Edit tour

Windows Analysis Report
https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0

Overview

General Information

Sample URL:	https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOa
Analysis ID:	1469349
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=1956,i,9439631370590086316,199388582780943592,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /_blazor/negotiate?negotiateVersion=1 HTTP/1.1Host: links.us1.defend.egress.comConnection: keep-aliveContent-Length: 0Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: text/plain;charset=UTF-8X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-SignalR-User-Agent: Microsoft SignalR/0.0 (0.0.0-DEV_BUILD; Unknown OS; Browser; Unknown Runtime Version)sec-ch-ua-platform: "Windows"Accept: */*Origin: https://links.us1.defend.egress.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=Y57lHVagrjCzjDR/+8U/oX1p8pVPrWLUm29xzdRVUCnCmcym46rRn+V84vR9ICfGBJPA4xhyGQE4+UTXf3UEHyTrVfATIrg1ZS9W6C1pB2U/jNiSn/KhozwInPZu; AWSALBCORS=Y57lHVagrjCzjDR/+8U/oX1p8pVPrWLUm29xzdRVUCnCmcym46rRn+V84vR9ICfGBJPA4xhyGQE4+UTXf3UEHyTrVfATIrg1ZS9W6C1pB2U/jNiSn/KhozwInPZu

Source: chromecache_69.2.dr	String found in binary or memory: http://www.linotype.com0
Source: chromecache_88.2.dr	String found in binary or memory: https://agitationfourthplug.com/api/users?token=L2lqNnNrN3MxP2tleT01NWYxN2E5ZmVlNjhlYTFiNmY0Y2NmYTJk
Source: chromecache_91.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/materialicons/v142/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic-CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic0CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic1CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic2CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic3CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic5CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxEIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxFIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxGIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxHIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxIIzI.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxLIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxMIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xFIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xGIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xLIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xMIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfABc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfCBc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfCRc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfChc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_89.2.dr, chromecache_78.2.dr, chromecache_92.2.dr, chromecache_72.2.dr, chromecache_99.2.dr	String found in binary or memory: https://lcolmuacvi.ezutubek.info/call/jxhohdpaqd
Source: chromecache_78.2.dr, chromecache_92.2.dr, chromecache_72.2.dr, chromecache_99.2.dr	String found in binary or memory: https://www.google.com/url?rct=j
Source: chromecache_72.2.dr	String found in binary or memory: https://www.google.com/url?rct=j&sa=t&url=https://lcolmuacvi.ezutubek.info/call/jxhohdpaqd&ct=ga&cd=
Source: chromecache_88.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-GDL0TGR9BE

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49766 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@17/63@16/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=1956,i,9439631370590086316,199388582780943592,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=1956,i,9439631370590086316,199388582780943592,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://links.us1.defend.egress.com/_framework/blazor.server.js	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=toTYSEG6AL9X-EIBOcZkbA&_=1720461060204	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=OcP1CEtffnutIfw-9yozUw&_=1720461137221	0%	Avira URL Cloud	safe
https://lcolmuacvi.ezutubek.info/call/jxhohdpaqd	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/fonts/AvenirLTStd-Book_0.otf	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor/negotiate?negotiateVersion=1	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=nMeXvhnhZYlyrair5GEe-g&_=1720461090883	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor/disconnect	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_framework/blazor.polyfill.min.js	0%	Avira URL Cloud	safe
https://agitationfourthplug.com/favicon.ico	100%	Avira URL Cloud	malware
https://links.us1.defend.egress.com/_blazor?id=EkSnBsfn9XZA3r7CM66AYQ	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=N_tCeQTw6VgXxhBa3E5K7Q&_=1720461106607	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=AiobawV_otbCYUjRpvyRKw&_=1720461115534	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/js/JsInteropFuncions.js?v=8ZRc1sGeVrPBx4lD717BgRaQekyh78QKV9SKsdt638U	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=o6uEjSPvXVFoeNaVmLBIBg&_=1720461144448	0%	Avira URL Cloud	safe
http://www.linotype.com0	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=lHorztA_KwiYbv5A0V3PqQ&_=1720461067250	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/images/egress-logo-dark.svg	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=AiobawV_otbCYUjRpvyRKw	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=7gtLAi8y986CJC3xmPDq3g&_=1720461126884	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=OcP1CEtffnutIfw-9yozUw&_=1720461137857	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=lHorztA_KwiYbv5A0V3PqQ	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=SnDaSj9SZJ__4Sz4AMWIBQ&_=1720461168348	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=dxR48vWYOtDYHWVfc7Z-Lw	0%	Avira URL Cloud	safe
https://www.google.com/url?rct=j&sa=t&url=https://lcolmuacvi.ezutubek.info/call/jxhohdpaqd&ct=ga&cd=CAEYAioSOTI5Nzk0MjU4Mjc2NjI4MjA5Mho3NGYzZGRlMTU1YWQ5ZTMzOmNvbTplbjpVUw&usg=AOvVaw01A1xlICSsI0pQcUvHHTI0	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=sbi0_wXs4K4_52g4xYJqgg	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=7gtLAi8y986CJC3xmPDq3g	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=toTYSEG6AL9X-EIBOcZkbA	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=7gtLAi8y986CJC3xmPDq3g&_=1720461128097	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor/initializers	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=OcP1CEtffnutIfw-9yozUw&_=1720461136625	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=7gtLAi8y986CJC3xmPDq3g&_=1720461128732	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/images/egress-icon.png	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=OcP1CEtffnutIfw-9yozUw&_=1720461138452	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=N_tCeQTw6VgXxhBa3E5K7Q&_=1720461107191	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=eMoP-fvLJ0Pl8L9tCc8YUQ	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=toTYSEG6AL9X-EIBOcZkbA&_=1720461060799	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=o6uEjSPvXVFoeNaVmLBIBg	0%	Avira URL Cloud	safe
https://www.google.com/url?rct=j&sa=t&url=https://lcolmuacvi.ezutubek.info/call/jxhohdpaqd&ct=ga&cd=	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=lHorztA_KwiYbv5A0V3PqQ&_=1720461066330	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/css/site.css?v=3_7xBUVF7AMmqCChOMZj_vfG2g8ZfedUIPQTnu-5_qA	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=N_tCeQTw6VgXxhBa3E5K7Q&_=1720461107916	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=OcP1CEtffnutIfw-9yozUw	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=7gtLAi8y986CJC3xmPDq3g&_=1720461127473	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=uArg-MmOm4ZwnvcgElHDUg	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=yOMQDwoxSRYqvZckdxxm_w	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=H8K-La5bOR1bnTz6eLg9wg	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=nMeXvhnhZYlyrair5GEe-g&_=1720461090277	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=dFo2J0KjmrPisx6XctqXxA	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=nMeXvhnhZYlyrair5GEe-g	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=toTYSEG6AL9X-EIBOcZkbA&_=1720461059604	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=G_ySy0QGe5x9HCxKZDoNhg	0%	Avira URL Cloud	safe
https://www.google.com/url?rct=j	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=N_tCeQTw6VgXxhBa3E5K7Q	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=AiobawV_otbCYUjRpvyRKw&_=1720461116161	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=o6uEjSPvXVFoeNaVmLBIBg&_=1720461143841	0%	Avira URL Cloud	safe
https://links.us1.defend.egress.com/_blazor?id=N_tCeQTw6VgXxhBa3E5K7Q&_=1720461109544	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
agitationfourthplug.com	192.243.59.12	true	false	unknown
s4.histats.com	54.39.128.117	true	false	unknown
www.google.com	142.250.186.164	true	false	unknown
lcolmuacvi.ezutubek.info	104.21.93.18	true	false	unknown
links.us1.defend.egress.com	99.83.228.139	true	false	unknown
s10.histats.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://lcolmuacvi.ezutubek.info/call/jxhohdpaqd	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=nMeXvhnhZYlyrair5GEe-g&_=1720461090883	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_framework/blazor.server.js	false	Avira URL Cloud: safe	unknown
https://agitationfourthplug.com/favicon.ico	false	Avira URL Cloud: malware	unknown
https://links.us1.defend.egress.com/_blazor/negotiate?negotiateVersion=1	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_framework/blazor.polyfill.min.js	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/fonts/AvenirLTStd-Book_0.otf	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=OcP1CEtffnutIfw-9yozUw&_=1720461137221	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=toTYSEG6AL9X-EIBOcZkbA&_=1720461060204	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor/disconnect	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=EkSnBsfn9XZA3r7CM66AYQ	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=N_tCeQTw6VgXxhBa3E5K7Q&_=1720461106607	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=o6uEjSPvXVFoeNaVmLBIBg&_=1720461144448	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/js/JsInteropFuncions.js?v=8ZRc1sGeVrPBx4lD717BgRaQekyh78QKV9SKsdt638U	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=7gtLAi8y986CJC3xmPDq3g&_=1720461126884	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=lHorztA_KwiYbv5A0V3PqQ&_=1720461067250	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=AiobawV_otbCYUjRpvyRKw&_=1720461115534	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/images/egress-logo-dark.svg	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=AiobawV_otbCYUjRpvyRKw	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=OcP1CEtffnutIfw-9yozUw&_=1720461137857	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=SnDaSj9SZJ__4Sz4AMWIBQ&_=1720461168348	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=lHorztA_KwiYbv5A0V3PqQ	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=sbi0_wXs4K4_52g4xYJqgg	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=dxR48vWYOtDYHWVfc7Z-Lw	false	Avira URL Cloud: safe	unknown
https://www.google.com/url?rct=j&sa=t&url=https://lcolmuacvi.ezutubek.info/call/jxhohdpaqd&ct=ga&cd=CAEYAioSOTI5Nzk0MjU4Mjc2NjI4MjA5Mho3NGYzZGRlMTU1YWQ5ZTMzOmNvbTplbjpVUw&usg=AOvVaw01A1xlICSsI0pQcUvHHTI0	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=7gtLAi8y986CJC3xmPDq3g	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=7gtLAi8y986CJC3xmPDq3g&_=1720461128097	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor/initializers	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=toTYSEG6AL9X-EIBOcZkbA	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=OcP1CEtffnutIfw-9yozUw&_=1720461136625	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=7gtLAi8y986CJC3xmPDq3g&_=1720461128732	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/images/egress-icon.png	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=N_tCeQTw6VgXxhBa3E5K7Q&_=1720461107191	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=OcP1CEtffnutIfw-9yozUw&_=1720461138452	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=eMoP-fvLJ0Pl8L9tCc8YUQ	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=toTYSEG6AL9X-EIBOcZkbA&_=1720461060799	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/css/site.css?v=3_7xBUVF7AMmqCChOMZj_vfG2g8ZfedUIPQTnu-5_qA	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=lHorztA_KwiYbv5A0V3PqQ&_=1720461066330	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=o6uEjSPvXVFoeNaVmLBIBg	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=N_tCeQTw6VgXxhBa3E5K7Q&_=1720461107916	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=OcP1CEtffnutIfw-9yozUw	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=nMeXvhnhZYlyrair5GEe-g&_=1720461090277	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=yOMQDwoxSRYqvZckdxxm_w	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=H8K-La5bOR1bnTz6eLg9wg	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=nMeXvhnhZYlyrair5GEe-g	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=7gtLAi8y986CJC3xmPDq3g&_=1720461127473	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=toTYSEG6AL9X-EIBOcZkbA&_=1720461059604	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=dFo2J0KjmrPisx6XctqXxA	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=G_ySy0QGe5x9HCxKZDoNhg	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=uArg-MmOm4ZwnvcgElHDUg	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=N_tCeQTw6VgXxhBa3E5K7Q	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=o6uEjSPvXVFoeNaVmLBIBg&_=1720461143841	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=AiobawV_otbCYUjRpvyRKw&_=1720461116161	false	Avira URL Cloud: safe	unknown
https://links.us1.defend.egress.com/_blazor?id=N_tCeQTw6VgXxhBa3E5K7Q&_=1720461109544	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.linotype.com0	chromecache_69.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/url?rct=j&sa=t&url=https://lcolmuacvi.ezutubek.info/call/jxhohdpaqd&ct=ga&cd=	chromecache_72.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/url?rct=j	chromecache_78.2.dr, chromecache_92.2.dr, chromecache_72.2.dr, chromecache_99.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
75.2.120.244	unknown	United States	16509	AMAZON-02US	false
99.83.228.139	links.us1.defend.egress.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.243.59.12	agitationfourthplug.com	Dominica	39572	ADVANCEDHOSTERS-ASNL	false
54.39.128.117	s4.histats.com	Canada	16276	OVHFR	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
104.21.93.18	lcolmuacvi.ezutubek.info	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1469349
Start date and time:	2024-07-08 19:50:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@17/63@16/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.227, 66.102.1.84, 142.250.186.174, 142.250.185.202, 34.104.35.123, 172.217.18.3, 216.58.206.67, 142.250.186.170, 216.58.206.46, 142.250.184.200, 104.20.19.71, 104.20.18.71
Excluded domains from analysis (whitelisted): clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, www.googletagmanager.com, update.googleapis.com, clients.l.google.com, s10.histats.com.cdn.cloudflare.net
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com

Input	Output
URL: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSL Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage title 'Egress Defend Url Scanner' does not contain any elements indicating a login form.","The text 'Attempting to reconnect to the server: 1 of 8' does not create a sense of urgency or interest.","There is no evidence of a CAPTCHA or anti-robot detection mechanism in the provided webpage content."]}
Title: Egress Defend Url Scanner OCR: Attempting to reconnect to the server: 1 of 8
URL: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSL Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form as there is no explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers (CVV).","The text does not create a sense of urgency or interest as it is a technical message about reconnecting to a server and does not contain any calls to action such as 'Click here to view document' or 'To view secured document click here'.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism as there are no challenges or tests presented to the user."]}
Title: Egress Defend Url Scanner OCR: Attempting to reconnect to the server: 2 of 8
URL: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSL Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form as there is no explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers (CVV).","The text 'Attempting to reconnect to the server: 3 of 8' does not create a sense of urgency or interest as it is a technical message indicating a connection status.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
Title: Egress Defend Url Scanner OCR: Attempting to reconnect to the server: 3 of 8
URL: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSL Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form requesting sensitive information.","The text does not create a sense of urgency or interest.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
Title: Egress Defend Url Scanner OCR: Attempting to reconnect to the server: 1 of 8 egress Egress Defend Link Scanner

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 8 16:50:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9833460529576987
Encrypted:	false
SSDEEP:	48:81d5Th1foHuidAKZdA1FehwiZUklqehLy+3:8RLfxky
MD5:	B53BB7BB6EF8324119463365E961F685
SHA1:	C1C18315DE571B6D3CBDDB0FBFB7C787538D4CCB
SHA-256:	A52C761992E299E10EDE1E629597F3F8C54537E71055B03D8F47B413ACE3D22A
SHA-512:	90306A54CD1A3CFB9CD4FC681AB054505367C4C26B1475A15023523132A3D4FE4919ED047560CFB6A56384DED2CB68E9B36CBF093A6B545A3035C7FB463D5765
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....s.:c_...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XT.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X]............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............P].....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: links.us1.defend.egress.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lcolmuacvi.ezutubek.info
Source: global traffic	DNS traffic detected: DNS query: s10.histats.com
Source: global traffic	DNS traffic detected: DNS query: agitationfourthplug.com
Source: global traffic	DNS traffic detected: DNS query: s4.histats.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 8, 2024 19:50:56.562752962 CEST	53	59261	1.1.1.1	192.168.2.16
Jul 8, 2024 19:50:56.596400023 CEST	63662	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:50:56.596632004 CEST	53665	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:50:56.618601084 CEST	53	63662	1.1.1.1	192.168.2.16
Jul 8, 2024 19:50:56.626343012 CEST	53	53665	1.1.1.1	192.168.2.16
Jul 8, 2024 19:50:56.631275892 CEST	53	59745	1.1.1.1	192.168.2.16
Jul 8, 2024 19:50:57.324353933 CEST	53	56288	1.1.1.1	192.168.2.16
Jul 8, 2024 19:50:57.686587095 CEST	53	57258	1.1.1.1	192.168.2.16
Jul 8, 2024 19:50:58.261231899 CEST	53	58626	1.1.1.1	192.168.2.16
Jul 8, 2024 19:50:58.970144987 CEST	58845	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:50:58.970279932 CEST	62426	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:50:59.000145912 CEST	53	62426	1.1.1.1	192.168.2.16
Jul 8, 2024 19:50:59.182028055 CEST	53	58845	1.1.1.1	192.168.2.16
Jul 8, 2024 19:51:01.394421101 CEST	63505	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:51:01.394582033 CEST	50676	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:51:01.402277946 CEST	53	50676	1.1.1.1	192.168.2.16
Jul 8, 2024 19:51:01.404023886 CEST	53	63505	1.1.1.1	192.168.2.16
Jul 8, 2024 19:51:14.757848024 CEST	53	55389	1.1.1.1	192.168.2.16
Jul 8, 2024 19:51:33.702347994 CEST	53	64769	1.1.1.1	192.168.2.16
Jul 8, 2024 19:51:56.556754112 CEST	53	54830	1.1.1.1	192.168.2.16
Jul 8, 2024 19:51:56.692238092 CEST	53	50503	1.1.1.1	192.168.2.16
Jul 8, 2024 19:51:58.255959988 CEST	138	138	192.168.2.16	192.168.2.255
Jul 8, 2024 19:52:03.936594009 CEST	53	49397	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:04.782116890 CEST	53	59888	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:25.083499908 CEST	53	60269	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:50.837538004 CEST	56923	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:52:50.837683916 CEST	54697	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:52:50.867028952 CEST	53	56923	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:50.867477894 CEST	53	54697	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:51.895309925 CEST	64310	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:52:51.895474911 CEST	59976	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:52:51.901938915 CEST	53	52092	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:52.000715971 CEST	50115	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:52:52.000821114 CEST	53982	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:52:52.164907932 CEST	53	50115	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:52.181134939 CEST	53	53982	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:52.788499117 CEST	49693	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:52:52.788633108 CEST	60037	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:52:52.795850039 CEST	53	49693	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:52.796365023 CEST	53	60037	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:53.098247051 CEST	63200	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:52:53.098402977 CEST	52009	53	192.168.2.16	1.1.1.1
Jul 8, 2024 19:52:53.106286049 CEST	53	63200	1.1.1.1	192.168.2.16
Jul 8, 2024 19:52:53.428553104 CEST	53	52009	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 8, 2024 19:50:56.626406908 CEST	192.168.2.16	1.1.1.1	c24f	(Port unreachable)	Destination Unreachable
Jul 8, 2024 19:52:53.428654909 CEST	192.168.2.16	1.1.1.1	c23d	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:50:57 UTC	1027	OUT	GET /Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-08 17:50:57 UTC	1039	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:50:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: AWSALB=zKqRAdbgH6e4MYI8HLDCv5RVgAjcqAoNZ7FBAWkE/4LNG1p+HAedVJIJ9U1BTITfLut1t2ZQXazt9UPrKII3qBjQbpnvwV3/QldThdFdjMsaNkgXyQqvrb4pySMV; Expires=Mon, 15 Jul 2024 17:50:57 GMT; Path=/ Set-Cookie: AWSALBCORS=zKqRAdbgH6e4MYI8HLDCv5RVgAjcqAoNZ7FBAWkE/4LNG1p+HAedVJIJ9U1BTITfLut1t2ZQXazt9UPrKII3qBjQbpnvwV3/QldThdFdjMsaNkgXyQqvrb4pySMV; Expires=Mon, 15 Jul 2024 17:50:57 GMT; Path=/; SameSite=None; Secure Cache-Control: no-cache, no-store, max-age=0 X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:50:57 UTC	1407	IN	Data Raw: 35 37 38 0d 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 67 72 65 73 73 20 44 65 66 65 6e 64 20 55 72 6c 20 53 63 61 6e 6e 65 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f Data Ascii: 578<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"/> <meta name="viewport" content="width=device-width, initial-scale=1.0"/> <meta name="robots" content="noindex"> <title>Egress Defend Url Scanner</title> <base href="/
2024-07-08 17:50:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:50:57 UTC	1246	OUT	GET /css/site.css?v=3_7xBUVF7AMmqCChOMZj_vfG2g8ZfedUIPQTnu-5_qA HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=zKqRAdbgH6e4MYI8HLDCv5RVgAjcqAoNZ7FBAWkE/4LNG1p+HAedVJIJ9U1BTITfLut1t2ZQXazt9UPrKII3qBjQbpnvwV3/QldThdFdjMsaNkgXyQqvrb4pySMV; AWSALBCORS=zKqRAdbgH6e4MYI8HLDCv5RVgAjcqAoNZ7FBAWkE/4LNG1p+HAedVJIJ9U1BTITfLut1t2ZQXazt9UPrKII3qBjQbpnvwV3/QldThdFdjMsaNkgXyQqvrb4pySMV
2024-07-08 17:50:57 UTC	1089	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:50:57 GMT Content-Type: text/css Content-Length: 3478 Connection: close Set-Cookie: AWSALB=G12PWljco8Ad5vNhBKsYOKp8T2DXTvETN+eFcQMkLAJ6KQsEhw8pc6HY7lQg9djATdP4s54s0sJSIlHZwZFrMi9Awi6mduPwnyTH9f3cU+VfJcUhjYt7Y8FFRA9C; Expires=Mon, 15 Jul 2024 17:50:57 GMT; Path=/ Set-Cookie: AWSALBCORS=G12PWljco8Ad5vNhBKsYOKp8T2DXTvETN+eFcQMkLAJ6KQsEhw8pc6HY7lQg9djATdP4s54s0sJSIlHZwZFrMi9Awi6mduPwnyTH9f3cU+VfJcUhjYt7Y8FFRA9C; Expires=Mon, 15 Jul 2024 17:50:57 GMT; Path=/; SameSite=None; Secure Accept-Ranges: bytes Cache-Control: no-cache ETag: "1dacded42a67a16" Last-Modified: Thu, 04 Jul 2024 08:36:27 GMT X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:50:57 UTC	3478	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 41 76 65 6e 69 72 27 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 2f 66 6f 6e 74 73 2f 41 76 65 6e 69 72 4c 54 53 74 64 2d 42 6f 6f 6b 5f 30 2e 6f 74 66 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 3b 0a 7d 0a 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 41 76 65 6e 69 72 27 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6c 69 67 68 74 3b 0a 20 20 20 20 73 72 63 3a 20 75 72 Data Ascii: @font-face { font-family: 'Avenir'; font-style: normal; font-weight: bold; src: url('/fonts/AvenirLTStd-Book_0.otf') format('truetype');}@font-face { font-family: 'Avenir'; font-style: normal; font-weight: light; src: ur

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:50:57 UTC	1243	OUT	GET /js/JsInteropFuncions.js?v=8ZRc1sGeVrPBx4lD717BgRaQekyh78QKV9SKsdt638U HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=zKqRAdbgH6e4MYI8HLDCv5RVgAjcqAoNZ7FBAWkE/4LNG1p+HAedVJIJ9U1BTITfLut1t2ZQXazt9UPrKII3qBjQbpnvwV3/QldThdFdjMsaNkgXyQqvrb4pySMV; AWSALBCORS=zKqRAdbgH6e4MYI8HLDCv5RVgAjcqAoNZ7FBAWkE/4LNG1p+HAedVJIJ9U1BTITfLut1t2ZQXazt9UPrKII3qBjQbpnvwV3/QldThdFdjMsaNkgXyQqvrb4pySMV
2024-07-08 17:50:57 UTC	1100	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:50:57 GMT Content-Type: application/javascript Content-Length: 3 Connection: close Set-Cookie: AWSALB=cyigbB2OYXVFPbTPSliz6dUWLXOJj9zlb1vY7qdh82LVpM4fkT9zOeEqGKDfOjLfTRF/AnBzToFfWTicpbsqJOyxKMcDMDn230vQXMdZOYiG3vNhie0rnYd0Qgu0; Expires=Mon, 15 Jul 2024 17:50:57 GMT; Path=/ Set-Cookie: AWSALBCORS=cyigbB2OYXVFPbTPSliz6dUWLXOJj9zlb1vY7qdh82LVpM4fkT9zOeEqGKDfOjLfTRF/AnBzToFfWTicpbsqJOyxKMcDMDn230vQXMdZOYiG3vNhie0rnYd0Qgu0; Expires=Mon, 15 Jul 2024 17:50:57 GMT; Path=/; SameSite=None; Secure Accept-Ranges: bytes Cache-Control: no-cache ETag: "1dacded42a67783" Last-Modified: Thu, 04 Jul 2024 08:36:27 GMT X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:50:57 UTC	3	IN	Data Raw: ef bb bf Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:50:57 UTC	1207	OUT	GET /_framework/blazor.polyfill.min.js HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=zKqRAdbgH6e4MYI8HLDCv5RVgAjcqAoNZ7FBAWkE/4LNG1p+HAedVJIJ9U1BTITfLut1t2ZQXazt9UPrKII3qBjQbpnvwV3/QldThdFdjMsaNkgXyQqvrb4pySMV; AWSALBCORS=zKqRAdbgH6e4MYI8HLDCv5RVgAjcqAoNZ7FBAWkE/4LNG1p+HAedVJIJ9U1BTITfLut1t2ZQXazt9UPrKII3qBjQbpnvwV3/QldThdFdjMsaNkgXyQqvrb4pySMV
2024-07-08 17:50:57 UTC	1082	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:50:57 GMT Content-Type: application/javascript Content-Length: 2397 Connection: close Set-Cookie: AWSALB=BhQxIugc6nnF/siGG9MX9fiJoZcFYYEG4RJlHe8iKnE4PbRMSUDOrZYZoklvaiaLseDjUOaianv+hgRr/MNuVvSGZE7QjwdsSxNcPkTV21T5jYhEkd4cwdpZS0DI; Expires=Mon, 15 Jul 2024 17:50:57 GMT; Path=/ Set-Cookie: AWSALBCORS=BhQxIugc6nnF/siGG9MX9fiJoZcFYYEG4RJlHe8iKnE4PbRMSUDOrZYZoklvaiaLseDjUOaianv+hgRr/MNuVvSGZE7QjwdsSxNcPkTV21T5jYhEkd4cwdpZS0DI; Expires=Mon, 15 Jul 2024 17:50:57 GMT; Path=/; SameSite=None; Secure Cache-Control: no-cache ETag: 8b41f523cc9870bf36be7927991b7a2694e4c9f24414a16f1aa27f6a8ce1fc35 X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:50:57 UTC	2397	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 69 6d 70 6f 72 74 5f 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 66 69 6c 65 4e 61 6d 65 2c 20 77 65 62 52 6f 6f 74 50 61 74 68 29 20 7b 0d 0a 0d 0a 20 20 20 20 69 66 20 28 77 65 62 52 6f 6f 74 50 61 74 68 20 3d 3d 3d 20 75 6e 64 65 66 69 6e 65 64 20 7c 7c 20 77 65 62 52 6f 6f 74 50 61 74 68 20 3d 3d 3d 20 6e 75 6c 6c 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 77 65 62 52 6f 6f 74 50 61 74 68 20 3d 20 22 22 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 70 61 74 68 4a 6f 69 6e 28 70 61 74 68 31 2c 20 70 61 74 68 32 29 20 7b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 70 61 74 68 31 20 3d 3d 3d 20 6e 75 6c 6c 20 7c 7c 20 70 61 74 68 31 20 3d 3d 3d 20 75 6e 64 65 66 69 6e 65 64 29 20 7b 0d 0a 20 20 20 20 20 20 Data Ascii: window._import_ = function (fileName, webRootPath) { if (webRootPath === undefined \|\| webRootPath === null) { webRootPath = ""; } function pathJoin(path1, path2) { if (path1 === null \|\| path1 === undefined) {

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:50:57 UTC	1201	OUT	GET /_framework/blazor.server.js HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=zKqRAdbgH6e4MYI8HLDCv5RVgAjcqAoNZ7FBAWkE/4LNG1p+HAedVJIJ9U1BTITfLut1t2ZQXazt9UPrKII3qBjQbpnvwV3/QldThdFdjMsaNkgXyQqvrb4pySMV; AWSALBCORS=zKqRAdbgH6e4MYI8HLDCv5RVgAjcqAoNZ7FBAWkE/4LNG1p+HAedVJIJ9U1BTITfLut1t2ZQXazt9UPrKII3qBjQbpnvwV3/QldThdFdjMsaNkgXyQqvrb4pySMV
2024-07-08 17:50:57 UTC	1105	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:50:57 GMT Content-Type: application/javascript Content-Length: 132185 Connection: close Set-Cookie: AWSALB=TiedITX3S9kycXP2PdfAnzEAG1b2XM2KmjDKfJn5Z3ONzgf58QAcy8otZDHNSmSf+DG1tcDx2S3++IQFCJyant5W+joWl4dOHuVP3rIrDUyfBMmtlDuWiqVq2Eo7; Expires=Mon, 15 Jul 2024 17:50:57 GMT; Path=/ Set-Cookie: AWSALBCORS=TiedITX3S9kycXP2PdfAnzEAG1b2XM2KmjDKfJn5Z3ONzgf58QAcy8otZDHNSmSf+DG1tcDx2S3++IQFCJyant5W+joWl4dOHuVP3rIrDUyfBMmtlDuWiqVq2Eo7; Expires=Mon, 15 Jul 2024 17:50:57 GMT; Path=/; SameSite=None; Secure Accept-Ranges: bytes Cache-Control: no-cache ETag: "1daaa6a01891fd9" Last-Modified: Mon, 20 May 2024 03:58:43 GMT X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:50:57 UTC	13805	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 74 2c 6e 2c 72 3d 7b 7d 3b 72 2e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 29 72 65 74 75 72 6e 20 67 6c 6f 62 61 6c 54 68 69 73 3b 74 72 79 7b 72 65 74 75 72 6e 20 74 68 69 73 7c 7c 6e 65 77 20 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 63 61 74 63 68 28 65 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 29 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 7d 7d 28 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2e 44 6f 74 4e 65 74 3d 65 3b 63 6f 6e 73 74 20 74 3d 5b 5d 2c 6e 3d 6e 65 77 20 4d 61 70 2c 72 3d 6e 65 77 20 4d Data Ascii: (()=>{"use strict";var e,t,n,r={};r.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),function(e){window.DotNet=e;const t=[],n=new Map,r=new M
2024-07-08 17:50:58 UTC	8688	IN	Data Raw: 53 65 6c 65 63 74 45 6c 65 6d 65 6e 74 29 26 26 52 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 75 29 26 26 68 2e 64 69 73 61 62 6c 65 64 29 29 29 7b 69 66 28 21 69 29 7b 63 6f 6e 73 74 20 6e 3d 63 28 65 29 3b 73 3d 28 6e 75 6c 6c 3d 3d 6e 3f 76 6f 69 64 20 30 3a 6e 2e 63 72 65 61 74 65 45 76 65 6e 74 41 72 67 73 29 3f 6e 2e 63 72 65 61 74 65 45 76 65 6e 74 41 72 67 73 28 74 29 3a 7b 7d 2c 69 3d 21 30 7d 44 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 74 2e 74 79 70 65 29 26 26 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 49 28 74 68 69 73 2e 62 72 6f 77 73 65 72 52 65 6e 64 65 72 65 72 49 64 2c 7b 65 76 65 6e 74 48 61 6e 64 6c 65 72 49 64 3a 6e 2e 65 76 65 6e 74 48 61 6e 64 6c 65 72 49 64 2c 65 76 65 6e 74 4e 61 6d 65 3a 65 2c 65 76 65 Data Ascii: SelectElement)&&R.hasOwnProperty(u)&&h.disabled))){if(!i){const n=c(e);s=(null==n?void 0:n.createEventArgs)?n.createEventArgs(t):{},i=!0}D.hasOwnProperty(t.type)&&t.preventDefault(),I(this.browserRendererId,{eventHandlerId:n.eventHandlerId,eventName:e,eve
2024-07-08 17:50:58 UTC	16384	IN	Data Raw: 49 6e 64 65 78 28 68 29 7d 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 74 2e 70 65 72 6d 75 74 61 74 69 6f 6e 4c 69 73 74 45 6e 64 3a 71 28 72 2c 61 29 2c 61 3d 76 6f 69 64 20 30 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 60 55 6e 6b 6e 6f 77 6e 20 65 64 69 74 20 74 79 70 65 3a 20 24 7b 66 7d 60 29 7d 7d 7d 69 6e 73 65 72 74 46 72 61 6d 65 28 65 2c 74 2c 72 2c 6f 2c 73 2c 69 2c 61 29 7b 63 6f 6e 73 74 20 63 3d 65 2e 66 72 61 6d 65 52 65 61 64 65 72 2c 6c 3d 63 2e 66 72 61 6d 65 54 79 70 65 28 69 29 3b 73 77 69 74 63 68 28 6c 29 7b 63 61 73 65 20 6e 2e 65 6c 65 6d 65 6e 74 3a 72 65 74 75 72 6e 20 74 68 69 73 2e 69 6e 73 65 72 74 45 6c 65 6d 65 6e 74 28 65 2c 74 2c 72 2c 6f 2c 73 2c 69 2c 61 29 2c 31 3b 63 61 73 Data Ascii: Index(h)});break;case t.permutationListEnd:q(r,a),a=void 0;break;default:throw new Error(`Unknown edit type: ${f}`)}}}insertFrame(e,t,r,o,s,i,a){const c=e.frameReader,l=c.frameType(i);switch(l){case n.element:return this.insertElement(e,t,r,o,s,i,a),1;cas
2024-07-08 17:50:58 UTC	16384	IN	Data Raw: 2e 5f 6c 6f 67 67 65 72 2e 6c 6f 67 28 56 65 2e 57 61 72 6e 69 6e 67 2c 22 54 69 6d 65 6f 75 74 20 66 72 6f 6d 20 48 54 54 50 20 72 65 71 75 65 73 74 2e 22 29 2c 6e 3d 6e 65 77 20 4d 65 7d 29 2c 72 29 7d 74 72 79 7b 72 3d 61 77 61 69 74 20 74 68 69 73 2e 5f 66 65 74 63 68 54 79 70 65 28 65 2e 75 72 6c 2c 7b 62 6f 64 79 3a 65 2e 63 6f 6e 74 65 6e 74 2c 63 61 63 68 65 3a 22 6e 6f 2d 63 61 63 68 65 22 2c 63 72 65 64 65 6e 74 69 61 6c 73 3a 21 30 3d 3d 3d 65 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3f 22 69 6e 63 6c 75 64 65 22 3a 22 73 61 6d 65 2d 6f 72 69 67 69 6e 22 2c 68 65 61 64 65 72 73 3a 7b 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2c 22 58 2d 52 65 71 75 65 73 74 Data Ascii: ._logger.log(Ve.Warning,"Timeout from HTTP request."),n=new Me}),r)}try{r=await this._fetchType(e.url,{body:e.content,cache:"no-cache",credentials:!0===e.withCredentials?"include":"same-origin",headers:{"Content-Type":"text/plain;charset=UTF-8","X-Request
2024-07-08 17:50:58 UTC	10672	IN	Data Raw: 61 74 75 73 43 6f 64 65 7d 27 60 29 29 3b 63 6f 6e 73 74 20 6e 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 65 2e 63 6f 6e 74 65 6e 74 29 3b 72 65 74 75 72 6e 28 21 6e 2e 6e 65 67 6f 74 69 61 74 65 56 65 72 73 69 6f 6e 7c 7c 6e 2e 6e 65 67 6f 74 69 61 74 65 56 65 72 73 69 6f 6e 3c 31 29 26 26 28 6e 2e 63 6f 6e 6e 65 63 74 69 6f 6e 54 6f 6b 65 6e 3d 6e 2e 63 6f 6e 6e 65 63 74 69 6f 6e 49 64 29 2c 6e 7d 63 61 74 63 68 28 65 29 7b 6c 65 74 20 74 3d 22 46 61 69 6c 65 64 20 74 6f 20 63 6f 6d 70 6c 65 74 65 20 6e 65 67 6f 74 69 61 74 69 6f 6e 20 77 69 74 68 20 74 68 65 20 73 65 72 76 65 72 3a 20 22 2b 65 3b 72 65 74 75 72 6e 20 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 4c 65 26 26 34 30 34 3d 3d 3d 65 2e 73 74 61 74 75 73 43 6f 64 65 26 26 28 74 2b 3d 22 20 45 69 74 68 65 Data Ascii: atusCode}'`));const n=JSON.parse(e.content);return(!n.negotiateVersion\|\|n.negotiateVersion<1)&&(n.connectionToken=n.connectionId),n}catch(e){let t="Failed to complete negotiation with the server: "+e;return e instanceof Le&&404===e.statusCode&&(t+=" Eithe
2024-07-08 17:50:58 UTC	16384	IN	Data Raw: 63 6f 6e 6e 65 63 74 69 6f 6e 53 74 61 72 74 65 64 3d 21 30 2c 74 68 69 73 2e 5f 6c 6f 67 67 65 72 2e 6c 6f 67 28 56 65 2e 44 65 62 75 67 2c 22 48 75 62 43 6f 6e 6e 65 63 74 69 6f 6e 20 63 6f 6e 6e 65 63 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 63 6f 6e 6e 65 63 74 69 6f 6e 53 74 61 74 65 3d 47 65 2e 44 69 73 63 6f 6e 6e 65 63 74 65 64 2c 74 68 69 73 2e 5f 6c 6f 67 67 65 72 2e 6c 6f 67 28 56 65 2e 44 65 62 75 67 2c 60 48 75 62 43 6f 6e 6e 65 63 74 69 6f 6e 20 66 61 69 6c 65 64 20 74 6f 20 73 74 61 72 74 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 62 65 63 61 75 73 65 20 6f 66 20 65 72 72 6f 72 20 27 24 7b 65 7d 27 2e 60 29 2c 50 72 6f 6d 69 73 65 2e 72 65 6a 65 63 74 28 65 Data Ascii: connectionStarted=!0,this._logger.log(Ve.Debug,"HubConnection connected successfully.")}catch(e){return this._connectionState=Ge.Disconnected,this._logger.log(Ve.Debug,`HubConnection failed to start successfully because of error '${e}'.`),Promise.reject(e
2024-07-08 17:50:58 UTC	16384	IN	Data Raw: 28 68 2d 3d 36 35 35 33 36 2c 73 2e 70 75 73 68 28 68 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 68 3d 35 36 33 32 30 7c 31 30 32 33 26 68 29 2c 73 2e 70 75 73 68 28 68 29 7d 65 6c 73 65 20 73 2e 70 75 73 68 28 61 29 3b 73 2e 6c 65 6e 67 74 68 3e 3d 34 30 39 36 26 26 28 69 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 2e 61 70 70 6c 79 28 53 74 72 69 6e 67 2c 73 29 2c 73 2e 6c 65 6e 67 74 68 3d 30 29 7d 72 65 74 75 72 6e 20 73 2e 6c 65 6e 67 74 68 3e 30 26 26 28 69 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 2e 61 70 70 6c 79 28 53 74 72 69 6e 67 2c 73 29 29 2c 69 7d 76 61 72 20 6a 74 2c 57 74 3d 42 74 3f 6e 65 77 20 54 65 78 74 44 65 63 6f 64 65 72 3a 6e 75 6c 6c 2c 7a 74 3d 42 74 3f 22 75 6e 64 65 66 69 6e Data Ascii: (h-=65536,s.push(h>>>10&1023\|55296),h=56320\|1023&h),s.push(h)}else s.push(a);s.length>=4096&&(i+=String.fromCharCode.apply(String,s),s.length=0)}return s.length>0&&(i+=String.fromCharCode.apply(String,s)),i}var jt,Wt=Bt?new TextDecoder:null,zt=Bt?"undefin
2024-07-08 17:50:58 UTC	13568	IN	Data Raw: 61 3d 75 2e 73 65 6e 74 28 29 29 69 6e 73 74 61 6e 63 65 6f 66 20 61 6e 29 29 74 68 72 6f 77 20 61 3b 72 65 74 75 72 6e 5b 33 2c 31 30 5d 3b 63 61 73 65 20 31 30 3a 74 68 69 73 2e 74 6f 74 61 6c 50 6f 73 2b 3d 74 68 69 73 2e 70 6f 73 2c 75 2e 6c 61 62 65 6c 3d 31 31 3b 63 61 73 65 20 31 31 3a 72 65 74 75 72 6e 5b 33 2c 32 5d 3b 63 61 73 65 20 31 32 3a 72 65 74 75 72 6e 5b 33 2c 31 39 5d 3b 63 61 73 65 20 31 33 3a 72 65 74 75 72 6e 20 63 3d 75 2e 73 65 6e 74 28 29 2c 6c 3d 7b 65 72 72 6f 72 3a 63 7d 2c 5b 33 2c 31 39 5d 3b 63 61 73 65 20 31 34 3a 72 65 74 75 72 6e 20 75 2e 74 72 79 73 2e 70 75 73 68 28 5b 31 34 2c 2c 31 37 2c 31 38 5d 29 2c 73 26 26 21 73 2e 64 6f 6e 65 26 26 28 68 3d 6f 2e 72 65 74 75 72 6e 29 3f 5b 34 2c 6e 6e 28 68 2e 63 61 6c 6c 28 6f Data Ascii: a=u.sent())instanceof an))throw a;return[3,10];case 10:this.totalPos+=this.pos,u.label=11;case 11:return[3,2];case 12:return[3,19];case 13:return c=u.sent(),l={error:c},[3,19];case 14:return u.trys.push([14,,17,18]),s&&!s.done&&(h=o.return)?[4,nn(h.call(o
2024-07-08 17:50:58 UTC	16384	IN	Data Raw: 61 74 61 55 69 6e 74 38 2c 65 2b 38 29 7d 6d 6f 76 65 54 6f 53 69 62 6c 69 6e 67 49 6e 64 65 78 28 65 29 7b 72 65 74 75 72 6e 20 62 6e 28 74 68 69 73 2e 62 61 74 63 68 44 61 74 61 55 69 6e 74 38 2c 65 2b 38 29 7d 72 65 6d 6f 76 65 64 41 74 74 72 69 62 75 74 65 4e 61 6d 65 28 65 29 7b 63 6f 6e 73 74 20 74 3d 62 6e 28 74 68 69 73 2e 62 61 74 63 68 44 61 74 61 55 69 6e 74 38 2c 65 2b 31 32 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 74 72 69 6e 67 52 65 61 64 65 72 2e 72 65 61 64 53 74 72 69 6e 67 28 74 29 7d 7d 63 6c 61 73 73 20 6b 6e 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 29 7b 74 68 69 73 2e 62 61 74 63 68 44 61 74 61 55 69 6e 74 38 3d 65 2c 74 68 69 73 2e 73 74 72 69 6e 67 52 65 61 64 65 72 3d 74 7d 66 72 61 6d 65 54 79 70 65 28 65 29 7b 72 65 Data Ascii: ataUint8,e+8)}moveToSiblingIndex(e){return bn(this.batchDataUint8,e+8)}removedAttributeName(e){const t=bn(this.batchDataUint8,e+12);return this.stringReader.readString(t)}}class kn{constructor(e,t){this.batchDataUint8=e,this.stringReader=t}frameType(e){re
2024-07-08 17:50:58 UTC	3532	IN	Data Raw: 65 29 7d 7d 3b 4e 65 2e 64 69 73 63 6f 6e 6e 65 63 74 3d 6c 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 75 6e 6c 6f 61 64 22 2c 6c 2c 7b 63 61 70 74 75 72 65 3a 21 31 2c 6f 6e 63 65 3a 21 30 7d 29 2c 72 2e 6c 6f 67 28 52 6e 2e 49 6e 66 6f 72 6d 61 74 69 6f 6e 2c 22 42 6c 61 7a 6f 72 20 73 65 72 76 65 72 2d 73 69 64 65 20 61 70 70 6c 69 63 61 74 69 6f 6e 20 73 74 61 72 74 65 64 2e 22 29 2c 6e 2e 69 6e 76 6f 6b 65 41 66 74 65 72 53 74 61 72 74 65 64 43 61 6c 6c 62 61 63 6b 73 28 4e 65 29 7d 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 65 72 28 74 2c 6e 2c 72 29 7b 76 61 72 20 6f 2c 73 3b 63 6f 6e 73 74 20 69 3d 6e 65 77 20 70 6e 3b 69 2e 6e 61 6d 65 3d 22 62 6c 61 7a 6f 72 70 61 63 6b 22 3b 63 6f 6e 73 74 20 61 3d 28 6e 65 Data Ascii: e)}};Ne.disconnect=l,window.addEventListener("unload",l,{capture:!1,once:!0}),r.log(Rn.Information,"Blazor server-side application started."),n.invokeAfterStartedCallbacks(Ne)}async function er(t,n,r){var o,s;const i=new pn;i.name="blazorpack";const a=(ne

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:50:58 UTC	1216	OUT	GET /_blazor/initializers HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=cyigbB2OYXVFPbTPSliz6dUWLXOJj9zlb1vY7qdh82LVpM4fkT9zOeEqGKDfOjLfTRF/AnBzToFfWTicpbsqJOyxKMcDMDn230vQXMdZOYiG3vNhie0rnYd0Qgu0; AWSALBCORS=cyigbB2OYXVFPbTPSliz6dUWLXOJj9zlb1vY7qdh82LVpM4fkT9zOeEqGKDfOjLfTRF/AnBzToFfWTicpbsqJOyxKMcDMDn230vQXMdZOYiG3vNhie0rnYd0Qgu0
2024-07-08 17:50:58 UTC	1000	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:50:58 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: AWSALB=Y57lHVagrjCzjDR/+8U/oX1p8pVPrWLUm29xzdRVUCnCmcym46rRn+V84vR9ICfGBJPA4xhyGQE4+UTXf3UEHyTrVfATIrg1ZS9W6C1pB2U/jNiSn/KhozwInPZu; Expires=Mon, 15 Jul 2024 17:50:58 GMT; Path=/ Set-Cookie: AWSALBCORS=Y57lHVagrjCzjDR/+8U/oX1p8pVPrWLUm29xzdRVUCnCmcym46rRn+V84vR9ICfGBJPA4xhyGQE4+UTXf3UEHyTrVfATIrg1ZS9W6C1pB2U/jNiSn/KhozwInPZu; Expires=Mon, 15 Jul 2024 17:50:58 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:50:58 UTC	7	IN	Data Raw: 32 0d 0a 5b 5d 0d 0a Data Ascii: 2[]
2024-07-08 17:50:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:50:58 UTC	1256	OUT	GET /images/egress-icon.png HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=cyigbB2OYXVFPbTPSliz6dUWLXOJj9zlb1vY7qdh82LVpM4fkT9zOeEqGKDfOjLfTRF/AnBzToFfWTicpbsqJOyxKMcDMDn230vQXMdZOYiG3vNhie0rnYd0Qgu0; AWSALBCORS=cyigbB2OYXVFPbTPSliz6dUWLXOJj9zlb1vY7qdh82LVpM4fkT9zOeEqGKDfOjLfTRF/AnBzToFfWTicpbsqJOyxKMcDMDn230vQXMdZOYiG3vNhie0rnYd0Qgu0
2024-07-08 17:50:59 UTC	1090	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:50:59 GMT Content-Type: image/png Content-Length: 4436 Connection: close Set-Cookie: AWSALB=IQZJYQYkC+IkhrXl67/T9rLxhulZ2lq2SBO0yq4kX2bMk0yirksbdXq1Lg2fM5AKcS/sEzM65BiHJgfbbX0h6TInn1iLYVWKvVwdnJ5En1fOusZkGX5jmAIB2wQB; Expires=Mon, 15 Jul 2024 17:50:59 GMT; Path=/ Set-Cookie: AWSALBCORS=IQZJYQYkC+IkhrXl67/T9rLxhulZ2lq2SBO0yq4kX2bMk0yirksbdXq1Lg2fM5AKcS/sEzM65BiHJgfbbX0h6TInn1iLYVWKvVwdnJ5En1fOusZkGX5jmAIB2wQB; Expires=Mon, 15 Jul 2024 17:50:59 GMT; Path=/; SameSite=None; Secure Accept-Ranges: bytes Cache-Control: no-cache ETag: "1dacded42a666d4" Last-Modified: Thu, 04 Jul 2024 08:36:27 GMT X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:50:59 UTC	4436	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 74 00 00 00 74 08 06 00 00 00 54 9a 16 27 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 10 e9 49 44 41 54 78 5e ed 9d 0b 94 54 75 1d c7 7f ff 7b 67 57 70 85 d4 44 8c 79 2c a8 28 22 a0 e2 a3 44 3d 29 a6 9e 42 cd ac c0 e3 11 76 66 d1 88 d2 d4 3a 9a 95 16 be 32 3b 9e f2 11 15 0a 33 bb 20 a6 52 f9 44 2d cb 67 64 a4 59 e6 5b e4 b1 33 b3 2b 49 59 0a 8b fb 98 b9 ff be bf 7b ff 2b bb ec 6b 76 ee ff ce bd 33 ec 87 73 67 7e ff df 70 76 1e df fb 7f ff fe ff bf a0 4a 20 d9 1c 25 23 3f 81 a4 88 e0 1a 0b 4f 98 0c 39 96 24 ed e6 fc 07 aa 21 21 ab 89 44 1b 7c 1f 10 49 5c e2 7d f8 b6 90 34 d2 24 f2 1b 48 5a Data Ascii: PNGIHDRttT'sRGBgAMAapHYsodIDATx^Tu{gWpDy,("D=)Bvf:2;3 RD-gdY[3+IY{+kv3sg~pvJ %#?O9$!!D\|I\}4$HZ

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:50:59 UTC	1480	OUT	POST /_blazor/negotiate?negotiateVersion=1 HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive Content-Length: 0 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-SignalR-User-Agent: Microsoft SignalR/0.0 (0.0.0-DEV_BUILD; Unknown OS; Browser; Unknown Runtime Version) sec-ch-ua-platform: "Windows" Accept: / Origin: https://links.us1.defend.egress.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=Y57lHVagrjCzjDR/+8U/oX1p8pVPrWLUm29xzdRVUCnCmcym46rRn+V84vR9ICfGBJPA4xhyGQE4+UTXf3UEHyTrVfATIrg1ZS9W6C1pB2U/jNiSn/KhozwInPZu; AWSALBCORS=Y57lHVagrjCzjDR/+8U/oX1p8pVPrWLUm29xzdRVUCnCmcym46rRn+V84vR9ICfGBJPA4xhyGQE4+UTXf3UEHyTrVfATIrg1ZS9W6C1pB2U/jNiSn/KhozwInPZu
2024-07-08 17:50:59 UTC	978	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:50:59 GMT Content-Type: application/json Content-Length: 316 Connection: close Set-Cookie: AWSALB=nRGBZ1IumF+hZ8Mbemq3W01uqUgd4o3yAv4cXNIUZgcE/JKin9ku3UL0cfZyMlGTaO7/XfB7yfy3unI3c4cTLBUa1T/tFdoO4ULDauo0OgKXtB4bADAoXLYPCXFa; Expires=Mon, 15 Jul 2024 17:50:59 GMT; Path=/ Set-Cookie: AWSALBCORS=nRGBZ1IumF+hZ8Mbemq3W01uqUgd4o3yAv4cXNIUZgcE/JKin9ku3UL0cfZyMlGTaO7/XfB7yfy3unI3c4cTLBUa1T/tFdoO4ULDauo0OgKXtB4bADAoXLYPCXFa; Expires=Mon, 15 Jul 2024 17:50:59 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:50:59 UTC	316	IN	Data Raw: 7b 22 6e 65 67 6f 74 69 61 74 65 56 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 6e 65 63 74 69 6f 6e 49 64 22 3a 22 39 74 4a 49 63 31 6f 63 44 32 70 5f 78 41 50 42 57 50 53 4a 4b 67 22 2c 22 63 6f 6e 6e 65 63 74 69 6f 6e 54 6f 6b 65 6e 22 3a 22 47 5f 79 53 79 30 51 47 65 35 78 39 48 43 78 4b 5a 44 6f 4e 68 67 22 2c 22 61 76 61 69 6c 61 62 6c 65 54 72 61 6e 73 70 6f 72 74 73 22 3a 5b 7b 22 74 72 61 6e 73 70 6f 72 74 22 3a 22 57 65 62 53 6f 63 6b 65 74 73 22 2c 22 74 72 61 6e 73 66 65 72 46 6f 72 6d 61 74 73 22 3a 5b 22 54 65 78 74 22 2c 22 42 69 6e 61 72 79 22 5d 7d 2c 7b 22 74 72 61 6e 73 70 6f 72 74 22 3a 22 53 65 72 76 65 72 53 65 6e 74 45 76 65 6e 74 73 22 2c 22 74 72 61 6e 73 66 65 72 46 6f 72 6d 61 74 73 22 3a 5b 22 54 65 78 74 22 5d 7d 2c 7b 22 74 72 Data Ascii: {"negotiateVersion":1,"connectionId":"9tJIc1ocD2p_xAPBWPSJKg","connectionToken":"G_ySy0QGe5x9HCxKZDoNhg","availableTransports":[{"transport":"WebSockets","transferFormats":["Text","Binary"]},{"transport":"ServerSentEvents","transferFormats":["Text"]},{"tr

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:00 UTC	665	OUT	GET /_blazor/negotiate?negotiateVersion=1 HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=nRGBZ1IumF+hZ8Mbemq3W01uqUgd4o3yAv4cXNIUZgcE/JKin9ku3UL0cfZyMlGTaO7/XfB7yfy3unI3c4cTLBUa1T/tFdoO4ULDauo0OgKXtB4bADAoXLYPCXFa; AWSALBCORS=nRGBZ1IumF+hZ8Mbemq3W01uqUgd4o3yAv4cXNIUZgcE/JKin9ku3UL0cfZyMlGTaO7/XfB7yfy3unI3c4cTLBUa1T/tFdoO4ULDauo0OgKXtB4bADAoXLYPCXFa
2024-07-08 17:51:00 UTC	986	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 08 Jul 2024 17:51:00 GMT Content-Type: text/plain Content-Length: 0 Connection: close Set-Cookie: AWSALB=pq1v12G0vkwya5mUeOJ8XK5Y7ru9JP78+oM9xiJAXFUWYK6BgMHF6ixB8VD+YQSNyBZbUk1fqHCWnBzXd9jftRk14jQtFvj2V3p45xOu3fjYKkilkrVZlrHZCuFM; Expires=Mon, 15 Jul 2024 17:51:00 GMT; Path=/ Set-Cookie: AWSALBCORS=pq1v12G0vkwya5mUeOJ8XK5Y7ru9JP78+oM9xiJAXFUWYK6BgMHF6ixB8VD+YQSNyBZbUk1fqHCWnBzXd9jftRk14jQtFvj2V3p45xOu3fjYKkilkrVZlrHZCuFM; Expires=Mon, 15 Jul 2024 17:51:00 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:00 UTC	829	OUT	GET /_blazor?id=G_ySy0QGe5x9HCxKZDoNhg HTTP/1.1 Host: links.us1.defend.egress.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://links.us1.defend.egress.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=nRGBZ1IumF+hZ8Mbemq3W01uqUgd4o3yAv4cXNIUZgcE/JKin9ku3UL0cfZyMlGTaO7/XfB7yfy3unI3c4cTLBUa1T/tFdoO4ULDauo0OgKXtB4bADAoXLYPCXFa; AWSALBCORS=nRGBZ1IumF+hZ8Mbemq3W01uqUgd4o3yAv4cXNIUZgcE/JKin9ku3UL0cfZyMlGTaO7/XfB7yfy3unI3c4cTLBUa1T/tFdoO4ULDauo0OgKXtB4bADAoXLYPCXFa Sec-WebSocket-Key: 2k5NaMRKUybcNevuOGYK1Q== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-07-08 17:51:00 UTC	984	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:00 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close Set-Cookie: AWSALB=9pl69TbTQHGDxwel4BzkCJDv9YqSypKVcKIE1DTyJMh67B/rIZ/MltLU1go9iXeg2ppNMRamVH54QUsYb5kigddau8vzTk78wqFYzTEHNjxwVxBpHOa7TgMgk98c; Expires=Mon, 15 Jul 2024 17:51:00 GMT; Path=/ Set-Cookie: AWSALBCORS=9pl69TbTQHGDxwel4BzkCJDv9YqSypKVcKIE1DTyJMh67B/rIZ/MltLU1go9iXeg2ppNMRamVH54QUsYb5kigddau8vzTk78wqFYzTEHNjxwVxBpHOa7TgMgk98c; Expires=Mon, 15 Jul 2024 17:51:00 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:01 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-08 17:51:01 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=166758 Date: Mon, 08 Jul 2024 17:51:01 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:01 UTC	1428	OUT	GET /_blazor?id=toTYSEG6AL9X-EIBOcZkbA&_=1720461059604 HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-SignalR-User-Agent: Microsoft SignalR/0.0 (0.0.0-DEV_BUILD; Unknown OS; Browser; Unknown Runtime Version) sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=htknphGgnHA+WxQddfuDoAmbI/etWLSU/iBNZjlEvI2FS0VCozV8uDsGZ7gP36CG6pGxQN+PNLcgX9A6/YZgdO5Bv44xzwUVpNhdb+Kwwm0mlnqglf1d8JiOsc7b; AWSALBCORS=htknphGgnHA+WxQddfuDoAmbI/etWLSU/iBNZjlEvI2FS0VCozV8uDsGZ7gP36CG6pGxQN+PNLcgX9A6/YZgdO5Bv44xzwUVpNhdb+Kwwm0mlnqglf1d8JiOsc7b
2024-07-08 17:51:01 UTC	984	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:01 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close Set-Cookie: AWSALB=/+L3yUef/6v7biQp4AF1iO4duroZL/ma331K7LVnl3CKDi14/XHk7EEZV7dQXpsZZNJWpD7r4emdl2Pbsv8g4oEM/ujFBHoGI7YOrbtxa0UOPr1nGVX4PLAqVJGC; Expires=Mon, 15 Jul 2024 17:51:01 GMT; Path=/ Set-Cookie: AWSALBCORS=/+L3yUef/6v7biQp4AF1iO4duroZL/ma331K7LVnl3CKDi14/XHk7EEZV7dQXpsZZNJWpD7r4emdl2Pbsv8g4oEM/ujFBHoGI7YOrbtxa0UOPr1nGVX4PLAqVJGC; Expires=Mon, 15 Jul 2024 17:51:01 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:01 UTC	1478	OUT	POST /_blazor?id=toTYSEG6AL9X-EIBOcZkbA HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive Content-Length: 38 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-SignalR-User-Agent: Microsoft SignalR/0.0 (0.0.0-DEV_BUILD; Unknown OS; Browser; Unknown Runtime Version) sec-ch-ua-platform: "Windows" Accept: / Origin: https://links.us1.defend.egress.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=/+L3yUef/6v7biQp4AF1iO4duroZL/ma331K7LVnl3CKDi14/XHk7EEZV7dQXpsZZNJWpD7r4emdl2Pbsv8g4oEM/ujFBHoGI7YOrbtxa0UOPr1nGVX4PLAqVJGC; AWSALBCORS=/+L3yUef/6v7biQp4AF1iO4duroZL/ma331K7LVnl3CKDi14/XHk7EEZV7dQXpsZZNJWpD7r4emdl2Pbsv8g4oEM/ujFBHoGI7YOrbtxa0UOPr1nGVX4PLAqVJGC
2024-07-08 17:51:01 UTC	38	OUT	Data Raw: 7b 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 62 6c 61 7a 6f 72 70 61 63 6b 22 2c 22 76 65 72 73 69 6f 6e 22 3a 31 7d 1e Data Ascii: {"protocol":"blazorpack","version":1}
2024-07-08 17:51:01 UTC	970	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:01 GMT Content-Type: text/plain Content-Length: 0 Connection: close Set-Cookie: AWSALB=O0xxbVC9G5t9xtyGUeuOEnl7VtUl/hEVwcC+E8B9O/4xd9t1kqo+entcv5c2uHK8PpBy/IfG4pp5YZkKhuoH0FgXcf4z0HWNiwDyeCH8qkvDe/9994awANkxbcJS; Expires=Mon, 15 Jul 2024 17:51:01 GMT; Path=/ Set-Cookie: AWSALBCORS=O0xxbVC9G5t9xtyGUeuOEnl7VtUl/hEVwcC+E8B9O/4xd9t1kqo+entcv5c2uHK8PpBy/IfG4pp5YZkKhuoH0FgXcf4z0HWNiwDyeCH8qkvDe/9994awANkxbcJS; Expires=Mon, 15 Jul 2024 17:51:01 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:01 UTC	678	OUT	GET /_blazor?id=toTYSEG6AL9X-EIBOcZkbA&_=1720461059604 HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=/+L3yUef/6v7biQp4AF1iO4duroZL/ma331K7LVnl3CKDi14/XHk7EEZV7dQXpsZZNJWpD7r4emdl2Pbsv8g4oEM/ujFBHoGI7YOrbtxa0UOPr1nGVX4PLAqVJGC; AWSALBCORS=/+L3yUef/6v7biQp4AF1iO4duroZL/ma331K7LVnl3CKDi14/XHk7EEZV7dQXpsZZNJWpD7r4emdl2Pbsv8g4oEM/ujFBHoGI7YOrbtxa0UOPr1nGVX4PLAqVJGC
2024-07-08 17:51:02 UTC	959	IN	HTTP/1.1 204 No Content Date: Mon, 08 Jul 2024 17:51:02 GMT Content-Type: text/plain Connection: close Set-Cookie: AWSALB=IpTlOilr2pSt0nK3ifnd4hQU++Tfvl37MJ/RY9s2678LO/aqcX5Xi2ohiNrjx+/mQy5B+j8kAKicNIFizkJJ1oxnHWFo/lOO1eu76ksjMgxYs3ewGwQaEqK59WIs; Expires=Mon, 15 Jul 2024 17:51:01 GMT; Path=/ Set-Cookie: AWSALBCORS=IpTlOilr2pSt0nK3ifnd4hQU++Tfvl37MJ/RY9s2678LO/aqcX5Xi2ohiNrjx+/mQy5B+j8kAKicNIFizkJJ1oxnHWFo/lOO1eu76ksjMgxYs3ewGwQaEqK59WIs; Expires=Mon, 15 Jul 2024 17:51:01 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:02 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-08 17:51:02 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=166690 Date: Mon, 08 Jul 2024 17:51:02 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-08 17:51:02 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:02 UTC	662	OUT	GET /_blazor?id=toTYSEG6AL9X-EIBOcZkbA HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=O0xxbVC9G5t9xtyGUeuOEnl7VtUl/hEVwcC+E8B9O/4xd9t1kqo+entcv5c2uHK8PpBy/IfG4pp5YZkKhuoH0FgXcf4z0HWNiwDyeCH8qkvDe/9994awANkxbcJS; AWSALBCORS=O0xxbVC9G5t9xtyGUeuOEnl7VtUl/hEVwcC+E8B9O/4xd9t1kqo+entcv5c2uHK8PpBy/IfG4pp5YZkKhuoH0FgXcf4z0HWNiwDyeCH8qkvDe/9994awANkxbcJS
2024-07-08 17:51:02 UTC	986	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:02 GMT Content-Type: application/octet-stream Content-Length: 101 Connection: close Set-Cookie: AWSALB=YKZeaW7B/sHPey61CG50NHBG0qIJK8/Co9GcHBB4CWo4KO4SRYSgeMnUSa33fmHEqPGOsZbnGlEP/IIfofqGK1g0tFcTz9BW+R5DI7XC4FO1Oe795/OupgjirQmG; Expires=Mon, 15 Jul 2024 17:51:02 GMT; Path=/ Set-Cookie: AWSALBCORS=YKZeaW7B/sHPey61CG50NHBG0qIJK8/Co9GcHBB4CWo4KO4SRYSgeMnUSa33fmHEqPGOsZbnGlEP/IIfofqGK1g0tFcTz9BW+R5DI7XC4FO1Oe795/OupgjirQmG; Expires=Mon, 15 Jul 2024 17:51:02 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:51:02 UTC	101	IN	Data Raw: 64 96 01 80 c0 b0 4a 53 2e 42 65 67 69 6e 49 6e 76 6f 6b 65 4a 53 95 02 d9 29 42 6c 61 7a 6f 72 2e 5f 69 6e 74 65 72 6e 61 6c 2e 61 74 74 61 63 68 57 65 62 52 65 6e 64 65 72 65 72 49 6e 74 65 72 6f 70 be 5b 30 2c 7b 22 5f 5f 64 6f 74 4e 65 74 4f 62 6a 65 63 74 22 3a 31 7d 2c 7b 7d 2c 7b 7d 5d 03 00 90 Data Ascii: dJS.BeginInvokeJS)Blazor._internal.attachWebRendererInterop[0,{"__dotNetObject":1},{},{}]

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:02 UTC	1479	OUT	POST /_blazor?id=toTYSEG6AL9X-EIBOcZkbA HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive Content-Length: 899 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-SignalR-User-Agent: Microsoft SignalR/0.0 (0.0.0-DEV_BUILD; Unknown OS; Browser; Unknown Runtime Version) sec-ch-ua-platform: "Windows" Accept: / Origin: https://links.us1.defend.egress.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=O0xxbVC9G5t9xtyGUeuOEnl7VtUl/hEVwcC+E8B9O/4xd9t1kqo+entcv5c2uHK8PpBy/IfG4pp5YZkKhuoH0FgXcf4z0HWNiwDyeCH8qkvDe/9994awANkxbcJS; AWSALBCORS=O0xxbVC9G5t9xtyGUeuOEnl7VtUl/hEVwcC+E8B9O/4xd9t1kqo+entcv5c2uHK8PpBy/IfG4pp5YZkKhuoH0FgXcf4z0HWNiwDyeCH8qkvDe/9994awANkxbcJS
2024-07-08 17:51:02 UTC	899	OUT	Data Raw: 81 07 95 01 80 a1 30 ac 53 74 61 72 74 43 69 72 63 75 69 74 94 d9 24 68 74 74 70 73 3a 2f 2f 6c 69 6e 6b 73 2e 75 73 31 2e 64 65 66 65 6e 64 2e 65 67 72 65 73 73 2e 63 6f 6d 2f da 01 89 68 74 74 70 73 3a 2f 2f 6c 69 6e 6b 73 2e 75 73 31 2e 64 65 66 65 6e 64 2e 65 67 72 65 73 73 2e 63 6f 6d 2f 57 61 72 6e 69 6e 67 3f 63 72 49 64 3d 36 36 38 63 31 33 66 30 31 30 37 64 62 39 62 36 36 62 37 37 64 37 34 65 26 44 6f 6d 61 69 6e 3d 6c 63 61 74 74 65 72 74 6f 6e 2e 63 6f 6d 26 4c 61 6e 67 3d 65 6e 26 42 61 73 65 36 34 55 72 6c 3d 65 4e 6f 31 69 30 46 76 67 79 41 59 51 50 38 4e 52 39 46 74 58 70 61 51 68 6a 52 4e 79 77 46 4e 57 33 54 52 47 36 4a 54 36 57 64 68 43 74 4c 34 36 2d 65 6c 70 35 65 58 76 44 63 34 5a 35 64 76 6a 45 4d 49 55 57 39 4d 44 31 32 6b 7a 49 54 Data Ascii: 0StartCircuit$https://links.us1.defend.egress.com/https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT
2024-07-08 17:51:02 UTC	970	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:02 GMT Content-Type: text/plain Content-Length: 0 Connection: close Set-Cookie: AWSALB=1NtUxtS7FiHKjVJN7kSOOo1FQZ5d/mLK7YDOLhgw/MGfIBv/GKIw1CVrh9ZPnVd/vO12ZZU+HSkYOZ+4So1eNJrLgyVCXzb52tuTudqiMUcXhZOS3VX3xOBY0o5n; Expires=Mon, 15 Jul 2024 17:51:02 GMT; Path=/ Set-Cookie: AWSALBCORS=1NtUxtS7FiHKjVJN7kSOOo1FQZ5d/mLK7YDOLhgw/MGfIBv/GKIw1CVrh9ZPnVd/vO12ZZU+HSkYOZ+4So1eNJrLgyVCXzb52tuTudqiMUcXhZOS3VX3xOBY0o5n; Expires=Mon, 15 Jul 2024 17:51:02 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:03 UTC	662	OUT	GET /_blazor?id=toTYSEG6AL9X-EIBOcZkbA HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=1NtUxtS7FiHKjVJN7kSOOo1FQZ5d/mLK7YDOLhgw/MGfIBv/GKIw1CVrh9ZPnVd/vO12ZZU+HSkYOZ+4So1eNJrLgyVCXzb52tuTudqiMUcXhZOS3VX3xOBY0o5n; AWSALBCORS=1NtUxtS7FiHKjVJN7kSOOo1FQZ5d/mLK7YDOLhgw/MGfIBv/GKIw1CVrh9ZPnVd/vO12ZZU+HSkYOZ+4So1eNJrLgyVCXzb52tuTudqiMUcXhZOS3VX3xOBY0o5n
2024-07-08 17:51:04 UTC	987	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:03 GMT Content-Type: application/octet-stream Content-Length: 3369 Connection: close Set-Cookie: AWSALB=CET3MDk2n+01JeFgQgbAeZaQJQL5f0IhSHCdYdZj57DJ7IW6yRj1VrVfA3h/DicrNIx8my1NbzCLf7tp+IIJkeitr+D3HpvVkIP5R9Dn6cjPMJqKqWbdS/kSB6+y; Expires=Mon, 15 Jul 2024 17:51:03 GMT; Path=/ Set-Cookie: AWSALBCORS=CET3MDk2n+01JeFgQgbAeZaQJQL5f0IhSHCdYdZj57DJ7IW6yRj1VrVfA3h/DicrNIx8my1NbzCLf7tp+IIJkeitr+D3HpvVkIP5R9Dn6cjPMJqKqWbdS/kSB6+y; Expires=Mon, 15 Jul 2024 17:51:03 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:51:04 UTC	3369	IN	Data Raw: 1c 96 01 80 c0 b2 4a 53 2e 41 74 74 61 63 68 43 6f 6d 70 6f 6e 65 6e 74 92 00 a1 30 90 a5 0d 96 01 80 c0 ae 4a 53 2e 52 65 6e 64 65 72 42 61 74 63 68 92 02 c5 06 8c 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 04 00 00 00 ff ff ff ff 01 00 00 00 00 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 07 00 00 00 ff ff ff ff 02 00 00 00 00 00 00 00 03 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 0a 00 00 00 ff ff ff ff 03 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 0c 00 00 00 ff ff ff ff 05 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 18 00 00 00 ff ff ff ff 06 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 19 00 00 00 ff ff ff ff 07 00 00 00 01 00 00 00 Data Ascii: JS.AttachComponent0JS.RenderBatch

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:06 UTC	1480	OUT	POST /_blazor/negotiate?negotiateVersion=1 HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive Content-Length: 0 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-SignalR-User-Agent: Microsoft SignalR/0.0 (0.0.0-DEV_BUILD; Unknown OS; Browser; Unknown Runtime Version) sec-ch-ua-platform: "Windows" Accept: / Origin: https://links.us1.defend.egress.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=CET3MDk2n+01JeFgQgbAeZaQJQL5f0IhSHCdYdZj57DJ7IW6yRj1VrVfA3h/DicrNIx8my1NbzCLf7tp+IIJkeitr+D3HpvVkIP5R9Dn6cjPMJqKqWbdS/kSB6+y; AWSALBCORS=CET3MDk2n+01JeFgQgbAeZaQJQL5f0IhSHCdYdZj57DJ7IW6yRj1VrVfA3h/DicrNIx8my1NbzCLf7tp+IIJkeitr+D3HpvVkIP5R9Dn6cjPMJqKqWbdS/kSB6+y
2024-07-08 17:51:06 UTC	978	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:06 GMT Content-Type: application/json Content-Length: 316 Connection: close Set-Cookie: AWSALB=JC+0ZOYBo//uSxkW2IElVoSYcnPTRiiLKLhA4ljvFHmOEuuk5B9bMwyEiK+RRd80MpWicNr9ixR3tA+/b1KTuXR7D5N3KcJHR5wWBhc6hBVymZf7L/DULdZxI8AN; Expires=Mon, 15 Jul 2024 17:51:06 GMT; Path=/ Set-Cookie: AWSALBCORS=JC+0ZOYBo//uSxkW2IElVoSYcnPTRiiLKLhA4ljvFHmOEuuk5B9bMwyEiK+RRd80MpWicNr9ixR3tA+/b1KTuXR7D5N3KcJHR5wWBhc6hBVymZf7L/DULdZxI8AN; Expires=Mon, 15 Jul 2024 17:51:06 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:51:06 UTC	316	IN	Data Raw: 7b 22 6e 65 67 6f 74 69 61 74 65 56 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 6e 65 63 74 69 6f 6e 49 64 22 3a 22 31 47 48 52 51 4d 7a 64 74 38 5f 59 49 6e 42 59 67 53 35 6e 5f 67 22 2c 22 63 6f 6e 6e 65 63 74 69 6f 6e 54 6f 6b 65 6e 22 3a 22 79 4f 4d 51 44 77 6f 78 53 52 59 71 76 5a 63 6b 64 78 78 6d 5f 77 22 2c 22 61 76 61 69 6c 61 62 6c 65 54 72 61 6e 73 70 6f 72 74 73 22 3a 5b 7b 22 74 72 61 6e 73 70 6f 72 74 22 3a 22 57 65 62 53 6f 63 6b 65 74 73 22 2c 22 74 72 61 6e 73 66 65 72 46 6f 72 6d 61 74 73 22 3a 5b 22 54 65 78 74 22 2c 22 42 69 6e 61 72 79 22 5d 7d 2c 7b 22 74 72 61 6e 73 70 6f 72 74 22 3a 22 53 65 72 76 65 72 53 65 6e 74 45 76 65 6e 74 73 22 2c 22 74 72 61 6e 73 66 65 72 46 6f 72 6d 61 74 73 22 3a 5b 22 54 65 78 74 22 5d 7d 2c 7b 22 74 72 Data Ascii: {"negotiateVersion":1,"connectionId":"1GHRQMzdt8_YInBYgS5n_g","connectionToken":"yOMQDwoxSRYqvZckdxxm_w","availableTransports":[{"transport":"WebSockets","transferFormats":["Text","Binary"]},{"transport":"ServerSentEvents","transferFormats":["Text"]},{"tr

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:06 UTC	829	OUT	GET /_blazor?id=yOMQDwoxSRYqvZckdxxm_w HTTP/1.1 Host: links.us1.defend.egress.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://links.us1.defend.egress.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=JC+0ZOYBo//uSxkW2IElVoSYcnPTRiiLKLhA4ljvFHmOEuuk5B9bMwyEiK+RRd80MpWicNr9ixR3tA+/b1KTuXR7D5N3KcJHR5wWBhc6hBVymZf7L/DULdZxI8AN; AWSALBCORS=JC+0ZOYBo//uSxkW2IElVoSYcnPTRiiLKLhA4ljvFHmOEuuk5B9bMwyEiK+RRd80MpWicNr9ixR3tA+/b1KTuXR7D5N3KcJHR5wWBhc6hBVymZf7L/DULdZxI8AN Sec-WebSocket-Key: 2I8mFAVehrHGndE/R8pboQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-07-08 17:51:06 UTC	984	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:06 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close Set-Cookie: AWSALB=v+avgO20NdQsAPD1vN3ICVaS3AMX2r+VSD9DHDjw5F0GVnBifv6R1oUWD9/k2PxRi7lYlDpkuK+KkHoYPrKTn4GY7XDElQhSV2tfilvrzVxgSEsRN/0d4nbLUvC7; Expires=Mon, 15 Jul 2024 17:51:06 GMT; Path=/ Set-Cookie: AWSALBCORS=v+avgO20NdQsAPD1vN3ICVaS3AMX2r+VSD9DHDjw5F0GVnBifv6R1oUWD9/k2PxRi7lYlDpkuK+KkHoYPrKTn4GY7XDElQhSV2tfilvrzVxgSEsRN/0d4nbLUvC7; Expires=Mon, 15 Jul 2024 17:51:06 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:07 UTC	1480	OUT	POST /_blazor/negotiate?negotiateVersion=1 HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive Content-Length: 0 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-SignalR-User-Agent: Microsoft SignalR/0.0 (0.0.0-DEV_BUILD; Unknown OS; Browser; Unknown Runtime Version) sec-ch-ua-platform: "Windows" Accept: / Origin: https://links.us1.defend.egress.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=JC+0ZOYBo//uSxkW2IElVoSYcnPTRiiLKLhA4ljvFHmOEuuk5B9bMwyEiK+RRd80MpWicNr9ixR3tA+/b1KTuXR7D5N3KcJHR5wWBhc6hBVymZf7L/DULdZxI8AN; AWSALBCORS=JC+0ZOYBo//uSxkW2IElVoSYcnPTRiiLKLhA4ljvFHmOEuuk5B9bMwyEiK+RRd80MpWicNr9ixR3tA+/b1KTuXR7D5N3KcJHR5wWBhc6hBVymZf7L/DULdZxI8AN
2024-07-08 17:51:07 UTC	978	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:07 GMT Content-Type: application/json Content-Length: 316 Connection: close Set-Cookie: AWSALB=sehZ+BZ7y2K0mdd0IcwVujxRCao0JD7tgZ7tAyOR3wp3YW0kXEHKvRHrhaGwvlBpnNIhaaKcKUzIJBNtsUHF30sl4N8cU/ICXK6P6Ml8+JSrHySSpFXqIHJjBNUE; Expires=Mon, 15 Jul 2024 17:51:07 GMT; Path=/ Set-Cookie: AWSALBCORS=sehZ+BZ7y2K0mdd0IcwVujxRCao0JD7tgZ7tAyOR3wp3YW0kXEHKvRHrhaGwvlBpnNIhaaKcKUzIJBNtsUHF30sl4N8cU/ICXK6P6Ml8+JSrHySSpFXqIHJjBNUE; Expires=Mon, 15 Jul 2024 17:51:07 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:51:07 UTC	316	IN	Data Raw: 7b 22 6e 65 67 6f 74 69 61 74 65 56 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 6e 65 63 74 69 6f 6e 49 64 22 3a 22 50 4b 4f 70 4d 7a 48 38 74 2d 57 41 5a 41 6f 39 4b 2d 62 72 5a 51 22 2c 22 63 6f 6e 6e 65 63 74 69 6f 6e 54 6f 6b 65 6e 22 3a 22 6c 48 6f 72 7a 74 41 5f 4b 77 69 59 62 76 35 41 30 56 33 50 71 51 22 2c 22 61 76 61 69 6c 61 62 6c 65 54 72 61 6e 73 70 6f 72 74 73 22 3a 5b 7b 22 74 72 61 6e 73 70 6f 72 74 22 3a 22 57 65 62 53 6f 63 6b 65 74 73 22 2c 22 74 72 61 6e 73 66 65 72 46 6f 72 6d 61 74 73 22 3a 5b 22 54 65 78 74 22 2c 22 42 69 6e 61 72 79 22 5d 7d 2c 7b 22 74 72 61 6e 73 70 6f 72 74 22 3a 22 53 65 72 76 65 72 53 65 6e 74 45 76 65 6e 74 73 22 2c 22 74 72 61 6e 73 66 65 72 46 6f 72 6d 61 74 73 22 3a 5b 22 54 65 78 74 22 5d 7d 2c 7b 22 74 72 Data Ascii: {"negotiateVersion":1,"connectionId":"PKOpMzH8t-WAZAo9K-brZQ","connectionToken":"lHorztA_KwiYbv5A0V3PqQ","availableTransports":[{"transport":"WebSockets","transferFormats":["Text","Binary"]},{"transport":"ServerSentEvents","transferFormats":["Text"]},{"tr

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:07 UTC	665	OUT	GET /_blazor/negotiate?negotiateVersion=1 HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=sehZ+BZ7y2K0mdd0IcwVujxRCao0JD7tgZ7tAyOR3wp3YW0kXEHKvRHrhaGwvlBpnNIhaaKcKUzIJBNtsUHF30sl4N8cU/ICXK6P6Ml8+JSrHySSpFXqIHJjBNUE; AWSALBCORS=sehZ+BZ7y2K0mdd0IcwVujxRCao0JD7tgZ7tAyOR3wp3YW0kXEHKvRHrhaGwvlBpnNIhaaKcKUzIJBNtsUHF30sl4N8cU/ICXK6P6Ml8+JSrHySSpFXqIHJjBNUE
2024-07-08 17:51:08 UTC	986	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 08 Jul 2024 17:51:08 GMT Content-Type: text/plain Content-Length: 0 Connection: close Set-Cookie: AWSALB=XU7SUx3bElk4GyGVIiFp3dvY6MiVIX44Cvg10EJo8TbROmJiUTvO2dGuUWH/L5t6FJtnVpoUw2RWG0O6BBAu15G47Fd+R/wGnHPYa/Ib9iAJ+0u4sXHPU646RaHH; Expires=Mon, 15 Jul 2024 17:51:08 GMT; Path=/ Set-Cookie: AWSALBCORS=XU7SUx3bElk4GyGVIiFp3dvY6MiVIX44Cvg10EJo8TbROmJiUTvO2dGuUWH/L5t6FJtnVpoUw2RWG0O6BBAu15G47Fd+R/wGnHPYa/Ib9iAJ+0u4sXHPU646RaHH; Expires=Mon, 15 Jul 2024 17:51:08 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:08 UTC	1428	OUT	GET /_blazor?id=lHorztA_KwiYbv5A0V3PqQ&_=1720461066330 HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-SignalR-User-Agent: Microsoft SignalR/0.0 (0.0.0-DEV_BUILD; Unknown OS; Browser; Unknown Runtime Version) sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=sehZ+BZ7y2K0mdd0IcwVujxRCao0JD7tgZ7tAyOR3wp3YW0kXEHKvRHrhaGwvlBpnNIhaaKcKUzIJBNtsUHF30sl4N8cU/ICXK6P6Ml8+JSrHySSpFXqIHJjBNUE; AWSALBCORS=sehZ+BZ7y2K0mdd0IcwVujxRCao0JD7tgZ7tAyOR3wp3YW0kXEHKvRHrhaGwvlBpnNIhaaKcKUzIJBNtsUHF30sl4N8cU/ICXK6P6Ml8+JSrHySSpFXqIHJjBNUE
2024-07-08 17:51:08 UTC	984	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:08 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close Set-Cookie: AWSALB=ue+X2oBx+oSm5S2FJb2O8uRi0vOFU2x5vLyb6gRi7VhJ8255wIVcqvevKerIihzk/j2pMMNbX8v62KFfJ65l4qPyzfs85miCIu5I8wcYGlmYso30laIJWzQ0L32N; Expires=Mon, 15 Jul 2024 17:51:08 GMT; Path=/ Set-Cookie: AWSALBCORS=ue+X2oBx+oSm5S2FJb2O8uRi0vOFU2x5vLyb6gRi7VhJ8255wIVcqvevKerIihzk/j2pMMNbX8v62KFfJ65l4qPyzfs85miCIu5I8wcYGlmYso30laIJWzQ0L32N; Expires=Mon, 15 Jul 2024 17:51:08 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:08 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cUTPhztVM7SU1b+&MD=2xy3Xo9K HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-08 17:51:08 UTC	513	IN	HTTP/1.1 200 OK Content-Length: 24490 Connection: close Content-Type: application/octet-stream Date: Mon, 08 Jul 2024 17:51:08 GMT Cache-Control: no-cache ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT SLSVersion: 2.0 MS-CorrelationId: 1d8ca7b1-54a8-4ffa-8b7f-ba285459c13d MS-RequestId: ca73a45e-613b-45b9-98aa-6e61f98c571d MS-CV: GAl54cSqdEKO8nHS.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab
2024-07-08 17:51:08 UTC	3583	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-08 17:51:08 UTC	4096	IN	Data Raw: 43 6f 8f 4b 08 bf 90 5e dd e9 e0 ad 3a f3 6e f5 13 8d bc dc 4a e5 ce 08 39 bf 0b 6f 71 a1 bd f9 89 a4 0b 7e ad b7 07 c4 b2 4d 5e 04 10 a3 94 1f bf 5f 3c fe 61 32 7d 66 f8 c3 90 15 94 b5 2b 94 9b 3e b0 52 61 a7 8c f1 bd e1 aa d3 94 82 bb 52 af 1f 6d 5e f1 79 90 3d 67 86 9a ca 0e d4 c9 a5 cf cc 65 eb 98 57 b2 f6 7c f9 74 af d6 53 3e 74 b8 2f 8a b2 eb c5 bd 21 03 ca 11 15 fe 9e a3 b5 a5 1d 4a d2 07 d9 5f 47 e6 38 aa ce 22 44 4d 8f 54 6f 28 cd 68 29 54 2b d9 9c 1b 70 91 b0 4e 69 0b e6 9b 21 51 76 14 c9 c5 03 45 00 9e fe e9 d7 c5 85 c3 a1 28 3c 7d 17 58 d7 f6 5d ec 81 be 06 ac aa 84 41 e1 bf 8e 3d e0 a1 86 c4 14 5f 36 93 16 8a c8 c1 43 77 81 6b ab 04 5e 00 f7 0a fa b9 eb e3 96 e4 70 e8 6f 84 0e 4e 75 b3 27 fa 2f c5 52 e4 18 f8 52 50 fb e7 86 68 b1 f4 5c 91 75 Data Ascii: CoK^:nJ9oq~M^_<a2}f+>RaRm^y=geW\|tS>t/!J_G8"DMTo(h)T+pNi!QvE(<}X]A=_6Cwk^poNu'/RRPh\u
2024-07-08 17:51:08 UTC	4096	IN	Data Raw: f6 ba 1a 14 67 56 cc de df be 44 ef 34 be 5a 3d 68 d0 94 71 3a ec 86 ca 6c b7 75 9c 13 7f 71 8b bf 63 4d 32 13 26 f2 aa 5b ad 7f b0 1c 2c c0 c7 38 6e 5c de 9c bf 78 25 14 b9 27 fd 1d ce 80 5f 4a a7 25 65 f8 7c 62 0b cf 2d 1f ab cc e9 f1 ea 61 ab c3 35 7d 62 c3 39 ab 32 69 09 51 99 1d 23 bc fc 7a 36 35 36 af 83 6b 6f 89 11 f1 3d 8c a1 8e 1a 34 7e 5d ef bf 1b 4a cd 50 a1 ba 7e 8e e7 69 82 3e de 34 ac fe 6a c7 33 6b a8 50 09 e1 bf 29 fe 07 30 82 41 0f 06 09 2a 86 48 86 f7 0d 01 07 02 a0 82 41 00 30 82 40 fc 02 01 01 31 0f 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 30 81 9d 06 0a 2b 06 01 04 01 82 37 02 01 04 a0 81 8e 30 81 8b 30 56 06 0a 2b 06 01 04 01 82 37 02 01 1c a1 48 04 10 a6 b5 86 d5 b4 a1 24 66 ae 05 a2 17 da 8e 60 d6 04 34 31 32 30 30 06 0a 2b 06 Data Ascii: gVD4Z=hq:luqcM2&[,8n\x%'_J%e\|b-a5}b92iQ#z656ko=4~]JP~i>4j3kP)0A*HA0@10`He0+700V+7H$f`41200+
2024-07-08 17:51:08 UTC	4096	IN	Data Raw: 76 9b c2 1b 25 6c 3f 01 d0 b8 bb 6f e9 4d 62 55 f3 7a 5b c4 05 04 2e 09 48 41 fd e9 13 24 1e f0 71 f0 79 9e 8e a7 ea d7 72 49 9f 71 e8 41 4c 0a 8e 69 71 3c 8f e9 56 c5 9d a0 e6 3c df 48 88 1c cf 7f eb a0 34 f3 ff 37 ca 6d 9f c7 86 eb 12 35 0a 45 a5 81 a8 f8 53 6d c6 11 4e ef 37 77 2a 73 bf 08 f9 ee ba 8d b8 48 1a 93 32 44 3a cd 7c 41 2d e3 20 7e 34 a2 7c 2b 93 92 2f 0a 5f 17 c8 65 98 79 74 bb e7 1c 1a e2 6c a4 15 db cf ae 5b 18 f9 9a 82 ab 98 f5 13 93 f3 0f 89 71 a4 2f c0 7e 77 fb 64 26 22 e5 4e ad f6 92 18 a6 d3 94 cd 49 13 ad 79 db e2 53 23 d3 01 f4 55 10 41 0d 52 3e fd 89 9e 2a c8 0a d1 11 8b 87 81 95 4a 78 71 ab af 15 de f4 09 82 83 c6 11 e8 4d cf 5e c7 90 ea 63 c2 f2 61 65 db d9 2f 77 be a4 19 52 2e b5 62 7b 0f bb cd 6f d8 a4 a1 82 30 ab 30 82 12 e1 Data Ascii: v%l?oMbUz[.HA$qyrIqALiq<V<H47m5ESmN7wsH2D:\|A- ~4\|+/_eytl[q/~wd&"NIyS#UAR>JxqM^cae/wR.b{o00
2024-07-08 17:51:08 UTC	4096	IN	Data Raw: d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 82 03 0d 30 82 03 09 02 01 01 30 81 93 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 Data Ascii: 06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1000\|10UUS10UWashingt
2024-07-08 17:51:08 UTC	4096	IN	Data Raw: 61 74 69 6f 6e 73 31 26 30 24 06 03 55 04 0b 13 1d 54 68 61 6c 65 73 20 54 53 53 20 45 53 4e 3a 31 32 42 43 2d 45 33 41 45 2d 37 34 45 42 31 25 30 23 06 03 55 04 03 13 1c 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 53 65 72 76 69 63 65 a0 82 0e 3c 30 82 04 f1 30 82 03 d9 a0 03 02 01 02 02 13 33 00 00 00 f8 c2 5f 33 d0 b5 8f 15 04 00 00 00 00 00 f8 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 Data Ascii: ations1&0$UThales TSS ESN:12BC-E3AE-74EB1%0#UMicrosoft Time-Stamp Service<003_30*H0\|10UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp
2024-07-08 17:51:08 UTC	427	IN	Data Raw: 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 02 13 33 00 00 00 f8 c2 5f 33 d0 b5 8f 15 04 00 00 00 00 00 f8 30 22 04 20 7a de d8 d5 6f 69 33 d0 70 dc 4b 0a 87 20 2e 89 b9 7d 43 21 25 09 e9 8e e0 2f 61 63 6e 2e d3 c8 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 04 82 01 00 2d 46 01 d9 a2 c3 dc 11 ef 0b c9 9a 71 cb 9b d2 85 03 27 37 73 d7 48 58 97 ee 08 0c 34 5a 0a 0a d8 df 80 0a f3 3d 79 80 3f 16 0c dc 7c c5 78 09 cb 96 e0 3a a7 af 76 2e 9e f2 9d 5b 86 24 9a 4a ff 6d 1d cf 92 7d 03 90 a8 a0 be 00 b2 b0 9c d1 a3 2f 8d 33 d8 a2 96 c4 ce Data Ascii: 10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103_30" zoi3pK .}C!%/acn.0*H-Fq'7sHX4Z=y?\|x:v.[$Jm}/3

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:08 UTC	678	OUT	GET /_blazor?id=lHorztA_KwiYbv5A0V3PqQ&_=1720461066330 HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=ue+X2oBx+oSm5S2FJb2O8uRi0vOFU2x5vLyb6gRi7VhJ8255wIVcqvevKerIihzk/j2pMMNbX8v62KFfJ65l4qPyzfs85miCIu5I8wcYGlmYso30laIJWzQ0L32N; AWSALBCORS=ue+X2oBx+oSm5S2FJb2O8uRi0vOFU2x5vLyb6gRi7VhJ8255wIVcqvevKerIihzk/j2pMMNbX8v62KFfJ65l4qPyzfs85miCIu5I8wcYGlmYso30laIJWzQ0L32N
2024-07-08 17:51:09 UTC	984	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:09 GMT Content-Type: application/octet-stream Content-Length: 3 Connection: close Set-Cookie: AWSALB=d3S0318oTVMuJrQdWZkm35hrWtATtBcAo6IYdQ5O8jhtoedrmK7GCtJPwnjUxjlSQzAi0xvMt+YsdEglxo0lnKa1GLww2RIAYaylSMVdAxr+wNa8f8ScSVvWyYQU; Expires=Mon, 15 Jul 2024 17:51:08 GMT; Path=/ Set-Cookie: AWSALBCORS=d3S0318oTVMuJrQdWZkm35hrWtATtBcAo6IYdQ5O8jhtoedrmK7GCtJPwnjUxjlSQzAi0xvMt+YsdEglxo0lnKa1GLww2RIAYaylSMVdAxr+wNa8f8ScSVvWyYQU; Expires=Mon, 15 Jul 2024 17:51:08 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload
2024-07-08 17:51:09 UTC	3	IN	Data Raw: 7b 7d 1e Data Ascii: {}

Timestamp	Bytes transferred	Direction	Data
2024-07-08 17:51:08 UTC	1478	OUT	POST /_blazor?id=lHorztA_KwiYbv5A0V3PqQ HTTP/1.1 Host: links.us1.defend.egress.com Connection: keep-alive Content-Length: 38 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-SignalR-User-Agent: Microsoft SignalR/0.0 (0.0.0-DEV_BUILD; Unknown OS; Browser; Unknown Runtime Version) sec-ch-ua-platform: "Windows" Accept: / Origin: https://links.us1.defend.egress.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://links.us1.defend.egress.com/Warning?crId=668c13f0107db9b66b77d74e&Domain=lcatterton.com&Lang=en&Base64Url=eNo1i0FvgyAYQP8NR9FtXpaQhjRNywFNW3TRG6JT6WdhCtL46-elp5eXvDc4Z5dvjEMIUW9MD12kzIT9DIdZOaLRIolDu5J3CcrA5KVax6jbvPNN94jG56_BSgJg_RrM0Fr516J97yVSLTnSU0VHc88FS7PtEXNdfHGtPjLNdtKUD-YzO1dbfb4BF0VS_VzTWvAtn7K1ERYabcsiIL_0hOZrKUOc0OQF7HhfWGyvqlgvF8HifyPiRzE%3D&@OriginalLink=www.google.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=ue+X2oBx+oSm5S2FJb2O8uRi0vOFU2x5vLyb6gRi7VhJ8255wIVcqvevKerIihzk/j2pMMNbX8v62KFfJ65l4qPyzfs85miCIu5I8wcYGlmYso30laIJWzQ0L32N; AWSALBCORS=ue+X2oBx+oSm5S2FJb2O8uRi0vOFU2x5vLyb6gRi7VhJ8255wIVcqvevKerIihzk/j2pMMNbX8v62KFfJ65l4qPyzfs85miCIu5I8wcYGlmYso30laIJWzQ0L32N
2024-07-08 17:51:08 UTC	38	OUT	Data Raw: 7b 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 62 6c 61 7a 6f 72 70 61 63 6b 22 2c 22 76 65 72 73 69 6f 6e 22 3a 31 7d 1e Data Ascii: {"protocol":"blazorpack","version":1}
2024-07-08 17:51:09 UTC	970	IN	HTTP/1.1 200 OK Date: Mon, 08 Jul 2024 17:51:09 GMT Content-Type: text/plain Content-Length: 0 Connection: close Set-Cookie: AWSALB=ZgKhRowAeFIiCBN8ri4dpbWqzia5uuHUU7SucWNV5ZJN0AYVpEfpL9gsTfcjXC6HTtPO0c+wDRYGr/XtrLeDaWwz65I8RF8530NC+2qzK9FOMXMvA/fyE4wyxNNQ; Expires=Mon, 15 Jul 2024 17:51:09 GMT; Path=/ Set-Cookie: AWSALBCORS=ZgKhRowAeFIiCBN8ri4dpbWqzia5uuHUU7SucWNV5ZJN0AYVpEfpL9gsTfcjXC6HTtPO0c+wDRYGr/XtrLeDaWwz65I8RF8530NC+2qzK9FOMXMvA/fyE4wyxNNQ; Expires=Mon, 15 Jul 2024 17:51:09 GMT; Path=/; SameSite=None; Secure X-Robots-Tag: noindex X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none Referrer-Policy: same-origin X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; img-src 'self' https:; font-src 'self' https: https://fonts.gstatic.com; connect-src https: ws: wss:; object-src 'none' Strict-Transport-Security: max-age=2592000; preload