 19 00 00 00 23 23 16 16 2e 2e 24 24 17 13 16 11 11 0e 0c 0a 0d 0a 0a 0a 0a 0a 22 27 0a 00 0e 14 17 19 17 19 17 19 17 19 17 19 17 19 17 19 16 16 17 19 17 20 1c 17 1c 17 1e 1e 15 1e 22 1c 17 17 1c 19 1a 21 1a 25 09 0c 1c 15 09 15 25 1e 17 21 24 1c 20 17 1c 1c 15 1a 10 0c 1a 0c 1a 1f 1e 20 15 1a 15 Data Ascii: !!!!!!!!!11&&"'"'"'"'"'"'""""/.##..$$"' "!%%!$
2025-03-20 13:26:34 UTC	16384	IN	Data Raw: 24 26 23 24 24 17 17 17 17 21 21 21 21 37 37 24 24 37 37 24 24 4a 4a 39 39 4a 4a 39 39 27 27 27 27 27 27 27 27 24 1e 23 1a 24 1e 23 1a 35 35 12 12 27 27 12 12 28 28 1a 1a 22 22 0e 0e 17 17 1a 1a 23 23 10 10 13 19 1e 1a 1d 1d 2b 27 2b 27 10 10 24 28 24 28 24 28 24 28 32 32 00 00 32 32 32 00 00 32 32 00 00 32 32 32 00 00 00 00 00 00 32 00 00 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 15 15 15 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 08 43 86 39 2c 39 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 38 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: $&#$$!!!!77$$77$$JJ99JJ99''''''''$#$#55''((""##+'+'$($($($(22222222222222222222222222222222222222222222222222222222222222222222222222222222222222222C9,9-"88

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:35 UTC	691	OUT	GET /f1718227932057x822365466237625200/DOCU-60cafc67.png HTTP/1.1 Host: meta-q.cdn.bubble.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://hyj48i39.s3.us-east-1.amazonaws.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:35 UTC	697	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:35 GMT Content-Type: image/png Content-Length: 22658 Connection: close Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=33006 Last-Modified: Wed, 12 Jun 2024 21:32:13 GMT cache-control: public,max-age=86400 etag: "282ba85a1c65bfadc21a004e2a4a9ad5" x-amz-id-2: ceXUydcp6EAs/OZblvKkETJpNdWi0JeGYg9lQidHUJLcNiC1OGrUQzjPkrOaNNvxFsuqsOXZTSU= x-amz-meta-app-version: live x-amz-meta-appname: meta x-amz-request-id: PYXAYR22FQQDKA78 x-amz-server-side-encryption: AES256 x-amz-version-id: VJwr9ehspq7Y4Hruul9084tFCPC0kb1W CF-Cache-Status: HIT Accept-Ranges: bytes Server: cloudflare CF-RAY: 92358aca18548c84-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:35 UTC	672	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 06 0b 00 00 06 0d 08 06 00 00 00 f4 90 6b 42 00 00 00 01 73 52 47 42 01 d9 c9 2c 7f 00 00 58 3c 49 44 41 54 78 da ec dd df eb dd 05 1d c7 f1 e7 5a f8 63 9b a5 a3 81 a2 e2 5a 33 d0 0a ac 06 82 20 b1 81 50 14 44 6a 11 68 45 66 84 17 d6 55 84 83 ac 2e bc 89 2e 2c 2a a2 1f 42 3f c0 8b 46 20 c6 c4 95 2b 67 5b d2 dc 82 72 df fc b1 2d 37 6d e4 36 99 b5 59 a3 82 ba 39 f0 85 f6 fd ea be ba ef f6 3d 9f f3 78 c0 8b cf 39 e7 2f 38 9c 27 6f ce a2 ff 5e 7f 7d 00 c0 6b b2 a2 ba a0 3a bf 5a 12 00 00 b3 f9 4f f5 ef 9a de f4 67 27 ec a5 00 80 d3 e6 f5 01 00 27 eb ea 6a 5d 75 45 b5 6a b4 8b 02 00 60 3e 1d af fe 31 cb fe 39 c3 67 c7 aa bf 57 7f 9b 65 07 03 00 4e b0 c8 65 01 00 cc ea 9c ea c6 ea 83 d5 75 d5 1b 03 00 60 08 Data Ascii: PNGIHDRkBsRGB,X<IDATxZcZ3 PDjhEfU..,*B?F +g[r-7m6Y9=x9/8'o^}k:ZOg''j]uEj`>19gWeNeu`
2025-03-20 13:26:35 UTC	1369	IN	Data Raw: a9 3a 1a 00 0b d2 eb 02 80 61 f9 76 00 00 c0 42 b1 b2 ba ad da 50 1d a9 b6 56 77 56 57 fb 5d 0a 60 4e 5c 16 00 c0 1c 7c bc fa 61 00 00 c0 38 38 52 fd b2 da 54 6d ac 0e 04 c0 cc c4 02 00 38 69 e7 56 7b aa 8b 02 00 00 c6 d1 ae ea be 6a 63 b5 35 00 a6 89 05 00 70 d2 3e 57 dd 1d 00 00 30 04 87 aa 8d d5 fd d5 83 d5 b1 00 f0 9f 05 00 f0 0a ce aa be 10 00 00 30 14 2b aa 4f 54 1b aa 17 aa 4d d5 ed d5 a5 01 e0 b2 00 00 66 f1 e9 ea bb 01 00 00 93 60 aa ba af da 50 ed 0c 00 97 05 00 30 f2 99 00 00 80 49 71 65 75 47 b5 a3 9a aa be 58 ad 0e 00 97 05 00 4c b4 37 57 7b 03 00 00 26 dd 8e ea de d1 0e 04 80 cb 02 00 26 ca ad 01 00 00 d4 bb ab af 55 cf 55 5b aa db aa e5 01 e0 b2 00 80 89 f0 64 f5 d6 00 00 00 66 f6 8b a6 2f 0e 8e 07 80 cb 02 00 06 e7 12 a1 00 00 00 78 05 d7 Data Ascii: :avBPVwVW]`N\\|a88RTm8iV{jc5p>W00+OTMf`P0IqeuGXL7W{&&UU[df/x
2025-03-20 13:26:35 UTC	1369	IN	Data Raw: df 88 05 00 00 00 00 c0 08 d6 57 87 ab c5 6a 73 c0 9f 88 05 00 00 00 00 c0 48 76 54 cb d5 e3 01 7f 10 0b 00 00 00 00 80 d1 6c ac de ab de af ae 09 48 2c 00 00 00 00 00 46 f5 58 f5 63 b5 3b 40 2c 00 00 00 00 00 86 75 63 75 b2 7a c5 e3 c7 20 16 00 00 00 00 00 e3 ba a2 7a b1 5a ac 16 02 c4 02 00 00 00 00 60 58 3b aa b3 d5 93 01 62 01 00 00 00 00 30 ac 0d d5 3b d5 87 d5 d5 01 62 01 00 00 00 00 30 ac 47 aa a5 ea d6 00 b1 00 00 00 00 00 18 d6 96 ea bb ea e9 00 b1 00 00 00 00 00 18 d6 7c f5 56 75 cc 6f 89 40 2c 00 00 00 00 00 c6 b6 bf 5a aa 6e 09 10 0b 00 00 00 00 80 61 6d a9 ce 54 4f 05 88 05 00 00 00 00 c0 b0 e6 ab b7 ab 63 d5 7c 80 58 00 c0 e4 ad 04 00 00 00 ff 6c 7f f5 7d b5 10 f0 3b 7b f7 ce 1a 66 1d 05 60 fc c9 45 6b 4a d0 16 b1 9b 34 9b 41 17 a7 a2 1d 8a Data Ascii: WjsHvTlH,FXc;@,ucuz zZ`X;b0;b0G\|Vuo@,ZnamTOc\|Xl};{f`EkJ4A
2025-03-20 13:26:35 UTC	1369	IN	Data Raw: 00 0b b2 1f 00 00 00 b0 8a 03 d5 ed ea e3 40 2c 00 60 21 36 02 00 00 00 56 75 b4 ba 55 6d 05 62 01 00 00 00 00 c0 58 c7 aa dd 6a 33 10 0b 00 00 00 00 00 c6 da a9 ce 05 62 01 00 00 00 00 c0 68 67 aa 1f 02 b1 00 00 00 00 00 60 b4 7f ab 9d 18 4f 2c 00 00 00 00 00 98 6b b3 da ad 3e 88 d1 c4 02 00 00 00 00 80 d9 b6 aa bb d5 56 8c 25 16 00 00 00 00 00 70 ac da f5 33 9e cb e1 01 00 00 00 00 a8 da a9 ce c5 48 62 01 00 00 00 00 00 0f fd 54 9d 8e 71 c4 02 00 00 00 00 00 ea 91 ff aa af 62 14 b1 00 00 00 00 00 80 7a e4 40 75 ad 7a 27 c6 10 0b 00 00 00 00 00 78 dc 76 75 a3 3a 18 23 88 05 00 00 00 00 00 3c c9 e7 d5 f9 18 41 2c 00 00 00 00 00 e0 69 4e 55 bf c6 e2 89 05 00 00 00 00 00 3c cb d9 ea db 58 34 b1 00 00 00 00 00 80 e7 fd 91 af 54 1f c5 62 89 05 00 00 00 00 00 Data Ascii: @,`!6VuUmbXj3bhg`O,k>V%p3HbTqbz@uz'xvu:#<A,iNU<X4Tb
2025-03-20 13:26:35 UTC	1369	IN	Data Raw: 00 00 fe de a9 ea 63 88 05 00 2c 14 37 0c 00 00 00 d8 ab 67 d5 d9 30 b4 00 00 00 00 00 30 d6 89 ea 53 88 05 00 00 00 00 00 8c b6 5a 9d 0f b1 00 00 00 00 00 80 b1 8e 55 6b 21 16 00 00 00 00 00 30 da d3 ea 62 88 05 00 00 00 00 00 8c 75 a4 5a 0f b1 00 00 00 00 00 80 d1 1e f9 5d 20 16 00 00 00 00 00 30 db a1 ea 6b 88 05 00 00 00 00 00 8c 76 bf ba 1c 62 01 00 00 00 00 00 63 2d 55 df 42 2c 00 e0 c0 da 0c 00 00 00 e0 df dd ab ae 37 9c 58 00 c0 41 e5 86 01 00 00 00 ff cb 7a c3 19 5a 00 00 00 00 00 98 ee 6e 75 a5 c1 c4 02 00 00 00 00 00 a6 5b aa 3e 35 98 58 00 00 00 00 00 00 f5 a0 ba d4 50 62 01 00 00 00 00 00 d4 a1 ea 5d 43 89 05 00 00 00 00 00 50 55 8f ab 73 0d 24 16 00 00 00 00 00 40 55 1d a9 3e 36 90 58 00 00 00 00 00 00 6d 59 ad ce 34 8c 58 00 00 00 00 00 00 Data Ascii: c,7g00SZUk!0buZ] 0kvbc-UB,7XAzZnu[>5XPb]CPUs$@U>6XmY4X
2025-03-20 13:26:35 UTC	1369	IN	Data Raw: b5 56 01 00 00 00 2c cb 5e b5 d5 55 62 01 00 00 00 00 00 8c b1 59 7d e9 0a b1 00 00 00 00 00 00 66 39 ea 0a b1 00 00 00 00 00 00 66 39 ec 0a b1 00 00 00 00 00 00 66 79 5a bd ea 12 b1 00 00 00 00 00 00 e6 f9 d9 25 62 01 00 00 00 00 00 cc 73 d4 25 62 01 00 00 00 00 00 cc f3 a1 da ae aa 12 0b 00 00 00 00 00 60 9e 55 f5 ab aa 12 0b 00 00 00 00 00 60 a8 a3 aa 2a b1 00 00 00 00 00 00 66 fa 51 3d a8 12 0b 00 00 00 00 00 60 a6 ed 6a b7 4a 2c 00 80 f5 ce 03 00 00 00 58 b6 c3 aa c4 02 00 b0 61 00 00 00 c0 58 df aa 1c 2d 00 00 00 00 00 30 d7 eb ea 91 58 00 00 00 00 00 00 b3 7d 17 0b 00 00 00 00 00 60 b6 7d b1 00 00 00 00 00 00 66 3b 10 0b 00 00 00 00 00 60 b6 e7 d5 0b b1 00 00 00 00 00 00 66 3b 10 0b 00 00 00 00 00 60 b6 7d b1 00 00 00 00 00 00 66 fb 5a ad c4 02 00 Data Ascii: V,^UbY}f9f9fyZ%bs%b`U`*fQ=`jJ,XaX-0X}`}f;`f;`}fZ
2025-03-20 13:26:35 UTC	1369	IN	Data Raw: 2e 8d 8e 7e f9 a5 65 00 00 c0 ff eb da ed b0 e0 66 92 4f 49 ce 06 00 f2 37 cd 02 00 28 87 57 2b 2b ed c7 47 46 be 7e 5b 5b 5b 0f 00 00 ec b1 66 c1 9d 24 43 01 80 ea a9 4b 62 cc 12 80 9a b0 b2 b1 d1 d6 51 2c ae 17 97 97 ad 25 02 00 e0 5f 75 ee 56 58 f0 28 c9 93 00 40 95 39 70 0c 40 2d d9 dc d9 39 72 79 6c ac f0 6c 7e fe 73 00 00 a0 74 6d 49 0e 97 fb a3 65 30 c9 fd 00 00 00 50 0d 0d b7 26 27 4f 3e 9c 9d 9d 0a 00 00 94 ae bb 9c 61 c1 75 87 8c 01 d8 4b ac 21 02 a0 46 d5 0d cc cc 9c bb 31 31 f1 26 00 00 bf d9 bb 9b 16 1f f7 38 8e e3 9f ab dc 74 9c 85 53 ce c9 21 33 64 30 c4 82 14 45 94 94 9b 28 3b 2b ca c2 b3 b0 f2 2c 2c ec d8 d8 8a 22 45 63 6e 64 a1 2c 94 94 95 0d 63 78 0c 7f 4d d9 08 ff b9 ae f9 8f e9 ba ae df eb f5 34 de 7d be 5f a8 67 72 a5 62 c1 d9 24 77 Data Ascii: .~efOI7(W++GF~[[[f$CKbQ,%_uVX(@9p@-9ryll~stmIe0P&'O>auK!F11&8tS!3d0E(;+,,"Ecnd,cxM4}_grb$w
2025-03-20 13:26:35 UTC	1369	IN	Data Raw: 2c 00 00 00 00 c1 00 00 40 2c 00 00 00 00 c1 00 00 40 2c 00 00 00 00 c1 00 00 40 2c 00 00 00 00 c1 00 00 40 2c 00 00 00 80 76 30 d8 2b 8a 1b c1 00 00 40 2c 00 00 00 20 b0 a3 56 6b 4d 30 00 00 e8 69 4a 2c 00 00 00 a0 d6 04 03 00 00 cb 02 00 00 00 68 07 83 97 f7 f7 0c 00 00 b1 00 00 00 80 a0 52 30 d8 29 8a 3b c1 00 00 40 2c 00 00 00 20 b0 93 a7 a7 15 c1 00 00 40 2c 00 00 00 20 38 c1 00 00 40 2c 00 00 00 80 2c 05 83 ed 3c bf 15 0c 00 00 b2 64 56 2c 00 00 00 20 a4 d3 b2 5c b5 30 00 00 f8 22 16 00 00 00 10 96 4b 22 00 80 b6 71 b1 00 00 00 80 b0 04 03 00 00 b1 00 00 00 00 04 03 00 00 b1 00 00 00 00 04 03 00 20 bc 31 b1 00 00 00 00 04 03 00 20 36 cb 02 00 00 00 e8 0c 06 cf 82 01 00 10 8b 65 01 00 00 00 74 06 83 ad 3c bf 17 0c 00 80 40 2c 0b 00 00 00 a0 d3 45 59 Data Ascii: ,@,@,@,@,v0+@, VkM0iJ,hR0);@, @, 8@,,<dV, \0"K"q 1 6et<@,EY
2025-03-20 13:26:35 UTC	1369	IN	Data Raw: 00 00 08 06 00 90 9b 58 00 00 00 00 08 06 00 90 dc bd 58 00 00 00 00 c4 a6 82 c1 91 60 00 00 2b 73 b3 00 00 00 00 e8 94 2b c1 00 00 9a 68 20 16 00 00 00 00 9f 04 03 00 48 c9 b2 00 00 00 00 f8 4a 30 00 80 74 c4 02 00 00 00 e0 27 c1 00 00 52 f1 0d 11 00 00 00 f0 3b c1 00 00 d2 b0 2c 00 00 00 00 16 d8 50 30 38 2d 8a 00 00 be 13 0b 00 00 00 80 24 3e 82 c1 71 bf 3f 15 0c 00 e0 5f 5c 8a 05 00 00 00 40 23 0c ca 72 5b 30 00 80 8d 1b 45 c4 4c 2c 00 00 00 00 96 22 18 00 40 27 dd 46 45 2c 00 00 00 00 96 26 18 00 40 e7 0c c4 02 00 00 00 60 55 82 01 00 74 8b 65 01 00 00 00 d0 5c 82 01 00 88 05 00 00 00 00 82 01 00 f8 86 08 00 00 00 40 30 00 80 9a 5d 8b 05 00 00 00 40 2b 08 06 00 50 9b 4b b1 00 00 00 00 68 0d c1 00 00 6a 71 21 16 00 00 00 00 ad 32 0f 06 b3 93 d1 28 00 Data Ascii: XX`+s+h HJ0t'R;,P08-$>q?_\@#r[0EL,"@'FE,&@`Ute\@0]@+PKhjq!2(
2025-03-20 13:26:35 UTC	1369	IN	Data Raw: 00 00 00 00 00 80 66 6b 89 05 00 00 00 00 00 d0 6c 5e 16 00 00 00 00 00 40 c3 89 05 00 00 00 00 00 d0 60 9d 88 38 15 0b 00 00 00 00 00 a0 b9 36 63 41 2c 00 00 00 00 00 80 e6 6a 89 05 00 00 00 00 00 d0 6c 62 01 00 00 00 00 00 34 dc 3d b1 00 00 00 00 00 00 9a eb 30 22 9e 8b 05 00 00 00 00 00 d0 5c 6b b1 20 16 00 00 00 f0 96 7d 3b 48 6d 2a 80 02 28 7a bb ff 25 25 86 26 68 d3 d6 a0 e0 44 67 22 8e 04 75 20 2d 38 68 9b fe 4d 34 7c 78 e7 6c e3 72 01 00 98 eb a3 58 00 00 00 00 00 00 b3 9d c4 02 00 00 00 00 00 98 ed 5e 2c 00 00 00 00 00 80 b9 7e 56 bf c5 02 00 00 00 00 00 98 eb 54 25 16 00 00 00 00 00 c0 5c 62 01 00 00 00 00 00 0c 27 16 00 00 00 00 00 c0 70 b7 62 01 00 00 00 00 00 cc f5 bd fa 27 16 00 00 00 00 00 c0 5c a7 2a b1 00 00 00 00 60 05 ce 8b 00 e0 f2 ee Data Ascii: fkl^@`86cA,jlb4=0"\k };Hm(z%%&hDg"u -8hM4\|xlrX^,~VT%\b'pb'\`

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:36 UTC	435	OUT	GET /f1718227932057x822365466237625200/DOCU-60cafc67.png HTTP/1.1 Host: meta-q.cdn.bubble.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:36 UTC	709	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:36 GMT Content-Type: image/png Content-Length: 22658 Connection: close Cf-Bgj: imgq:100,h2pri Cf-Polished: origSize=33006 Last-Modified: Wed, 12 Jun 2024 21:32:13 GMT cache-control: public,max-age=86400 etag: "282ba85a1c65bfadc21a004e2a4a9ad5" x-amz-id-2: ceXUydcp6EAs/OZblvKkETJpNdWi0JeGYg9lQidHUJLcNiC1OGrUQzjPkrOaNNvxFsuqsOXZTSU= x-amz-meta-app-version: live x-amz-meta-appname: meta x-amz-request-id: PYXAYR22FQQDKA78 x-amz-server-side-encryption: AES256 x-amz-version-id: VJwr9ehspq7Y4Hruul9084tFCPC0kb1W CF-Cache-Status: HIT Age: 81805 Accept-Ranges: bytes Server: cloudflare CF-RAY: 92358acdd9d6c44d-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:36 UTC	660	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 06 0b 00 00 06 0d 08 06 00 00 00 f4 90 6b 42 00 00 00 01 73 52 47 42 01 d9 c9 2c 7f 00 00 58 3c 49 44 41 54 78 da ec dd df eb dd 05 1d c7 f1 e7 5a f8 63 9b a5 a3 81 a2 e2 5a 33 d0 0a ac 06 82 20 b1 81 50 14 44 6a 11 68 45 66 84 17 d6 55 84 83 ac 2e bc 89 2e 2c 2a a2 1f 42 3f c0 8b 46 20 c6 c4 95 2b 67 5b d2 dc 82 72 df fc b1 2d 37 6d e4 36 99 b5 59 a3 82 ba 39 f0 85 f6 fd ea be ba ef f6 3d 9f f3 78 c0 8b cf 39 e7 2f 38 9c 27 6f ce a2 ff 5e 7f 7d 00 c0 6b b2 a2 ba a0 3a bf 5a 12 00 00 b3 f9 4f f5 ef 9a de f4 67 27 ec a5 00 80 d3 e6 f5 01 00 27 eb ea 6a 5d 75 45 b5 6a b4 8b 02 00 60 3e 1d af fe 31 cb fe 39 c3 67 c7 aa bf 57 7f 9b 65 07 03 00 4e b0 c8 65 01 00 cc ea 9c ea c6 ea 83 d5 75 d5 1b 03 00 60 08 Data Ascii: PNGIHDRkBsRGB,X<IDATxZcZ3 PDjhEfU..,*B?F +g[r-7m6Y9=x9/8'o^}k:ZOg''j]uEj`>19gWeNeu`
2025-03-20 13:26:36 UTC	1369	IN	Data Raw: 7b 00 00 c0 42 f0 4c f5 40 f5 50 b5 a9 3a 1a 00 0b d2 eb 02 80 61 f9 76 00 00 c0 42 b1 b2 ba ad da 50 1d a9 b6 56 77 56 57 fb 5d 0a 60 4e 5c 16 00 c0 1c 7c bc fa 61 00 00 c0 38 38 52 fd b2 da 54 6d ac 0e 04 c0 cc c4 02 00 38 69 e7 56 7b aa 8b 02 00 00 c6 d1 ae ea be 6a 63 b5 35 00 a6 89 05 00 70 d2 3e 57 dd 1d 00 00 30 04 87 aa 8d d5 fd d5 83 d5 b1 00 f0 9f 05 00 f0 0a ce aa be 10 00 00 30 14 2b aa 4f 54 1b aa 17 aa 4d d5 ed d5 a5 01 e0 b2 00 00 66 f1 e9 ea bb 01 00 00 93 60 aa ba af da 50 ed 0c 00 97 05 00 30 f2 99 00 00 80 49 71 65 75 47 b5 a3 9a aa be 58 ad 0e 00 97 05 00 4c b4 37 57 7b 03 00 00 26 dd 8e ea de d1 0e 04 80 cb 02 00 26 ca ad 01 00 00 d4 bb ab af 55 cf 55 5b aa db aa e5 01 e0 b2 00 80 89 f0 64 f5 d6 00 00 00 66 f6 8b a6 2f 0e 8e 07 80 cb Data Ascii: {BL@P:avBPVwVW]`N\\|a88RTm8iV{jc5p>W00+OTMf`P0IqeuGXL7W{&&UU[df/
2025-03-20 13:26:36 UTC	1369	IN	Data Raw: 00 00 60 ea b6 55 4b d5 a1 6a 5d c0 df 88 05 00 00 00 00 c0 08 d6 57 87 ab c5 6a 73 c0 9f 88 05 00 00 00 00 c0 48 76 54 cb d5 e3 01 7f 10 0b 00 00 00 00 80 d1 6c ac de ab de af ae 09 48 2c 00 00 00 00 00 46 f5 58 f5 63 b5 3b 40 2c 00 00 00 00 00 86 75 63 75 b2 7a c5 e3 c7 20 16 00 00 00 00 00 e3 ba a2 7a b1 5a ac 16 02 c4 02 00 00 00 00 60 58 3b aa b3 d5 93 01 62 01 00 00 00 00 30 ac 0d d5 3b d5 87 d5 d5 01 62 01 00 00 00 00 30 ac 47 aa a5 ea d6 00 b1 00 00 00 00 00 18 d6 96 ea bb ea e9 00 b1 00 00 00 00 00 18 d6 7c f5 56 75 cc 6f 89 40 2c 00 00 00 00 00 c6 b6 bf 5a aa 6e 09 10 0b 00 00 00 00 80 61 6d a9 ce 54 4f 05 88 05 00 00 00 00 c0 b0 e6 ab b7 ab 63 d5 7c 80 58 00 c0 e4 ad 04 00 00 00 ff 6c 7f f5 7d b5 10 f0 3b 7b f7 ce 1a 66 1d 05 60 fc c9 45 6b 4a Data Ascii: `UKj]WjsHvTlH,FXc;@,ucuz zZ`X;b0;b0G\|Vuo@,ZnamTOc\|Xl};{f`EkJ
2025-03-20 13:26:36 UTC	1369	IN	Data Raw: 00 00 00 00 80 d1 2e 54 5f 07 62 01 00 0b b2 1f 00 00 00 b0 8a 03 d5 ed ea e3 40 2c 00 60 21 36 02 00 00 00 56 75 b4 ba 55 6d 05 62 01 00 00 00 00 c0 58 c7 aa dd 6a 33 10 0b 00 00 00 00 00 c6 da a9 ce 05 62 01 00 00 00 00 c0 68 67 aa 1f 02 b1 00 00 00 00 00 60 b4 7f ab 9d 18 4f 2c 00 00 00 00 00 98 6b b3 da ad 3e 88 d1 c4 02 00 00 00 00 80 d9 b6 aa bb d5 56 8c 25 16 00 00 00 00 00 70 ac da f5 33 9e cb e1 01 00 00 00 00 a8 da a9 ce c5 48 62 01 00 00 00 00 00 0f fd 54 9d 8e 71 c4 02 00 00 00 00 00 ea 91 ff aa af 62 14 b1 00 00 00 00 00 80 7a e4 40 75 ad 7a 27 c6 10 0b 00 00 00 00 00 78 dc 76 75 a3 3a 18 23 88 05 00 00 00 00 00 3c c9 e7 d5 f9 18 41 2c 00 00 00 00 00 e0 69 4e 55 bf c6 e2 89 05 00 00 00 00 00 3c cb d9 ea db 58 34 b1 00 00 00 00 00 80 e7 fd 91 Data Ascii: .T_b@,`!6VuUmbXj3bhg`O,k>V%p3HbTqbz@uz'xvu:#<A,iNU<X4
2025-03-20 13:26:36 UTC	1369	IN	Data Raw: da 87 ea 74 88 05 00 2c 94 cd 00 00 00 00 fe de a9 ea 63 88 05 00 2c 14 37 0c 00 00 00 d8 ab 67 d5 d9 30 b4 00 00 00 00 00 30 d6 89 ea 53 88 05 00 00 00 00 00 8c b6 5a 9d 0f b1 00 00 00 00 00 80 b1 8e 55 6b 21 16 00 00 00 00 00 30 da d3 ea 62 88 05 00 00 00 00 00 8c 75 a4 5a 0f b1 00 00 00 00 00 80 d1 1e f9 5d 20 16 00 00 00 00 00 30 db a1 ea 6b 88 05 00 00 00 00 00 8c 76 bf ba 1c 62 01 00 00 00 00 00 63 2d 55 df 42 2c 00 e0 c0 da 0c 00 00 00 e0 df dd ab ae 37 9c 58 00 c0 41 e5 86 01 00 00 00 ff cb 7a c3 19 5a 00 00 00 00 00 98 ee 6e 75 a5 c1 c4 02 00 00 00 00 00 a6 5b aa 3e 35 98 58 00 00 00 00 00 00 f5 a0 ba d4 50 62 01 00 00 00 00 00 d4 a1 ea 5d 43 89 05 00 00 00 00 00 50 55 8f ab 73 0d 24 16 00 00 00 00 00 40 55 1d a9 3e 36 90 58 00 00 00 00 00 00 6d Data Ascii: t,c,7g00SZUk!0buZ] 0kvbc-UB,7XAzZnu[>5XPb]CPUs$@U>6Xm
2025-03-20 13:26:36 UTC	1369	IN	Data Raw: 02 00 00 00 58 96 df 5d 47 2c 00 80 b5 56 01 00 00 00 2c cb 5e b5 d5 55 62 01 00 00 00 00 00 8c b1 59 7d e9 0a b1 00 00 00 00 00 00 66 39 ea 0a b1 00 00 00 00 00 00 66 39 ec 0a b1 00 00 00 00 00 00 66 79 5a bd ea 12 b1 00 00 00 00 00 00 e6 f9 d9 25 62 01 00 00 00 00 00 cc 73 d4 25 62 01 00 00 00 00 00 cc f3 a1 da ae aa 12 0b 00 00 00 00 00 60 9e 55 f5 ab aa 12 0b 00 00 00 00 00 60 a8 a3 aa 2a b1 00 00 00 00 00 00 66 fa 51 3d a8 12 0b 00 00 00 00 00 60 a6 ed 6a b7 4a 2c 00 80 f5 ce 03 00 00 00 58 b6 c3 aa c4 02 00 b0 61 00 00 00 c0 58 df aa 1c 2d 00 00 00 00 00 30 d7 eb ea 91 58 00 00 00 00 00 00 b3 7d 17 0b 00 00 00 00 00 60 b6 7d b1 00 00 00 00 00 00 66 3b 10 0b 00 00 00 00 00 60 b6 e7 d5 0b b1 00 00 00 00 00 00 66 3b 10 0b 00 00 00 00 00 60 b6 7d b1 00 Data Ascii: X]G,V,^UbY}f9f9fyZ%bs%b`U`*fQ=`jJ,XaX-0X}`}f;`f;`}
2025-03-20 13:26:36 UTC	1369	IN	Data Raw: 05 00 0e b0 9f 5b 5b 2d 57 c7 c7 5b 2e 8d 8e 7e f9 a5 65 00 00 c0 ff eb da ed b0 e0 66 92 4f 49 ce 06 00 f2 37 cd 02 00 28 87 57 2b 2b ed c7 47 46 be 7e 5b 5b 5b 0f 00 00 ec b1 66 c1 9d 24 43 01 80 ea a9 4b 62 cc 12 80 9a b0 b2 b1 d1 d6 51 2c ae 17 97 97 ad 25 02 00 e0 5f 75 ee 56 58 f0 28 c9 93 00 40 95 39 70 0c 40 2d d9 dc d9 39 72 79 6c ac f0 6c 7e fe 73 00 00 a0 74 6d 49 0e 97 fb a3 65 30 c9 fd 00 00 00 50 0d 0d b7 26 27 4f 3e 9c 9d 9d 0a 00 00 94 ae bb 9c 61 c1 75 87 8c 01 d8 4b ac 21 02 a0 46 d5 0d cc cc 9c bb 31 31 f1 26 00 00 bf d9 bb 9b 16 1f f7 38 8e e3 9f ab dc 74 9c 85 53 ce c9 21 33 64 30 c4 82 14 45 94 94 9b 28 3b 2b ca c2 b3 b0 f2 2c 2c ec d8 d8 8a 22 45 63 6e 64 a1 2c 94 94 95 0d 63 78 0c 7f 4d d9 08 ff b9 ae f9 8f e9 ba ae df eb f5 34 de Data Ascii: [[-W[.~efOI7(W++GF~[[[f$CKbQ,%_uVX(@9p@-9ryll~stmIe0P&'O>auK!F11&8tS!3d0E(;+,,"Ecnd,cxM4
2025-03-20 13:26:36 UTC	1369	IN	Data Raw: a6 c4 02 00 00 00 2a 4f 30 00 00 b0 2c 00 00 00 00 c1 00 00 40 2c 00 00 00 00 c1 00 00 40 2c 00 00 00 00 c1 00 00 40 2c 00 00 00 00 c1 00 00 40 2c 00 00 00 80 76 30 d8 2b 8a 1b c1 00 00 40 2c 00 00 00 20 b0 a3 56 6b 4d 30 00 00 e8 69 4a 2c 00 00 00 a0 d6 04 03 00 00 cb 02 00 00 00 68 07 83 97 f7 f7 0c 00 00 b1 00 00 00 80 a0 52 30 d8 29 8a 3b c1 00 00 40 2c 00 00 00 20 b0 93 a7 a7 15 c1 00 00 40 2c 00 00 00 20 38 c1 00 00 40 2c 00 00 00 80 2c 05 83 ed 3c bf 15 0c 00 00 b2 64 56 2c 00 00 00 20 a4 d3 b2 5c b5 30 00 00 f8 22 16 00 00 00 10 96 4b 22 00 80 b6 71 b1 00 00 00 80 b0 04 03 00 00 b1 00 00 00 00 04 03 00 00 b1 00 00 00 00 04 03 00 20 bc 31 b1 00 00 00 00 04 03 00 20 36 cb 02 00 00 00 e8 0c 06 cf 82 01 00 10 8b 65 01 00 00 00 74 06 83 ad 3c bf 17 0c Data Ascii: *O0,@,@,@,@,v0+@, VkM0iJ,hR0);@, @, 8@,,<dV, \0"K"q 1 6et<
2025-03-20 13:26:36 UTC	1369	IN	Data Raw: 9e 4c 76 04 03 00 68 bc a1 58 00 00 00 00 08 06 00 90 9b 58 00 00 00 00 08 06 00 90 dc bd 58 00 00 00 00 c4 a6 82 c1 91 60 00 00 2b 73 b3 00 00 00 00 e8 94 2b c1 00 00 9a 68 20 16 00 00 00 00 9f 04 03 00 48 c9 b2 00 00 00 00 f8 4a 30 00 80 74 c4 02 00 00 00 e0 27 c1 00 00 52 f1 0d 11 00 00 00 f0 3b c1 00 00 d2 b0 2c 00 00 00 00 16 d8 50 30 38 2d 8a 00 00 be 13 0b 00 00 00 80 24 3e 82 c1 71 bf 3f 15 0c 00 e0 5f 5c 8a 05 00 00 00 40 23 0c ca 72 5b 30 00 80 8d 1b 45 c4 4c 2c 00 00 00 00 96 22 18 00 40 27 dd 46 45 2c 00 00 00 00 96 26 18 00 40 e7 0c c4 02 00 00 00 60 55 82 01 00 74 8b 65 01 00 00 00 d0 5c 82 01 00 88 05 00 00 00 00 82 01 00 f8 86 08 00 00 00 40 30 00 80 9a 5d 8b 05 00 00 00 40 2b 08 06 00 50 9b 4b b1 00 00 00 00 68 0d c1 00 00 6a 71 21 16 00 Data Ascii: LvhXXX`+s+h HJ0t'R;,P08-$>q?_\@#r[0EL,"@'FE,&@`Ute\@0]@+PKhjq!
2025-03-20 13:26:36 UTC	1369	IN	Data Raw: ef a0 05 00 00 00 00 00 9a 6d 53 2c 00 00 00 00 00 80 66 6b 89 05 00 00 00 00 00 d0 6c 5e 16 00 00 00 00 00 40 c3 89 05 00 00 00 00 00 d0 60 9d 88 38 15 0b 00 00 00 00 00 a0 b9 36 63 41 2c 00 00 00 00 00 80 e6 6a 89 05 00 00 00 00 00 d0 6c 62 01 00 00 00 00 00 34 dc 3d b1 00 00 00 00 00 00 9a eb 30 22 9e 8b 05 00 00 00 00 00 d0 5c 6b b1 20 16 00 00 00 f0 96 7d 3b 48 6d 2a 80 02 28 7a bb ff 25 25 86 26 68 d3 d6 a0 e0 44 67 22 8e 04 75 20 2d 38 68 9b fe 4d 34 7c 78 e7 6c e3 72 01 00 98 eb a3 58 00 00 00 00 00 00 b3 9d c4 02 00 00 00 00 00 98 ed 5e 2c 00 00 00 00 00 80 b9 7e 56 bf c5 02 00 00 00 00 00 98 eb 54 25 16 00 00 00 00 00 c0 5c 62 01 00 00 00 00 00 0c 27 16 00 00 00 00 00 c0 70 b7 62 01 00 00 00 00 00 cc f5 bd fa 27 16 00 00 00 00 00 c0 5c a7 2a b1 Data Ascii: mS,fkl^@`86cA,jlb4=0"\k };Hm(z%%&hDg"u -8hM4\|xlrX^,~VT%\b'pb'\

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:52 UTC	720	OUT	GET /8kfUZ HTTP/1.1 Host: office.endangered.it.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://hyj48i39.s3.us-east-1.amazonaws.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:52 UTC	882	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 20 Mar 2025 13:26:52 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: http://office.endangered.it.com/8kfUZ/ cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mIfgU5WQkl%2Bf9vfRZ3fubveBZGrPfTFB65cBA%2BOJsIamg1qyRVg2r8E7oG1DTztMCRdJQ2pYhP%2BNTlqgi7E5IM9WxwduXZv%2B%2B%2BwDEq2qdiUpJc%2F17O2mTiEYWaQjUvwCsSWgxnYTUxj%2FXB0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92358b320e77437f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=99104&min_rtt=97919&rtt_var=21887&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1292&delivery_rate=38035&cwnd=235&unsent_bytes=0&cid=8f371a667d577a02&ts=443&x=0"
2025-03-20 13:26:52 UTC	253	IN	Data Raw: 66 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 66 66 69 63 65 2e 65 6e 64 61 6e 67 65 72 65 64 2e 69 74 2e 63 6f 6d 2f 38 6b 66 55 5a 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: f7<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://office.endangered.it.com/8kfUZ/">here</a>.</p></body></html>
2025-03-20 13:26:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:52 UTC	666	OUT	GET /8kfUZ/ HTTP/1.1 Host: office.endangered.it.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:53 UTC	1000	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=ihf6a32hd8trftdvhagpnglago; path=/ cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LmCAFtXM6vi%2BN3AqpAe0isy09cO%2FgWoYYwdBgVmsl9Tb0EaHxtTDatkwosc0YbAYQC%2FXOULKJIruXDeAOuIOUEaXV1xYQ2U0RzgXgjpllSwyAutGUH1GlAq%2BCn4a4OrR0E%2BhqJ6tHYlYQ2I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92358b364add41ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=99435&min_rtt=96880&rtt_var=23029&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1238&delivery_rate=38388&cwnd=222&unsent_bytes=0&cid=7d80832e4e162e3a&ts=433&x=0"
2025-03-20 13:26:53 UTC	369	IN	Data Raw: 31 30 65 61 0d 0a 20 20 20 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 78 65 6e 6f 70 68 69 6c 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 3c 73 70 61 6e 3e 41 20 70 61 73 73 69 6f 6e 61 74 65 20 74 65 61 63 68 65 72 20 69 6e 73 70 69 72 65 64 20 73 74 75 64 65 6e 74 73 20 74 6f 20 70 75 72 73 75 65 20 63 61 72 65 65 72 73 20 69 6e 20 73 63 69 65 6e 63 65 20 61 6e 64 20 74 65 63 68 6e 6f 6c 6f 67 79 2e 3c 2f 73 70 61 6e 3e 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 Data Ascii: 10ea <html lang="en"> <head> <meta charset="UTF-8"> <title>xenophile</title> ... <span>A passionate teacher inspired students to pursue careers in science and technology.</span> --> <meta name="robots" cont
2025-03-20 13:26:53 UTC	1369	IN	Data Raw: 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 74 75 72 6e 73 74 69 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 3c 70 3e 54 68 65 20 65 6e 67 69 6e 65 65 72 73 20 64 65 76 65 6c 6f 70 65 64 20 73 65 6c 66 2d 64 72 69 76 69 6e 67 20 74 65 63 68 6e 6f 6c 6f 67 79 20 74 6f 20 69 6d 70 72 6f 76 65 20 74 72 61 6e 73 70 6f 72 74 61 74 69 6f 6e 20 73 61 66 65 74 79 2e 3c 2f 70 3e 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2a 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 20 54 68 65 20 61 73 74 72 6f 6e 61 75 74 73 20 63 6f 6e 64 75 Data Ascii: <script src="https://challenges.cloudflare.com/turnstile/v0/api.js"></script> ... <p>The engineers developed self-driving technology to improve transportation safety.</p> --> <style> * /* The astronauts condu
2025-03-20 13:26:53 UTC	1369	IN	Data Raw: 20 20 20 20 20 2f 2a 20 54 68 65 20 6a 6f 75 72 6e 61 6c 69 73 74 20 77 72 6f 74 65 20 61 6e 20 61 72 74 69 63 6c 65 20 61 62 6f 75 74 20 74 68 65 20 69 6d 70 61 63 74 20 6f 66 20 61 72 74 69 66 69 63 69 61 6c 20 69 6e 74 65 6c 6c 69 67 65 6e 63 65 2e 20 2a 2f 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 72 65 6d 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 31 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 38 70 78 29 20 7b Data Ascii: /* The journalist wrote an article about the impact of artificial intelligence. */ font-size: 1rem; margin-bottom: 30px; letter-spacing: 1px; } @media (max-width: 768px) {
2025-03-20 13:26:53 UTC	1231	IN	Data Raw: 61 74 65 72 20 70 75 72 69 66 69 63 61 74 69 6f 6e 20 73 79 73 74 65 6d 20 66 6f 72 20 72 75 72 61 6c 20 61 72 65 61 73 2e 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 54 68 65 20 65 6e 67 69 6e 65 65 72 73 20 64 65 76 65 6c 6f 70 65 64 20 73 65 6c 66 2d 64 72 69 76 69 6e 67 20 74 65 63 68 6e 6f 6c 6f 67 79 20 74 6f 20 69 6d 70 72 6f 76 65 20 74 72 61 6e 73 70 6f 72 74 61 74 69 6f 6e 20 73 61 66 65 74 79 2e 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 30 78 34 41 41 41 41 41 41 42 42 6d 66 51 4c 51 78 55 52 41 33 5a 30 78 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 67 6c Data Ascii: ater purification system for rural areas. --> ... The engineers developed self-driving technology to improve transportation safety. --> <span class="cf-turnstile" data-sitekey="0x4AAAAAABBmfQLQxURA3Z0x" data-callback="gl
2025-03-20 13:26:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:53 UTC	593	OUT	GET /turnstile/v0/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://office.endangered.it.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:54 UTC	386	IN	HTTP/1.1 302 Found Date: Thu, 20 Mar 2025 13:26:53 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/708f7a809116/api.js Server: cloudflare CF-RAY: 92358b3b19a8dc28-EWR alt-svc: h3=":443"; ma=86400

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:53 UTC	664	OUT	GET /logos/assets/PNG/Microsoft_Logo_512px.png HTTP/1.1 Host: mailmeteor.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://office.endangered.it.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:54 UTC	1172	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:53 GMT Content-Type: image/png Content-Length: 2309 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=14400, must-revalidate ETag: "fd1dd9eb8405629af71bda9e0fc8400c" content-security-policy: frame-ancestors 'self' *.mailmeteor.com referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-xss-protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3XRB5he5xAYjS3USxPefkwQOSVpvmNSnlN48rad7kXU2sLpXBvn7jndod31x9uFsB8il0YbmJ9rYv4aMgC0f7fou9F6rlLvIZFKfkYs97a8XzG%2FHycS5N0IGDUi0pTltnw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding CF-Cache-Status: HIT Age: 28 Accept-Ranges: bytes Strict-Transport-Security: max-age=2592000 Server: cloudflare CF-RAY: 92358b3b3f6f43cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=97266&min_rtt=97173&rtt_var=20641&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2817&recv_bytes=1236&delivery_rate=38225&cwnd=216&unsent_bytes=0&cid=9c537693f0e925cc&ts=256&x=0"
2025-03-20 13:26:54 UTC	197	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 06 00 00 00 f4 78 d4 fa 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 9a 49 44 41 54 78 01 ed d6 31 aa 5d 55 14 80 e1 b5 1f 8f 60 23 64 08 b7 b1 cf 10 14 c1 5e b0 b1 74 08 4e c0 c2 09 38 04 3b 3b b1 17 41 87 10 db 54 37 33 78 45 8a 40 20 3b 37 90 22 03 c8 39 24 f9 bf af d9 dd ea d6 5e ff 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDRxpHYssRGBgAMAaIDATx1]U`#d^tN8;;AT73xE@ ;7"9$^
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 7c aa d6 1c e8 c5 0f 5f fd b6 f7 3c 19 e0 44 eb e1 cb 3f 9f 7d 3f 07 f8 f5 9f 47 bf df e6 5f 06 38 cf 7a fd f4 97 6f 5f fd 3c 1f d8 fd 1c e8 dd f1 ff 7a 80 d3 ac d9 d7 39 c8 5e b7 7d de fb 32 c0 69 d6 be 9b 23 1c 33 15 00 f8 a8 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 Data Ascii: \|_<D?}?G_8zo_<z9^}2i#3$ H@ A$ H@ A$ H@ A$ H@ A$ H@ A
2025-03-20 13:26:54 UTC	743	IN	Data Raw: 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 02 00 00 82 04 00 00 04 09 00 00 08 12 00 00 10 24 00 00 20 48 00 00 40 90 00 00 80 20 01 00 00 41 Data Ascii: $ H@ A$ H@ A$ H@ A$ H@ A$ H@ A$ H@ A$ H@ A$ H@ A

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:54 UTC	608	OUT	GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://office.endangered.it.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:54 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:54 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48123 Connection: close accept-ranges: bytes last-modified: Tue, 18 Mar 2025 12:36:20 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 92358b3e3b1258c1-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function jt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 61 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 6c 3d 21 31 2c 76 2c 68 3b 74 72 79 7b 66 6f 72 28 61 3d 61 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 76 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 76 2e 76 61 6c 75 65 29 2c 21 28 74 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 74 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function Bt(e,t){var a=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(a!=null){var o=[],c=!0,l=!1,v,h;try{for(a=a.call(e);!(c=(v=a.next()).done)&&(o.push(v.value),!(t&&o.length===t));c=!0)
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 28 70 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 76 26 26 28 76 3d 30 2c 70 5b 30 5d 26 26 28 61 3d 30 29 29 2c 61 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 6c 3d 70 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 70 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 6c 3d 63 2e 72 65 74 75 72 6e 29 26 26 6c 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 6c 3d 6c 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 6c 3b 73 77 69 74 63 68 28 63 3d 30 2c 6c 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 6c 2e 76 61 6c Data Ascii: ])}}function s(p){if(o)throw new TypeError("Generator is already executing.");for(;v&&(v=0,p[0]&&(a=0)),a;)try{if(o=1,c&&(l=p[0]&2?c.return:p[0]?c.throw\|\|((l=c.return)&&l.call(c),0):c.next)&&!(l=l.call(c,p[1])).done)return l;switch(c=0,l&&(p=[p[0]&2,l.val
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 29 3b 76 61 72 20 48 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 2c 65 2e 4c 69 67 68 74 3d 22 6c 69 67 68 74 22 2c 65 2e 44 61 72 6b 3d 22 64 61 72 6b 22 7d 29 28 48 65 7c 7c 28 48 65 3d 7b 7d 29 29 3b 76 61 72 20 43 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 65 72 69 66 79 69 6e 67 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 65 72 69 66 79 69 6e 67 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 56 65 72 69 66 79 69 6e 67 4f 76 65 72 72 75 6e 3d 22 76 65 72 69 66 79 69 6e 67 2d 6f 76 65 72 72 75 6e 22 2c 65 2e 46 61 69 6c 75 72 65 57 6f 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 3d 22 66 61 69 6c 75 72 65 2d 77 6f Data Ascii: );var He;(function(e){e.Auto="auto",e.Light="light",e.Dark="dark"})(He\|\|(He={}));var Ce;(function(e){e.Verifying="verifying",e.VerifyingHavingTroubles="verifying-having-troubles",e.VerifyingOverrun="verifying-overrun",e.FailureWoHavingTroubles="failure-wo
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 75 74 65 22 2c 65 2e 41 75 74 6f 45 78 70 69 72 65 3d 22 61 75 74 6f 5f 65 78 70 69 72 65 22 2c 65 2e 41 75 74 6f 54 69 6d 65 6f 75 74 3d 22 61 75 74 6f 5f 74 69 6d 65 6f 75 74 22 2c 65 2e 4d 61 6e 75 61 6c 52 65 66 72 65 73 68 3d 22 6d 61 6e 75 61 6c 5f 72 65 66 72 65 73 68 22 2c 65 2e 41 70 69 3d 22 61 70 69 22 2c 65 2e 43 68 65 63 6b 44 65 6c 61 79 73 3d 22 63 68 65 63 6b 5f 64 65 6c 61 79 73 22 2c 65 2e 54 69 6d 65 43 68 65 63 6b 43 61 63 68 65 64 57 61 72 6e 69 6e 67 41 75 78 3d 22 74 69 6d 65 5f 63 68 65 63 6b 5f 63 61 63 68 65 64 5f 77 61 72 6e 69 6e 67 5f 61 75 78 22 2c 65 2e 4a 73 43 6f 6f 6b 69 65 73 4d 69 73 73 69 6e 67 41 75 78 3d 22 6a 73 5f 63 6f 6f 6b 69 65 73 5f 6d 69 73 73 69 6e 67 5f 61 75 78 22 2c 65 2e 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: ute",e.AutoExpire="auto_expire",e.AutoTimeout="auto_timeout",e.ManualRefresh="manual_refresh",e.Api="api",e.CheckDelays="check_delays",e.TimeCheckCachedWarningAux="time_check_cached_warning_aux",e.JsCookiesMissingAux="js_cookies_missing_aux",e.Redirecting
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 74 2e 73 65 74 28 22 6f 66 66 6c 61 62 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 29 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 4c 65 76 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 74 2e 73 65 74 28 22 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 Data Ascii: s;if(e.params._debugSitekeyOverrides&&(e.params._debugSitekeyOverrides.offlabel!=="default"&&t.set("offlabel",e.params._debugSitekeyOverrides.offlabel),e.params._debugSitekeyOverrides.clearanceLevel!=="default"&&t.set("clearance_level",e.params._debugSite
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 5f 29 7d 76 61 72 20 53 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 61 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 43 65 2e 46 61 69 6c 75 72 65 46 65 65 64 62 61 63 6b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 43 65 2e 46 61 69 6c 75 72 65 48 61 76 69 6e 67 54 72 6f 75 62 6c 65 73 2c 6c 2c 76 3d 4c 28 4d 72 2c 28 6c 3d 28 74 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 74 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 22 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 2c 68 2c 73 Data Ascii: guage,"/").concat(_)}var St=function(e){var t,a,o=window.innerWidth<400,c=e.state===Ce.FailureFeedback\|\|e.state===Ce.FailureHavingTroubles,l,v=L(Mr,(l=(t=e.displayLanguage)===null\|\|t===void 0?void 0:t.toLowerCase())!==null&&l!==void 0?l:"nonexistent"),h,s
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 4f 65 28 65 2c 74 2c 61 29 7b 72 65 74 75 72 6e 20 42 65 28 29 3f 4f 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 4f 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 76 29 7b 76 61 72 20 68 3d 5b 6e 75 6c 6c 5d 3b 68 2e 70 75 73 68 2e 61 70 70 6c 79 28 68 2c 6c 29 3b 76 61 72 20 73 3d 46 75 6e 63 74 69 6f 6e 2e 62 69 6e 64 2e 61 70 70 6c 79 28 63 2c 68 29 2c 70 3d 6e 65 77 20 73 3b 72 65 74 75 72 6e 20 76 26 26 65 65 28 70 2c 76 2e 70 72 6f 74 6f 74 79 70 65 29 2c 70 7d 2c 4f 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 Data Ascii: eflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Oe(e,t,a){return Be()?Oe=Reflect.construct:Oe=function(c,l,v){var h=[null];h.push.apply(h,l);var s=Function.bind.apply(c,h),p=new s;return v&&ee(p,v.prototype),p},Oe.apply(null,argu
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 3b 66 75 6e 63 74 69 6f 6e 20 67 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 66 72 28 61 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 78 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 58 65 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 73 74 61 72 74 73 57 69 74 68 28 71 65 29 3f 65 2e 73 75 62 73 74 72 69 6e 67 28 71 65 2e 6c 65 6e 67 74 68 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 24 28 65 29 7b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 71 65 29 2e 63 6f 6e 63 61 74 28 65 29 Data Ascii: ;function g(e,t){var a="[Cloudflare Turnstile] ".concat(e,".");throw new fr(a,t)}function x(e){console.warn("[Cloudflare Turnstile] ".concat(e))}function Xe(e){return e.startsWith(qe)?e.substring(qe.length):null}function $(e){return"".concat(qe).concat(e)
2025-03-20 13:26:54 UTC	1369	IN	Data Raw: 67 68 74 3d 22 31 30 30 76 68 22 2c 73 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 73 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 73 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 73 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 22 3b 76 61 72 20 70 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 70 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 74 61 62 6c 65 2d 63 65 6c 6c 22 2c 70 2e 73 74 79 6c 65 2e 76 65 72 74 69 63 61 6c Data Ascii: ght="100vh",s.style.top="0",s.style.left="0",s.style.transformOrigin="center center",s.style.overflowX="hidden",s.style.overflowY="auto",s.style.background="rgba(0,0,0,0.4)";var p=document.createElement("div");p.style.display="table-cell",p.style.vertical

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:55 UTC	849	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://office.endangered.it.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:56 UTC	1297	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 28317 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: default-src 'none'; script-src 'nonce-Fiz5P3ZDvVoj0OdX' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
2025-03-20 13:26:56 UTC	411	IN	Data Raw: 63 72 69 74 69 63 61 6c 2d 63 68 3a 20 53 65 63 2d 43 48 2d 55 41 2d 42 69 74 6e 65 73 73 2c 20 53 65 63 2d 43 48 2d 55 41 2d 41 72 63 68 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 62 69 6c 65 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 64 65 6c 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2d 4c 69 73 74 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2c 20 53 65 63 2d 43 48 2d 55 41 2c 20 55 41 2d 42 69 74 6e 65 73 73 2c 20 55 41 2d 41 72 63 68 2c 20 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 4d 6f 62 69 6c 65 2c 20 55 41 2d 4d 6f 64 65 6c 2c 20 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 20 55 41 2d 50 Data Ascii: critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-P
2025-03-20 13:26:56 UTC	1030	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 2d 73 72 63 20 26 23 78 32 37 3b 6e 6f 6e 65 26 23 78 32 37 3b 3b 20 73 63 72 69 70 74 2d 73 72 63 20 26 23 78 32 37 3b 6e 6f 6e 63 65 2d 46 69 7a 35 50 33 5a 44 76 56 6f 6a 30 4f 64 58 26 23 78 32 37 3b 20 26 23 78 32 37 3b 75 6e 73 61 66 65 2d Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="x-ua-compatible" content="IE=Edge,chrome=1"> <meta http-equiv="content-security-policy" content="default-src 'none'; script-src 'nonce-Fiz5P3ZDvVoj0OdX' 'unsafe-
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 6d 65 73 20 66 69 6c 6c 66 61 69 6c 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 33 30 70 78 20 30 20 30 20 23 64 65 31 33 30 33 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 33 30 70 78 20 23 32 33 32 33 32 33 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 69 6c 6c 66 61 69 6c 2d 6f 66 66 6c 61 62 65 6c 2d 64 61 72 6b 7b 74 6f 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 33 30 70 78 20 23 66 66 66 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 30 31 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 Data Ascii: mes fillfail{to{box-shadow:inset 0 30px 0 0 #de1303}}@keyframes fillfail-offlabel{to{box-shadow:inset 0 0 0 30px #232323}}@keyframes fillfail-offlabel-dark{to{box-shadow:inset 0 0 0 30px #fff}}@keyframes scale-up-center{0%{transform:scale(.01)}to{transfor
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 61 6c 69 67 6e 3a 72 69 67 68 74 7d 23 6f 76 65 72 72 75 6e 2d 69 2c 23 73 70 69 6e 6e 65 72 2d 69 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 70 69 6e 20 35 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 68 65 69 67 68 74 3a 33 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 7d 23 66 61 69 6c 2d 69 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 35 35 2c 2e 30 38 35 2c 2e 36 38 2c 2e 35 33 29 20 62 6f 74 68 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 23 64 65 31 33 30 33 7d 23 66 61 69 6c 2d 69 2c 23 73 75 63 63 65 73 73 2d 69 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 64 69 73 70 6c 61 79 3a 66 Data Ascii: align:right}#overrun-i,#spinner-i{animation:spin 5s linear infinite;display:flex;height:30px;width:30px}#fail-i{animation:scale-up-center .6s cubic-bezier(.55,.085,.68,.53) both;box-shadow:inset 0 0 0 #de1303}#fail-i,#success-i{border-radius:50%;display:f
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 61 61 39 33 37 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 3a 23 30 61 61 39 33 37 3b 66 69 6c 6c 3a 23 30 61 61 39 33 37 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 78 70 69 72 65 64 2d 63 69 72 63 6c 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 74 69 6d 65 6f 75 74 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 39 39 39 3b 66 69 6c 6c 3a 23 39 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 65 78 70 Data Ascii: hadow:inset 0 0 0 #0aa937}.theme-dark .success-circle{stroke:#0aa937;fill:#0aa937}.theme-dark .expired-circle,.theme-dark .timeout-circle{stroke-dasharray:166;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#999;fill:#999}.theme-dark #exp
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 68 31 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 61 63 74 69 76 65 2c Data Ascii: }.theme-dark h1{color:#fff}.theme-dark #challenge-error-title{color:#ffa299}.theme-dark #challenge-error-title a,.theme-dark #challenge-error-title a:link,.theme-dark #challenge-error-title a:visited{color:#bbb}.theme-dark #challenge-error-title a:active,
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 65 73 68 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6f 76 65 72 6c 61 79 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 3b 63 6f 6c 6f 72 3a 23 66 66 61 32 39 39 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 3a 6c 69 6e 6b Data Ascii: esh-link:active,.theme-dark #timeout-refresh-link:focus,.theme-dark #timeout-refresh-link:hover{color:#949494}.theme-dark .overlay{border-color:#ffa299;color:#ffa299}.theme-dark .error-message,.theme-dark .error-message a,.theme-dark .error-message a:link
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 3a 63 68 65 63 6b 65 64 7e 2e 63 62 2d 69 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 6f 70 61 63 69 74 79 3a 31 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 20 73 63 61 6c 65 28 31 29 7d 2e 63 62 2d 6c 62 20 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 7e 2e 63 62 2d 69 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 3a 73 6f 6c 69 64 20 23 63 34 34 64 30 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 30 20 34 70 78 20 34 70 78 20 30 3b 68 65 69 67 68 74 3a 31 32 70 78 3b 6c 65 66 74 3a 35 70 78 3b 74 6f 70 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 34 35 64 65 67 29 20 73 63 61 6c 65 28 31 29 3b 77 69 64 Data Ascii: :checked~.cb-i{background-color:#fff;border-radius:5px;opacity:1;transform:rotate(0deg) scale(1)}.cb-lb input:checked~.cb-i:after{border:solid #c44d0e;border-radius:0;border-width:0 4px 4px 0;height:12px;left:5px;top:0;transform:rotate(45deg) scale(1);wid
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 20 73 70 61 63 65 2d 65 76 65 6e 6c 79 3b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 65 78 70 69 72 65 64 2d 74 65 78 74 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 6f 76 65 72 72 75 6e 2d 74 65 78 74 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 69 6d 65 6f 75 74 2d 74 65 78 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 65 78 70 69 72 65 64 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 69 6d 65 6f 75 74 2d 72 65 66 72 65 73 68 2d 6c 69 6e 6b 2c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 20 61 7b 6d 61 72 67 69 6e 3a 30 Data Ascii: ontent:center space-evenly;visibility:visible}.size-compact #expired-text,.size-compact #overrun-text,.size-compact #timeout-text{display:block}.size-compact #expired-refresh-link,.size-compact #timeout-refresh-link,.size-compact .error-message a{margin:0
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 36 70 78 7d 23 74 65 72 6d 73 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 38 70 78 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 30 70 78 7d 23 74 65 72 6d 73 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 3a 30 20 2e 32 72 65 6d 7d 23 74 65 72 6d 73 20 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 23 74 65 72 6d 73 20 61 2c 23 74 65 72 6d 73 20 61 3a 6c 69 6e 6b 2c 23 74 65 72 6d 73 20 61 3a 76 69 73 69 74 65 64 7b 63 6f Data Ascii: {margin-left:0;margin-right:16px}#terms{color:#232323;display:inline-flex;font-size:8px;font-style:normal;justify-content:flex-end;line-height:10px}#terms .link-spacer{margin:0 .2rem}#terms a{display:inline-block}#terms a,#terms a:link,#terms a:visited{co

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:56 UTC	772	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=92358b47afc40f63&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:56 UTC	331	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:56 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 109950 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 92358b4b1b3aa67e-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:56 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 43 75 55 53 37 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 Data Ascii: window._cf_chl_opt.CuUS7={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23brow
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 6e 74 61 63 74 25 32 30 74 68 65 25 32 30 77 65 62 73 69 74 65 25 32 30 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 25 32 30 6f 72 25 32 30 73 75 62 6d 69 74 25 32 30 61 25 32 30 66 65 65 64 62 61 63 6b 25 32 30 72 65 70 6f 72 74 22 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 22 59 6f 75 72 25 32 30 66 65 65 64 62 61 63 6b 25 32 30 72 65 70 6f 72 74 25 32 30 68 61 73 25 32 30 62 65 65 6e 25 32 30 73 75 63 63 65 73 73 66 75 6c 6c 79 25 32 30 73 75 62 6d 69 74 74 65 64 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 65 65 64 62 61 63 6b 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 53 65 6e 64 25 32 30 46 65 65 64 62 61 63 6b 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 69 66 72 61 6d 65 5f 61 6c 74 22 3a 22 57 69 Data Ascii: ntact%20the%20website%20administrator%20or%20submit%20a%20feedback%20report","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","turnstile_feedback_description":"Send%20Feedback","turnstile_iframe_alt":"Wi
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 65 25 32 30 65 6d 62 65 64 64 65 64 25 32 30 69 6e 74 6f 25 32 30 61 25 32 30 70 61 72 65 6e 74 25 32 30 70 61 67 65 2e 22 7d 2c 22 70 6f 6c 79 66 69 6c 6c 73 22 3a 7b 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 67 75 69 64 65 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 61 75 78 5f 73 75 62 74 69 74 6c 65 22 3a 66 61 6c 73 65 7d 2c 22 72 74 6c 22 3a 66 61 6c 73 65 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 75 73 22 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 67 4a 2c 65 4d 2c 65 4e 2c 65 52 2c 65 53 2c 65 56 2c 65 59 2c 66 30 2c 66 31 2c 66 32 2c 66 65 2c 66 71 2c 66 77 2c 66 78 2c 66 79 2c 66 49 2c 66 Data Ascii: e%20embedded%20into%20a%20parent%20page."},"polyfills":{"feedback_report_guideline":false,"feedback_report_output_subtitle":false,"feedback_report_aux_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eR,eS,eV,eY,f0,f1,f2,fe,fq,fw,fx,fy,fI,f
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 7d 2c 65 53 3d 66 75 6e 63 74 69 6f 6e 28 67 59 2c 64 2c 65 2c 66 2c 67 29 7b 72 65 74 75 72 6e 20 67 59 3d 67 4a 2c 64 3d 7b 27 74 64 6e 57 44 27 3a 67 59 28 31 30 36 35 29 2c 27 46 6d 77 72 78 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 69 7d 2c 27 58 48 54 74 58 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 3d 68 7d 2c 27 4f 56 6a 6d 7a 27 3a 67 59 28 37 37 32 29 2c 27 66 78 79 66 48 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 6b 54 44 73 65 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 44 6a 54 79 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 6b 67 47 63 4c Data Ascii: },eS=function(gY,d,e,f,g){return gY=gJ,d={'tdnWD':gY(1065),'Fmwrx':function(h,i){return h==i},'XHTtX':function(h,i){return i===h},'OVjmz':gY(772),'fxyfH':function(h,i){return h<i},'kTDse':function(h,i){return h-i},'DjTyj':function(h,i){return h(i)},'kgGcL
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 68 2c 36 2c 66 75 6e 63 74 69 6f 6e 28 69 2c 68 30 29 7b 72 65 74 75 72 6e 20 68 30 3d 67 5a 2c 64 5b 68 30 28 31 32 30 33 29 5d 5b 68 30 28 37 32 35 29 5d 28 69 29 7d 29 7d 2c 27 67 27 3a 66 75 6e 63 74 69 6f 6e 28 69 2c 6a 2c 6f 2c 68 31 2c 73 2c 78 2c 42 2c 43 2c 44 2c 45 2c 46 2c 47 2c 48 2c 49 2c 4a 2c 4b 2c 51 2c 52 2c 4c 2c 4d 2c 4e 29 7b 69 66 28 68 31 3d 67 59 2c 73 3d 7b 27 63 54 79 53 4b 27 3a 66 75 6e 63 74 69 6f 6e 28 4f 2c 50 29 7b 72 65 74 75 72 6e 20 4f 28 50 29 7d 2c 27 47 5a 63 74 74 27 3a 68 31 28 31 32 31 38 29 2c 27 4e 49 68 41 43 27 3a 68 31 28 32 39 32 29 7d 2c 69 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 42 3d 7b 7d 2c 43 3d 7b 7d 2c 44 3d 27 27 2c 45 3d 32 2c 46 3d 33 2c 47 3d 32 2c 48 3d 5b 5d 2c 49 3d 30 2c 4a Data Ascii: h,6,function(i,h0){return h0=gZ,d[h0(1203)][h0(725)](i)})},'g':function(i,j,o,h1,s,x,B,C,D,E,F,G,H,I,J,K,Q,R,L,M,N){if(h1=gY,s={'cTySK':function(O,P){return O(P)},'GZctt':h1(1218),'NIhAC':h1(292)},i==null)return'';for(B={},C={},D='',E=2,F=3,G=2,H=[],I=0,J
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 44 5b 68 31 28 34 36 36 29 5d 28 30 29 2c 78 3d 30 3b 64 5b 68 31 28 31 33 31 35 29 5d 28 38 2c 78 29 3b 49 3d 64 5b 68 31 28 36 33 38 29 5d 28 64 5b 68 31 28 31 33 33 37 29 5d 28 49 2c 31 29 2c 4e 26 31 2e 30 34 29 2c 6a 2d 31 3d 3d 4a 3f 28 4a 3d 30 2c 48 5b 68 31 28 31 34 34 29 5d 28 64 5b 68 31 28 31 30 38 31 29 5d 28 6f 2c 49 29 29 2c 49 3d 30 29 3a 4a 2b 2b 2c 4e 3e 3e 3d 31 2c 78 2b 2b 29 3b 7d 65 6c 73 65 20 69 66 28 64 5b 68 31 28 39 30 34 29 5d 28 68 31 28 31 30 32 39 29 2c 68 31 28 34 32 32 29 29 29 51 3d 7b 27 44 44 6f 70 56 27 3a 66 75 6e 63 74 69 6f 6e 28 53 2c 54 2c 68 32 29 7b 72 65 74 75 72 6e 20 68 32 3d 68 31 2c 73 5b 68 32 28 31 32 31 37 29 5d 28 53 2c 54 29 7d 7d 2c 52 3d 73 5b 68 31 28 31 33 39 34 29 5d 2c 48 28 52 29 2c 6a 28 73 5b Data Ascii: D[h1(466)](0),x=0;d[h1(1315)](8,x);I=d[h1(638)](d[h1(1337)](I,1),N&1.04),j-1==J?(J=0,H[h1(144)](d[h1(1081)](o,I)),I=0):J++,N>>=1,x++);}else if(d[h1(904)](h1(1029),h1(422)))Q={'DDopV':function(S,T,h2){return h2=h1,s[h2(1217)](S,T)}},R=s[h1(1394)],H(R),j(s[
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 29 5d 28 27 7c 27 29 2c 4d 3d 30 3b 21 21 5b 5d 3b 29 7b 73 77 69 74 63 68 28 4c 5b 4d 2b 2b 5d 29 7b 63 61 73 65 27 30 27 3a 48 3d 3d 30 26 26 28 48 3d 6a 2c 47 3d 64 5b 68 36 28 31 30 38 31 29 5d 28 6f 2c 49 2b 2b 29 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 31 27 3a 4a 7c 3d 28 64 5b 68 36 28 31 33 32 29 5d 28 30 2c 4e 29 3f 31 3a 30 29 2a 46 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 32 27 3a 48 3e 3e 3d 31 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 33 27 3a 4e 3d 48 26 47 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 34 27 3a 46 3c 3c 3d 31 3b 63 6f 6e 74 69 6e 75 65 7d 62 72 65 61 6b 7d 73 77 69 74 63 68 28 4a 29 7b 63 61 73 65 20 30 3a 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 68 36 28 31 32 37 32 29 5d 28 32 2c 38 29 2c 46 3d 31 3b 4b Data Ascii: )]('\|'),M=0;!![];){switch(L[M++]){case'0':H==0&&(H=j,G=d[h6(1081)](o,I++));continue;case'1':J\|=(d[h6(132)](0,N)?1:0)*F;continue;case'2':H>>=1;continue;case'3':N=H&G;continue;case'4':F<<=1;continue}break}switch(J){case 0:for(J=0,K=Math[h6(1272)](2,8),F=1;K
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 5b 68 36 28 39 37 35 29 5d 2c 53 26 26 53 5b 68 36 28 33 31 32 29 5d 3d 3d 3d 68 36 28 31 34 30 29 26 26 53 5b 68 36 28 38 36 33 29 5d 3d 3d 3d 68 36 28 31 31 38 31 29 3f 6f 3d 64 5b 68 36 28 37 39 38 29 5d 28 73 2c 66 75 6e 63 74 69 6f 6e 28 68 37 29 7b 68 37 3d 68 36 2c 52 5b 68 37 28 35 36 31 29 5d 28 78 29 7d 2c 31 65 33 29 3a 53 26 26 64 5b 68 36 28 39 38 36 29 5d 28 53 5b 68 36 28 33 31 32 29 5d 2c 68 36 28 31 34 30 29 29 26 26 64 5b 68 36 28 38 31 31 29 5d 28 53 5b 68 36 28 38 36 33 29 5d 2c 68 36 28 33 30 35 29 29 26 26 64 5b 68 36 28 32 31 35 29 5d 28 78 2c 42 29 7d 7d 7d 2c 67 3d 7b 7d 2c 67 5b 67 59 28 39 37 31 29 5d 3d 66 2e 68 2c 67 7d 28 29 2c 65 4d 5b 67 4a 28 34 37 35 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 68 38 2c 64 2c 65 2c 66 2c 67 29 7b Data Ascii: [h6(975)],S&&S[h6(312)]===h6(140)&&S[h6(863)]===h6(1181)?o=d[h6(798)](s,function(h7){h7=h6,R[h7(561)](x)},1e3):S&&d[h6(986)](S[h6(312)],h6(140))&&d[h6(811)](S[h6(863)],h6(305))&&d[h6(215)](x,B)}}},g={},g[gY(971)]=f.h,g}(),eM[gJ(475)]=function(h8,d,e,f,g){
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 5d 3d 65 4d 5b 68 61 28 31 34 32 37 29 5d 5b 68 61 28 31 39 33 29 5d 2c 6f 5b 68 61 28 35 33 31 29 5d 3d 65 4d 5b 68 61 28 31 34 32 37 29 5d 5b 68 61 28 35 33 31 29 5d 2c 6f 5b 68 61 28 38 36 39 29 5d 3d 65 4d 5b 68 61 28 31 34 32 37 29 5d 5b 68 61 28 38 36 39 29 5d 2c 6f 5b 68 61 28 31 37 34 29 5d 3d 65 4d 5b 68 61 28 31 34 32 37 29 5d 5b 68 61 28 31 30 37 36 29 5d 2c 73 3d 6f 2c 76 3d 6e 65 77 20 65 4d 5b 28 68 61 28 36 30 36 29 29 5d 28 29 2c 76 5b 68 61 28 38 37 32 29 5d 28 6b 5b 68 61 28 31 34 36 31 29 5d 2c 6e 29 2c 76 5b 68 61 28 31 34 31 29 5d 3d 35 65 33 2c 76 5b 68 61 28 36 38 31 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 78 3d 7b 7d 2c 78 5b 68 61 28 31 30 36 29 5d 3d 67 2c 78 5b 68 61 28 37 39 30 29 5d 3d 6c 2c 78 2e 63 63 3d 68 2c 78 5b Data Ascii: ]=eM[ha(1427)][ha(193)],o[ha(531)]=eM[ha(1427)][ha(531)],o[ha(869)]=eM[ha(1427)][ha(869)],o[ha(174)]=eM[ha(1427)][ha(1076)],s=o,v=new eM[(ha(606))](),v[ha(872)](k[ha(1461)],n),v[ha(141)]=5e3,v[ha(681)]=function(){},x={},x[ha(106)]=g,x[ha(790)]=l,x.cc=h,x[
2025-03-20 13:26:56 UTC	1369	IN	Data Raw: 6f 6e 28 68 66 29 7b 68 66 3d 68 64 2c 65 4d 5b 68 66 28 34 37 35 29 5d 28 29 7d 2c 31 65 33 29 2c 65 4d 5b 68 64 28 32 39 30 29 5d 5b 68 64 28 31 31 30 32 29 5d 28 68 64 28 31 34 36 35 29 2c 65 29 2c 21 5b 5d 29 7d 2c 65 56 3d 30 2c 65 59 3d 7b 7d 2c 65 59 5b 67 4a 28 33 36 32 29 5d 3d 65 58 2c 65 4d 5b 67 4a 28 31 31 36 38 29 5d 3d 65 59 2c 66 30 3d 65 4d 5b 67 4a 28 31 34 32 37 29 5d 5b 67 4a 28 39 30 32 29 5d 5b 67 4a 28 31 33 31 37 29 5d 2c 66 31 3d 65 4d 5b 67 4a 28 31 34 32 37 29 5d 5b 67 4a 28 39 30 32 29 5d 5b 67 4a 28 37 38 31 29 5d 2c 66 32 3d 65 4d 5b 67 4a 28 31 34 32 37 29 5d 5b 67 4a 28 39 30 32 29 5d 5b 67 4a 28 33 34 32 29 5d 2c 66 65 3d 21 5b 5d 2c 66 71 3d 75 6e 64 65 66 69 6e 65 64 2c 65 4d 5b 67 4a 28 38 38 35 29 5d 28 67 4a 28 37 30 Data Ascii: on(hf){hf=hd,eM[hf(475)]()},1e3),eM[hd(290)][hd(1102)](hd(1465),e),![])},eV=0,eY={},eY[gJ(362)]=eX,eM[gJ(1168)]=eY,f0=eM[gJ(1427)][gJ(902)][gJ(1317)],f1=eM[gJ(1427)][gJ(902)][gJ(781)],f2=eM[gJ(1427)][gJ(902)][gJ(342)],fe=![],fq=undefined,eM[gJ(885)](gJ(70

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:56 UTC	784	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:56 UTC	240	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:56 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 92358b4b1c4543fb-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:56 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Windows Analysis Report
https://protect2.fireeye.com/v1/url?k=31323334-501d2dca-3114f648-454455534531-f18bcc46852af03b&q=1&e=a5b004d0-9ad2-44a3-a203-9d7fb71ea4db&u=https%3A%2F%2Fhyj48i39.s3.us-east-1.amazonaws.com%2Fdocnwhdheb.html

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:56 UTC	425	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:57 UTC	240	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:57 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 92358b4eaf8b43f8-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:57 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:57 UTC	663	OUT	GET /favicon.ico HTTP/1.1 Host: office.endangered.it.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://office.endangered.it.com/8kfUZ/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=ihf6a32hd8trftdvhagpnglago
2025-03-20 13:26:57 UTC	291	IN	HTTP/1.1 404 Not Found Date: Thu, 20 Mar 2025 13:26:57 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Server: cloudflare Cache-Control: max-age=14400 Cf-Cache-Status: EXPIRED CF-RAY: 92358b517f8e32fc-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:57 UTC	207	IN	Data Raw: 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: c4<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>0

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:57 UTC	1191	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1414348410:1742472878:yecUZmDbN8up8L1looyXyvk3UZZiWClMcjK2TzNEz6M/92358b47afc40f63/FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMr HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3663 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMr cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:57 UTC	3663	OUT	Data Raw: 36 64 72 50 56 50 61 50 79 50 72 50 58 7a 35 69 7a 35 47 50 7a 4d 59 73 52 38 7a 6d 35 52 35 41 74 4d 31 77 6a 35 24 5a 73 50 76 6a 59 5a 35 42 35 33 6a 52 73 4c 6a 55 61 4b 4c 35 6d 6a 31 4c 35 62 35 36 4f 50 35 56 5a 50 35 46 31 35 46 54 64 55 49 35 79 72 39 5a 5a 4c 31 6a 59 2b 35 37 4d 59 41 35 79 65 6a 55 6d 73 6a 5a 64 35 71 52 77 62 61 58 31 50 55 67 6c 44 4b 7a 78 6a 55 30 35 70 47 65 6c 37 65 62 6f 66 36 39 58 4e 4d 45 55 51 32 44 6a 35 65 65 44 4b 61 31 6c 51 31 35 59 61 4b 77 64 64 70 55 64 50 76 4c 47 4d 66 78 55 46 2d 36 75 6d 78 55 50 35 64 61 35 75 70 4b 44 4d 35 49 64 35 41 50 55 77 36 52 50 46 72 6a 35 2b 69 31 73 4d 47 59 68 49 47 50 57 53 35 31 34 49 35 33 75 5a 35 31 75 47 35 6d 73 44 4c 57 75 4a 49 7a 5a 35 7a 65 5a 35 2d 4c 67 7a 4d Data Ascii: 6drPVPaPyPrPXz5iz5GPzMYsR8zm5R5AtM1wj5$ZsPvjYZ5B53jRsLjUaKL5mj1L5b56OP5VZP5F15FTdUI5yr9ZZL1jY+57MYA5yejUmsjZd5qRwbaX1PUglDKzxjU05pGel7ebof69XNMEUQ2Dj5eeDKa1lQ15YaKwddpUdPvLGMfxUF-6umxUP5da5upKDM5Id5APUw6RPFrj5+i1sMGYhIGPWS514I53uZ51uG5msDLWuJIzZ5zeZ5-LgzM
2025-03-20 13:26:57 UTC	1051	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:57 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 228376 Connection: close cf-chl-gen: DU9OJQ007u0eh9FC6ju4OLLX6R1d0/unDcKgiZZ3b4BFwbAetA+rwDnm9YSyjludlHGjgIR4ohd7xjEDu5NjuPOEzRynCH+QEu0cuvQzCzkD/a17raw81XcC5tqG1DnlMLHetF5+kabyp2Wqj38ZUwA1PkxKcaHE0X8lBgsRX2IMVjuXt/RA/oQprtS5V7VI06oBDgtYJruYXcDbxNE6LAiJPTwkgcr/0UKn6Ly6PSaRSc452jXrzMzpMn3xBkRnOf67kPOs4wpo0N+Sx0PUpJ0n6iYSz28dTnORf0t6XhlESyrTc0gDGEwHYf8ZI4VPMOnm3T6hAOH69m2BkwcCrOdNsZ68dHV2bTpsR0WlhJosMEHGSe7jJVamLru7E3MByb5Lk+0MSZ85kwEIieHXG+0aJkcbqvtb9txQYgG+m8PmRB/ClhRSmMJUx0OQrHdhT3rIdQA4venZ8sDCIIkLriPkam+yTdFFXP1xD6NhS38qHXMVRUXua0zLH6OxfkXRqhfpP3F7EZSu3C8d0j/kwkEVec2SiA434z4BkQ4T6Cip1Uz6yBJdFATMtNQ463/nrXxsExOW0vG77B/8xvg2Zr0lAeK8sE+srusKNZbYsi/yo5jqk06QPhiFM9odLFVgFyyjKrN+iof4nglMoa2EH4v/gEzzHjiMSPe7bb5k5S7GY8tIOeJw5XECoh6s0m4k/efH/H/KCpRpNQmjHHghlFpByjmfLNlw9hIke1e1iDMB6Nstb7gmynaf5wrE+a94M9gpOT4E9GLJgU4v2ux3Mw==$tOJ7FNmWVi93CwXUXt91gQ== Server: cloudflare CF-RAY: 92358b50cabb15bb-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:57 UTC	318	IN	Data Raw: 65 57 4a 64 68 45 31 53 59 57 75 4c 67 6f 79 63 6c 6f 69 66 6b 56 74 69 67 6f 52 63 6f 5a 53 56 67 48 65 4c 5a 57 4f 4a 65 4b 61 4e 66 71 61 67 66 72 4b 59 62 71 2b 50 70 34 71 73 6e 37 65 31 73 71 78 39 77 70 57 4f 76 63 61 48 79 70 2b 58 6e 5a 6d 5a 75 4b 79 74 71 36 61 75 79 4b 2f 56 73 38 71 62 72 72 53 36 76 35 79 64 71 73 50 51 77 65 54 52 30 62 57 30 78 4f 69 38 37 4e 33 76 77 75 44 6f 72 62 37 58 36 4e 54 7a 37 2f 66 32 2b 4f 66 4e 76 76 75 2f 41 4c 30 44 31 4e 66 5a 32 4e 66 57 78 74 73 50 32 73 72 66 45 2f 4d 4e 31 52 63 43 37 75 55 57 32 75 76 72 39 78 62 37 2b 2f 76 62 48 76 37 77 39 77 58 68 4c 50 63 45 4c 53 49 42 2b 4f 34 30 4c 77 4d 4f 37 51 45 43 45 79 33 33 44 78 67 5a 39 52 6e 33 50 43 49 64 50 53 45 68 2b 6b 6f 42 53 45 45 6a 4f 51 73 Data Ascii: eWJdhE1SYWuLgoycloifkVtigoRcoZSVgHeLZWOJeKaNfqagfrKYbq+Pp4qsn7e1sqx9wpWOvcaHyp+XnZmZuKytq6auyK/Vs8qbrrS6v5ydqsPQweTR0bW0xOi87N3vwuDorb7X6NTz7/f2+OfNvvu/AL0D1NfZ2NfWxtsP2srfE/MN1RcC7uUW2uvr9xb7+/vbHv7w9wXhLPcELSIB+O40LwMO7QECEy33DxgZ9Rn3PCIdPSEh+koBSEEjOQs
2025-03-20 13:26:57 UTC	1369	IN	Data Raw: 5a 2f 54 34 46 36 51 46 42 30 66 6c 52 54 51 57 52 59 58 6b 57 4f 58 45 53 52 61 30 64 57 61 49 39 77 62 33 4b 57 6d 48 52 72 65 46 6c 32 66 70 61 42 6c 36 4b 62 70 58 32 71 6e 6c 2b 75 62 61 42 37 73 48 47 43 62 72 57 77 69 61 2b 6b 68 58 4f 63 6a 61 43 36 6a 70 35 39 6b 34 43 51 67 4b 43 6d 6c 72 71 73 70 5a 75 70 6e 59 2b 79 6b 4d 79 55 30 74 54 51 73 64 6a 4c 74 4e 65 39 7a 72 6d 32 76 72 43 35 32 38 58 6d 77 4c 54 5a 79 73 6e 64 72 4e 37 76 79 72 33 6a 33 73 6a 48 30 4d 6a 73 79 2f 76 72 39 2f 43 36 36 4c 76 77 76 75 57 39 39 4f 66 52 77 2f 62 62 39 74 37 2b 32 4f 67 51 42 75 33 6a 45 2f 44 76 34 39 6e 6b 47 66 73 61 2b 41 33 78 49 42 48 77 2b 51 2f 35 41 42 76 66 41 52 30 71 47 51 6b 6d 44 43 4c 71 42 52 38 42 46 76 49 5a 46 41 4d 48 4e 6a 76 38 50 Data Ascii: Z/T4F6QFB0flRTQWRYXkWOXESRa0dWaI9wb3KWmHRreFl2fpaBl6KbpX2qnl+ubaB7sHGCbrWwia+khXOcjaC6jp59k4CQgKCmlrqspZupnY+ykMyU0tTQsdjLtNe9zrm2vrC528XmwLTZysndrN7vyr3j3sjH0Mjsy/vr9/C66LvwvuW99OfRw/bb9t7+2OgQBu3jE/Dv49nkGfsa+A3xIBHw+Q/5ABvfAR0qGQkmDCLqBR8BFvIZFAMHNjv8P
2025-03-20 13:26:57 UTC	1369	IN	Data Raw: 76 57 55 46 63 64 58 56 6e 5a 57 32 47 69 6b 31 7a 55 57 56 6a 67 47 74 79 68 59 65 4d 63 5a 42 36 58 49 31 33 6d 31 39 69 63 35 4e 35 6d 5a 65 61 5a 4b 32 6e 6f 57 35 37 62 4b 53 68 6a 34 47 74 70 71 6d 52 74 71 36 39 70 36 2b 33 74 58 32 56 73 36 47 77 6d 4c 53 62 78 4b 76 41 75 72 75 4b 6d 73 4c 4e 69 72 47 6c 6c 5a 62 4a 75 72 72 63 73 35 79 32 34 4e 61 61 75 36 36 73 34 70 7a 50 6f 2b 50 42 33 39 62 63 7a 39 32 2b 73 4f 6e 69 33 71 36 30 34 63 54 73 34 37 65 79 33 65 79 35 30 74 58 7a 35 50 6e 65 35 64 67 47 34 74 6e 68 79 66 58 2b 34 75 58 4a 2f 75 62 4e 33 77 66 32 47 65 63 49 45 76 6e 59 32 2b 7a 38 46 76 6e 64 33 68 72 69 45 2f 45 71 41 51 48 69 35 75 55 61 45 68 6f 75 49 41 45 79 42 53 55 35 46 50 41 56 4b 51 77 66 48 42 45 32 50 76 31 42 45 41 Data Ascii: vWUFcdXVnZW2Gik1zUWVjgGtyhYeMcZB6XI13m19ic5N5mZeaZK2noW57bKShj4GtpqmRtq69p6+3tX2Vs6GwmLSbxKvAuruKmsLNirGllZbJurrcs5y24Naau66s4pzPo+PB39bcz92+sOni3q604cTs47ey3ey50tXz5Pne5dgG4tnhyfX+4uXJ/ubN3wf2GecIEvnY2+z8Fvnd3hriE/EqAQHi5uUaEhouIAEyBSU5FPAVKQwfHBE2Pv1BEA
2025-03-20 13:26:57 UTC	1369	IN	Data Raw: 62 6b 5a 74 68 47 5a 2f 54 6b 32 48 63 58 42 31 6c 70 56 59 56 4a 64 2f 65 57 43 51 6c 33 70 74 6a 70 43 56 6d 70 75 41 68 6d 74 6f 6d 47 71 53 70 5a 4e 72 62 37 4f 4b 69 4b 36 44 6c 59 6d 51 69 4c 36 2b 6d 70 4f 4e 73 72 69 57 6a 38 4b 7a 6f 72 53 69 6e 59 65 2f 6e 6f 6d 7a 72 4d 48 47 6a 49 6e 45 6c 63 6a 44 6d 64 6a 5a 73 39 57 79 32 39 33 58 33 4f 47 66 31 39 2b 35 75 61 4c 56 72 65 6a 68 78 65 6a 4a 78 39 54 79 38 75 58 6d 73 65 62 38 39 67 44 71 2f 64 72 72 7a 37 76 68 32 63 4c 33 77 75 48 59 31 50 7a 74 78 74 41 41 38 50 48 6c 41 75 49 4b 30 41 6a 36 36 50 45 4d 44 39 76 7a 46 65 34 67 47 51 2f 79 38 50 54 2b 4a 69 30 72 35 43 6f 46 2b 43 38 68 48 42 55 32 46 77 45 6f 4d 52 77 4a 2b 43 6b 64 4d 68 59 73 43 78 63 38 52 41 41 68 48 68 67 64 52 54 59 Data Ascii: bkZthGZ/Tk2HcXB1lpVYVJd/eWCQl3ptjpCVmpuAhmtomGqSpZNrb7OKiK6DlYmQiL6+mpONsriWj8KzorSinYe/nomzrMHGjInElcjDmdjZs9Wy293X3OGf19+5uaLVrejhxejJx9Ty8uXmseb89gDq/drrz7vh2cL3wuHY1PztxtAA8PHlAuIK0Aj66PEMD9vzFe4gGQ/y8PT+Ji0r5CoF+C8hHBU2FwEoMRwJ+CkdMhYsCxc8RAAhHhgdRTY
2025-03-20 13:26:57 UTC	1369	IN	Data Raw: 6d 79 57 65 46 4a 6d 69 6e 69 55 6a 56 61 55 62 6c 6d 50 63 33 31 6a 65 33 64 67 6d 4b 4f 59 64 59 69 4f 65 49 56 74 62 48 75 73 6f 70 4e 70 64 62 57 49 6a 4c 69 31 74 4b 32 30 6b 4b 31 37 78 4a 43 67 6f 4d 6d 7a 68 37 32 45 75 62 72 42 72 61 32 6b 72 37 47 31 71 49 36 51 77 62 72 62 31 36 32 57 6e 39 4f 76 73 74 32 36 75 64 50 51 78 65 6a 68 7a 4b 53 6a 33 73 2b 36 36 74 50 6c 35 4b 65 75 37 65 33 68 36 62 6e 37 78 39 41 42 33 63 33 4e 2b 76 76 35 2f 63 58 43 75 2f 50 33 43 73 76 67 34 4f 76 6f 2f 64 34 54 46 73 6a 6f 31 39 4c 6d 38 77 55 47 33 76 6e 74 48 67 48 2b 4a 67 44 39 42 52 62 33 49 51 77 41 49 68 72 74 4c 76 73 47 45 4f 77 44 37 2f 41 6c 42 67 37 33 4e 68 77 55 4c 44 63 51 4f 6b 45 37 2f 67 48 2b 51 44 35 46 47 55 55 73 46 7a 68 4b 49 43 39 4d Data Ascii: myWeFJminiUjVaUblmPc31je3dgmKOYdYiOeIVtbHusopNpdbWIjLi1tK20kK17xJCgoMmzh72EubrBra2kr7G1qI6Qwbrb162Wn9Ovst26udPQxejhzKSj3s+66tPl5Keu7e3h6bn7x9AB3c3N+vv5/cXCu/P3Csvg4Ovo/d4TFsjo19Lm8wUG3vntHgH+JgD9BRb3IQwAIhrtLvsGEOwD7/AlBg73NhwULDcQOkE7/gH+QD5FGUUsFzhKIC9M
2025-03-20 13:26:57 UTC	1369	IN	Data Raw: 6c 6d 61 33 65 65 65 57 39 71 6c 6e 32 63 68 59 69 6c 66 4a 64 38 65 61 52 6b 72 4b 4e 78 66 36 53 63 71 48 2b 4a 75 4a 71 59 71 4a 4b 46 72 5a 35 33 76 62 75 57 77 71 53 57 6e 49 57 59 6f 34 61 72 7a 5a 61 36 72 63 47 6c 30 63 4f 7a 72 34 36 6c 78 61 2b 79 32 4e 66 49 71 4e 75 77 31 39 58 58 78 62 66 44 32 38 57 39 6f 37 6e 4c 7a 2b 2b 77 76 64 76 7a 79 75 54 69 34 2b 48 79 32 65 76 76 36 4e 72 4d 31 65 33 4e 2b 4f 44 4f 42 4e 6b 41 41 64 59 44 31 76 76 38 79 66 77 4d 42 73 76 55 36 68 50 50 38 75 4c 74 45 42 48 56 31 52 6f 43 41 2b 49 54 35 43 45 62 48 53 63 44 4b 43 66 6c 2f 75 59 43 2b 68 30 4e 4b 43 73 32 4e 53 6f 5a 4b 66 49 77 4f 7a 78 41 51 55 49 77 47 78 68 46 48 68 41 70 53 42 49 44 50 45 35 4d 52 51 5a 52 51 42 4d 6d 4c 6b 30 70 4d 31 63 78 53 Data Ascii: lma3eeeW9qln2chYilfJd8eaRkrKNxf6ScqH+JuJqYqJKFrZ53vbuWwqSWnIWYo4arzZa6rcGl0cOzr46lxa+y2NfIqNuw19XXxbfD28W9o7nLz++wvdvzyuTi4+Hy2evv6NrM1e3N+ODOBNkAAdYD1vv8yfwMBsvU6hPP8uLtEBHV1RoCA+IT5CEbHScDKCfl/uYC+h0NKCs2NSoZKfIwOzxAQUIwGxhFHhApSBIDPE5MRQZRQBMmLk0pM1cxS
2025-03-20 13:26:57 UTC	1369	IN	Data Raw: 52 63 33 47 66 6c 6f 61 6b 63 70 4f 68 67 61 75 74 66 35 68 36 6f 59 4b 76 73 4b 53 57 73 33 6d 6a 65 70 32 36 73 35 33 41 6c 36 75 38 6b 6f 43 31 6c 35 58 44 75 71 72 49 6c 72 66 46 70 63 2f 52 6f 38 79 65 77 4b 61 55 30 73 69 36 70 5a 33 54 6d 72 61 74 7a 35 79 63 34 39 43 32 6f 62 58 58 70 65 47 37 32 38 36 36 78 4f 50 70 37 4f 2f 79 78 39 4c 43 34 38 76 76 75 2b 7a 64 76 63 7a 73 31 39 32 33 38 2b 55 4a 32 76 66 46 78 51 48 37 37 2b 37 63 2f 4f 49 4b 34 77 45 41 35 67 38 45 2b 77 30 5a 47 2b 2f 36 36 67 7a 7a 47 4f 4d 56 42 75 58 30 46 51 41 47 4b 52 6a 70 36 44 41 70 45 7a 44 31 4a 67 62 30 38 54 73 6c 4b 69 77 65 4d 43 2f 2b 4c 51 4d 44 49 77 41 61 51 43 6b 6c 4c 66 34 5a 53 7a 41 61 43 45 46 4b 54 41 31 43 4b 45 45 71 53 31 45 70 48 53 31 4f 58 7a Data Ascii: Rc3GfloakcpOhgautf5h6oYKvsKSWs3mjep26s53Al6u8koC1l5XDuqrIlrfFpc/Ro8yewKaU0si6pZ3Tmratz5yc49C2obXXpeG72866xOPp7O/yx9LC48vvu+zdvczs19238+UJ2vfFxQH77+7c/OIK4wEA5g8E+w0ZG+/66gzzGOMVBuX0FQAGKRjp6DApEzD1Jgb08TslKiweMC/+LQMDIwAaQCklLf4ZSzAaCEFKTA1CKEEqS1EpHS1OXz
2025-03-20 13:26:57 UTC	1369	IN	Data Raw: 59 47 57 46 71 59 32 72 6f 58 42 77 70 6e 4b 67 6b 33 47 79 73 6f 6d 4d 6b 6f 53 46 72 5a 52 2f 6e 5a 79 64 6f 70 4f 55 6f 4b 57 42 6e 4b 4f 71 70 59 43 38 72 72 36 63 76 37 44 56 6a 38 4b 31 6f 70 57 61 30 63 6a 52 73 37 37 64 34 74 33 59 77 4f 57 32 32 37 48 67 31 36 50 57 79 73 66 75 79 72 7a 7a 31 4f 72 47 77 64 6a 6d 78 2b 37 59 79 74 4f 35 75 73 33 61 37 38 54 43 35 2f 72 6b 34 2b 48 46 78 67 44 34 34 41 6e 6a 44 65 49 49 31 41 54 53 44 65 54 6f 46 2b 51 54 39 52 54 36 38 76 62 37 34 64 66 63 47 43 63 4c 34 76 6b 73 4a 2b 73 47 37 79 49 52 2f 41 45 4f 43 41 49 6a 44 69 55 74 4b 42 49 52 4c 7a 59 38 2f 6a 77 55 46 42 41 42 47 41 4e 46 41 6b 68 46 52 30 41 72 4b 55 5a 46 4c 68 49 76 4d 6a 52 4d 46 69 6b 36 4e 6b 6c 52 54 42 67 65 5a 45 31 54 4d 32 63 Data Ascii: YGWFqY2roXBwpnKgk3GysomMkoSFrZR/nZydopOUoKWBnKOqpYC8rr6cv7DVj8K1opWa0cjRs77d4t3YwOW227Hg16PWysfuyrzz1OrGwdjmx+7YytO5us3a78TC5/rk4+HFxgD44AnjDeII1ATSDeToF+QT9RT68vb74dfcGCcL4vksJ+sG7yIR/AEOCAIjDiUtKBIRLzY8/jwUFBABGANFAkhFR0ArKUZFLhIvMjRMFik6NklRTBgeZE1TM2c
2025-03-20 13:26:57 UTC	1369	IN	Data Raw: 49 68 75 6a 61 4f 4e 6c 6f 71 71 69 5a 6d 4a 70 48 69 30 76 4c 36 77 73 33 71 34 6a 4c 2b 68 73 63 61 43 6d 73 75 33 77 5a 32 36 76 4b 75 51 78 4e 54 54 31 35 2b 6f 7a 62 57 7a 73 4d 71 70 74 74 36 2f 76 70 33 45 6d 38 4b 77 79 62 7a 46 79 4b 65 66 7a 4d 7a 4e 78 74 72 41 79 64 48 52 30 73 33 4e 31 63 69 38 30 74 33 38 79 39 58 33 2f 66 4c 52 31 2b 2f 6a 75 2b 54 46 41 67 76 61 78 77 38 48 34 38 55 50 35 65 54 6c 43 65 54 31 37 75 77 4a 2f 66 63 62 33 67 34 46 2f 51 55 68 45 50 48 33 35 76 55 70 4a 76 63 49 36 4f 4d 62 44 75 6f 6d 45 68 51 79 47 41 38 61 47 2f 6f 79 49 41 6b 59 4c 79 56 43 52 67 45 78 42 6b 49 66 41 67 4d 41 44 44 70 47 4b 79 49 52 4c 42 34 57 45 51 39 54 54 44 4d 64 52 31 73 58 46 7a 55 39 58 79 51 6b 49 45 49 62 59 31 4d 2f 4c 46 64 61 Data Ascii: IhujaONloqqiZmJpHi0vL6ws3q4jL+hscaCmsu3wZ26vKuQxNTT15+ozbWzsMqptt6/vp3Em8KwybzFyKefzMzNxtrAydHR0s3N1ci80t38y9X3/fLR1+/ju+TFAgvaxw8H48UP5eTlCeT17uwJ/fcb3g4F/QUhEPH35vUpJvcI6OMbDuomEhQyGA8aG/oyIAkYLyVCRgExBkIfAgMADDpGKyIRLB4WEQ9TTDMdR1sXFzU9XyQkIEIbY1M/LFda

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:58 UTC	567	OUT	OPTIONS /report/v4?s=LmCAFtXM6vi%2BN3AqpAe0isy09cO%2FgWoYYwdBgVmsl9Tb0EaHxtTDatkwosc0YbAYQC%2FXOULKJIruXDeAOuIOUEaXV1xYQ2U0RzgXgjpllSwyAutGUH1GlAq%2BCn4a4OrR0E%2BhqJ6tHYlYQ2I%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://office.endangered.it.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:58 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 20 Mar 2025 13:26:58 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:58 UTC	639	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1414348410:1742472878:yecUZmDbN8up8L1looyXyvk3UZZiWClMcjK2TzNEz6M/92358b47afc40f63/FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMr HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:58 UTC	442	IN	HTTP/1.1 400 Bad Request Date: Thu, 20 Mar 2025 13:26:58 GMT Content-Type: application/json Content-Length: 14 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: S7fUokN/E143ln82+zQNyB62sc0HiKBVfYZ8sRPzZ2HnOgNituTGSN3WCfBu+XF4XJRJroFtFILdWwXQ6bigFg==$H07tkMJN7zNjuwebo+DNvg== Server: cloudflare CF-RAY: 92358b573f94f793-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:58 UTC	14	IN	Data Raw: 7b 22 65 72 72 22 3a 31 30 30 32 38 30 7d Data Ascii: {"err":100280}

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:58 UTC	542	OUT	POST /report/v4?s=LmCAFtXM6vi%2BN3AqpAe0isy09cO%2FgWoYYwdBgVmsl9Tb0EaHxtTDatkwosc0YbAYQC%2FXOULKJIruXDeAOuIOUEaXV1xYQ2U0RzgXgjpllSwyAutGUH1GlAq%2BCn4a4OrR0E%2BhqJ6tHYlYQ2I%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 445 Content-Type: application/reports+json Origin: https://office.endangered.it.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:58 UTC	445	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 34 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 66 66 69 63 65 2e 65 6e 64 61 6e 67 65 72 65 64 2e 69 74 2e 63 6f 6d 2f 38 6b 66 55 5a 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 31 35 31 2e 32 30 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 Data Ascii: [{"age":0,"body":{"elapsed_time":643,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://office.endangered.it.com/8kfUZ/","sampling_fraction":1.0,"server_ip":"172.67.151.202","status_code":404,"type":"http.error"},"type":"networ
2025-03-20 13:26:58 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Thu, 20 Mar 2025 13:26:58 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:58 UTC	827	OUT	GET /cdn-cgi/challenge-platform/h/b/d/92358b47afc40f63/1742477217518/MVkB8_5L5hzmSA_ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:58 UTC	200	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:58 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 92358b58ae324303-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:58 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 55 08 02 00 00 00 84 ac 20 04 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR2U IDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:26:58 UTC	468	OUT	GET /cdn-cgi/challenge-platform/h/b/d/92358b47afc40f63/1742477217518/MVkB8_5L5hzmSA_ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:26:59 UTC	200	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:26:59 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 92358b5b89c3557d-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:26:59 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 55 08 02 00 00 00 84 ac 20 04 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR2U IDAT$IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:27:00 UTC	856	OUT	GET /cdn-cgi/challenge-platform/h/b/pat/92358b47afc40f63/1742477217522/f66b3bf5b729985606b08bc1e8cd061b00221200606694c1867f2177f0d465a9/Ev6mBFcA9R_K-Lr HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:27:00 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Thu, 20 Mar 2025 13:27:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 1 Connection: close
2025-03-20 13:27:00 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 39 6d 73 37 39 62 63 70 6d 46 59 47 73 49 76 42 36 4d 30 47 47 77 41 69 45 67 42 67 5a 70 54 42 68 6e 38 68 64 5f 44 55 5a 61 6b 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20g9ms79bcpmFYGsIvB6M0GGwAiEgBgZpTBhn8hd_DUZakAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2025-03-20 13:27:00 UTC	1	IN	Data Raw: 4a Data Ascii: J

Timestamp	Bytes transferred	Direction	Data
2025-03-20 13:27:01 UTC	1192	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1414348410:1742472878:yecUZmDbN8up8L1looyXyvk3UZZiWClMcjK2TzNEz6M/92358b47afc40f63/FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMr HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 38541 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 cf-chl: FzHUKSp1wJ2CszkSxGoi0VVZSjh_ZxqvdSDu5TACaLI-1742477215-1.1.1.1-SErd2hAq6CWGvQ8gV.L8CdyPOUBA8iCEdByGaVh_b3b7cepcuyK0GO6fT2YoNBMr cf-chl-ra: 0 sec-ch-ua-mobile: ?0 Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/wrv6t/0x4AAAAAABBmfQLQxURA3Z0x/auto/fbE/new/normal/auto/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-20 13:27:01 UTC	16384	OUT	Data Raw: 36 64 72 50 68 7a 55 4b 75 79 72 5a 73 6d 77 55 2b 35 6f 33 72 55 65 55 68 35 38 68 50 72 50 5a 4d 35 74 35 4d 50 52 73 35 2b 35 61 50 59 73 7a 7a 63 35 6e 5a 74 35 59 6a 44 67 34 5a 59 30 35 34 49 50 7a 76 35 70 4d 59 49 34 5a 35 52 32 74 35 41 4d 59 74 35 37 6a 55 77 51 7a 73 72 55 33 7a 50 33 72 35 6d 33 72 6a 7a 4b 52 6f 57 32 64 35 39 6a 53 35 59 46 52 35 55 72 55 59 35 72 64 35 78 35 55 57 57 72 49 68 77 72 55 30 43 52 44 59 6a 72 49 75 35 54 50 35 76 4f 56 6a 76 70 68 58 4c 32 57 73 4b 42 33 54 73 73 4f 24 6a 35 36 75 50 4d 30 6a 35 39 35 7a 2b 35 46 75 41 66 41 35 35 30 44 74 65 6f 68 51 70 35 7a 51 55 33 36 34 49 4c 57 6a 35 31 65 2b 6a 35 55 4d 4b 68 6e 6a 64 35 33 64 35 32 50 7a 77 51 35 7a 74 35 62 73 35 69 68 33 38 39 62 73 35 63 5a 46 35 71 Data Ascii: 6drPhzUKuyrZsmwU+5o3rUeUh58hPrPZM5t5MPRs5+5aPYszzc5nZt5YjDg4ZY054IPzv5pMYI4Z5R2t5AMYt57jUwQzsrU3zP3r5m3rjzKRoW2d59jS5YFR5UrUY5rd5x5UWWrIhwrU0CRDYjrIu5TP5vOVjvphXL2WsKB3TssO$j56uPM0j595z+5FuAfA550DteohQp5zQU364ILWj51e+j5UMKhnjd53d52PzwQ5zt5bs5ih389bs5cZF5q
2025-03-20 13:27:01 UTC	16384	OUT	Data Raw: 6e 4f 6c 5a 73 32 24 43 30 6f 68 4c 43 68 67 38 73 72 41 51 7a 73 64 5a 6a 70 4c 78 63 63 65 7a 49 4e 74 4d 50 6a 6b 46 71 70 50 59 53 75 32 47 44 7a 73 47 59 76 41 67 58 37 4e 6d 6d 6c 7a 37 64 54 30 49 62 74 76 39 50 46 71 47 4c 6a 59 32 6d 36 4b 55 63 77 5a 35 77 79 65 6a 7a 34 73 70 55 55 6e 63 6b 6d 49 6c 68 39 50 50 61 33 62 35 72 7a 6e 6d 32 37 44 62 55 4e 70 7a 46 55 62 55 6f 65 55 49 50 34 50 4a 35 45 56 37 51 31 7a 35 66 50 33 6f 35 41 35 6e 47 68 78 35 6e 30 31 50 46 75 7a 77 35 45 49 55 4d 59 42 77 49 4b 50 4a 38 64 24 37 31 69 72 55 51 65 6d 31 5a 24 79 41 34 31 6f 7a 6f 35 6e 61 76 4a 59 72 44 4b 75 55 6a 49 6a 32 66 51 71 4c 65 5a 44 6f 4f 6f 72 52 70 59 34 4d 2d 32 78 71 57 4b 75 69 6a 46 46 50 70 6a 35 37 6d 6f 47 32 50 58 43 7a 4d 35 53 Data Ascii: nOlZs2$C0ohLChg8srAQzsdZjpLxccezINtMPjkFqpPYSu2GDzsGYvAgX7Nmmlz7dT0Ibtv9PFqGLjY2m6KUcwZ5wyejz4spUUnckmIlh9PPa3b5rznm27DbUNpzFUbUoeUIP4PJ5EV7Q1z5fP3o5A5nGhx5n01PFuzw5EIUMYBwIKPJ8d$71irUQem1Z$yA41ozo5navJYrDKuUjIj2fQqLeZDoOorRpY4M-2xqWKuijFFPpj57moG2PXCzM5S
2025-03-20 13:27:01 UTC	5773	OUT	Data Raw: 65 79 6d 73 68 52 38 6b 5a 59 46 35 61 44 68 4c 55 24 6d 39 6c 4a 46 4e 4d 74 72 73 39 66 47 46 66 5a 35 33 42 46 24 78 43 44 53 7a 4b 6d 6d 58 79 6e 70 35 4d 78 4a 57 50 5a 2b 55 58 37 50 5a 5a 6e 72 78 58 37 77 46 24 4d 41 33 2d 69 55 72 36 30 4a 50 41 6c 36 51 6d 49 43 61 61 63 6a 78 70 47 34 57 36 6d 52 45 70 4d 4e 77 4c 58 62 51 44 70 59 74 2d 34 51 6e 68 70 7a 35 4b 50 6a 4d 52 65 2b 4e 35 62 72 55 78 44 2b 32 2b 35 55 74 55 31 73 62 79 33 37 70 79 6a 62 77 59 41 55 33 34 57 6f 35 64 35 61 50 6a 47 68 24 35 33 34 2b 30 54 75 47 52 4a 66 50 35 6a 65 7a 73 62 79 33 41 61 51 24 54 4d 52 44 2d 51 33 38 4b 49 37 2d 49 38 65 74 33 41 61 6c 71 55 73 31 2d 38 76 35 35 65 7a 39 55 51 68 58 45 77 32 44 33 79 53 66 64 31 51 2b 57 53 5a 5a 4c 32 74 35 31 54 6c Data Ascii: eymshR8kZYF5aDhLU$m9lJFNMtrs9fGFfZ53BF$xCDSzKmmXynp5MxJWPZ+UX7PZZnrxX7wF$MA3-iUr60JPAl6QmICaacjxpG4W6mREpMNwLXbQDpYt-4Qnhpz5KPjMRe+N5brUxD+2+5UtU1sby37pyjbwYAU34Wo5d5aPjGh$534+0TuGRJfP5jezsby3AaQ$TMRD-Q38KI7-I8et3AalqUs1-8v55ez9UQhXEw2D3ySfd1Q+WSZZL2t51Tl
2025-03-20 13:27:01 UTC	322	IN	HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 13:27:01 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 28216 Connection: close cf-chl-gen: vAp/Npn8PzulljHxmJCvnYfQGSPveEl6V2rcfjbQxf7qgl3x4PcWOklRk45NwA+l$xuNnAJxisf3APh5rRkQnCQ== Server: cloudflare CF-RAY: 92358b6988110c90-EWR alt-svc: h3=":443"; ma=86400
2025-03-20 13:27:01 UTC	1047	IN	Data Raw: 65 57 4a 64 68 45 35 32 55 49 32 51 6b 5a 75 50 6a 6f 74 78 6d 36 4a 30 62 6e 4f 6c 5a 6e 4a 33 71 57 71 55 6c 4b 78 75 6e 4a 78 73 6f 37 4b 53 69 72 4e 76 71 35 4f 47 6d 37 57 52 72 37 53 30 72 6e 2b 4f 6d 62 71 2b 6e 62 57 36 73 71 6d 33 78 4a 36 4e 7a 71 47 61 79 64 4b 48 77 37 4c 56 6a 36 4b 78 78 4c 69 35 75 71 43 32 72 4b 4b 68 76 4e 4b 2f 74 72 6a 64 77 39 71 39 70 4b 37 45 79 36 75 75 34 62 2f 41 74 75 54 49 35 38 36 79 76 64 6e 64 34 4c 6e 56 31 64 55 44 41 4f 57 2f 42 50 51 49 31 65 33 38 41 76 72 74 45 77 30 56 33 77 58 4e 7a 2f 54 76 32 75 76 72 39 78 62 37 2b 2f 76 62 48 76 37 77 39 77 58 68 4c 50 63 46 4c 53 49 42 2b 4f 34 30 4c 77 4d 4f 37 51 45 43 45 79 33 33 44 78 67 5a 39 52 6e 33 50 43 49 64 50 53 45 68 2b 6b 6f 42 53 45 45 6a 4f 51 73 Data Ascii: eWJdhE52UI2QkZuPjotxm6J0bnOlZnJ3qWqUlKxunJxso7KSirNvq5OGm7WRr7S0rn+Ombq+nbW6sqm3xJ6NzqGaydKHw7LVj6KxxLi5uqC2rKKhvNK/trjdw9q9pK7Ey6uu4b/AtuTI586yvdnd4LnV1dUDAOW/BPQI1e38AvrtEw0V3wXNz/Tv2uvr9xb7+/vbHv7w9wXhLPcFLSIB+O40LwMO7QECEy33DxgZ9Rn3PCIdPSEh+koBSEEjOQs
2025-03-20 13:27:01 UTC	1369	IN	Data Raw: 7a 68 34 53 44 64 34 74 32 69 49 6d 74 6a 59 70 71 68 71 4f 6b 6f 36 64 79 63 6f 47 61 6d 5a 70 76 65 59 78 2f 72 70 4f 74 72 4b 2b 41 73 48 72 44 70 61 66 45 79 61 58 48 6a 4b 57 4d 71 34 79 55 6b 4c 65 53 75 4c 4c 58 6a 73 2f 61 74 74 32 79 6e 72 54 43 72 39 33 47 77 71 44 70 33 38 6e 4a 37 65 50 49 71 62 2f 48 30 65 66 78 36 4d 6a 74 74 63 75 75 30 76 7a 50 7a 66 58 34 30 39 45 46 42 66 33 49 43 64 72 6f 32 4f 62 38 37 75 45 46 45 67 76 52 41 75 54 73 45 74 54 70 46 2b 6a 2b 47 68 6b 67 38 50 50 64 44 76 51 57 4a 78 4d 6b 4a 2b 63 62 47 67 63 6d 43 51 73 52 49 78 37 30 46 79 58 32 45 79 34 73 42 7a 30 58 46 51 34 79 46 78 73 6b 41 44 42 49 2f 68 38 43 52 53 70 4f 47 43 55 75 52 45 34 77 4e 6a 4d 6a 52 31 52 4c 4d 77 35 52 47 46 6f 79 4d 43 70 41 51 56 Data Ascii: zh4SDd4t2iImtjYpqhqOko6dycoGamZpveYx/rpOtrK+AsHrDpafEyaXHjKWMq4yUkLeSuLLXjs/att2ynrTCr93GwqDp38nJ7ePIqb/H0efx6Mjttcuu0vzPzfX409EFBf3ICdro2Ob87uEFEgvRAuTsEtTpF+j+Ghkg8PPdDvQWJxMkJ+cbGgcmCQsRIx70FyX2Ey4sBz0XFQ4yFxskADBI/h8CRSpOGCUuRE4wNjMjR1RLMw5RGFoyMCpAQV
2025-03-20 13:27:01 UTC	1369	IN	Data Raw: 68 34 70 38 72 34 2b 4e 67 61 4b 48 6b 49 57 70 6a 35 4f 48 76 49 65 57 6a 49 32 50 6d 5a 43 67 66 61 53 67 77 4a 43 66 6f 4d 61 47 72 72 65 67 79 61 61 6c 71 6f 75 51 30 4d 65 33 73 39 50 47 30 5a 6d 63 31 36 36 33 33 39 50 6a 78 4e 2b 34 35 61 69 38 71 4e 72 42 77 62 6a 77 78 4e 43 72 36 2b 44 51 36 50 62 32 2b 65 7a 59 32 39 6e 38 75 74 7a 71 38 41 62 5a 38 65 4c 79 32 2b 58 46 41 4e 33 61 34 75 62 65 7a 78 48 7a 34 42 45 4e 32 41 7a 71 32 64 6e 78 45 50 66 62 37 2f 72 5a 45 50 58 66 41 65 63 68 34 2f 54 38 44 4f 59 76 41 67 48 71 49 79 2f 73 37 68 45 34 4c 66 49 46 39 42 6a 31 50 2f 30 55 4e 68 30 54 42 68 4a 4a 2b 6a 67 44 50 52 6f 39 4c 78 73 66 43 78 39 50 56 6a 64 50 55 79 4a 48 53 42 52 53 54 30 77 38 58 6c 52 65 48 31 6b 59 47 56 4a 56 4e 45 41 Data Ascii: h4p8r4+NgaKHkIWpj5OHvIeWjI2PmZCgfaSgwJCfoMaGrregyaalqouQ0Me3s9PG0Zmc166339PjxN+45ai8qNrBwbjwxNCr6+DQ6Pb2+ezY29n8utzq8AbZ8eLy2+XFAN3a4ubezxHz4BEN2Azq2dnxEPfb7/rZEPXfAech4/T8DOYvAgHqIy/s7hE4LfIF9Bj1P/0UNh0TBhJJ+jgDPRo9LxsfCx9PVjdPUyJHSBRST0w8XlReH1kYGVJVNEA
2025-03-20 13:27:01 UTC	1369	IN	Data Raw: 6e 4f 52 6e 35 36 6d 6f 37 6d 79 69 4b 36 36 66 4c 61 35 6e 35 57 59 78 4a 4b 75 78 6f 50 4b 77 4b 69 4d 77 4b 48 49 71 59 69 79 77 70 79 75 79 62 62 59 6a 38 71 5a 30 61 6d 70 7a 4c 4f 34 72 4c 75 61 74 37 47 66 32 62 61 31 75 63 75 31 75 4d 71 75 78 4c 76 6c 78 72 36 2f 34 2b 72 55 32 73 58 49 79 2b 6a 32 76 51 44 4b 32 4d 2f 6a 30 77 43 2f 35 63 72 34 2b 66 6a 72 45 41 2f 61 37 67 6e 6a 7a 2b 4c 54 46 67 77 63 35 75 67 54 31 77 6a 70 48 76 44 62 44 53 41 47 41 41 41 61 49 43 55 6a 48 4f 67 73 44 79 41 48 4d 51 67 6c 4c 50 4d 4a 46 76 41 58 2b 78 49 54 46 68 30 63 49 68 31 44 48 44 55 37 49 52 6f 55 49 51 6f 35 52 45 49 4d 52 54 42 49 50 30 63 50 4c 43 6b 32 4c 45 67 79 46 6c 30 57 4e 53 39 52 48 55 39 6c 4a 46 35 59 56 57 45 37 53 32 77 6e 53 56 42 41 Data Ascii: nORn56mo7myiK66fLa5n5WYxJKuxoPKwKiMwKHIqYiywpyuybbYj8qZ0ampzLO4rLuat7Gf2ba1ucu1uMquxLvlxr6/4+rU2sXIy+j2vQDK2M/j0wC/5cr4+fjrEA/a7gnjz+LTFgwc5ugT1wjpHvDbDSAGAAAaICUjHOgsDyAHMQglLPMJFvAX+xITFh0cIh1DHDU7IRoUIQo5REIMRTBIP0cPLCk2LEgyFl0WNS9RHU9lJF5YVWE7S2wnSVBA
2025-03-20 13:27:01 UTC	1369	IN	Data Raw: 69 56 75 5a 70 35 72 58 31 36 65 49 32 57 6e 34 4b 47 73 4d 57 42 73 73 53 66 66 36 71 4e 78 59 65 73 70 70 2b 51 7a 4c 4c 4e 31 4e 4f 35 31 62 4b 62 6c 62 79 54 6d 36 76 43 31 39 44 62 73 4d 54 62 71 62 54 44 36 4c 66 46 71 64 48 6a 72 2f 50 54 30 63 2b 76 37 65 6e 51 79 64 76 56 76 2f 37 32 38 39 48 7a 76 4e 32 2f 33 73 54 39 31 76 6a 57 33 39 7a 5a 34 73 33 4b 37 4d 77 53 7a 68 73 4a 43 52 50 2b 36 2b 33 58 44 4f 76 67 49 76 6b 67 2b 64 38 66 39 2b 6a 6b 2b 2f 63 49 47 68 34 55 4e 53 38 43 46 2f 45 4e 4d 52 73 7a 4f 79 63 2f 44 52 66 34 2b 77 41 42 41 68 6f 37 42 6b 55 71 52 44 38 70 54 77 74 52 47 6b 30 64 4a 6a 4a 52 54 79 64 5a 57 46 30 36 4b 6c 6f 63 49 57 42 55 57 7a 70 61 4f 7a 30 2f 52 55 78 4b 52 56 31 68 52 57 35 4e 61 57 30 75 54 56 4a 4d 63 Data Ascii: iVuZp5rX16eI2Wn4KGsMWBssSff6qNxYespp+QzLLN1NO51bKblbyTm6vC19DbsMTbqbTD6LfFqdHjr/PT0c+v7enQydvVv/7289HzvN2/3sT91vjW39zZ4s3K7MwSzhsJCRP+6+3XDOvgIvkg+d8f9+jk+/cIGh4UNS8CF/ENMRszOyc/DRf4+wABAho7BkUqRD8pTwtRGk0dJjJRTydZWF06KlocIWBUWzpaOz0/RUxKRV1hRW5NaW0uTVJMc
2025-03-20 13:27:01 UTC	1369	IN	Data Raw: 36 6f 73 4b 37 66 4d 53 42 77 4c 4f 37 67 72 71 39 66 37 36 5a 71 4d 47 38 7a 4a 2f 54 73 70 53 59 78 38 75 56 71 5a 50 63 70 36 71 70 74 5a 36 6b 6c 36 57 6b 74 72 4b 37 75 75 76 6e 32 4c 75 72 34 4e 44 65 79 4b 37 57 39 2f 66 6a 73 4d 7a 55 76 62 6e 79 31 51 50 58 30 62 37 33 77 39 6a 38 33 39 51 4d 39 77 66 4c 44 51 38 48 33 41 37 50 41 42 4d 5a 30 64 4d 62 35 68 33 38 36 51 2f 61 39 78 7a 7a 45 68 77 64 41 52 58 33 43 77 50 69 44 41 76 70 2b 52 37 71 41 68 41 44 42 7a 55 4f 4b 42 72 78 2f 41 38 75 43 54 45 43 45 45 50 39 44 69 64 47 4b 44 51 71 4b 30 51 76 4b 53 56 52 4a 67 77 50 55 55 34 6c 52 55 77 78 53 30 73 76 46 43 77 35 4e 7a 52 4d 50 57 4a 41 52 69 4a 43 4e 55 4e 6e 50 56 6f 71 58 30 49 37 54 45 4e 4d 64 31 4a 59 51 57 52 33 56 58 64 66 62 6b Data Ascii: 6osK7fMSBwLO7grq9f76ZqMG8zJ/TspSYx8uVqZPcp6qptZ6kl6WktrK7uuvn2Lur4NDeyK7W9/fjsMzUvbny1QPX0b73w9j839QM9wfLDQ8H3A7PABMZ0dMb5h386Q/a9xzzEhwdARX3CwPiDAvp+R7qAhADBzUOKBrx/A8uCTECEEP9DidGKDQqK0QvKSVRJgwPUU4lRUwxS0svFCw5NzRMPWJARiJCNUNnPVoqX0I7TENMd1JYQWR3VXdfbk
2025-03-20 13:27:01 UTC	1369	IN	Data Raw: 76 63 6e 42 70 61 6d 49 75 4b 47 6d 69 37 79 6c 77 63 75 52 76 73 72 50 30 63 61 75 6c 63 57 30 79 35 66 43 75 4e 66 55 6f 64 62 61 32 74 2f 71 76 71 50 4f 70 4d 54 63 37 4d 54 68 36 72 48 75 37 4c 48 59 35 2b 66 71 30 2f 66 33 76 66 33 5a 2b 63 41 43 38 2f 72 46 39 64 6e 67 79 51 72 64 41 4d 73 4f 38 51 66 51 36 2f 55 4c 31 52 54 55 45 74 6b 4b 2f 52 44 64 39 78 41 61 34 42 49 43 49 43 6f 57 48 42 7a 6f 33 79 67 6e 37 52 34 47 4b 50 41 4d 4b 41 33 7a 4e 68 49 30 39 7a 6f 4f 4d 76 30 2b 47 6a 70 47 4d 6b 41 38 42 6a 59 61 50 41 6b 6b 52 45 41 4d 54 6b 51 70 45 51 67 32 54 42 59 77 4d 6c 49 5a 57 6a 70 54 48 45 77 64 57 53 42 53 51 6c 38 6c 51 45 4a 69 4b 53 42 63 61 48 4a 65 5a 47 55 78 4b 46 5a 75 4e 47 5a 30 63 7a 68 71 64 46 55 2b 57 48 78 37 51 59 4a Data Ascii: vcnBpamIuKGmi7ylwcuRvsrP0caulcW0y5fCuNfUodba2t/qvqPOpMTc7MTh6rHu7LHY5+fq0/f3vf3Z+cAC8/rF9dngyQrdAMsO8QfQ6/UL1RTUEtkK/RDd9xAa4BICICoWHBzo3ygn7R4GKPAMKA3zNhI09zoOMv0+GjpGMkA8BjYaPAkkREAMTkQpEQg2TBYwMlIZWjpTHEwdWSBSQl8lQEJiKSBcaHJeZGUxKFZuNGZ0czhqdFU+WHx7QYJ