Edit tour

Windows Analysis Report
https://formaigine.com/

Overview

General Information

Sample URL:	https://formaigine.com/
Analysis ID:	1540632
Tags:	urlscan
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6224 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1912,i,104717107978586262,117549601071073288,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5964 --field-trial-handle=1912,i,104717107978586262,117549601071073288,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://formaigine.com/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /bolt-performance?src=72&evid=21&appName=thunderbolt&is_rollout=1&is_company_network=false&is_sav_rollout=0&is_dac_rollout=0&dc=42&microPop=fastly_42_g&is_cached=false&msid=104443df-94fb-4f1d-a85d-62d33b6e3abf&session_id=7d6a723c-2b75-4353-8f37-83624e11716e&ish=false&isb=false&vsi=a93c7756-2f94-4362-84e2-df4624b7433c&caching=miss,miss_miss&pv=visible&pn=1&v=1.14709.0&url=https%3A%2F%2Fwww.formaigine.com%2F&st=2&ts=713&tsn=3457&platformOnSite=true HTTP/1.1Host: frog.wix.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.formaigine.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.formaigine.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://www.formaigine.com/	HTTP Parser: Iframe src: https://ecom.wixapps.net/storefront/cartwidgetPopup?pageId=masterPage&compId=tpapopup-1729722565022_rtby_comp-m2cxw3sw2&viewerCompId=tpapopup-1729722565022_rtby_comp-m2cxw3sw2&siteRevision=45&viewMode=site&deviceType=desktop&locale=en&tz=Asia%2FKolkata&regionalLanguage=en&width=25&height=20&isInPopup=true&origCompId=comp-m2cxw3sw2&instance=QbnwA1XD0DmjbNkEkhvOrw-nuQEQsa6_Qm7lXlkgYGE.eyJpbnN0YW5jZUlkIjoiZTkyN2MyMTMtNzE5Yy00ZDBlLTljYjAtNTg3ZjlhMGFlOGVlIiwiYXBwRGVmSWQiOiIxMzgwYjcwMy1jZTgxLWZmMDUtZjExNS0zOTU3MWQ5NGRmY2QiLCJtZXRhU2l0ZUlkIjoiMTA0NDQzZGYtOTRmYi00ZjFkLWE4NWQtNjJkMzNiNmUzYWJmIiwic2lnbkRhdGUiOiIyMDI0LTEwLTIzVDIyOjI4OjU1Ljc0NFoiLCJ2ZW5kb3JQcm9kdWN0SWQiOiJzdG9yZXNfc2lsdmVyIiwiZGVtb01vZGUiOmZhbHNlLCJhaWQiOiIzZjdlMTY2NC00NTM1LTRlM2YtOTQ0Mi0yMDBmNjVkNGY5NDciLCJiaVRva2VuIjoiZjk2MzgxY2MtZTU2Ny0wMjEzLTM0ZWQtM2FhY2ExNjRkMjUxIiwic2l0ZU93bmVySWQiOiI0MjNkYjcwNC0wMmQzLTQxZDAtYTFmYS00ZDkxYjJlZTRkNTkifQ&currency=INR&currentCurrency=INR&commonConfig=%7B%22brand%22%3A%22wix%22%2C%22host%22%3A%22VIEWER%22%2C%22bsi%22%3A%224f1931a9-9179-4116-b48c-90bee8bef24b%7C1%22%2C%22siteRevision%22%3A%2245%22%2C%22renderingFlow%22%3A%22NONE%22%2C%22language%22%3A%22en%22%2C%22locale%22%3A%22en-in%22%2C%22BSI%22%3A%224f1931a9-9179-4116-b48c-90bee8bef24b%7C1%22%7D&currentRoute=.%2F&vsi=a93c7756-2f94-4362-84e2-df4624b7433c
Source: https://www.formaigine.com/design-vault	HTTP Parser: Iframe src: https://ecom.wixapps.net/storefront/cartwidgetPopup?pageId=masterPage&compId=tpapopup-1729722565022_rtby_comp-m2cxw3sw2&viewerCompId=tpapopup-1729722565022_rtby_comp-m2cxw3sw2&siteRevision=45&viewMode=site&deviceType=desktop&locale=en&tz=Asia%2FKolkata&regionalLanguage=en&width=25&height=20&isInPopup=true&origCompId=comp-m2cxw3sw2&instance=QbnwA1XD0DmjbNkEkhvOrw-nuQEQsa6_Qm7lXlkgYGE.eyJpbnN0YW5jZUlkIjoiZTkyN2MyMTMtNzE5Yy00ZDBlLTljYjAtNTg3ZjlhMGFlOGVlIiwiYXBwRGVmSWQiOiIxMzgwYjcwMy1jZTgxLWZmMDUtZjExNS0zOTU3MWQ5NGRmY2QiLCJtZXRhU2l0ZUlkIjoiMTA0NDQzZGYtOTRmYi00ZjFkLWE4NWQtNjJkMzNiNmUzYWJmIiwic2lnbkRhdGUiOiIyMDI0LTEwLTIzVDIyOjI4OjU1Ljc0NFoiLCJ2ZW5kb3JQcm9kdWN0SWQiOiJzdG9yZXNfc2lsdmVyIiwiZGVtb01vZGUiOmZhbHNlLCJhaWQiOiIzZjdlMTY2NC00NTM1LTRlM2YtOTQ0Mi0yMDBmNjVkNGY5NDciLCJiaVRva2VuIjoiZjk2MzgxY2MtZTU2Ny0wMjEzLTM0ZWQtM2FhY2ExNjRkMjUxIiwic2l0ZU93bmVySWQiOiI0MjNkYjcwNC0wMmQzLTQxZDAtYTFmYS00ZDkxYjJlZTRkNTkifQ&currency=INR&currentCurrency=INR&commonConfig=%7B%22brand%22%3A%22wix%22%2C%22host%22%3A%22VIEWER%22%2C%22bsi%22%3A%224f1931a9-9179-4116-b48c-90bee8bef24b%7C1%22%2C%22siteRevision%22%3A%2245%22%2C%22renderingFlow%22%3A%22NONE%22%2C%22language%22%3A%22en%22%2C%22locale%22%3A%22en-in%22%2C%22BSI%22%3A%224f1931a9-9179-4116-b48c-90bee8bef24b%7C1%22%7D&currentRoute=.%2F&vsi=a93c7756-2f94-4362-84e2-df4624b7433c

Source: https://www.formaigine.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.formaigine.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.formaigine.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.formaigine.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.formaigine.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.formaigine.com/design-vault	HTTP Parser: No <meta name="author".. found

Source: https://www.formaigine.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.formaigine.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.formaigine.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.formaigine.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.formaigine.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.formaigine.com/design-vault	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:62968 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	DNS traffic detected: DNS query: formaigine.com
Source: global traffic	DNS traffic detected: DNS query: www.formaigine.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.parastorage.com
Source: global traffic	DNS traffic detected: DNS query: static.wixstatic.com
Source: global traffic	DNS traffic detected: DNS query: siteassets.parastorage.com
Source: global traffic	DNS traffic detected: DNS query: frog.wix.com
Source: global traffic	DNS traffic detected: DNS query: panorama.wixapps.net
Source: global traffic	DNS traffic detected: DNS query: video.wixstatic.com
Source: global traffic	DNS traffic detected: DNS query: ecom.wixapps.net
Source: global traffic	DNS traffic detected: DNS query: cdn.ravenjs.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-Wix-Request-Id: 1729722601.05014708872826930713Server: PepyakaX-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 23 Oct 2024 22:30:01 GMTX-Served-By: cache-dfw-kdfw8210097-DFWX-Cache: MISSStrict-Transport-Security: max-age=86401X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,AHc3TXLcXOul+t9LIbGg9ciHE4dbw+wewoJ5nvKoyjE=,m0j2EEknGIVUW/liY8BLLl0JD7KSWkoEfVPVR5/VVk4QXT2AyjWfyxKagyd4/pDD,qYxvFa0bBL43z6b6TutC4Qxd8IE708pE8FxKUL3BiNmEMtypOn7orxbcrnlvNeEdT1WE5U66waiJEJz3HArgXw==,ZyqOU5RmLo06QtSO1rnOlQDQLRL0CB+cXjGp7vN+JY8=Via: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 654Content-Type: application/json; charset=utf-8Pragma: no-cacheCache-Control: no-store, no-cacheX-Wix-Request-Id: 1729722604.714151470495461297Server: PepyakaX-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 23 Oct 2024 22:30:04 GMTX-Served-By: cache-dfw-kdfw8210037-DFWX-Cache: MISSStrict-Transport-Security: max-age=86401X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLlAwLb1tXR23DYhcoMEdpYDu/2EjeiyKjB/JVOb8T5Ve,qYxvFa0bBL43z6b6TutC4XcNukqOgPgkWSw4z7R4sPuav3eHP5QoHPKzJEubJovuTlpbaAb6W883SiJl1RFiqA==,cHRtQrknGItGja64/E4ONwqchA0VEAROgOj6VgeSDvY=,OsvjBGZTB/e2ihuGMeCnQtkcOrtt3PTyMrkEERb2WJ3GWGT0pYGZ9G7JddqjaHecND6giIhNyfZUs5VloQcdzmFICA5kZK49PzKXXSGj/+8=Via: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1912,i,104717107978586262,117549601071073288,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://formaigine.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5964 --field-trial-handle=1912,i,104717107978586262,117549601071073288,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1912,i,104717107978586262,117549601071073288,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5964 --field-trial-handle=1912,i,104717107978586262,117549601071073288,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://static.parastorage.com/services/wix-thunderbolt/dist/platformPubsub.236f41ee.chunk.min.js	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/group_22.c72c096c.chunk.min.js	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/platformPubsub.236f41ee.chunk.min.js.ma	0%	URL Reputation	safe
https://static.parastorage.com/services/editor-elements-design-systems/dist/thunderbolt/	0%	URL Reputation	safe
https://static.parastorage.com/services/editor-elements-library/dist/corvid/rb_wixui.corvid_bootstra	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/environmentWixCodeSdk.7690a40b.chunk.mi	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/tslib.inline.4901af4a.chunk.min.js	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/panorama.051dc072.chunk.min.js	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/tpaCommons.1b788520.chunk.min.js	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/triggersAndReactions.66bcbb0c.chunk.min	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/bi.inline.b203996e.bundle.min.js.map	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/environmentWixCodeSdk.7690a40b.chunk.min.js	0%	URL Reputation	safe
https://openjsf.org/	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/router.a5287863.chunk.min.js.map	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/animations.0c47ed2a.chunk.min.js.map	0%	URL Reputation	safe
http://underscorejs.org/LICENSE	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/group_7.bae0ce0c.chunk.min.css	0%	URL Reputation	safe
https://greensock.com/standard-license	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/usedPlatformApis.c3e70464.chunk.min.js	0%	URL Reputation	safe
https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt_bootstrap-responsive.af222ade.bundle.min.js	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/passwordProtectedPage.f58235c3.chunk.mi	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/triggersAndReactions.66bcbb0c.chunk.min.js	0%	URL Reputation	safe
https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[SkipToContentButton].69abe737.bundle.min.js	0%	URL Reputation	safe

Source: chromecache_270.2.dr, chromecache_297.2.dr, chromecache_527.2.dr, chromecache_403.2.dr	String found in binary or memory: http://angularjs.org
Source: chromecache_270.2.dr, chromecache_297.2.dr	String found in binary or memory: http://caniuse.com/#search=transition
Source: chromecache_527.2.dr, chromecache_403.2.dr	String found in binary or memory: http://errors.angularjs.org/1.6.1/
Source: chromecache_544.2.dr, chromecache_405.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_533.2.dr, chromecache_379.2.dr	String found in binary or memory: http://medialize.github.io/URI.js/
Source: chromecache_337.2.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_337.2.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_337.2.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_337.2.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_328.2.dr, chromecache_251.2.dr	String found in binary or memory: http://underscorejs.org/LICENSE
Source: chromecache_533.2.dr, chromecache_379.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license
Source: chromecache_488.2.dr, chromecache_546.2.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: chromecache_322.2.dr, chromecache_517.2.dr	String found in binary or memory: https://api.whatsapp.com/send?phone=
Source: chromecache_337.2.dr	String found in binary or memory: https://bo.wix.com/suricate/
Source: chromecache_337.2.dr	String found in binary or memory: https://browser.sentry-cdn.com/6.18.2/bundle.min.js
Source: chromecache_484.2.dr, chromecache_542.2.dr	String found in binary or memory: https://cdn.ravenjs.com/3.22.2/angular/raven.min.js
Source: chromecache_544.2.dr, chromecache_405.2.dr	String found in binary or memory: https://feross.org
Source: chromecache_350.2.dr, chromecache_386.2.dr	String found in binary or memory: https://files.wix.com/site/media/files/
Source: chromecache_350.2.dr, chromecache_386.2.dr	String found in binary or memory: https://files.wixstatic.com/
Source: chromecache_484.2.dr, chromecache_542.2.dr	String found in binary or memory: https://gepi.global-e.com/Wix/WixStaticScript_MC.js
Source: chromecache_446.2.dr, chromecache_359.2.dr	String found in binary or memory: https://github.com/obogo/angular-focusmanager
Source: chromecache_451.2.dr, chromecache_622.2.dr	String found in binary or memory: https://greensock.com
Source: chromecache_451.2.dr, chromecache_622.2.dr	String found in binary or memory: https://greensock.com/standard-license
Source: chromecache_328.2.dr, chromecache_251.2.dr	String found in binary or memory: https://lodash.com/
Source: chromecache_328.2.dr, chromecache_251.2.dr	String found in binary or memory: https://lodash.com/license
Source: chromecache_328.2.dr, chromecache_251.2.dr	String found in binary or memory: https://npms.io/search?q=ponyfill.
Source: chromecache_328.2.dr, chromecache_251.2.dr	String found in binary or memory: https://openjsf.org/
Source: chromecache_337.2.dr	String found in binary or memory: https://polyfill-fastly.io/v3/polyfill.min.js?features=fetch
Source: chromecache_557.2.dr, chromecache_414.2.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_337.2.dr	String found in binary or memory: https://schema.org/
Source: chromecache_337.2.dr	String found in binary or memory: https://siteassets.parastorage.com/pages/pages/thunderbolt?appDefinitionIdToSiteRevision=%7B%22d9065
Source: chromecache_337.2.dr	String found in binary or memory: https://static.parastorage.com/client/pfavico.ico
Source: chromecache_285.2.dr, chromecache_609.2.dr	String found in binary or memory: https://static.parastorage.com/services/auto-frontend-modules/dist/webworker/auto-frontend-modules.6
Source: chromecache_337.2.dr	String found in binary or memory: https://static.parastorage.com/services/ecom-platform-cart-icon/1.942.0/CartIconViewerWidget.min.css
Source: chromecache_337.2.dr	String found in binary or memory: https://static.parastorage.com/services/ecom-platform-cart-icon/1.942.0/CartIconViewerWidgetNoCss.bu
Source: chromecache_544.2.dr, chromecache_405.2.dr	String found in binary or memory: https://static.parastorage.com/services/ecom-platform-cart-icon/c2ef8e76f411d0960a7121c4fb14c2ee077e
Source: chromecache_576.2.dr, chromecache_310.2.dr	String found in binary or memory: https://static.parastorage.com/services/editor-elements-design-systems/dist/thunderbolt/
Source: chromecache_572.2.dr, chromecache_354.2.dr, chromecache_608.2.dr, chromecache_498.2.dr, chromecache_439.2.dr, chromecache_412.2.dr, chromecache_445.2.dr, chromecache_619.2.dr, chromecache_332.2.dr, chromecache_279.2.dr, chromecache_301.2.dr, chromecache_274.2.dr, chromecache_482.2.dr, chromecache_420.2.dr	String found in binary or memory: https://static.parastorage.com/services/editor-elements-library/dist/corvid/rb_wixui.corvid
Source: chromecache_428.2.dr, chromecache_530.2.dr	String found in binary or memory: https://static.parastorage.com/services/editor-elements-library/dist/corvid/rb_wixui.corvid_bootstra
Source: chromecache_547.2.dr, chromecache_553.2.dr	String found in binary or memory: https://static.parastorage.com/services/editor-elements-library/dist/corvid/rb_wixui.corvid_forms.93

IP	Domain	Country	ASN	ASN Name	Malicious
107.23.201.212	unknown	United States	14618	AMAZON-AESUS	false
3.165.102.68	unknown	United States	16509	AMAZON-02US	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
185.230.63.186	formaigine.com	Israel	58182	WIX_COMIL	false
34.49.229.81	td-static-34-49-229-81.parastorage.com	United States	2686	ATGS-MMD-ASUS	false
52.200.115.90	unknown	United States	14618	AMAZON-AESUS	false
151.101.130.217	unknown	United States	54113	FASTLYUS	false
99.86.4.125	d1cq301dpr7fww.cloudfront.net	United States	16509	AMAZON-02US	false
54.237.71.103	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
99.86.4.79	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.194.217	cdn.ravenjs.com	United States	54113	FASTLYUS	false
34.149.87.45	td-ccm-neg-87-45.wixdns.net	United States	2686	ATGS-MMD-ASUS	false
172.217.16.196	unknown	United States	15169	GOOGLEUS	false
34.149.206.255	glb-editor.wix.com	United States	2686	ATGS-MMD-ASUS	false

IP
192.168.2.9
192.168.2.6

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540632
Start date and time:	2024-10-24 00:27:50 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://formaigine.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@19/581@48/17
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
glb-editor.wix.com	34.149.206.255	true	false	unknown
td-static-34-49-229-81.parastorage.com	34.49.229.81	true	false	unknown
d1cq301dpr7fww.cloudfront.net	99.86.4.125	true	false	unknown
cdn.ravenjs.com	151.101.194.217	true	false	unknown
formaigine.com	185.230.63.186	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
td-ccm-neg-87-45.wixdns.net	34.149.87.45	true	false	unknown
bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com	54.237.71.103	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
video.wixstatic.com	unknown	unknown	false	unknown
static.wixstatic.com	unknown	unknown	false	unknown
siteassets.parastorage.com	unknown	unknown	false	unknown
frog.wix.com	unknown	unknown	false	unknown
ecom.wixapps.net	unknown	unknown	false	unknown
www.formaigine.com	unknown	unknown	false	unknown
panorama.wixapps.net	unknown	unknown	false	unknown
static.parastorage.com	unknown	unknown	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://static.parastorage.com/services/wix-thunderbolt/dist/group_31.82d70b0a.chunk.min.js.map	chromecache_480.2.dr, chromecache_273.2.dr	false		unknown
https://static.parastorage.com/services/ecom-platform-cart-icon/1.942.0/CartIconViewerWidgetNoCss.bu	chromecache_337.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/platformPubsub.236f41ee.chunk.min.js.ma	chromecache_407.2.dr, chromecache_460.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/editor-elements-design-systems/dist/thunderbolt/	chromecache_576.2.dr, chromecache_310.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/editor-elements-library/dist/corvid/rb_wixui.corvid_bootstra	chromecache_428.2.dr, chromecache_530.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/motion.31953914.chunk.min.js.map	chromecache_258.2.dr, chromecache_346.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/environmentWixCodeSdk.7690a40b.chunk.mi	chromecache_390.2.dr, chromecache_532.2.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/AUTHORS.txt	chromecache_337.2.dr	false	URL Reputation: safe	unknown
https://www.formaigine.com	chromecache_337.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_19.7fd5a859.chunk.min.js.map	chromecache_381.2.dr, chromecache_357.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/triggersAndReactions.66bcbb0c.chunk.min	chromecache_284.2.dr, chromecache_624.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/bi.inline.b203996e.bundle.min.js.map	chromecache_337.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/8869.0bfadfd3.chunk.min.js.map	chromecache_287.2.dr, chromecache_338.2.dr	false		unknown
https://openjsf.org/	chromecache_328.2.dr, chromecache_251.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_28.80fe286a.chunk.min.js.map	chromecache_571.2.dr, chromecache_536.2.dr	false		unknown
https://gepi.global-e.com/Wix/WixStaticScript_MC.js	chromecache_484.2.dr, chromecache_542.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/router.a5287863.chunk.min.js.map	chromecache_322.2.dr, chromecache_517.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/ooi.23a751c1.chunk.min.js.map	chromecache_469.2.dr, chromecache_378.2.dr	false		unknown
https://files.wix.com/site/media/files/	chromecache_350.2.dr, chromecache_386.2.dr	false		unknown
http://polymer.github.io/PATENTS.txt	chromecache_337.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/popups.efc78062.chunk.min.js.map	chromecache_340.2.dr, chromecache_483.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/animations.0c47ed2a.chunk.min.js.map	chromecache_522.2.dr, chromecache_543.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/webpack-runtime.2968ab7a.bundle.min.js.	chromecache_337.2.dr	false		unknown
http://underscorejs.org/LICENSE	chromecache_328.2.dr, chromecache_251.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_4.92eb9137.chunk.min.js.map	chromecache_600.2.dr, chromecache_276.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_7.bae0ce0c.chunk.min.css	chromecache_337.2.dr	false	URL Reputation: safe	unknown
https://greensock.com/standard-license	chromecache_451.2.dr, chromecache_622.2.dr	false	URL Reputation: safe	unknown
http://errors.angularjs.org/1.6.1/	chromecache_527.2.dr, chromecache_403.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/passwordProtectedPage.f58235c3.chunk.mi	chromecache_531.2.dr, chromecache_256.2.dr	false	URL Reputation: safe	unknown

Input	Output
URL: https://www.formaigine.com/ Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Redefining Design and Architecture Utilising Artificial Intelligence", "prominent_button_name": "Explore", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://www.formaigine.com/ Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Redefining Design and Architecture Utilising Artificial Intelligence", "prominent_button_name": "Explore", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://www.formaigine.com/ Model: claude-3-haiku-20240307	```json { "brands": [ "Formalgine" ] }
	```json { "brands": [ "Formalgine" ] }
URL: https://www.formaigine.com/ Model: claude-3-haiku-20240307	```json { "brands": [ "Formaigine" ] }
	```json { "brands": [ "Formaigine" ] }
URL: https://www.formaigine.com/design-vault Model: claude-3-haiku-20240307	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Explore", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://www.formaigine.com/design-vault Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Redefining Design and Architecture Utilising Artificial Intelligence", "prominent_button_name": "Explore", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://www.formaigine.com/design-vault Model: claude-3-haiku-20240307	```json { "brands": [ "Formalgine" ] }
	```json { "brands": [ "Formalgine" ] }
URL: https://www.formaigine.com/portfolio-collections/my-portfolio/casa-di-roccia Model: claude-3-haiku-20240307	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://www.formaigine.com/portfolio-collections/my-portfolio/casa-di-roccia Model: claude-3-haiku-20240307	```json { "brands": [ "The Design Vault" ] }
	```json { "brands": [ "The Design Vault" ] }
URL: https://www.formaigine.com/design-vault Model: claude-3-haiku-20240307	```json { "brands": [ "Formalgine" ] }
	```json { "brands": [ "Formalgine" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64455)
Category:	downloaded
Size (bytes):	64571
Entropy (8bit):	5.385180063067938
Encrypted:	false
SSDEEP:	1536:aDewHw0JPREP6HU8WHGJDewrur6pKlYzsu8ZEjlfTYkCwmB0uVbOa:aDeURRE2DEdjkCSej
MD5:	08D3C18D3D4EDEF8471BA28F99C044E1
SHA1:	0DF1286DE8D08894FCF347370B55DA5F2B6446D8
SHA-256:	236B026062BD9D13A92BD8A0DBD2FFCDF8A2D46B89C969682EED4F13400E7C69
SHA-512:	9844059075A6C7E12214851E59660043C75E165B29D880E754966FCF1A9A9DE917993A380789AF641E3409159863D9A1A82FA4F2407EDDA346C3199253108619
Malicious:	false
Reputation:	low
URL:	https://static.parastorage.com/services/wix-thunderbolt/dist/group_3.cb439756.chunk.min.js
Preview:	(self.webpackJsonp__wix_thunderbolt_app=self.webpackJsonp__wix_thunderbolt_app\|\|[]).push([[266],{62289:function(e,t,n){"use strict";t.YZ=void 0;var r=n(71764);Object.defineProperty(t,"YZ",{enumerable:!0,get:function(){return r.hashString}})},64846:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.hashPhone=t.hashEmail=t.digest=void 0;var r=n(5292),o="@@@wix-D15BA8F5-3031-42CA-BD43-0B68F418B2F0@@@";function a(e){return r(e+o)}t.digest=a,t.hashEmail=function(e){var t=e.lastIndexOf("@"),n=e.substr(0,t),r=e.substr(t+1);return"wix.com"!==r&&(n=a(n)),"".concat(n,"@").concat(r)},t.hashPhone=function(e){for(var t=a(e),n=e.substr(0,e.length-5),r="",o=0;o<t.length&&r.length<5;o++)isNaN(t[o])\|\|(r+=t[o]);return"".concat(n).concat(r)}},23097:function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.replaceEmails=void 0;var n=o(["=","/","?","(",")","[","]",'"',"'","&","@"]),r=o(["!","#","$","%","&","'","*","+","/","=","?","^","_","`","{","}","(",")",

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 00:28:52.230951071 CEST	192.168.2.6	1.1.1.1	0xd934	Standard query (0)	formaigine.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:52.231040001 CEST	192.168.2.6	1.1.1.1	0xf2fe	Standard query (0)	formaigine.com	65	IN (0x0001)	false
Oct 24, 2024 00:28:53.259799957 CEST	192.168.2.6	1.1.1.1	0x56a2	Standard query (0)	www.formaigine.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:53.259948015 CEST	192.168.2.6	1.1.1.1	0xc72d	Standard query (0)	www.formaigine.com	65	IN (0x0001)	false
Oct 24, 2024 00:28:54.295828104 CEST	192.168.2.6	1.1.1.1	0x4f6b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:54.296133041 CEST	192.168.2.6	1.1.1.1	0x5df7	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 24, 2024 00:28:54.930012941 CEST	192.168.2.6	1.1.1.1	0x5ad7	Standard query (0)	static.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:54.930953979 CEST	192.168.2.6	1.1.1.1	0x877e	Standard query (0)	static.parastorage.com	65	IN (0x0001)	false
Oct 24, 2024 00:28:54.932317972 CEST	192.168.2.6	1.1.1.1	0x3ea1	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:54.932557106 CEST	192.168.2.6	1.1.1.1	0xd036	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Oct 24, 2024 00:28:54.943916082 CEST	192.168.2.6	1.1.1.1	0x7ac2	Standard query (0)	siteassets.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:54.944067001 CEST	192.168.2.6	1.1.1.1	0x96e	Standard query (0)	siteassets.parastorage.com	65	IN (0x0001)	false
Oct 24, 2024 00:28:55.670120955 CEST	192.168.2.6	1.1.1.1	0x3b54	Standard query (0)	frog.wix.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:55.670376062 CEST	192.168.2.6	1.1.1.1	0x61e7	Standard query (0)	frog.wix.com	65	IN (0x0001)	false
Oct 24, 2024 00:28:56.055599928 CEST	192.168.2.6	1.1.1.1	0x10c7	Standard query (0)	panorama.wixapps.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:56.055823088 CEST	192.168.2.6	1.1.1.1	0xa596	Standard query (0)	panorama.wixapps.net	65	IN (0x0001)	false
Oct 24, 2024 00:28:56.068936110 CEST	192.168.2.6	1.1.1.1	0x1509	Standard query (0)	video.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:56.069308996 CEST	192.168.2.6	1.1.1.1	0xfebb	Standard query (0)	video.wixstatic.com	65	IN (0x0001)	false
Oct 24, 2024 00:28:56.122343063 CEST	192.168.2.6	1.1.1.1	0xe8f8	Standard query (0)	www.formaigine.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:56.122744083 CEST	192.168.2.6	1.1.1.1	0x8405	Standard query (0)	www.formaigine.com	65	IN (0x0001)	false
Oct 24, 2024 00:28:56.262116909 CEST	192.168.2.6	1.1.1.1	0xc647	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:56.262295961 CEST	192.168.2.6	1.1.1.1	0xc2d8	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Oct 24, 2024 00:28:56.555696964 CEST	192.168.2.6	1.1.1.1	0x8e3	Standard query (0)	static.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:28:56.555866003 CEST	192.168.2.6	1.1.1.1	0x2f32	Standard query (0)	static.parastorage.com	65	IN (0x0001)	false
Oct 24, 2024 00:29:09.369187117 CEST	192.168.2.6	1.1.1.1	0x716d	Standard query (0)	siteassets.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:09.369714975 CEST	192.168.2.6	1.1.1.1	0x856c	Standard query (0)	siteassets.parastorage.com	65	IN (0x0001)	false
Oct 24, 2024 00:29:28.355276108 CEST	192.168.2.6	1.1.1.1	0xc40	Standard query (0)	ecom.wixapps.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:28.356265068 CEST	192.168.2.6	1.1.1.1	0xbd40	Standard query (0)	ecom.wixapps.net	65	IN (0x0001)	false
Oct 24, 2024 00:29:30.162539959 CEST	192.168.2.6	1.1.1.1	0x1063	Standard query (0)	static.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:30.162900925 CEST	192.168.2.6	1.1.1.1	0x111b	Standard query (0)	static.parastorage.com	65	IN (0x0001)	false
Oct 24, 2024 00:29:30.427927017 CEST	192.168.2.6	1.1.1.1	0x25c4	Standard query (0)	cdn.ravenjs.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:30.428062916 CEST	192.168.2.6	1.1.1.1	0x913	Standard query (0)	cdn.ravenjs.com	65	IN (0x0001)	false
Oct 24, 2024 00:29:31.475022078 CEST	192.168.2.6	1.1.1.1	0xac82	Standard query (0)	cdn.ravenjs.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:31.475177050 CEST	192.168.2.6	1.1.1.1	0xe607	Standard query (0)	cdn.ravenjs.com	65	IN (0x0001)	false
Oct 24, 2024 00:29:33.416681051 CEST	192.168.2.6	1.1.1.1	0xdcda	Standard query (0)	frog.wix.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:33.416842937 CEST	192.168.2.6	1.1.1.1	0x37a0	Standard query (0)	frog.wix.com	65	IN (0x0001)	false
Oct 24, 2024 00:29:34.260101080 CEST	192.168.2.6	1.1.1.1	0xa99b	Standard query (0)	frog.wix.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:34.260329962 CEST	192.168.2.6	1.1.1.1	0x4536	Standard query (0)	frog.wix.com	65	IN (0x0001)	false
Oct 24, 2024 00:29:55.225770950 CEST	192.168.2.6	1.1.1.1	0x32ee	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:55.226592064 CEST	192.168.2.6	1.1.1.1	0x52e6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 24, 2024 00:29:57.422312021 CEST	192.168.2.6	1.1.1.1	0x9b9	Standard query (0)	frog.wix.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:57.422646999 CEST	192.168.2.6	1.1.1.1	0x6a33	Standard query (0)	frog.wix.com	65	IN (0x0001)	false
Oct 24, 2024 00:29:57.793410063 CEST	192.168.2.6	1.1.1.1	0xb7ea	Standard query (0)	static.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:57.793634892 CEST	192.168.2.6	1.1.1.1	0x127e	Standard query (0)	static.parastorage.com	65	IN (0x0001)	false
Oct 24, 2024 00:29:58.951062918 CEST	192.168.2.6	1.1.1.1	0x51f0	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:29:58.951196909 CEST	192.168.2.6	1.1.1.1	0x2eef	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Oct 24, 2024 00:30:00.582448006 CEST	192.168.2.6	1.1.1.1	0x1fbb	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 00:30:00.582587957 CEST	192.168.2.6	1.1.1.1	0xc384	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:49 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 59 31 2f 43 55 48 45 61 6c 30 4f 47 62 53 37 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 64 35 38 30 34 65 62 62 30 63 32 64 61 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Y1/CUHEal0OGbS7r.1Context: d8d5804ebb0c2da9
2024-10-23 22:28:49 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-23 22:28:49 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 59 31 2f 43 55 48 45 61 6c 30 4f 47 62 53 37 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 64 35 38 30 34 65 62 62 30 63 32 64 61 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 44 68 36 34 56 7a 77 44 74 37 71 71 36 72 41 39 5a 6a 63 2f 36 6e 55 62 37 35 34 53 50 62 54 6a 6f 6c 57 51 53 4d 6f 72 39 73 53 47 7a 46 69 58 64 7a 4c 78 42 65 50 4c 76 77 79 75 68 77 62 73 49 68 2f 57 33 54 62 68 50 4b 49 56 37 2f 5a 35 6a 54 54 74 50 74 62 2b 4d 38 52 31 65 72 6a 6f 4c 75 39 58 72 6c 73 49 76 66 71 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Y1/CUHEal0OGbS7r.2Context: d8d5804ebb0c2da9<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaDh64VzwDt7qq6rA9Zjc/6nUb754SPbTjolWQSMor9sSGzFiXdzLxBePLvwyuhwbsIh/W3TbhPKIV7/Z5jTTtPtb+M8R1erjoLu9XrlsIvfqA
2024-10-23 22:28:49 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 59 31 2f 43 55 48 45 61 6c 30 4f 47 62 53 37 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 64 35 38 30 34 65 62 62 30 63 32 64 61 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Y1/CUHEal0OGbS7r.3Context: d8d5804ebb0c2da9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-23 22:28:49 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-23 22:28:49 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6c 44 62 30 67 39 61 6b 6d 55 4b 30 6a 68 42 44 77 66 36 63 51 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: lDb0g9akmUK0jhBDwf6cQw.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:51 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:51 UTC	561	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:51 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 21 Oct 2024 13:21:21 GMT ETag: "0x8DCF1D34132B902" x-ms-request-id: 89fa8e61-601e-0070-0c14-24a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222851Z-r197bdfb6b4lkrtc7na2dkay28000000029g000000001gqy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-23 22:28:51 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-23 22:28:51 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-23 22:28:51 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-23 22:28:51 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-23 22:28:51 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-23 22:28:51 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-23 22:28:52 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-23 22:28:52 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-23 22:28:52 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-23 22:28:52 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:52 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:53 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:52 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 331d1c77-401e-0029-354e-229b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222852Z-16849878b786vsxz21496wc2qn00000006u000000000unz9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 22:28:53 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:52 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:53 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:52 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 394abe64-001e-0028-050b-22c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222852Z-16849878b78c2tmb7nhatnd68s00000006v000000000edvy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 22:28:53 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:52 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:53 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:52 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fdb61705-b01e-0001-2f09-2246e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222852Z-16849878b782558xg5kpzay6es00000006ug0000000081w5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 22:28:53 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://formaigine.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Chrome Cache Entry: 252

Chrome Cache Entry: 253

Chrome Cache Entry: 254

Chrome Cache Entry: 255

Chrome Cache Entry: 256

Chrome Cache Entry: 257

Chrome Cache Entry: 258

Chrome Cache Entry: 259

Chrome Cache Entry: 260

Chrome Cache Entry: 261

Chrome Cache Entry: 262

Chrome Cache Entry: 263

Chrome Cache Entry: 264

Chrome Cache Entry: 265

Chrome Cache Entry: 266

Chrome Cache Entry: 267

Chrome Cache Entry: 268

Chrome Cache Entry: 269

Chrome Cache Entry: 270

Chrome Cache Entry: 271

Chrome Cache Entry: 272

Chrome Cache Entry: 273

Chrome Cache Entry: 274

Windows Analysis Report
https://formaigine.com/

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:52 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:52 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 52fc638d-b01e-0070-36c5-201cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222852Z-16849878b78ngdnlw4w0762cms00000006v000000000q3md x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 22:28:53 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:52 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:53 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 626c88a9-b01e-003d-54f3-24d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222853Z-15b8d89586fx2hlt035xdehq580000000dp0000000004z5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 22:28:53 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:53 UTC	657	OUT	GET / HTTP/1.1 Host: formaigine.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 22:28:53 UTC	706	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 23 Oct 2024 22:28:53 GMT Content-Length: 0 Connection: close location: https://www.formaigine.com/ x-wix-cache-control: public, max-age=86400 strict-transport-security: max-age=86400 Age: 378 Server-Timing: cache;desc=hit, varnish;desc=hit, dc;desc=42 X-Seen-By: oDbbMvfdXCdtsgjD2KgaM8iHE4dbw+wewoJ5nvKoyjE=,m0j2EEknGIVUW/liY8BLLrjAMl1QewRKjWjp2YfgqGAO5u3dMxPR3QRc6kpLZVuH,2d58ifebGbosy5xc+FRalqB1qwAUJEpYloxpSTMUbY9SVb3xcwLQ7SpP8sVGCTs0BtMRK08Fsez2+UzRTdZSFA==,2UNV7KOq4oGjA5+PKsX47OFQIYwPrAuSSGkhbTTPX/NYgeUJqUXtid+86vZww+nL Cache-Control: no-cache X-Wix-Request-Id: 1729722533.1651467457221119777 Server: Pepyaka X-Content-Type-Options: nosniff

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:53 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:53 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:53 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: e5972945-801e-007b-45f3-24e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222853Z-15b8d89586fsx9lfqmgrbzpgmg0000000deg00000000na1u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-23 22:28:53 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:53 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:53 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: bcb88dd7-c01e-0079-47cd-21e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222853Z-16849878b78p6ttkmyustyrk8s00000006r000000000epwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 22:28:53 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:53 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 095283a4-c01e-0066-76f4-24a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222853Z-r197bdfb6b4b582bwynewx7zgn0000000bf000000000ktta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 22:28:53 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:53 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:53 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:53 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: e1deb6d3-201e-006e-700b-22bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222853Z-16849878b784cpcc2dr9ch74ng00000006z0000000006kd2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 22:28:53 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:53 UTC	661	OUT	GET / HTTP/1.1 Host: www.formaigine.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-23 22:28:54 UTC	1861	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Link: <https://static.parastorage.com/>; rel=preconnect; crossorigin;,<https://static.parastorage.com/>; rel=preconnect;,<https://static.wixstatic.com/>; rel=preconnect; crossorigin;,<https://static.wixstatic.com/>; rel=preconnect;,<https://siteassets.parastorage.com>; rel=preconnect; crossorigin;, X-Wix-Request-Id: 1729722534.02714673551609919774 Html-Cacheable: true ETag: W/"d11e483d7f8a23f5822287d65a0ea9a2" Content-Language: en-US Strict-Transport-Security: max-age=86400 Cache-Control: public,max-age=0,must-revalidate Server: Pepyaka X-Content-Type-Options: nosniff Accept-Ranges: bytes Age: 0 Date: Wed, 23 Oct 2024 22:28:54 GMT X-Served-By: cache-dfw-kdfw8210099-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g Set-Cookie: ssr-caching=cache#desc=miss#varnish=miss_miss#dc#desc=fastly_42_g; max-age=20 X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,jKB0KR2wTEE1MYSdxvKSbciHE4dbw+wewoJ5nvKoyjE=,m0j2EEknGIVUW/liY8BLLrjAMl1QewRKjWjp2YfgqGAO5u3dMxPR3QRc6kpLZVuH,2d58ifebGbosy5xc+FRaliHM8Ay1fNe/zeVFqkD1u8G4y5Op3/QmBST/rqSNjOn0RsM/kwNYbCDi8N+1ydB/VA==,2UNV7KOq4oGjA5+PKsX47OFQIYwPrAuSSGkhbTTPX/NYgeUJqUXtid+86vZww+nL,LYvXuRmXT7Xan8m7eUbPAhzvVk/QM5kPLzWXQvn3Jog=,updaSF0YDozocDRTgMoSRw432uAZCweD0iSau0XpIlLPPAV2UyWBb87YYxRA+2U+dqn9roRk4DoFmdx61w2qEA==,CcCC11BBvV9+FhyNj77ZOOm5XnMA0b/e08plLVTjVR0=,LoUK8/saGAmOxZWtpubo2l/0dAijP/lOUF47Y7KSe7vF/dnaq4TxF9qV7eo+ANf5YwM8VT7Lzrt+bAS5PoEceg==,sbu8YdkXYD/va37Ig2h5JP7vhG6Ou1INSKvnGXSHnBo=,/a5ccLSK1HEmwPNg/x6OuvMV0SMiigyUmc/NW7P4sdit2hbZOnPk9pazw45XZFy6UbFEqm54PMqFsntCIG3DZ9KDUNnkN3a3cTDxCIV6CEs= Transfer-Encoding: chunked Via: 1.1 google glb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc= Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-23 22:28:54 UTC	1861	IN	Data Raw: 33 33 61 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 69 64 3d 22 77 69 78 44 65 73 6b 74 6f 70 56 69 65 77 70 6f 72 74 22 20 2f 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e Data Ascii: 33a9<!DOCTYPE html><html lang="en"><head> <meta charset='utf-8'> <meta name="viewport" content="width=device-width, initial-scale=1" id="wixDesktopViewport" /> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="generator" con
2024-10-23 22:28:54 UTC	1861	IN	Data Raw: 77 20 3d 20 44 61 74 65 2e 6e 6f 77 28 29 0a 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 69 6e 69 74 69 61 6c 54 69 6d 65 73 74 61 6d 70 73 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 69 6e 69 74 69 61 6c 54 69 6d 65 73 74 61 6d 70 3a 20 6e 6f 77 2c 0a 20 20 20 20 20 20 20 20 69 6e 69 74 69 61 6c 52 65 71 75 65 73 74 54 69 6d 65 73 74 61 6d 70 3a 20 4d 61 74 68 2e 72 6f 75 6e 64 28 70 65 72 66 6f 72 6d 61 6e 63 65 2e 74 69 6d 65 4f 72 69 67 69 6e 20 3f 20 70 65 72 66 6f 72 6d 61 6e 63 65 2e 74 69 6d 65 4f 72 69 67 69 6e 20 3a 20 6e 6f 77 20 2d 20 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 29 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 74 68 75 6e 64 65 72 62 6f 6c 74 54 61 67 20 3d 20 22 51 41 5f 52 45 41 44 59 22 0a 20 20 20 20 20 Data Ascii: w = Date.now() window.initialTimestamps = { initialTimestamp: now, initialRequestTimestamp: Math.round(performance.timeOrigin ? performance.timeOrigin : now - performance.now()) } window.thunderboltTag = "QA_READY"
2024-10-23 22:28:54 UTC	1861	IN	Data Raw: 43 6f 64 65 53 64 6b 22 2c 22 65 6e 76 69 72 6f 6e 6d 65 6e 74 22 2c 22 6c 69 67 68 74 62 6f 78 22 2c 22 6c 6f 63 61 74 69 6f 6e 57 69 78 43 6f 64 65 53 64 6b 22 2c 22 6e 61 76 69 67 61 74 69 6f 6e 4d 61 6e 61 67 65 72 22 2c 22 6e 61 76 69 67 61 74 69 6f 6e 50 68 61 73 65 73 22 2c 22 6f 6f 69 22 2c 22 70 61 67 65 73 22 2c 22 70 61 6e 6f 72 61 6d 61 22 2c 22 70 61 73 73 77 6f 72 64 50 72 6f 74 65 63 74 65 64 50 61 67 65 22 2c 22 70 72 6f 74 65 63 74 65 64 50 61 67 65 73 22 2c 22 72 65 6e 64 65 72 65 72 22 2c 22 72 65 70 6f 72 74 65 72 22 2c 22 72 6f 75 74 65 72 46 65 74 63 68 22 2c 22 72 6f 75 74 65 72 22 2c 22 73 63 72 6f 6c 6c 52 65 73 74 6f 72 61 74 69 6f 6e 22 2c 22 73 65 6f 57 69 78 43 6f 64 65 53 64 6b 22 2c 22 73 65 6f 22 2c 22 73 65 73 73 69 6f 6e Data Ascii: CodeSdk","environment","lightbox","locationWixCodeSdk","navigationManager","navigationPhases","ooi","pages","panorama","passwordProtectedPage","protectedPages","renderer","reporter","routerFetch","router","scrollRestoration","seoWixCodeSdk","seo","session
2024-10-23 22:28:54 UTC	1861	IN	Data Raw: 66 20 65 3f 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 74 72 69 6d 53 74 61 72 74 28 29 3a 65 2c 74 3d 22 63 6c 69 65 6e 74 2d 73 65 73 73 69 6f 6e 2d 62 69 6e 64 22 2c 6f 3d 22 63 6c 69 65 6e 74 2d 62 69 6e 64 69 6e 67 22 2c 73 3d 22 74 62 52 65 61 64 79 22 2c 72 3d 22 73 65 63 75 72 69 74 79 5f 6f 76 65 72 72 69 64 65 47 6c 6f 62 61 6c 73 22 2c 6e 3d 5b 74 2c 6f 2c 22 73 76 53 65 73 73 69 6f 6e 22 2c 22 73 6d 53 65 73 73 69 6f 6e 22 2c 22 73 65 72 76 65 72 2d 73 65 73 73 69 6f 6e 2d 62 69 6e 64 22 2c 22 77 69 78 53 65 73 73 69 6f 6e 32 22 5d 2e 6d 61 70 28 28 65 3d 3e 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 29 2c 69 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 Data Ascii: f e?decodeURIComponent(e).toLowerCase().trimStart():e,t="client-session-bind",o="client-binding",s="tbReady",r="security_overrideGlobals",n=[t,o,"svSession","smSession","server-session-bind","wixSession2"].map((e=>e.toLowerCase())),i=Object.getOwnProperty
2024-10-23 22:28:54 UTC	1861	IN	Data Raw: 69 73 74 2f 68 61 6e 64 6c 65 41 63 63 65 73 73 54 6f 6b 65 6e 73 2e 69 6e 6c 69 6e 65 2e 35 61 36 37 62 35 36 33 2e 62 75 6e 64 6c 65 2e 6d 69 6e 2e 6a 73 2e 6d 61 70 3c 2f 73 63 72 69 70 74 3e 0a 20 20 0a 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 77 69 6e 64 6f 77 2e 63 6f 6d 6d 6f 6e 43 6f 6e 66 69 67 20 3d 20 76 69 65 77 65 72 4d 6f 64 65 6c 2e 63 6f 6d 6d 6f 6e 43 6f 6e 66 69 67 0a 20 20 20 20 0a 20 20 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 3c 21 2d 2d 20 69 6e 69 74 43 75 73 74 6f 6d 45 6c 65 6d 65 6e 74 73 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 77 69 78 2d 64 79 6e 61 6d 69 63 2d 63 75 73 74 6f 6d 2d 65 6c 65 6d 65 6e 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 44 72 6f 70 44 6f 77 6e 4d 65 6e 75 22 3e 0a 0a 20 20 3c 21 2d 2d Data Ascii: ist/handleAccessTokens.inline.5a67b563.bundle.min.js.map</script> <script> window.commonConfig = viewerModel.commonConfig </script> ... initCustomElements --> <meta name="wix-dynamic-custom-elements" content="DropDownMenu"> ...
2024-10-23 22:28:55 UTC	1861	IN	Data Raw: 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 62 6f 64 79 2e 66 75 6c 6c 53 63 72 65 65 6e 4d 6f 64 65 2d 73 63 72 6f 6c 6c 61 62 6c 65 2e 64 65 76 69 63 65 2d 6d 6f 62 69 6c 65 2d 6f 70 74 69 6d 69 7a 65 64 20 23 53 49 54 45 5f 42 41 43 4b 47 52 4f 55 4e 44 2c 62 6f 64 79 2e 66 75 6c 6c 53 63 72 65 65 6e 4d 6f 64 65 2d 73 63 72 6f 6c 6c 61 62 6c 65 2e 64 65 76 69 63 65 2d 6d 6f 62 69 6c 65 2d 6f 70 74 69 6d 69 7a 65 64 20 23 6d 61 73 74 65 72 50 61 67 65 7b 68 65 69 67 68 74 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 62 6f 64 79 2e 66 75 6c 6c 53 63 72 65 65 6e 4d 6f 64 65 2d 73 63 72 6f 6c 6c 61 62 6c 65 2e 64 65 76 69 63 65 2d 6d 6f 62 69 6c 65 2d 6f 70 74 69 6d 69 7a 65 64 20 23 6d 61 73 74 65 72 50 61 67 65 2e 6d 65 73 68 2d 6c 61 79 6f 75 Data Ascii: hidden!important}body.fullScreenMode-scrollable.device-mobile-optimized #SITE_BACKGROUND,body.fullScreenMode-scrollable.device-mobile-optimized #masterPage{height:auto!important}body.fullScreenMode-scrollable.device-mobile-optimized #masterPage.mesh-layou
2024-10-23 22:28:55 UTC	1861	IN	Data Raw: 73 20 62 61 63 6b 77 61 72 64 73 7d 40 6d 65 64 69 61 28 70 72 65 66 65 72 73 2d 72 65 64 75 63 65 64 2d 6d 6f 74 69 6f 6e 3a 72 65 64 75 63 65 29 7b 3a 3a 76 69 65 77 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 67 72 6f 75 70 28 2a 29 2c 3a 3a 76 69 65 77 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 6e 65 77 28 2a 29 2c 3a 3a 76 69 65 77 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 6f 6c 64 28 2a 29 7b 61 6e 69 6d 61 74 69 6f 6e 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 62 6f 64 79 2c 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6f 75 74 6c 69 6e 65 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 62 6f 64 79 7b 2d 2d Data Ascii: s backwards}@media(prefers-reduced-motion:reduce){::view-transition-group(),::view-transition-new(),::view-transition-old(*){animation:none!important}}body,html{background:transparent;border:0;margin:0;outline:0;padding:0;vertical-align:baseline}body{--
2024-10-23 22:28:55 UTC	206	IN	Data Raw: 6c 69 6e 65 2d 68 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 6f 75 74 6c 69 6e 65 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 3b 70 61 64 64 69 6e 67 3a 30 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 73 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 7d 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 23 73 69 74 65 2d 72 6f 6f 74 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 0d 0a Data Ascii: line-height:normal;outline:0;overflow:visible;padding:0;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}:focus{outline:none}#site-root{margin:0 auto;min-height:100%;position:relative;t
2024-10-23 22:28:55 UTC	1378	IN	Data Raw: 35 61 32 0d 0a 6f 70 3a 76 61 72 28 2d 2d 77 69 78 2d 61 64 73 2d 68 65 69 67 68 74 29 7d 23 73 69 74 65 2d 72 6f 6f 74 20 69 6d 67 3a 6e 6f 74 28 5b 73 72 63 5d 29 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 23 73 69 74 65 2d 72 6f 6f 74 20 73 76 67 20 69 6d 67 3a 6e 6f 74 28 5b 73 72 63 5d 29 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 2e 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 2d 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 53 43 52 4f 4c 4c 5f 54 4f 5f 42 4f 54 54 4f 4d 2c 23 53 43 52 4f 4c 4c 5f 54 4f 5f 54 4f 50 7b 68 65 69 67 68 74 3a 30 7d 2e 68 61 73 2d 63 6c 69 63 6b 2d 74 72 69 67 67 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 66 75 6c 6c 53 63 72 65 65 6e 4f 76 65 72 6c 61 79 7b 62 6f Data Ascii: 5a2op:var(--wix-ads-height)}#site-root img:not([src]){visibility:hidden}#site-root svg img:not([src]){visibility:visible}.auto-generated-link{color:inherit}#SCROLL_TO_BOTTOM,#SCROLL_TO_TOP{height:0}.has-click-trigger{cursor:pointer}.fullScreenOverlay{bo
2024-10-23 22:28:55 UTC	71	IN	Data Raw: 2e 6d 65 73 68 2d 6c 61 79 6f 75 74 20 23 53 49 54 45 5f 46 4f 4f 54 45 52 5f 57 52 41 50 50 45 52 2c 23 6d 61 73 74 65 72 50 61 67 65 2e 6d 65 73 68 2d 6c 61 79 6f 75 74 20 23 53 49 54 45 5f 48 45 41 44 45 0d 0a Data Ascii: .mesh-layout #SITE_FOOTER_WRAPPER,#masterPage.mesh-layout #SITE_HEADE

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:54 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:54 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:54 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 0a92035d-201e-00aa-57da-213928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222854Z-16849878b78gvgmlcfru6nuc5400000006q000000000vnh4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 22:28:54 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-23 22:28:54 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 22:28:54 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 22:28:54 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T222854Z-16849878b78hz7zj8u0h2zng1400000006zg000000005q7s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-23 22:28:54 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">