Edit tour

Windows Analysis Report
https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlx

Overview

General Information

Sample URL:	https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RR
Analysis ID:	1397507
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Creates files inside the system directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5600 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2272,i,14050104179310117098,726667368655157578,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6376 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 104.118.8.139:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.118.8.139:443 -> 192.168.2.4:49757 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.46.128
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.46.128
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.46.128
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.46.128
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742 HTTP/1.1Host: 2fa.com-token-auth.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-1fad17ce0880f978206c332819cfbcf1a9232d0ff44aace838815115cb62d62b.js HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /packs/js/vendor-954761ad0dceb106b971.js HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/modernizr-79e0181ec91aff04bb01d87cba546535ede843f75d19f5c60f66b8dd6546971f.js HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /packs/js/vendor-69f70dd3792dc7287ac8.js HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /QRF01zv.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /helpimg/landing_pages/css/dd.css HTTP/1.1Host: s3.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /QRF01zv.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "20f88cb052864ef047cbf095e46a23b0"If-Modified-Since: Fri, 06 Oct 2017 17:40:18 GMT
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: safe-site.protected-forms.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Feb 2024 08:28:40 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: 09f832e5-d886-4fb4-93b2-02b20d570bd5X-Runtime: 0.017753Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Feb 2024 08:28:40 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: f955862f-1ea2-4073-8028-3f9a77a4688bX-Runtime: 0.020733Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Feb 2024 08:28:40 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: 1e841252-4f18-4763-b03c-26802fe686c4X-Runtime: 0.020125Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Feb 2024 08:28:40 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: 2c12fa34-daa3-4f96-996b-d451d2f47aadX-Runtime: 0.014756Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Feb 2024 08:28:42 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: 2b871e6e-b115-43f4-bca9-185a04a8e9bfX-Runtime: 0.009866Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Source: chromecache_59.2.dr	String found in binary or memory: Http://bugs.jqueryui.com/ticket/9446
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jquery.com/jQuery.ajax/)
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/accordion/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/autocomplete/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/blind-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/bounce-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/button/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/category/effects-core/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/checkboxradio/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/clip-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/controlgroup/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/data-selector/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/datepicker/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/dialog/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/disableSelection/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/draggable/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/drop-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/droppable/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/explode-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/fade-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/focusable-selector/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/fold-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/form-reset-mixin/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/highlight-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/jQuery.ui.keyCode/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/jQuery.widget/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/labels/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/menu/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/mouse/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/position/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/progressbar/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/puff-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/pulsate-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/resizable/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/scale-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/scrollParent/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/selectable/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/selectmenu/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/shake-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/size-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/slide-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/slider/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/sortable/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/spinner/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/tabbable-selector/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/tabs/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/tooltip/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/transfer-effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://api.jqueryui.com/uniqueId/
Source: chromecache_59.2.dr	String found in binary or memory: http://blog.jquery.com/2012/08/09/jquery-1-8-released/
Source: chromecache_59.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/11778
Source: chromecache_59.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12359
Source: chromecache_59.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/13378
Source: chromecache_59.2.dr	String found in binary or memory: http://bugs.jqueryui.com/ticket/7552
Source: chromecache_59.2.dr	String found in binary or memory: http://creativecommons.org/licenses/by/3.0/)
Source: chromecache_59.2.dr	String found in binary or memory: http://datatables.net).
Source: chromecache_59.2.dr	String found in binary or memory: http://datatables.net/license
Source: chromecache_59.2.dr	String found in binary or memory: http://datatables.net/license/mit
Source: chromecache_59.2.dr	String found in binary or memory: http://datatables.net/manual/styling/bootstrap
Source: chromecache_59.2.dr	String found in binary or memory: http://datatables.net/tn/
Source: chromecache_59.2.dr	String found in binary or memory: http://dev.w3.org/csswg/cssom/#resolved-values
Source: chromecache_59.2.dr	String found in binary or memory: http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html
Source: chromecache_59.2.dr	String found in binary or memory: http://eligrey.com
Source: chromecache_59.2.dr	String found in binary or memory: http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291
Source: chromecache_59.2.dr	String found in binary or memory: http://flightschool.acylt.com/devnotes/caret-position-woes/
Source: chromecache_59.2.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chromecache_60.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_59.2.dr	String found in binary or memory: http://javascript.nwbox.com/IEContentLoaded/
Source: chromecache_59.2.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_59.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/accordion/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/autocomplete/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/button/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/checkboxradio/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/controlgroup/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/datepicker/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/dialog/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/draggable/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/droppable/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/effect/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/menu/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/position/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/progressbar/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/resizable/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/selectable/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/selectmenu/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/slider/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/sortable/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/spinner/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/tabs/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/tooltip/
Source: chromecache_59.2.dr	String found in binary or memory: http://jqueryui.com/widget/
Source: chromecache_59.2.dr	String found in binary or memory: http://jsfiddle.net/JZSMt/3/
Source: chromecache_59.2.dr	String found in binary or memory: http://jsperf.com/getall-vs-sizzle/2
Source: chromecache_59.2.dr	String found in binary or memory: http://jsperf.com/html-decode
Source: chromecache_59.2.dr	String found in binary or memory: http://jsperf.com/thor-indexof-vs-for/5
Source: chromecache_59.2.dr	String found in binary or memory: http://jsperf.com/tostring-v-check
Source: chromecache_59.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/add-inverted-param/
Source: chromecache_59.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/define-locale/
Source: chromecache_59.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/dst-shifted/
Source: chromecache_59.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/js-date/
Source: chromecache_59.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/min-max/
Source: chromecache_59.2.dr	String found in binary or memory: http://momentjs.com/guides/#/warnings/zone/
Source: chromecache_59.2.dr	String found in binary or memory: http://pdfmake.org
Source: chromecache_59.2.dr	String found in binary or memory: http://semver.org/
Source: chromecache_59.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_59.2.dr	String found in binary or memory: http://stackoverflow.com/a/21336448/937891
Source: chromecache_59.2.dr	String found in binary or memory: http://stackoverflow.com/a/26707753
Source: chromecache_59.2.dr	String found in binary or memory: http://stackoverflow.com/a/32954565/96342
Source: chromecache_59.2.dr	String found in binary or memory: http://stackoverflow.com/a/384380/937891
Source: chromecache_59.2.dr	String found in binary or memory: http://stackoverflow.com/questions/3561493/is-there-a-regexp-escape-function-in-javascript
Source: chromecache_59.2.dr	String found in binary or memory: http://stackoverflow.com/questions/8898412
Source: chromecache_59.2.dr	String found in binary or memory: http://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_59.2.dr	String found in binary or memory: http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context
Source: chromecache_59.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_59.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0)
Source: chromecache_59.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: chromecache_59.2.dr	String found in binary or memory: http://www.datatables.net
Source: chromecache_59.2.dr	String found in binary or memory: http://www.datatables.net/extensions/select
Source: chromecache_59.2.dr	String found in binary or memory: http://www.macromedia.com/go/getflashplayer
Source: chromecache_59.2.dr	String found in binary or memory: http://www.robertpenner.com/easing)
Source: chromecache_59.2.dr	String found in binary or memory: http://www.sprymedia.co.uk/dataTables/lang.txt
Source: chromecache_59.2.dr	String found in binary or memory: https://blog.alexmaccaw.com/css-transitions
Source: chromecache_59.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=107380
Source: chromecache_59.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: chromecache_59.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_59.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=47182
Source: chromecache_59.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
Source: chromecache_59.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=561664
Source: chromecache_59.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
Source: chromecache_59.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: chromecache_64.2.dr	String found in binary or memory: https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Source: chromecache_64.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
Source: chromecache_59.2.dr	String found in binary or memory: https://chmln.github.io/flatpickr/#altinput
Source: chromecache_59.2.dr	String found in binary or memory: https://chmln.github.io/flatpickr/#dateformat
Source: chromecache_59.2.dr	String found in binary or memory: https://chmln.github.io/flatpickr/#disable
Source: chromecache_59.2.dr	String found in binary or memory: https://chmln.github.io/flatpickr/#inline-calendar
Source: chromecache_59.2.dr	String found in binary or memory: https://chmln.github.io/flatpickr/examples/#flatpickr-external-elements
Source: chromecache_59.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=313082
Source: chromecache_59.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=378607
Source: chromecache_59.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=449857
Source: chromecache_59.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=470258
Source: chromecache_59.2.dr	String found in binary or memory: https://code.google.com/p/maashaack/source/browse/packages/graphics/trunk/src/graphics/colors/HUE2RG
Source: chromecache_59.2.dr	String found in binary or memory: https://datatables.net/tn/11
Source: chromecache_59.2.dr	String found in binary or memory: https://developer.apple.com/library/safari/documentation/Tools/Conceptual/SafariExtensionGuide/Worki
Source: chromecache_59.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_59.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Using_Firefox_1.5_caching
Source: chromecache_59.2.dr	String found in binary or memory: https://developer.mozilla.org/en/Security/CSP)
Source: chromecache_59.2.dr	String found in binary or memory: https://developer.snapappointments.com/bootstrap-select)
Source: chromecache_59.2.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Open
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVI
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVI
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVI
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVI
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVI
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVI
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVI
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5OaVI
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVI
Source: chromecache_59.2.dr	String found in binary or memory: https://fullcalendar.io/
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#affix
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#alerts
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#buttons
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#carousel
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#collapse
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#dropdowns
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#modals
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#popovers
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#scrollspy
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#tabs
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#tooltip
Source: chromecache_59.2.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/javascript/#transitions
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/DoersGuild/jQuery.print/issues/18#issuecomment-96451589
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/Microsoft/tslib/blob/v1.6.0/tslib.js
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/angular/angular/blob/7.2.4/packages/core/src/sanitization/url_sanitizer.ts
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/bassjobsen/Bootstrap-3-Typeahead
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/davidstutz/bootstrap-multiselect)
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/dordille/moment-isoduration/blob/master/moment.isoduration.js
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/eligrey/classList.js/issues/36
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jashkenas/underscore/blob/1.6.0/underscore.js#L714
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jdewit/bootstrap-timepicker/graphs/contributors
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jquery/jquery-color
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jquery/jquery-color/
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jquery/jquery-ui/blob/1.11.0/ui/core.js#L51
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jquery/jquery/blob/2.2.4/src/core.js#L448
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jquery/jquery/blob/e539bac79e666bba95bba86d690b4e609dca2286/src/selector/escapeSe
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jquery/jquery/issues/4382
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/764
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: chromecache_53.2.dr	String found in binary or memory: https://github.com/kriskowal/es5-shim/blob/master/es5-shim.js
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/moment/moment/blob/2.18.1/src/lib/moment/format.js#L22
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/moment/moment/issues/1423
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/moment/moment/issues/2166
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/moment/moment/issues/2978
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/moment/moment/pull/1871
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/rails/jquery-ujs
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/rails/jquery-ujs/issues/357
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/snapappointments/bootstrap-select/blob/master/LICENSE)
Source: chromecache_59.2.dr, chromecache_60.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/issues/14093
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/issues/20280
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/uxsolutions/bootstrap-datepicker)
Source: chromecache_59.2.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: chromecache_64.2.dr	String found in binary or memory: https://i.imgur.com/QRF01zv.png
Source: chromecache_59.2.dr	String found in binary or memory: https://itsjavi.com/bootstrap-colorpicker/
Source: chromecache_59.2.dr	String found in binary or memory: https://jsperf.com/childnodes-array-slice-vs-loop
Source: chromecache_59.2.dr	String found in binary or memory: https://modernizr.com/)
Source: chromecache_59.2.dr	String found in binary or memory: https://nodejs.org/dist/latest/docs/api/util.html#util_custom_inspect_function_on_objects
Source: chromecache_59.2.dr	String found in binary or memory: https://npms.io/search?q=ponyfill.
Source: chromecache_64.2.dr	String found in binary or memory: https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css
Source: chromecache_52.2.dr	String found in binary or memory: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeV
Source: chromecache_59.2.dr	String found in binary or memory: https://stackoverflow.com/q/181348
Source: chromecache_59.2.dr	String found in binary or memory: https://tools.ietf.org/html/rfc2822#section-3.3
Source: chromecache_59.2.dr	String found in binary or memory: https://www.chromestatus.com/features/5093566007214080
Source: chromecache_59.2.dr	String found in binary or memory: https://www.ecma-international.org/news/TC45_current_work/Office%20Open%20XML%20Part%204%20-%20Marku

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 104.118.8.139:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.118.8.139:443 -> 192.168.2.4:49757 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_5600_656906891

Jump to behavior

Source: classification engine

Classification label: clean0.win@17/48@24/11

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2272,i,14050104179310117098,726667368655157578,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2272,i,14050104179310117098,726667368655157578,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742	0%	Avira URL Cloud	safe
https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html	0%	URL Reputation	safe
http://www.robertpenner.com/easing)	0%	URL Reputation	safe
https://safe-site.protected-forms.com/assets/application-1fad17ce0880f978206c332819cfbcf1a9232d0ff44aace838815115cb62d62b.js	0%	Avira URL Cloud	safe
https://safe-site.protected-forms.com/assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js	0%	Avira URL Cloud	safe
https://safe-site.protected-forms.com/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
http://flightschool.acylt.com/devnotes/caret-position-woes/	0%	Avira URL Cloud	safe
https://chmln.github.io/flatpickr/examples/#flatpickr-external-elements	0%	Avira URL Cloud	safe
https://safe-site.protected-forms.com/packs/js/vendor-69f70dd3792dc7287ac8.js	0%	Avira URL Cloud	safe
https://chmln.github.io/flatpickr/examples/#flatpickr-external-elements	0%	Virustotal		Browse
http://flightschool.acylt.com/devnotes/caret-position-woes/	0%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
cdn2.hubspot.net	104.16.108.209	true	false	high
s3.amazonaws.com	52.217.41.134	true	false	high
accounts.google.com	172.253.62.84	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
www.google.com	142.251.40.228	true	false	high
clients.l.google.com	142.250.176.206	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
landing.training.knowbe4.com	3.223.26.84	true	false	high
ipv4.imgur.map.fastly.net	199.232.36.193	true	false	unknown
2fa.com-token-auth.com	unknown	unknown	false	unknown
clients2.google.com	unknown	unknown	false	high
i.imgur.com	unknown	unknown	false	high
safe-site.protected-forms.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css	false		high
https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png	false		high
https://safe-site.protected-forms.com/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js	false	Avira URL Cloud: safe	unknown
https://safe-site.protected-forms.com/assets/application-1fad17ce0880f978206c332819cfbcf1a9232d0ff44aace838815115cb62d62b.js	false	Avira URL Cloud: safe	unknown
https://safe-site.protected-forms.com/assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js	false	Avira URL Cloud: safe	unknown
https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742	false		unknown
https://safe-site.protected-forms.com/packs/js/vendor-69f70dd3792dc7287ac8.js	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=	false		unknown
https://i.imgur.com/QRF01zv.png	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://jqueryui.com/menu/	chromecache_59.2.dr	false		high
https://www.ecma-international.org/news/TC45_current_work/Office%20Open%20XML%20Part%204%20-%20Marku	chromecache_59.2.dr	false		high
http://api.jqueryui.com/slide-effect/	chromecache_59.2.dr	false		high
https://github.com/moment/moment/issues/1423	chromecache_59.2.dr	false		high
http://jqueryui.com/accordion/	chromecache_59.2.dr	false		high
http://api.jqueryui.com/data-selector/	chromecache_59.2.dr	false		high
https://chmln.github.io/flatpickr/examples/#flatpickr-external-elements	chromecache_59.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://stackoverflow.com/a/32954565/96342	chromecache_59.2.dr	false		high
https://code.google.com/p/chromium/issues/detail?id=378607	chromecache_59.2.dr	false		high
http://stackoverflow.com/a/26707753	chromecache_59.2.dr	false		high
https://github.com/jquery/jquery-color	chromecache_59.2.dr	false		high
http://jqueryui.com/position/	chromecache_59.2.dr	false		high
http://api.jqueryui.com/jQuery.widget/	chromecache_59.2.dr	false		high
http://blog.jquery.com/2012/08/09/jquery-1-8-released/	chromecache_59.2.dr	false		high
http://api.jqueryui.com/focusable-selector/	chromecache_59.2.dr	false		high
http://pdfmake.org	chromecache_59.2.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=561664	chromecache_59.2.dr	false		high
http://dev.w3.org/csswg/cssom/#resolved-values	chromecache_59.2.dr	false		high
https://bugs.webkit.org/show_bug.cgi?id=107380	chromecache_59.2.dr	false		high
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	chromecache_59.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0)	chromecache_59.2.dr	false		high
https://github.com/kriskowal/es5-shim/blob/master/es5-shim.js	chromecache_53.2.dr	false		high
http://api.jqueryui.com/button/	chromecache_59.2.dr	false		high
http://getbootstrap.com)	chromecache_60.2.dr	false	Avira URL Cloud: safe	low
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	chromecache_59.2.dr	false		high
https://blog.alexmaccaw.com/css-transitions	chromecache_59.2.dr	false		high
http://www.datatables.net	chromecache_59.2.dr	false		high
https://github.com/bassjobsen/Bootstrap-3-Typeahead	chromecache_59.2.dr	false		high
https://getbootstrap.com/docs/3.4/javascript/#transitions	chromecache_59.2.dr	false		high
http://api.jqueryui.com/size-effect/	chromecache_59.2.dr	false		high
http://momentjs.com/guides/#/warnings/zone/	chromecache_59.2.dr	false		high
http://bugs.jquery.com/ticket/12359	chromecache_59.2.dr	false		high
http://api.jqueryui.com/uniqueId/	chromecache_59.2.dr	false		high
http://creativecommons.org/licenses/by/3.0/)	chromecache_59.2.dr	false		high
http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html	chromecache_59.2.dr	false	URL Reputation: safe	unknown
http://api.jqueryui.com/checkboxradio/	chromecache_59.2.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	chromecache_59.2.dr	false		high
https://getbootstrap.com/docs/3.4/javascript/#tooltip	chromecache_59.2.dr	false		high
https://github.com/twbs/bootstrap/issues/20280	chromecache_59.2.dr	false		high
http://jqueryui.com/slider/	chromecache_59.2.dr	false		high
https://getbootstrap.com/docs/3.4/javascript/#modals	chromecache_59.2.dr	false		high
http://api.jqueryui.com/disableSelection/	chromecache_59.2.dr	false		high
https://code.google.com/p/chromium/issues/detail?id=313082	chromecache_59.2.dr	false		high
http://jqueryui.com/controlgroup/	chromecache_59.2.dr	false		high
https://stackoverflow.com/q/181348	chromecache_59.2.dr	false		high
https://getbootstrap.com/docs/3.4/javascript/#collapse	chromecache_59.2.dr	false		high
http://www.macromedia.com/go/getflashplayer	chromecache_59.2.dr	false		high
https://getbootstrap.com/docs/3.4/javascript/#scrollspy	chromecache_59.2.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_59.2.dr, chromecache_60.2.dr	false		high
http://flightschool.acylt.com/devnotes/caret-position-woes/	chromecache_59.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://api.jqueryui.com/transfer-effect/	chromecache_59.2.dr	false		high
https://github.com/rails/jquery-ujs	chromecache_59.2.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	chromecache_59.2.dr	false		high
http://www.robertpenner.com/easing)	chromecache_59.2.dr	false	URL Reputation: safe	unknown
http://momentjs.com/guides/#/warnings/min-max/	chromecache_59.2.dr	false		high
http://jqueryui.com/datepicker/	chromecache_59.2.dr	false		high
Http://bugs.jqueryui.com/ticket/9446	chromecache_59.2.dr	false		high
https://code.google.com/p/chromium/issues/detail?id=470258	chromecache_59.2.dr	false		high
https://npms.io/search?q=ponyfill.	chromecache_59.2.dr	false		high
http://api.jqueryui.com/drop-effect/	chromecache_59.2.dr	false		high
http://datatables.net/license	chromecache_59.2.dr	false		high
http://jsperf.com/getall-vs-sizzle/2	chromecache_59.2.dr	false		high
https://github.com/jquery/jquery/blob/e539bac79e666bba95bba86d690b4e609dca2286/src/selector/escapeSe	chromecache_59.2.dr	false		high
https://getbootstrap.com/docs/3.4/javascript/#buttons	chromecache_59.2.dr	false		high
https://github.com/jquery/jquery/pull/557)	chromecache_59.2.dr	false		high
http://api.jqueryui.com/menu/	chromecache_59.2.dr	false		high
http://jqueryui.com/checkboxradio/	chromecache_59.2.dr	false		high
https://getbootstrap.com/docs/3.4/javascript/#alerts	chromecache_59.2.dr	false		high
http://api.jqueryui.com/controlgroup/	chromecache_59.2.dr	false		high
http://jqueryui.com/widget/	chromecache_59.2.dr	false		high
http://momentjs.com/guides/#/warnings/define-locale/	chromecache_59.2.dr	false		high
http://api.jqueryui.com/category/effects-core/	chromecache_59.2.dr	false		high
http://api.jqueryui.com/dialog/	chromecache_59.2.dr	false		high
http://jqueryui.com/tooltip/	chromecache_59.2.dr	false		high
http://api.jqueryui.com/selectmenu/	chromecache_59.2.dr	false		high
http://api.jqueryui.com/shake-effect/	chromecache_59.2.dr	false		high
https://github.com/Microsoft/tslib/blob/v1.6.0/tslib.js	chromecache_59.2.dr	false		high
http://api.jqueryui.com/jQuery.ui.keyCode/	chromecache_59.2.dr	false		high
https://getbootstrap.com/)	chromecache_59.2.dr	false		high
https://modernizr.com/)	chromecache_59.2.dr	false		high
http://momentjs.com/guides/#/warnings/dst-shifted/	chromecache_59.2.dr	false		high
https://tools.ietf.org/html/rfc2822#section-3.3	chromecache_59.2.dr	false		high
http://api.jqueryui.com/bounce-effect/	chromecache_59.2.dr	false		high
http://api.jquery.com/jQuery.ajax/)	chromecache_59.2.dr	false		high
https://github.com/moment/moment/blob/2.18.1/src/lib/moment/format.js#L22	chromecache_59.2.dr	false		high
http://bugs.jquery.com/ticket/13378	chromecache_59.2.dr	false		high
http://jsperf.com/thor-indexof-vs-for/5	chromecache_59.2.dr	false		high
https://github.com/jashkenas/underscore/blob/1.6.0/underscore.js#L714	chromecache_59.2.dr	false		high
https://github.com/jdewit/bootstrap-timepicker/graphs/contributors	chromecache_59.2.dr	false		high
https://getbootstrap.com/docs/3.4/javascript/#tabs	chromecache_59.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.223.26.84	landing.training.knowbe4.com	United States	14618	AMAZON-AESUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.176.206	clients.l.google.com	United States	15169	GOOGLEUS	false
142.251.40.228	www.google.com	United States	15169	GOOGLEUS	false
172.253.62.84	accounts.google.com	United States	15169	GOOGLEUS	false
104.16.111.209	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
199.232.36.193	ipv4.imgur.map.fastly.net	United States	54113	FASTLYUS	false
52.217.41.134	s3.amazonaws.com	United States	16509	AMAZON-02US	false
104.16.108.209	cdn2.hubspot.net	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1397507
Start date and time:	2024-02-23 09:27:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@17/48@24/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.40.227, 34.104.35.123, 142.250.65.202, 142.251.40.163, 20.12.23.50, 72.21.81.240, 52.165.164.15, 192.229.211.108, 20.3.187.198, 142.251.40.131
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, fonts.gstatic.com, slscr.update.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 9344, version 1.0
Category:	downloaded
Size (bytes):	9344
Entropy (8bit):	7.975595436620788
Encrypted:	false
SSDEEP:	192:iy1J4xqYLC2akqiC1YV/R582UeGFc/AUGlF0djsT7qWPcC/Cdv:D2J7h5bV/37WUFGT7lPcC/Cdv
MD5:	CBCA61F27F93FD71171FE8D314C66AB9
SHA1:	C46A51672FFFF100945F84C3EB87826B7844A1E2
SHA-256:	F9A9A7A4B9D40BCC3047928DFA60695D53E6AE1D6EE699EA70146E171322ACAD
SHA-512:	7F9E8520DFB64197CE233AF7671A5A5643AE116478C6E2F5F67FBD8A092117126ADF1E2EDDA13FF1C19D68AEA3D04288310A2109D7C81183330F2B8DAD0785D4
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVIGxA.woff2
Preview:	wOF2......$.......A`..$..........................L.. ....`?STAT^.t..\|.......t.Z..N..6.$.... ..x..h....B;%c[.08.@D..=.E...O...q2.0..i......v.p.0......Y. ..P)......N.C...K,.W!.Wutp..I.2...6.....Y..X...W..z.U.nq.j^;.8.zO..gw.d.^U?p.........7.. ....S..d......d./.-.7....$...V(V(\|.........c~........B[H.D(.$2.1<....N7..n.9k...D.@.(.(...H.D....qsQ."..O..{Oh..r.T.Iw..9I...rq.2.n....SW.O..\b5B.n..M.06.j..L.Sx?.........t.\|z}..V...G..J....x..Co].5HC..6p..,.2..&..}`.I.n......S}'....$..iV.[.....W......6...m.I'M...a......c...\|.a.FK.d.zW9xi'Y8v..lWi....T-..F\...^p.<.TT!wvQ.i0.0.f.\.A.. .Hq..J...=/.....\.]..Dq...:..+...W..]4uZ.._.l...e-..........k..."p....c......X..=.9..1.....2.......],.....R\|J......r.x./...pa...ef.......{..&.........=.5..>....5@...x.v..o.Io.L.t[Wu^.=..Z.r?xV..V..jV..`...+.2..8..P....[.r.....4.,Y....&.\|.W<..7..Y.s.=,2..A.i..je..P..`pV..!VW-...`.>YBRJY[...!rY5...l........Z.5_..B.....cP.....v1....(.5...[....n.....vlx=I.*1..9R....=..2..u\..p...iFD...

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2024 09:28:34.765584946 CET	56947	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:34.765827894 CET	62692	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:34.766422987 CET	51690	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:34.766665936 CET	51431	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:34.800795078 CET	53	51614	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:34.853827000 CET	53	62692	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:34.854003906 CET	53	56947	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:34.854507923 CET	53	51690	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:34.855788946 CET	53	51431	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:35.430367947 CET	53	53771	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:37.172291040 CET	51534	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:37.172442913 CET	49840	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:37.391057968 CET	53	49840	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:37.391911983 CET	53	51534	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:38.049860001 CET	63659	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:38.050045967 CET	49643	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:38.195533037 CET	53	63659	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:38.243486881 CET	53	49643	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:39.084971905 CET	53158	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:39.085201979 CET	57983	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:39.173104048 CET	53	57983	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:39.173717022 CET	53	53158	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:40.139904976 CET	56489	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:40.140041113 CET	50113	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:40.141251087 CET	54814	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:40.141539097 CET	55540	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:40.144839048 CET	62429	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:40.145128012 CET	57208	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:40.145667076 CET	51774	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:40.145833969 CET	61515	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:40.228259087 CET	53	56489	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:40.228312969 CET	53	50113	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:40.229145050 CET	53	52196	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:40.229724884 CET	53	55540	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:40.229785919 CET	53	54814	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:40.234056950 CET	53	51774	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:40.234353065 CET	53	62429	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:40.234673023 CET	53	61515	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:40.235394001 CET	53	57208	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:41.191538095 CET	53	56701	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:41.221715927 CET	63853	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:41.222121000 CET	57746	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:41.223217964 CET	58665	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:41.223419905 CET	62777	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:41.315045118 CET	53	63853	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:41.315068960 CET	53	58665	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:41.315090895 CET	53	62777	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:41.321294069 CET	53	57746	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:49.811039925 CET	49171	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:49.811260939 CET	61426	53	192.168.2.4	1.1.1.1
Feb 23, 2024 09:28:49.963749886 CET	53	49171	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:49.984204054 CET	53	61426	1.1.1.1	192.168.2.4
Feb 23, 2024 09:28:51.823808908 CET	138	138	192.168.2.4	192.168.2.255
Feb 23, 2024 09:28:53.745482922 CET	53	50251	1.1.1.1	192.168.2.4
Feb 23, 2024 09:29:12.769583941 CET	53	58144	1.1.1.1	192.168.2.4
Feb 23, 2024 09:29:35.153832912 CET	53	56763	1.1.1.1	192.168.2.4
Feb 23, 2024 09:29:35.869472027 CET	53	53526	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:35 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:35 UTC	731	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce--7_4iEjvBSkz8szMas4BHA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 23 Feb 2024 08:28:35 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6262 X-Daystart: 1715 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-23 08:28:35 UTC	521	IN	Data Raw: 32 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 36 32 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 37 31 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20 Data Ascii: 2c8<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6262" elapsed_seconds="1715"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-02-23 08:28:35 UTC	198	IN	Data Raw: 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 3f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-02-23 08:28:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:35 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
2024-02-23 08:28:35 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-02-23 08:28:35 UTC	1798	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 23 Feb 2024 08:28:35 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--JSCE6oXCeMxP340AXNqjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmLw1JBiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQJiIW6OzesermMT-PF4UR0AoIwXzw" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-23 08:28:35 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-02-23 08:28:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:37 UTC	1045	OUT	GET /XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742 HTTP/1.1 Host: 2fa.com-token-auth.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:37 UTC	574	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 08:28:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 545 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade ETag: W/"e1a74a4c5f1144d824100167d21102e9" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 6aa50776-0eee-4a27-95e5-afc6d26b9e0c X-Runtime: 0.022903 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:37 UTC	545	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 61 66 65 2d 73 69 74 65 2e 70 72 6f 74 65 63 74 65 64 2d 66 6f 72 6d 73 2e 63 6f 6d 2f 70 61 67 65 73 2f 33 61 62 32 35 64 65 35 37 32 34 33 36 39 65 36 38 32 61 32 62 35 34 64 35 61 65 33 33 65 36 38 2f 58 61 6c 52 43 55 54 52 49 53 31 68 52 4f 45 39 4b 61 6d 4e 46 65 56 5a 54 53 30 4a 57 54 46 6f 32 5a 56 41 76 65 6c 70 6c 54 7a 5a 56 51 6b 73 76 57 48 4e 45 61 57 35 73 63 45 64 78 53 31 64 77 52 54 42 4a 63 44 4a 31 4d 31 68 76 64 55 6c 4e 56 6c 51 78 59 55 78 72 52 48 42 56 4e 44 52 5a 63 32 45 79 4e 6c 6c 34 62 45 70 75 5a 6d 74 72 61 79 74 55 64 56 4e 4d 59 6d 4e Data Ascii: <html> <head> <script>window.location.href = 'https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmN

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:38 UTC	1484	OUT	GET /pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:40 UTC	1029	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 08:28:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 107743 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Link: </assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css>; rel=preload; as=style; nopush,</assets/application-1fad17ce0880f978206c332819cfbcf1a9232d0ff44aace838815115cb62d62b.js>; rel=preload; as=script; nopush,</packs/js/vendor-954761ad0dceb106b971.js>; rel=preload; as=script; nopush,</assets/modernizr-79e0181ec91aff04bb01d87cba546535ede843f75d19f5c60f66b8dd6546971f.js>; rel=preload; as=script; nopush ETag: W/"cefa2323e157ac5ae0b9d1c108f0586a" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 61c251a5-b7d5-4000-8430-75e7ddf953a7 X-Runtime: 1.239381 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:40 UTC	15355	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 49 4d 50 4f 52 54 41 4e 54 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 70 61 67 65 20 69 73 20 70 61 72 74 20 6f 66 20 61 20 73 69 6d 75 6c 61 74 65 64 20 70 68 69 73 68 69 6e 67 20 61 74 74 61 63 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"> <meta name="IMPORTANT" content="This page is part of a simulated phishing attac
2024-02-23 08:28:40 UTC	10519	IN	Data Raw: 32 38 2c 32 31 31 2e 36 2d 31 30 36 2e 39 32 2c 32 33 30 2e 37 37 0a 09 09 09 09 09 43 34 33 38 2e 32 31 2c 35 34 38 2e 39 34 2c 33 38 35 2e 38 34 2c 36 30 39 2e 31 37 2c 33 32 30 2e 31 34 2c 36 30 33 2e 34 32 7a 22 3e 3c 2f 70 61 74 68 3e 20 3c 6c 69 6e 65 20 63 6c 61 73 73 3d 22 69 6e 6e 65 72 2d 73 74 72 6f 6b 65 22 20 78 31 3d 22 33 31 37 2e 34 34 22 20 78 32 3d 22 32 39 39 2e 39 33 22 20 79 31 3d 22 31 34 33 2e 39 31 22 20 79 32 3d 22 33 34 34 2e 30 34 22 3e 3c 2f 6c 69 6e 65 3e 20 3c 6c 69 6e 65 20 63 6c 61 73 73 3d 22 69 6e 6e 65 72 2d 73 74 72 6f 6b 65 22 20 78 31 3d 22 33 38 32 2e 39 32 22 20 78 32 3d 22 33 36 35 2e 38 33 22 20 79 31 3d 22 31 34 39 2e 36 34 22 20 79 32 3d 22 33 36 30 2e 39 39 22 3e 3c 2f 6c 69 6e 65 3e 20 3c 6c 69 6e 65 20 63 6c Data Ascii: 28,211.6-106.92,230.77C438.21,548.94,385.84,609.17,320.14,603.42z"></path> <line class="inner-stroke" x1="317.44" x2="299.93" y1="143.91" y2="344.04"></line> <line class="inner-stroke" x1="382.92" x2="365.83" y1="149.64" y2="360.99"></line> <line cl
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 6e 65 72 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 6e 75 6d 62 65 72 2d 33 22 3e 30 33 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 74 65 78 74 22 3e 3c 62 64 6f 20 64 69 72 3d 22 72 74 6c 22 3e d8 a5 d8 b0 d8 a7 20 d8 a7 d8 b3 d8 aa d9 84 d9 85 d8 aa 20 d8 b1 d8 b3 d8 a7 d9 84 d8 a9 20 d8 a5 d9 84 d9 83 d8 aa d8 b1 d9 88 d9 86 d9 8a d8 a9 20 d8 ba d9 8a d8 b1 20 d9 85 d8 b9 d8 aa d8 a7 d8 af d8 a9 20 d9 85 d9 86 20 d8 b4 d8 ae d8 b5 20 d8 aa d8 b9 d8 b1 d9 81 d9 87 d8 8c 20 d9 81 d8 a7 d8 aa d8 b5 d9 84 20 d8 a8 d8 b0 d9 84 d9 83 20 d8 a7 d9 84 d8 b4 d8 ae d8 b5 20 d8 b9 d8 a8 d8 b1 20 d9 88 d8 b3 d9 8a d9 84 d8 a9 20 d8 a7 d8 aa d8 b5 d8 a7 d9 84 20 d9 85 d8 ae d8 aa d9 Data Ascii: ner"><div class="rule-number-3">03</div><div class="rule-text"><bdo dir="rtl">
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 6c 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 30 70 78 3b 22 3e 0a 09 09 09 09 3c 74 62 6f 64 79 3e 0a 09 09 09 09 09 3c 74 72 3e 0a 09 09 09 09 09 09 3c 74 64 20 76 61 6c 69 67 6e 3d 22 74 6f 70 22 20 77 69 64 74 68 3d 22 33 30 25 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 6e 75 6d 62 65 72 2d 31 22 3e 30 31 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 75 6c 65 2d 74 65 78 74 22 3e 41 72 72 c3 aa 74 65 7a 2d 76 6f 75 73 2c 20 76 c3 a9 72 69 66 69 65 7a 20 65 74 20 72 c3 a9 66 6c c3 a9 63 68 69 73 73 65 7a 20 61 76 61 6e 74 20 64 65 20 63 6c 69 71 75 65 72 20 73 Data Ascii: le="padding-bottom: 100px;"><tbody><tr><td valign="top" width="30%"><div class="rule-container"><div class="rule-number-1">01</div><div class="rule-text">Arrtez-vous, vrifiez et rflchissez avant de cliquer s
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 80 ad e1 80 af e1 80 b8 e1 81 8b 20 e1 80 9e e1 80 84 e1 80 ba e1 80 9e e1 80 8a e1 80 ba 20 e1 80 94 e1 80 99 e1 80 b0 e1 80 94 e1 80 ac e1 80 a1 e1 80 94 e1 80 b1 e1 80 96 e1 80 bc e1 80 84 e1 80 b7 e1 80 ba e1 80 96 e1 80 94 e1 80 ba e1 80 90 e1 80 ae e1 80 b8 e1 80 91 e1 80 ac e1 80 b8 e1 80 9e e1 80 8a e1 80 b7 e1 80 ba 20 e1 80 a1 e1 80 90 e1 80 af e1 80 a1 e1 80 9a e1 80 b1 e1 80 ac e1 80 84 e1 80 ba 20 e1 80 9c e1 80 84 e1 80 b7 e1 80 ba e1 80 81 e1 80 ba e1 80 90 e1 80 85 e1 80 ba e1 80 81 e1 80 af e1 80 80 e1 80 ad e1 80 af 20 e1 80 94 e1 80 be e1 80 ad e1 80 95 e1 80 ba e1 80 99 e1 80 ad e1 80 81 e1 80 b2 e1 80 b7 e1 80 9e e1 80 8a e1 80 ba e1 81 8b 3c 2f 68 31 3e 0a 0a 09 09 09 3c 68 32 20 63 6c 61 73 73 3d 22 72 65 6d 65 6d 62 65 72 22 20 74 Data Ascii: </h1><h2 class="remember" t
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 20 64 69 67 2e 20 56 61 72 20 75 70 70 6d c3 a4 72 6b 73 61 6d 20 e2 80 93 20 64 75 20 c3 a4 72 20 64 65 6e 20 73 69 73 74 61 20 66 c3 b6 72 73 76 61 72 73 6c 69 6e 6a 65 6e 20 66 c3 b6 72 20 61 74 74 20 66 c3 b6 72 68 69 6e 64 72 61 20 65 74 74 20 70 68 69 73 68 69 6e 67 2d 61 6e 67 72 65 70 70 2e 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 6f 70 74 69 6f 6e 73 20 73 77 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6d 61 69 6e 22 3e 0a 09 09 09 3c 68 31 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 20 74 6b 65 79 3d 22 6f 6f 70 73 22 3e 4c 6f 21 20 55 6d 65 62 6f 66 79 61 20 6b 77 65 6e 79 65 20 6b 69 75 6e 67 6f 20 63 68 61 20 6d 77 69 67 6f 20 Data Ascii: dig. Var uppmrksam du r den sista frsvarslinjen fr att frhindra ett phishing-angrepp.</div></section><section class="options sw"><div class="content main"><h1 class="header" tkey="oops">Lo! Umebofya kwenye kiungo cha mwigo
2024-02-23 08:28:40 UTC	16333	IN	Data Raw: 63 2e 20 4c 61 73 20 6f 72 67 61 6e 69 7a 61 63 69 6f 6e 65 73 20 61 20 6c 61 73 20 71 75 65 20 73 65 20 68 61 63 65 20 72 65 66 65 72 65 6e 63 69 61 20 65 6e 20 65 6c 20 63 6f 72 72 65 6f 20 65 6c 65 63 74 72 c3 b3 6e 69 63 6f 20 6e 6f 20 65 73 74 c3 a1 6e 20 61 73 6f 63 69 61 64 61 73 20 61 20 4b 6e 6f 77 42 65 34 2c 20 49 6e 63 2e 20 6e 69 20 70 72 6f 6d 6f 63 69 6f 6e 61 6e 20 6c 6f 73 20 73 65 72 76 69 63 69 6f 73 20 64 65 20 4b 6e 6f 77 42 65 34 2c 20 49 6e 63 2e 20 3c 73 70 61 6e 20 74 6b 65 79 3d 22 64 69 73 63 6c 61 69 6d 65 72 2d 32 22 3e 45 6c 20 6f 62 6a 65 74 69 76 6f 20 64 65 20 65 73 74 65 20 6d 65 6e 73 61 6a 65 20 65 73 20 6d 6f 73 74 72 61 72 20 63 c3 b3 6d 6f 20 6c 6f 73 20 61 74 61 71 75 65 73 20 64 65 20 73 75 70 6c 61 6e 74 61 63 69 Data Ascii: c. Las organizaciones a las que se hace referencia en el correo electrnico no estn asociadas a KnowBe4, Inc. ni promocionan los servicios de KnowBe4, Inc. <span tkey="disclaimer-2">El objetivo de este mensaje es mostrar cmo los ataques de suplantaci

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	1054	OUT	GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:40 UTC	263	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 08:28:40 GMT Content-Type: text/css Content-Length: 1471 Connection: close Last-Modified: Fri, 23 Feb 2024 06:04:35 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:40 UTC	1471	IN	Data Raw: 2f 2a 20 6c 69 6e 65 20 31 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 74 65 72 6d 61 72 6b 2e 73 63 73 73 20 2a 2f 0a 2e 77 61 74 65 72 6d 61 72 6b 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 20 20 20 20 2d 6d 73 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 74 62 2d 72 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 74 65 78 74 2d 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 73 69 64 65 77 61 79 73 3b 0a 7d 0a 0a 2f 2a 20 6c 69 6e 65 20 34 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 Data Ascii: /* line 1, app/assets/stylesheets/landing-watermark.scss /.watermark { -webkit-writing-mode: vertical-rl; -ms-writing-mode: tb-rl; writing-mode: vertical-rl; text-orientation: sideways;}/ line 4, app/assets/stylesheets/landing-wa

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	1054	OUT	GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:40 UTC	514	IN	HTTP/1.1 404 Not Found Date: Fri, 23 Feb 2024 08:28:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 09f832e5-d886-4fb4-93b2-02b20d570bd5 X-Runtime: 0.017753 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:40 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	1033	OUT	GET /assets/application-1fad17ce0880f978206c332819cfbcf1a9232d0ff44aace838815115cb62d62b.js HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:40 UTC	280	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 08:28:40 GMT Content-Type: application/javascript Content-Length: 3205081 Connection: close Last-Modified: Fri, 23 Feb 2024 06:04:35 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:40 UTC	16104	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 31 2e 31 32 2e 34 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 44 61 74 65 3a 20 32 30 31 36 2d 30 35 2d 32 30 54 Data Ascii: /! jQuery JavaScript Library v1.12.4 * http://jquery.com/ * * Includes Sizzle.js * http://sizzlejs.com/ * * Copyright jQuery Foundation and other contributors * Released under the MIT license * http://jquery.org/license * * Date: 2016-05-20T
2024-02-23 08:28:40 UTC	10519	IN	Data Raw: 22 3a 28 22 20 2b 20 69 64 65 6e 74 69 66 69 65 72 20 2b 20 22 29 28 3f 3a 5c 5c 28 28 22 20 2b 0a 09 09 2f 2f 20 54 6f 20 72 65 64 75 63 65 20 74 68 65 20 6e 75 6d 62 65 72 20 6f 66 20 73 65 6c 65 63 74 6f 72 73 20 6e 65 65 64 69 6e 67 20 74 6f 6b 65 6e 69 7a 65 20 69 6e 20 74 68 65 20 70 72 65 46 69 6c 74 65 72 2c 20 70 72 65 66 65 72 20 61 72 67 75 6d 65 6e 74 73 3a 0a 09 09 2f 2f 20 31 2e 20 71 75 6f 74 65 64 20 28 63 61 70 74 75 72 65 20 33 3b 20 63 61 70 74 75 72 65 20 34 20 6f 72 20 63 61 70 74 75 72 65 20 35 29 0a 09 09 22 28 27 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 27 5d 29 2a 29 27 7c 5c 22 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 5c 22 5d 29 2a 29 5c 22 29 7c 22 20 2b 0a 09 09 2f 2f 20 32 2e 20 73 69 6d 70 6c 65 20 28 63 61 70 Data Ascii: ":(" + identifier + ")(?:\\((" +// To reduce the number of selectors needing tokenize in the preFilter, prefer arguments:// 1. quoted (capture 3; capture 4 or capture 5)"('((?:\\\\.\|[^\\\\']))'\|\"((?:\\\\.\|[^\\\\\"]))\")\|" +// 2. simple (cap
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 2a 20 40 72 65 74 75 72 6e 73 20 7b 45 6c 65 6d 65 6e 74 7c 4f 62 6a 65 63 74 7c 42 6f 6f 6c 65 61 6e 7d 20 54 68 65 20 69 6e 70 75 74 20 6e 6f 64 65 20 69 66 20 61 63 63 65 70 74 61 62 6c 65 2c 20 6f 74 68 65 72 77 69 73 65 20 61 20 66 61 6c 73 79 20 76 61 6c 75 65 0a 20 2a 2f 0a 66 75 6e 63 74 69 6f 6e 20 74 65 73 74 43 6f 6e 74 65 78 74 28 20 63 6f 6e 74 65 78 74 20 29 20 7b 0a 09 72 65 74 75 72 6e 20 63 6f 6e 74 65 78 74 20 26 26 20 74 79 70 65 6f 66 20 63 6f 6e 74 65 78 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 20 26 26 20 63 6f 6e 74 65 78 74 3b 0a 7d 0a 0a 2f 2f 20 45 78 70 6f 73 65 20 73 75 70 70 6f 72 74 20 76 61 72 73 20 66 6f 72 20 63 6f 6e 76 65 6e 69 65 6e 63 65 0a 73 75 Data Ascii: * @returns {Element\|Object\|Boolean} The input node if acceptable, otherwise a falsy value */function testContext( context ) {return context && typeof context.getElementsByTagName !== "undefined" && context;}// Expose support vars for conveniencesu
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 20 61 72 67 75 6d 65 6e 74 20 28 5b 2b 2d 5d 3f 5c 64 2a 6e 7c 29 0a 09 09 09 09 35 20 73 69 67 6e 20 6f 66 20 78 6e 2d 63 6f 6d 70 6f 6e 65 6e 74 0a 09 09 09 09 36 20 78 20 6f 66 20 78 6e 2d 63 6f 6d 70 6f 6e 65 6e 74 0a 09 09 09 09 37 20 73 69 67 6e 20 6f 66 20 79 2d 63 6f 6d 70 6f 6e 65 6e 74 0a 09 09 09 09 38 20 79 20 6f 66 20 79 2d 63 6f 6d 70 6f 6e 65 6e 74 0a 09 09 09 2a 2f 0a 09 09 09 6d 61 74 63 68 5b 31 5d 20 3d 20 6d 61 74 63 68 5b 31 5d 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0a 0a 09 09 09 69 66 20 28 20 6d 61 74 63 68 5b 31 5d 2e 73 6c 69 63 65 28 20 30 2c 20 33 20 29 20 3d 3d 3d 20 22 6e 74 68 22 20 29 20 7b 0a 09 09 09 09 2f 2f 20 6e 74 68 2d 2a 20 72 65 71 75 69 72 65 73 20 61 72 67 75 6d 65 6e 74 0a 09 09 09 09 69 66 20 28 20 21 6d Data Ascii: argument ([+-]?\dn\|)5 sign of xn-component6 x of xn-component7 sign of y-component8 y of y-component/match[1] = match[1].toLowerCase();if ( match[1].slice( 0, 3 ) === "nth" ) {// nth-* requires argumentif ( !m
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 09 09 09 09 69 66 20 28 20 65 6c 65 6d 2e 6e 6f 64 65 54 79 70 65 20 3d 3d 3d 20 31 20 7c 7c 20 63 68 65 63 6b 4e 6f 6e 45 6c 65 6d 65 6e 74 73 20 29 20 7b 0a 09 09 09 09 09 72 65 74 75 72 6e 20 6d 61 74 63 68 65 72 28 20 65 6c 65 6d 2c 20 63 6f 6e 74 65 78 74 2c 20 78 6d 6c 20 29 3b 0a 09 09 09 09 7d 0a 09 09 09 7d 0a 09 09 7d 20 3a 0a 0a 09 09 2f 2f 20 43 68 65 63 6b 20 61 67 61 69 6e 73 74 20 61 6c 6c 20 61 6e 63 65 73 74 6f 72 2f 70 72 65 63 65 64 69 6e 67 20 65 6c 65 6d 65 6e 74 73 0a 09 09 66 75 6e 63 74 69 6f 6e 28 20 65 6c 65 6d 2c 20 63 6f 6e 74 65 78 74 2c 20 78 6d 6c 20 29 20 7b 0a 09 09 09 76 61 72 20 6f 6c 64 43 61 63 68 65 2c 20 75 6e 69 71 75 65 43 61 63 68 65 2c 20 6f 75 74 65 72 43 61 63 68 65 2c 0a 09 09 09 09 6e 65 77 43 61 63 68 65 20 Data Ascii: if ( elem.nodeType === 1 \|\| checkNonElements ) {return matcher( elem, context, xml );}}} :// Check against all ancestor/preceding elementsfunction( elem, context, xml ) {var oldCache, uniqueCache, outerCache,newCache
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 0a 0a 76 61 72 20 72 6e 65 65 64 73 43 6f 6e 74 65 78 74 20 3d 20 6a 51 75 65 72 79 2e 65 78 70 72 2e 6d 61 74 63 68 2e 6e 65 65 64 73 43 6f 6e 74 65 78 74 3b 0a 0a 76 61 72 20 72 73 69 6e 67 6c 65 54 61 67 20 3d 20 28 20 2f 5e 3c 28 5b 5c 77 2d 5d 2b 29 5c 73 2a 5c 2f 3f 3e 28 3f 3a 3c 5c 2f 5c 31 3e 7c 29 24 2f 20 29 3b 0a 0a 0a 0a 76 61 72 20 72 69 73 53 69 6d 70 6c 65 20 3d 20 2f 5e 2e 5b 5e 3a 23 5c 5b 5c 2e 2c 5d 2a 24 2f 3b 0a 0a 2f 2f 20 49 6d 70 6c 65 6d 65 6e 74 20 74 68 65 20 69 64 65 6e 74 69 63 61 6c 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 66 6f 72 20 66 69 6c 74 65 72 20 61 6e 64 20 6e 6f 74 0a 66 75 6e 63 74 69 6f 6e 20 77 69 6e 6e 6f 77 28 20 65 6c 65 6d 65 6e 74 73 2c 20 71 75 61 6c 69 66 69 65 72 2c 20 6e 6f 74 20 29 20 7b 0a 09 69 Data Ascii: var rneedsContext = jQuery.expr.match.needsContext;var rsingleTag = ( /^<([\w-]+)\s\/?>(?:<\/\1>\|)$/ );var risSimple = /^.[^:#\[\.,]$/;// Implement the identical functionality for filter and notfunction winnow( elements, qualifier, not ) {i
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 65 20 29 20 29 20 7b 0a 09 09 09 09 09 09 09 09 09 72 65 74 75 72 6e 65 64 2e 70 72 6f 6d 69 73 65 28 29 0a 09 09 09 09 09 09 09 09 09 09 2e 70 72 6f 67 72 65 73 73 28 20 6e 65 77 44 65 66 65 72 2e 6e 6f 74 69 66 79 20 29 0a 09 09 09 09 09 09 09 09 09 09 2e 64 6f 6e 65 28 20 6e 65 77 44 65 66 65 72 2e 72 65 73 6f 6c 76 65 20 29 0a 09 09 09 09 09 09 09 09 09 09 2e 66 61 69 6c 28 20 6e 65 77 44 65 66 65 72 2e 72 65 6a 65 63 74 20 29 3b 0a 09 09 09 09 09 09 09 09 7d 20 65 6c 73 65 20 7b 0a 09 09 09 09 09 09 09 09 09 6e 65 77 44 65 66 65 72 5b 20 74 75 70 6c 65 5b 20 30 20 5d 20 2b 20 22 57 69 74 68 22 20 5d 28 0a 09 09 09 09 09 09 09 09 09 09 74 68 69 73 20 3d 3d 3d 20 70 72 6f 6d 69 73 65 20 3f 20 6e 65 77 44 65 66 65 72 2e 70 72 6f 6d 69 73 65 28 29 20 3a Data Ascii: e ) ) {returned.promise().progress( newDefer.notify ).done( newDefer.resolve ).fail( newDefer.reject );} else {newDefer[ tuple[ 0 ] + "With" ](this === promise ? newDefer.promise() :
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 6c 65 6d 20 26 26 20 65 6c 65 6d 2e 61 74 74 72 69 62 75 74 65 73 3b 0a 0a 09 09 2f 2f 20 53 70 65 63 69 61 6c 20 65 78 70 65 63 74 69 6f 6e 73 20 6f 66 20 2e 64 61 74 61 20 62 61 73 69 63 61 6c 6c 79 20 74 68 77 61 72 74 20 6a 51 75 65 72 79 2e 61 63 63 65 73 73 2c 0a 09 09 2f 2f 20 73 6f 20 69 6d 70 6c 65 6d 65 6e 74 20 74 68 65 20 72 65 6c 65 76 61 6e 74 20 62 65 68 61 76 69 6f 72 20 6f 75 72 73 65 6c 76 65 73 0a 0a 09 09 2f 2f 20 47 65 74 73 20 61 6c 6c 20 76 61 6c 75 65 73 0a 09 09 69 66 20 28 20 6b 65 79 20 3d 3d 3d 20 75 6e 64 65 66 69 6e 65 64 20 29 20 7b 0a 09 09 09 69 66 20 28 20 74 68 69 73 2e 6c 65 6e 67 74 68 20 29 20 7b 0a 09 09 09 09 64 61 74 61 20 3d 20 6a 51 75 65 72 79 2e 64 61 74 61 28 20 65 6c 65 6d 20 29 3b 0a 0a 09 09 09 09 69 66 20 Data Ascii: lem && elem.attributes;// Special expections of .data basically thwart jQuery.access,// so implement the relevant behavior ourselves// Gets all valuesif ( key === undefined ) {if ( this.length ) {data = jQuery.data( elem );if
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 20 66 6f 72 20 61 6e 79 20 72 61 64 69 6f 73 20 61 6e 64 20 63 68 65 63 6b 62 6f 78 65 73 0a 09 2f 2f 20 61 62 6f 75 74 20 74 6f 20 62 65 20 61 70 70 65 6e 64 65 64 20 74 6f 20 74 68 65 20 44 4f 4d 20 69 6e 20 49 45 20 36 2f 37 20 28 23 38 30 36 30 29 0a 09 69 66 20 28 20 21 73 75 70 70 6f 72 74 2e 61 70 70 65 6e 64 43 68 65 63 6b 65 64 20 29 20 7b 0a 09 09 6a 51 75 65 72 79 2e 67 72 65 70 28 20 67 65 74 41 6c 6c 28 20 6e 6f 64 65 73 2c 20 22 69 6e 70 75 74 22 20 29 2c 20 66 69 78 44 65 66 61 75 6c 74 43 68 65 63 6b 65 64 20 29 3b 0a 09 7d 0a 0a 09 69 20 3d 20 30 3b 0a 09 77 68 69 6c 65 20 28 20 28 20 65 6c 65 6d 20 3d 20 6e 6f 64 65 73 5b 20 69 2b 2b 20 5d 20 29 20 29 20 7b 0a 0a 09 09 2f 2f 20 53 6b 69 70 20 65 6c 65 6d 65 6e 74 73 20 61 6c 72 65 61 64 Data Ascii: for any radios and checkboxes// about to be appended to the DOM in IE 6/7 (#8060)if ( !support.appendChecked ) {jQuery.grep( getAll( nodes, "input" ), fixDefaultChecked );}i = 0;while ( ( elem = nodes[ i++ ] ) ) {// Skip elements alread
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 6e 74 2e 74 79 70 65 20 21 3d 3d 20 22 63 6c 69 63 6b 22 20 29 20 29 20 7b 0a 09 09 09 09 09 6d 61 74 63 68 65 73 20 3d 20 5b 5d 3b 0a 09 09 09 09 09 66 6f 72 20 28 20 69 20 3d 20 30 3b 20 69 20 3c 20 64 65 6c 65 67 61 74 65 43 6f 75 6e 74 3b 20 69 2b 2b 20 29 20 7b 0a 09 09 09 09 09 09 68 61 6e 64 6c 65 4f 62 6a 20 3d 20 68 61 6e 64 6c 65 72 73 5b 20 69 20 5d 3b 0a 0a 09 09 09 09 09 09 2f 2f 20 44 6f 6e 27 74 20 63 6f 6e 66 6c 69 63 74 20 77 69 74 68 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 20 70 72 6f 70 65 72 74 69 65 73 20 28 23 31 33 32 30 33 29 0a 09 09 09 09 09 09 73 65 6c 20 3d 20 68 61 6e 64 6c 65 4f 62 6a 2e 73 65 6c 65 63 74 6f 72 20 2b 20 22 20 22 3b 0a 0a 09 09 09 09 09 09 69 66 20 28 20 6d 61 74 63 68 65 73 5b 20 73 65 6c 20 5d 20 Data Ascii: nt.type !== "click" ) ) {matches = [];for ( i = 0; i < delegateCount; i++ ) {handleObj = handlers[ i ];// Don't conflict with Object.prototype properties (#13203)sel = handleObj.selector + " ";if ( matches[ sel ]

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	986	OUT	GET /packs/js/vendor-954761ad0dceb106b971.js HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:40 UTC	278	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 08:28:40 GMT Content-Type: application/javascript Content-Length: 18403 Connection: close Last-Modified: Fri, 23 Feb 2024 06:05:25 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:40 UTC	16106	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 65 28 72 29 7b 76 61 72 20 6f 3b 72 65 74 75 72 6e 28 6e 5b 72 5d 7c 7c 28 6f 3d 6e 5b 72 5d 3d 7b 69 3a 72 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 2c 74 5b 72 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 65 29 2c 6f 2e 6c 3d 21 30 2c 6f 29 29 2e 65 78 70 6f 72 74 73 7d 65 2e 6d 3d 74 2c 65 2e 63 3d 6e 2c 65 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 65 2e 6f 28 74 2c 6e 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 6e 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 72 7d 29 7d 2c 65 2e 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 6e 64 65 66 69 6e Data Ascii: !function(t){var n={};function e(r){var o;return(n[r]\|\|(o=n[r]={i:r,l:!1,exports:{}},t[r].call(o.exports,o,o.exports,e),o.l=!0,o)).exports}e.m=t,e.c=n,e.d=function(t,n,r){e.o(t,n)\|\|Object.defineProperty(t,n,{enumerable:!0,get:r})},e.r=function(t){"undefin
2024-02-23 08:28:40 UTC	2297	IN	Data Raw: 65 6e 74 2c 69 3d 72 28 6f 29 26 26 72 28 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 69 3f 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 74 29 3a 7b 7d 7d 7d 2c 37 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 28 31 26 74 29 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 28 32 26 74 29 2c 77 72 69 74 61 62 6c 65 3a 21 28 34 26 74 29 2c 76 61 6c 75 65 3a 6e 7d 7d 7d 2c 37 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 Data Ascii: ent,i=r(o)&&r(o.createElement);t.exports=function(t){return i?o.createElement(t):{}}},76:function(t,n){t.exports=function(t,n){return{enumerable:!(1&t),configurable:!(2&t),writable:!(4&t),value:n}}},77:function(t,n){t.exports=function(t){if("function"!=ty

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	1031	OUT	GET /assets/modernizr-79e0181ec91aff04bb01d87cba546535ede843f75d19f5c60f66b8dd6546971f.js HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:40 UTC	278	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 08:28:40 GMT Content-Type: application/javascript Content-Length: 51364 Connection: close Last-Modified: Fri, 23 Feb 2024 06:04:35 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:40 UTC	16106	IN	Data Raw: 2f 2a 21 0a 20 2a 20 4d 6f 64 65 72 6e 69 7a 72 20 76 32 2e 37 2e 31 0a 20 2a 20 77 77 77 2e 6d 6f 64 65 72 6e 69 7a 72 2e 63 6f 6d 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 46 61 72 75 6b 20 41 74 65 73 2c 20 50 61 75 6c 20 49 72 69 73 68 2c 20 41 6c 65 78 20 53 65 78 74 6f 6e 0a 20 2a 20 41 76 61 69 6c 61 62 6c 65 20 75 6e 64 65 72 20 74 68 65 20 42 53 44 20 61 6e 64 20 4d 49 54 20 6c 69 63 65 6e 73 65 73 3a 20 77 77 77 2e 6d 6f 64 65 72 6e 69 7a 72 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 2f 0a 20 2a 2f 0a 0a 2f 2a 0a 20 2a 20 4d 6f 64 65 72 6e 69 7a 72 20 74 65 73 74 73 20 77 68 69 63 68 20 6e 61 74 69 76 65 20 43 53 53 33 20 61 6e 64 20 48 54 4d 4c 35 20 66 65 61 74 75 72 65 73 20 61 72 65 20 61 76 61 69 6c 61 62 6c 65 20 69 6e 0a 20 Data Ascii: /! Modernizr v2.7.1 * www.modernizr.com * * Copyright (c) Faruk Ates, Paul Irish, Alex Sexton * Available under the BSD and MIT licenses: www.modernizr.com/license/ // * Modernizr tests which native CSS3 and HTML5 features are available in
2024-02-23 08:28:40 UTC	10519	IN	Data Raw: 7b 0a 20 20 20 20 20 20 72 65 74 75 72 6e 20 21 21 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 3b 0a 20 20 20 20 7d 3b 0a 0a 20 20 20 20 2f 2f 20 56 65 6e 64 6f 72 73 20 68 61 64 20 69 6e 63 6f 6e 73 69 73 74 65 6e 74 20 70 72 65 66 69 78 69 6e 67 20 77 69 74 68 20 74 68 65 20 65 78 70 65 72 69 6d 65 6e 74 61 6c 20 49 6e 64 65 78 65 64 20 44 42 3a 0a 20 20 20 20 2f 2f 20 2d 20 57 65 62 6b 69 74 27 73 20 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 20 69 73 20 61 63 63 65 73 73 69 62 6c 65 20 74 68 72 6f 75 67 68 20 77 65 62 6b 69 74 49 6e 64 65 78 65 64 44 42 0a 20 20 20 20 2f 2f 20 2d 20 46 69 72 65 66 6f 78 20 73 68 69 70 70 65 64 20 6d 6f 7a 5f 69 6e 64 65 78 65 64 44 42 20 62 65 66 6f 72 65 20 46 46 34 62 39 2c 20 62 75 74 20 73 69 6e 63 65 Data Ascii: { return !!window.openDatabase; }; // Vendors had inconsistent prefixing with the experimental Indexed DB: // - Webkit's implementation is accessible through webkitIndexedDB // - Firefox shipped moz_indexedDB before FF4b9, but since
2024-02-23 08:28:40 UTC	16384	IN	Data Raw: 65 73 74 20 66 69 72 73 74 20 62 65 63 61 75 73 65 20 6f 74 68 65 72 77 69 73 65 20 46 69 72 65 66 6f 78 20 77 69 6c 6c 0a 20 20 20 20 2f 2f 20 20 20 74 68 72 6f 77 20 62 75 67 7a 69 6c 2e 6c 61 2f 33 36 35 37 37 32 20 69 66 20 63 6f 6f 6b 69 65 73 20 61 72 65 20 64 69 73 61 62 6c 65 64 0a 0a 20 20 20 20 2f 2f 20 41 6c 73 6f 20 69 6e 20 69 4f 53 35 20 50 72 69 76 61 74 65 20 42 72 6f 77 73 69 6e 67 20 6d 6f 64 65 2c 20 61 74 74 65 6d 70 74 69 6e 67 20 74 6f 20 75 73 65 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 0a 20 20 20 20 2f 2f 20 77 69 6c 6c 20 74 68 72 6f 77 20 74 68 65 20 65 78 63 65 70 74 69 6f 6e 3a 0a 20 20 20 20 2f 2f 20 20 20 51 55 4f 54 41 5f 45 58 43 45 45 44 45 44 5f 45 52 52 52 4f 52 20 44 4f 4d 20 45 78 63 65 70 74 69 Data Ascii: est first because otherwise Firefox will // throw bugzil.la/365772 if cookies are disabled // Also in iOS5 Private Browsing mode, attempting to use localStorage.setItem // will throw the exception: // QUOTA_EXCEEDED_ERRROR DOM Excepti
2024-02-23 08:28:40 UTC	8355	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 27 68 2e 73 68 69 76 4d 65 74 68 6f 64 73 26 26 28 27 20 2b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 75 6e 72 6f 6c 6c 20 74 68 65 20 60 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 60 20 63 61 6c 6c 73 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 67 65 74 45 6c 65 6d 65 6e 74 73 28 29 2e 6a 6f 69 6e 28 29 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 77 5c 2d 5d 2b 2f 67 2c 20 66 75 6e 63 74 69 6f 6e 28 6e 6f 64 65 4e 61 6d 65 29 20 7b 0a 20 20 20 20 20 20 20 Data Ascii: 'h.shivMethods&&(' + // unroll the `createElement` calls getElements().join().replace(/[\w\-]+/g, function(nodeName) {

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	51364
Entropy (8bit):	4.630626843010533
Encrypted:	false
SSDEEP:	1536:TRCJJ/KpVsnpxvXmET56JYFE7qbe/7Y8fjWWy+4GrkfwuXxJ44ipW/VPRLq277ts:TS/FpzarzCT71Pts
MD5:	BF2F96E6233DE3D8C0346085AC28248A
SHA1:	4DB267704D7E3FB2489CF96E82862A2245CD9311
SHA-256:	EE94DDA0AF1FC5C5045741B39E54136015365EEDCA34095F1D3C666998BB442D
SHA-512:	D4DB54380D135D9F5AAA03727CC88037B014C1057A3061C3D173EB8D4CEC7E4A2F71CFCA1478E8E15C093D510EEE80668C2038691EAEB21958942089F0DD9C6C
Malicious:	false
Reputation:	low
URL:	https://safe-site.protected-forms.com/assets/modernizr-79e0181ec91aff04bb01d87cba546535ede843f75d19f5c60f66b8dd6546971f.js
Preview:	/!. Modernizr v2.7.1. * www.modernizr.com. . Copyright (c) Faruk Ates, Paul Irish, Alex Sexton. * Available under the BSD and MIT licenses: www.modernizr.com/license/. /../. * Modernizr tests which native CSS3 and HTML5 features are available in. * the current UA and makes the results available to you in two ways:. * as properties on a global Modernizr object, and as classes on the. * <html> element. This information allows you to progressively enhance. * your pages with a granular level of control over the experience.. . Modernizr has an optional (not included) conditional resource loader. * called Modernizr.load(), based on Yepnope.js (yepnopejs.com).. * To get a build that includes Modernizr.load(), as well as choosing. * which tests to include, go to www.modernizr.com/download/. . Authors Faruk Ates, Paul Irish, Alex Sexton. * Contributors Ryan Seddon, Ben Alman. */..window.Modernizr = (function( window, document, undefined ) {.. var version = '2.7.1',..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4524
Entropy (8bit):	5.108931295370594
Encrypted:	false
SSDEEP:	96:AG5XS7vBkRVkhmRaM44/HLPRaByA+zBRNI:AG5XABkAhmRaM44/H1CyrBRNI
MD5:	DD05B711E15EF201B07E20CB5C87F5D8
SHA1:	41B818B243140D90DA4CA917D454335B603A6BDA
SHA-256:	617F793D125F780AB7BB7C9E92AB427D9E757083E7368E241E8E8FA69F013E4F
SHA-512:	243C149BB8AAF5376EEBAC49833A59F75BA26BEC098AFD8A167D12BDACD3E80D98EE1DA1D82915CC7E4C7FAC747FBFF5D2D687D97F20BDF5C81D67CFA0620F39
Malicious:	false
Reputation:	low
URL:	https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css
Preview:	.borderRadius{-moz-border-radius:5px; border-radius:5px; }...borderRadiusTp{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 5px 5px;}...borderRadiusBtm{-moz-border-radius:0 0 5px 5px ; border-radius:5px 5px 5px 5px;}.....ddcommon {position:relative;display:-moz-inline-stack; zoom:1; display:inline-block; display:inline; cursor:default;}...ddcommon ul{padding:0;margin:0;}...ddcommon ul li{list-style-type:none;}...borderRadiusTp ul li:last-child{-moz-border-radius:0 0 5px 5px ; border-radius:0 0 5px 5px;border-bottom:0 none #c3c3c3; }...borderRadiusBtm ul li:first-child{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 0 0 ;border-bottom:1 solid #c3c3c3; }.....ddcommon .disabled img, .ddcommon .disabled span, .ddcommon.disabledAll{..opacity: .5; / standard: ff gt 1.5, opera, safari /..-ms-filter:"alpha(opacity=50)"; / ie 8 /..filter:alpha(opacity=50); / ie lt 7 /..-khtml-opacity:.5; / safari 1.x /..-moz-opacity:.5; / ff lt 1.5, netscape */..color:#999999;..}...ddcommo

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3205081
Entropy (8bit):	5.067657884847328
Encrypted:	false
SSDEEP:	49152:Jw4mDiTFyA6TVfMAeolyHCcmMy/W/EEPbhhDdR30mpz+aSKWheTXOz2usGgNaE0J:s
MD5:	26814C6E36FF19A4F9B6D347CBC5E599
SHA1:	1C9BDF0A458956B7636CDC59DD614AA82502220C
SHA-256:	80DF024EF21842EC1064FD7BACC3B5C01CB2499F18ED1F8CC65DEF2771BDCB48
SHA-512:	D98F2F192B406D25915605259EB9FF28727D4F448BFA33DCCA1CE37DF4CE4658BC4891547A348A6585FEC7680BB11A2BD1BDF796BEE60917D405DB85E23DF47C
Malicious:	false
Reputation:	low
URL:	https://safe-site.protected-forms.com/assets/application-1fad17ce0880f978206c332819cfbcf1a9232d0ff44aace838815115cb62d62b.js
Preview:	/!. jQuery JavaScript Library v1.12.4. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright jQuery Foundation and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2016-05-20T17:17Z. */..(function( global, factory ) {...if ( typeof module === "object" && typeof module.exports === "object" ) {...// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket #14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return factory( w );....};..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65371)
Category:	downloaded
Size (bytes):	121200
Entropy (8bit):	5.0982146191887106
Encrypted:	false
SSDEEP:	768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh
MD5:	EC3BB52A00E176A7181D454DFFAEA219
SHA1:	6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68
SHA-256:	F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C
SHA-512:	E8C5DAF01EAE68ED7C1E277A6E544C7AD108A0FA877FB531D6D9F2210769B7DA88E4E002C7B0BE3B72154EBF7CBF01A795C8342CE2DAD368BD6351E956195F8B
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
Preview:	/!. Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{color:#000;background:#ff0}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	1033	OUT	GET /assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:40 UTC	514	IN	HTTP/1.1 404 Not Found Date: Fri, 23 Feb 2024 08:28:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 1e841252-4f18-4763-b03c-26802fe686c4 X-Runtime: 0.020125 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:40 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	986	OUT	GET /packs/js/vendor-69f70dd3792dc7287ac8.js HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:40 UTC	514	IN	HTTP/1.1 404 Not Found Date: Fri, 23 Feb 2024 08:28:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: f955862f-1ea2-4073-8028-3f9a77a4688b X-Runtime: 0.020733 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:40 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	1031	OUT	GET /assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:40 UTC	514	IN	HTTP/1.1 404 Not Found Date: Fri, 23 Feb 2024 08:28:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 2c12fa34-daa3-4f96-996b-d451d2f47aad X-Runtime: 0.014756 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:40 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	1006	OUT	GET /ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:41 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 08:28:41 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb04010-1d970" Last-Modified: Mon, 04 May 2020 16:17:20 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 25926 Expires: Wed, 12 Feb 2025 08:28:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Oses6%2BHv8Mzb4kcMIt9TiK%2FBA2HEMd3M3OTF465EmdClKgmn9mhVPuubF7SM4WJF%2F8yX5Y4ClnvGXkltaIYxmvfH9jc8ZVG7NDHMcWGqyEl35AjhoZJOdajW9JjUcHUiSFf7g%2BRV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 859e18c45f180f4b-EWR alt-svc: h3=":443"; ma=86400
2024-02-23 08:28:41 UTC	423	IN	Data Raw: 33 39 62 65 0d 0a 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 33 2e 37 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 36 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 33 2e 30 2e 33 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 68 75 62 2e 63 6f 6d 2f 6e 65 63 6f 6c 61 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 2a 2f 68 74 6d 6c 7b Data Ascii: 39be/! Bootstrap v3.3.7 (http://getbootstrap.com) * Copyright 2011-2016 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: 73 65 63 74 69 6f 6e 2c 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 70 72 6f 67 72 65 73 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 5b 68 69 64 64 65 6e 5d 2c 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 61 3a 61 63 74 69 76 65 2c 61 3a 68 6f 76 65 72 7b 6f 75 74 6c 69 6e 65 3a 30 7d 61 62 62 72 5b 74 69 74 6c 65 5d 7b 62 6f 72 64 65 72 2d Data Ascii: section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: 74 3a 61 75 74 6f 7d 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 74 65 78 74 66 69 65 6c 64 7d 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 63 61 6e 63 65 6c 2d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 64 65 63 6f 72 61 74 69 6f 6e 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 Data Ascii: t:auto}input[type=search]{-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-appearance:textfield}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration{-webkit-appearance:none
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: 6f 6c 69 64 20 23 64 64 64 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 47 6c 79 70 68 69 63 6f 6e 73 20 48 61 6c 66 6c 69 6e 67 73 27 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 65 6f 74 29 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 65 6f 74 3f 23 69 65 66 69 78 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 77 6f 66 66 32 29 20 66 6f Data Ascii: olid #ddd!important}}@font-face{font-family:'Glyphicons Halflings';src:url(../fonts/glyphicons-halflings-regular.eot);src:url(../fonts/glyphicons-halflings-regular.eot?#iefix) format('embedded-opentype'),url(../fonts/glyphicons-halflings-regular.woff2) fo
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 7a 6f 6f 6d 2d 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 7a 6f 6f 6d 2d 6f 75 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6f Data Ascii: }.glyphicon-th:before{content:"\e011"}.glyphicon-th-list:before{content:"\e012"}.glyphicon-ok:before{content:"\e013"}.glyphicon-remove:before{content:"\e014"}.glyphicon-zoom-in:before{content:"\e015"}.glyphicon-zoom-out:before{content:"\e016"}.glyphicon-o
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: 6f 6b 6d 61 72 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 61 6d 65 72 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6f 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 62 6f 6c 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 69 74 61 6c 69 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 39 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 65 78 74 2d 68 65 69 67 68 74 3a 62 65 Data Ascii: okmark:before{content:"\e044"}.glyphicon-print:before{content:"\e045"}.glyphicon-camera:before{content:"\e046"}.glyphicon-font:before{content:"\e047"}.glyphicon-bold:before{content:"\e048"}.glyphicon-italic:before{content:"\e049"}.glyphicon-text-height:be
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: 2d 73 74 65 70 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 65 6a 65 63 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 6c 65 66 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 39 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 30 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 6c 75 73 2d 73 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6d 69 6e 75 73 2d 73 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c Data Ascii: -step-forward:before{content:"\e077"}.glyphicon-eject:before{content:"\e078"}.glyphicon-chevron-left:before{content:"\e079"}.glyphicon-chevron-right:before{content:"\e080"}.glyphicon-plus-sign:before{content:"\e081"}.glyphicon-minus-sign:before{content:"\
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: 70 68 69 63 6f 6e 2d 63 6f 6d 6d 65 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6d 61 67 6e 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 74 77 65 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 73 68 6f 70 70 69 6e 67 2d 63 61 72 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c Data Ascii: phicon-comment:before{content:"\e111"}.glyphicon-magnet:before{content:"\e112"}.glyphicon-chevron-up:before{content:"\e113"}.glyphicon-chevron-down:before{content:"\e114"}.glyphicon-retweet:before{content:"\e115"}.glyphicon-shopping-cart:before{content:"\
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 61 70 65 72 63 6c 69 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 68 65 61 72 74 2d 65 6d 70 74 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6c 69 6e 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 68 6f 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 75 73 68 70 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 75 73 64 3a 62 65 66 6f 72 65 7b 63 6f Data Ascii: ore{content:"\e141"}.glyphicon-paperclip:before{content:"\e142"}.glyphicon-heart-empty:before{content:"\e143"}.glyphicon-link:before{content:"\e144"}.glyphicon-phone:before{content:"\e145"}.glyphicon-pushpin:before{content:"\e146"}.glyphicon-usd:before{co
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: 74 65 6e 74 3a 22 5c 65 31 37 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 73 61 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 6f 70 65 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 72 65 64 69 74 2d 63 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 72 61 6e 73 66 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 75 Data Ascii: tent:"\e173"}.glyphicon-floppy-remove:before{content:"\e174"}.glyphicon-floppy-save:before{content:"\e175"}.glyphicon-floppy-open:before{content:"\e176"}.glyphicon-credit-card:before{content:"\e177"}.glyphicon-transfer:before{content:"\e178"}.glyphicon-cu

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	1038	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:41 UTC	1202	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 08:28:41 GMT Content-Type: image/webp Content-Length: 4156 Connection: close CF-Ray: 859e18c45c2443f2-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 2078068 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="KB4-logo.webp" ETag: "20f88cb052864ef047cbf095e46a23b0" Last-Modified: Fri, 06 Oct 2017 17:40:18 GMT Vary: Accept Via: 1.1 f48e3bba7eb119871945c3726fab1888.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=5864 Edge-Cache-Tag: F-3711502880,P-241394,FLS-ALL X-Amz-Cf-Id: kZ-oF4xK9ZGHruIB-dLqh_D425TzchqwifVG6Mr7Ga4L5_D9F3f39g== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: FMY7hEQryz/+JkVOGFH/smc84lugqhtFr0oXfnGEUC++AMyYiYJNo5P0q3w1FgHs1qbNZPLkeNA= x-amz-meta-cache-tag: F-3711502880,P-241394,FLS-ALL x-amz-request-id: 6JN339DB25Q3GV5E x-amz-version-id: g7nBhtlZ35jy1YqAk.ii5vduFHLTKp1W X-Cache: RefreshHit from cloudfront X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3 X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3
2024-02-23 08:28:41 UTC	378	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 56 72 6f 7a 33 4b 34 67 41 6f 48 4d 30 38 57 4b 46 58 62 50 79 6f 79 5a 32 6c 4c 77 59 77 66 74 47 46 74 35 4e 5a 58 78 6f 75 62 5a 79 59 68 71 61 73 43 62 30 70 50 33 58 32 44 4e 6e 78 32 59 59 5a 34 74 4a 56 47 34 54 67 25 32 46 66 6d 64 69 68 4e 54 56 33 58 67 37 7a 46 25 32 42 71 4a 54 6f 39 78 41 70 79 4e 56 4e 74 51 55 79 53 54 67 30 6d 6a 56 41 75 68 67 61 56 57 52 4e 42 47 58 53 59 52 58 38 63 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vroz3K4gAoHM08WKFXbPyoyZ2lLwYwftGFt5NZXxoubZyYhqasCb0pP3X2DNnx2YYZ4tJVG4Tg%2FfmdihNTV3Xg7zF%2BqJTo9xApyNVNtQUySTg0mjVAuhgaVWRNBGXSYRX8c%3D"}],"group":"cf-nel","max_age":604800}
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: 52 49 46 46 34 10 00 00 57 45 42 50 56 50 38 4c 27 10 00 00 2f c7 80 12 10 15 87 82 b4 0d 98 d5 bf f1 3d 01 11 31 01 3a 0c 01 4c f8 14 f8 88 dd da b6 65 6f 1b 75 6f af 7b 23 ab ad 7b f1 fb 6c b5 6b 7e cd d5 98 8a 6a 38 1e 8d a3 80 32 5f c1 10 e6 c4 61 46 8d 8b 66 50 52 46 15 95 8c c3 9c 82 a9 0c ca 28 0a d3 69 2a 1a e3 a0 79 7d 4e 15 30 94 39 cc 51 a3 0a 48 92 f6 3b 3a 08 b2 6d 9e fb 33 55 6d 0a 00 00 20 fe ff ff ff ff ff ff ff ff ff bf 09 a0 b2 01 00 69 3d fb 09 5b 5a b3 6d db b6 6d db 5b b2 99 6c 6f c9 de ce 3d af 6d db d6 b5 1d 5e fd 85 b3 b4 64 5b d5 c8 6f 9a 8d 64 24 e3 d6 25 db b6 7d d3 6c 7e fc 0d b6 cd c4 e7 81 18 b6 6d 20 87 be b4 fb 4f fc 82 81 b4 6d d6 dc bf e6 3b aa 6d ab ad 16 1a 98 22 26 31 f0 8b a4 14 1d 4f 49 7a 9c 20 81 31 6b ed 09 f0 7f Data Ascii: RIFF4WEBPVP8L'/=1:Leouo{#{lk~j82_aFfPRF(i*y}N09QH;:m3Um i=[Zmm[lo=m^d[od$%}l~m Om;m"&1OIz 1k
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: f8 ae 73 3c 2e 06 92 67 89 35 f1 4c ea e3 7f ca f8 20 70 7e 01 8b 15 d8 35 4d 34 c2 70 81 5e 9a 5b 80 43 85 74 29 42 3e 9f bf 0b a2 3f d1 f0 43 ae e1 19 fc 9b 88 25 96 23 16 e8 02 37 f0 40 16 54 83 2a b7 6e ad 47 36 f0 66 c8 2f e9 8b dd 47 a9 0b df d8 fd cc b6 f0 01 0e 4f 13 4e b0 ab 7d 1a 74 fc 35 6d 0c 5c 95 a7 c5 99 02 fb c7 a2 ee 05 e0 d0 1d d3 44 0b 30 b6 88 c8 03 71 9f 22 24 80 1d 5d 9e 45 16 20 1e 05 45 09 2f 0c 2b d0 cf dd e1 e6 c0 d9 76 0b 8c 9a e1 3b f2 03 5f d0 cd fa bf 7b 61 0b 4e ce e0 0c d6 60 0c aa 20 9a 67 75 cd 86 18 1f bc 3f 76 77 b6 7d 33 20 ec d2 ce 83 0f da 82 0c 10 bc 29 ab 96 c0 41 a5 d8 fe fc 2d 00 42 31 e5 54 58 e7 a2 13 81 e9 b6 37 ff 19 ba 37 57 62 f3 18 40 6c f7 15 1b e2 92 38 a7 36 45 dc 2f 61 3e 82 47 8e 68 2c aa 81 6f b0 c7 Data Ascii: s<.g5L p~5M4p^[Ct)B>?C%#7@T*nG6f/GON}t5m\D0q"$]E E/+v;_{aN` gu?vw}3 )A-B1TX77Wb@l86E/a>Gh,o
2024-02-23 08:28:41 UTC	1369	IN	Data Raw: f2 51 47 dd 97 07 92 aa 24 97 51 81 49 45 9b ba aa 06 6d ab 3a 55 25 9b 92 26 05 46 19 25 c8 ba 37 ae fc c9 ca f7 e7 13 3a a7 fe e4 22 e1 93 4b b0 88 8b 5c 4b fe 2c 0a 84 9a 80 74 e1 c3 45 6c 77 8e c5 93 85 b1 80 2f e5 2f 80 a0 4d 69 d4 05 84 20 bc 5f 48 08 75 61 70 f6 d9 42 41 88 0a ca 3d 5c f6 97 05 e7 ad 67 9f bd 69 85 60 ff 84 4b ff c6 58 01 ee ff 58 8d 22 88 0a 88 82 48 89 b2 88 e2 18 88 45 11 45 b9 46 e5 44 95 46 25 46 59 45 81 0d 0c a2 6c a2 42 2a 11 25 10 f5 1f 85 90 12 b5 10 e5 30 d0 8a 02 9c 11 f5 1d d5 12 e5 1c 65 18 e5 11 95 17 05 34 30 88 4a 88 6a 68 d4 1e 8e fa 88 12 f3 40 b3 6a a2 40 2e 9b 64 7b 75 14 9e 1d 85 15 05 d5 7b 64 14 5f 9b 7b a3 38 a3 84 16 d8 8e 82 8e 62 8e 12 bf 35 0a d1 76 14 46 14 8c a3 48 67 45 51 e4 f8 d4 ac 28 96 28 60 db Data Ascii: QG$QIEm:U%&F%7:"K\K,tElw//Mi _HuapBA=\gi`KXX"HEEFDF%FYElB*%0e40Jjh@j@.d{u{d_{8b5vFHgEQ((`
2024-02-23 08:28:41 UTC	49	IN	Data Raw: b6 9b 6e fd de 13 e3 db 6d fb a0 69 eb 1f 1c 6d 8f 18 9d f0 cd bf be f7 90 d7 6d bb fd df f7 fe 65 d1 76 3e f3 95 d2 de 14 9c 91 78 b3 f0 cd 36 00 Data Ascii: nmimmev>x6

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	999	OUT	GET /QRF01zv.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:41 UTC	718	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1666 Content-Type: image/png Last-Modified: Wed, 17 Jul 2019 19:34:43 GMT ETag: "29d583007fcd677aa31ca849478bc17a" X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: 5txwq_d814LMpzvKk9tCLaABYqTKmZQSSRgOwKbBjllsq_MWet_LDw== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Fri, 23 Feb 2024 08:28:41 GMT Age: 3260480 X-Served-By: cache-iad-kiad7000070-IAD, cache-lga21973-LGA X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 13403, 1 X-Timer: S1708676921.110266,VS0,VE1 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2024-02-23 08:28:41 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 06 00 00 00 3a fc d9 72 00 00 06 49 49 44 41 54 68 81 e5 9b 7b 88 56 45 14 c0 7f fb ed aa 59 a2 45 b9 bd b4 a7 95 8f b4 55 76 15 42 c9 f2 91 d4 1a 3d a8 20 2a 7b a8 f5 a7 19 65 65 a4 a5 92 f9 47 12 25 84 9a 88 a6 48 2f 29 92 55 52 31 5b c9 47 99 94 99 64 c6 1a be 12 5f 6d 19 d5 da d6 1f e7 7e 3a f7 7c f7 31 33 f7 1a 7e f4 83 65 ef 99 3b 73 ee 9c ef de 3b 67 e6 cc b9 15 0b 17 2e 26 67 0a 40 05 f0 77 c4 b9 47 81 e7 81 4b 81 7f 80 ef 80 c9 c0 7b 11 75 2b 81 d6 a0 5e ae 9d cb 93 6b 80 c5 c0 c0 88 73 2b 81 b9 c0 65 c8 0f 52 00 7a 01 ef 02 8b 22 ea 8f 04 16 00 17 e4 d9 c1 bc 0c be 05 d8 04 6c 07 7a 00 9f aa f3 ef 03 43 12 da df 07 bc a9 ca 56 01 23 80 7d c8 8f 35 28 8f 8e 66 35 f8 4e 60 Data Ascii: PNGIHDR<<:rIIDATh{VEYEUvB= *{eeG%H/)UR1[Gd_m~:\|13~e;s;g.&g@wGK{u+^ks+eRz"lzCV#}5(f5N`
2024-02-23 08:28:41 UTC	295	IN	Data Raw: 65 c8 bb 93 94 4c 52 4f 78 cb 66 11 fe 81 05 90 dc 2f 33 f3 6e 10 c9 23 f4 7e e0 5a 2c 26 3e b6 8b 87 46 e4 5b 85 6f 13 ea 3c a4 e4 59 96 ba a3 78 55 c9 a3 13 ea ae 21 bd 6f 27 70 59 2d 1d 42 7e c5 39 31 e7 47 23 33 a1 22 6f 10 5e b8 db b2 81 70 b2 ea 25 c8 37 11 51 4c 41 e6 ee d6 e1 25 9f e5 e1 58 64 4f 59 af 88 3a 13 76 05 2d 44 24 86 59 a0 13 e3 9e a0 74 dd be 17 71 87 2f b8 2a f7 5d 0f 7f 88 84 4c c6 10 0e f5 4c 25 1c 6f 5a 80 7c ba 63 cb 8b 48 0a 70 91 de 84 3f fc d8 03 dc 8b ec 17 af 75 d0 7b 82 ac 01 80 b9 48 6e d7 38 64 0b f3 4c 60 a1 aa 33 06 f8 cc 42 d7 52 4a 13 42 df 0e fe 37 21 af 4c 17 82 65 9e 2f 79 45 3c 5e 43 ee ec 08 a0 1d a5 33 a2 7a 24 4d 3f 8e 46 4a 3f f5 a9 47 fc ea 40 24 9f e3 ad 3c 3a 9a 77 88 67 05 32 88 68 f7 d0 8c 2c 25 a7 23 91 Data Ascii: eLROxf/3n#~Z,&>F[o<YxU!o'pY-B~91G#3"o^p%7QLA%XdOY:v-D$Ytq/*]LL%oZ\|cHp?u{Hn8dL`3BRJB7!Le/yE<^C3z$M?FJ?G@$<:wg2h,%#

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:40 UTC	979	OUT	GET /helpimg/landing_pages/css/dd.css HTTP/1.1 Host: s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:41 UTC	436	IN	HTTP/1.1 200 OK x-amz-id-2: dfQSSb0mvqHhmB3O1VF8Tz4lToGQIqEJYtn1TXEccoQraXFii27tjCnt+TBiobSD/6iEOCU86s0= x-amz-request-id: DPHP8CZ24KN2FEHT Date: Fri, 23 Feb 2024 08:28:42 GMT x-amz-replication-status: COMPLETED Last-Modified: Tue, 08 Aug 2017 20:12:22 GMT ETag: "dd05b711e15ef201b07e20cb5c87f5d8" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/css Server: AmazonS3 Content-Length: 4524 Connection: close
2024-02-23 08:28:41 UTC	1521	IN	Data Raw: 2e 62 6f 72 64 65 72 52 61 64 69 75 73 7b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 20 7d 0d 0a 2e 62 6f 72 64 65 72 52 61 64 69 75 73 54 70 7b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 20 35 70 78 20 30 20 30 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 20 35 70 78 20 35 70 78 20 35 70 78 3b 7d 0d 0a 2e 62 6f 72 64 65 72 52 61 64 69 75 73 42 74 6d 7b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 20 30 20 35 70 78 20 35 70 78 20 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 20 35 70 78 20 35 70 78 20 35 70 78 3b 7d 0d 0a 0d 0a 2e 64 64 63 6f 6d 6d 6f 6e 20 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b Data Ascii: .borderRadius{-moz-border-radius:5px; border-radius:5px; }.borderRadiusTp{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 5px 5px;}.borderRadiusBtm{-moz-border-radius:0 0 5px 5px ; border-radius:5px 5px 5px 5px;}.ddcommon {position:relative;
2024-02-23 08:28:41 UTC	3003	IN	Data Raw: 23 38 38 38 38 38 38 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 35 70 78 20 35 70 78 20 35 70 78 20 2d 35 70 78 20 23 38 38 38 38 38 38 3b 7d 0d 0a 2e 62 6f 72 64 65 72 52 61 64 69 75 73 42 74 6d 20 2e 73 68 61 64 6f 77 7b 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 2d 35 70 78 20 2d 35 70 78 20 35 70 78 20 2d 35 70 78 20 23 38 38 38 38 38 38 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 2d 35 70 78 20 2d 35 70 78 20 35 70 78 20 2d 35 70 78 20 23 38 38 38 38 38 38 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 2d 35 70 78 20 2d 35 70 78 20 35 70 78 20 2d 35 70 78 20 23 38 38 38 38 38 38 7d 0d 0a 2e 62 6f 72 64 65 72 52 61 64 69 75 73 54 70 20 2e 62 6f 72 64 65 72 2c 20 2e 62 6f 72 64 65 72 52 61 64 69 75 73 20 2e 62 6f 72 64 65 72 7b 2d 6d 6f 7a 2d Data Ascii: #888888;box-shadow: 5px 5px 5px -5px #888888;}.borderRadiusBtm .shadow{-moz-box-shadow:-5px -5px 5px -5px #888888;-webkit-box-shadow:-5px -5px 5px -5px #888888;box-shadow: -5px -5px 5px -5px #888888}.borderRadiusTp .border, .borderRadius .border{-moz-

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:41 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-02-23 08:28:41 UTC	496	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=212259 Date: Fri, 23 Feb 2024 08:28:41 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:41 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-02-23 08:28:41 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=212216 Date: Fri, 23 Feb 2024 08:28:41 GMT Content-Length: 55 Connection: close X-CID: 2
2024-02-23 08:28:41 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:42 UTC	1054	OUT	GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:42 UTC	514	IN	HTTP/1.1 404 Not Found Date: Fri, 23 Feb 2024 08:28:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 2b871e6e-b115-43f4-bca9-185a04a8e9bf X-Runtime: 0.009866 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-02-23 08:28:42 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:42 UTC	1139	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "20f88cb052864ef047cbf095e46a23b0" If-Modified-Since: Fri, 06 Oct 2017 17:40:18 GMT
2024-02-23 08:28:42 UTC	1142	IN	HTTP/1.1 304 Not Modified Date: Fri, 23 Feb 2024 08:28:42 GMT Connection: close CF-Ray: 859e18cfec6242d0-EWR CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 1031631 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="KB4-logo.webp" ETag: "20f88cb052864ef047cbf095e46a23b0" Last-Modified: Fri, 06 Oct 2017 17:40:18 GMT Vary: Accept Via: 1.1 f48e3bba7eb119871945c3726fab1888.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=5864 Edge-Cache-Tag: F-3711502880,P-241394,FLS-ALL X-Amz-Cf-Id: kZ-oF4xK9ZGHruIB-dLqh_D425TzchqwifVG6Mr7Ga4L5_D9F3f39g== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: FMY7hEQryz/+JkVOGFH/smc84lugqhtFr0oXfnGEUC++AMyYiYJNo5P0q3w1FgHs1qbNZPLkeNA= x-amz-meta-cache-tag: F-3711502880,P-241394,FLS-ALL x-amz-request-id: 6JN339DB25Q3GV5E x-amz-version-id: g7nBhtlZ35jy1YqAk.ii5vduFHLTKp1W X-Cache: RefreshHit from cloudfront X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3 X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3
2024-02-23 08:28:42 UTC	378	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 32 74 6f 65 53 43 69 75 6e 34 51 6c 43 34 50 35 78 73 62 4f 39 6f 54 47 4a 48 58 48 6a 43 71 71 46 39 56 6c 64 4b 75 67 78 73 5a 74 5a 75 7a 64 31 56 56 75 4a 6f 31 5a 7a 50 4a 74 56 6a 6e 31 4c 66 6a 6e 4e 52 36 68 74 58 43 4a 77 63 59 48 46 73 41 31 44 6f 25 32 42 61 63 58 53 64 63 37 55 43 74 6d 64 36 6f 4c 69 6d 55 39 62 75 67 36 69 38 4d 43 56 71 44 72 25 32 46 67 6a 6c 31 76 4c 4e 51 39 49 6d 41 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2toeSCiun4QlC4P5xsbO9oTGJHXHjCqqF9VldKugxsZtZuzd1VVuJo1ZzPJtVjn1LfjnNR6htXCJwcYHFsA1Do%2BacXSdc7UCtmd6oLimU9bug6i8MCVqDr%2Fgjl1vLNQ9ImA%3D"}],"group":"cf-nel","max_age":604800}

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:49 UTC	1018	OUT	GET /favicon.ico HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://safe-site.protected-forms.com/pages/3ab25de5724369e682a2b54d5ae33e68/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:49 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 08:28:49 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Fri, 23 Feb 2024 06:06:46 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Timestamp	Bytes transferred	Direction	Data
2024-02-23 08:28:50 UTC	364	OUT	GET /favicon.ico HTTP/1.1 Host: safe-site.protected-forms.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-23 08:28:50 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 23 Feb 2024 08:28:50 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Fri, 23 Feb 2024 06:06:46 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Target ID:	0
Start time:	09:28:29
Start date:	23/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	09:28:33
Start date:	23/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2272,i,14050104179310117098,726667368655157578,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	09:28:36
Start date:	23/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://2fa.com-token-auth.com/XalRCUTRIS1hROE9KamNFeVZTS0JWTFo2ZVAvelplTzZVQksvWHNEaW5scEdxS1dwRTBJcDJ1M1hvdUlNVlQxYUxrRHBVNDRZc2EyNll4bEpuZmtraytUdVNMYmNDTDFHUFFZdjBsczNmRVBPQWRLbXJqQ08wYk9wZ2szU0RROUNkcVJpOGs0b245UDE4YUloVzRTbk5NYUh3YVJackEzQnRKeE1NZ25JR2hyWEdYWkNyNnQ2Z3dFY2dDdUlFY3pHaTRsM1dqdVlxb3l1ZXBzYVpDeUlmYnB5YTA1c242bWNjdlVFLS1oOGM2OGZHNkxDbU0vZG9zLS1yOVNnWXRMV0hONkppUEY0djZGWHhnPT0=?cid=1913561742
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre