Edit tour

Windows Analysis Report
https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c

Overview

General Information

Sample URL:	https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c
Analysis ID:	1598938
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1288 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2096,i,2067873033797565785,9166219379275468913,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2680 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /v2/track HTTP/1.1Host: dc.services.visualstudio.comConnection: keep-aliveContent-Length: 1439sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-type: application/jsonsec-ch-ua-mobile: ?0Sdk-Context: appIdUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://retrieval.greatland.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://retrieval.greatland.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_101.2.dr	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Source: chromecache_101.2.dr	String found in binary or memory: https://yearli.com/legal/privacy-policy
Source: chromecache_101.2.dr	String found in binary or memory: https://yearli.com/legal/terms-of-use

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56955
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: clean1.win@16/57@10/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2096,i,2067873033797565785,9166219379275468913,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2096,i,2067873033797565785,9166219379275468913,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://retrieval.greatland.com/bundles/modal?v=-a4TryEKwD6_l2KoDb4knH7rIkrny3QIHNOq2F-8J1I1	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/Images/rrfill.png	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/Images/footer-tile.jpg	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/Images/corner-right.png	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/Images/icon_warning.png	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/bundles/modernizr?v=KGygLU_Ygx-27Szx0BNU49_4N_lJnUmNs2RbUl05ER01	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/bundles/Common?v=iv-wMx9JW9PONMa62erC7xTxZejViXqRf7JNiAKcC7Y1	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/bundles/jqueryval?v=XxisHtdIcly6w2Kb9rIeild9cZAElOjkA1aws8R1b4w1	0%	Avira URL Cloud	safe
https://yearli.com/legal/terms-of-use	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/bundles/jquery?v=dnh4CNLvAE-7b8jMEp_ifW1aAnsMY_uAuKfqaBWUVPU1	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/Images/btn-retrieve.png	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/Images/corner-left.png	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/favicon.ico	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/Images/background.jpg	0%	Avira URL Cloud	safe
https://yearli.com/legal/privacy-policy	0%	Avira URL Cloud	safe
https://retrieval.greatland.com/Images/logo.png	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
retrieval.greatland.com	13.82.175.96	true	false	high
gig-ai-g-prod-westeurope-6-app-v4-tag.westeurope.cloudapp.azure.com	20.50.88.234	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	172.217.23.100	true	false	high
gig-ai-g-prod-westeurope-3-app-v4-tag.westeurope.cloudapp.azure.com	20.50.88.238	true	false	high
dc.services.visualstudio.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://retrieval.greatland.com/Images/footer-tile.jpg	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/Images/rrfill.png	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/bundles/modernizr?v=KGygLU_Ygx-27Szx0BNU49_4N_lJnUmNs2RbUl05ER01	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/bundles/modal?v=-a4TryEKwD6_l2KoDb4knH7rIkrny3QIHNOq2F-8J1I1	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/bundles/Common?v=iv-wMx9JW9PONMa62erC7xTxZejViXqRf7JNiAKcC7Y1	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c	false		unknown
https://retrieval.greatland.com/bundles/jquery?v=dnh4CNLvAE-7b8jMEp_ifW1aAnsMY_uAuKfqaBWUVPU1	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/Images/icon_warning.png	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/bundles/jqueryval?v=XxisHtdIcly6w2Kb9rIeild9cZAElOjkA1aws8R1b4w1	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/Images/corner-right.png	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/Images/btn-retrieve.png	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/Images/background.jpg	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/Images/logo.png	false	Avira URL Cloud: safe	unknown
https://retrieval.greatland.com/Images/corner-left.png	false	Avira URL Cloud: safe	unknown
https://dc.services.visualstudio.com/v2/track	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://yearli.com/legal/terms-of-use	chromecache_101.2.dr	false	Avira URL Cloud: safe	unknown
https://yearli.com/legal/privacy-policy	chromecache_101.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.50.88.234	gig-ai-g-prod-westeurope-6-app-v4-tag.westeurope.cloudapp.azure.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.50.88.238	gig-ai-g-prod-westeurope-3-app-v4-tag.westeurope.cloudapp.azure.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.82.175.96	retrieval.greatland.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.23.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
192.168.2.23

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1598938
Start date and time:	2025-01-24 22:25:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/57@10/7

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.212.163, 142.250.181.238, 142.251.168.84, 172.217.18.14, 142.250.184.238, 142.250.186.46, 142.250.185.138, 142.250.184.234, 142.250.181.234, 216.58.212.170, 142.250.186.74, 216.58.212.138, 142.250.185.234, 142.250.185.74, 142.250.185.202, 142.250.186.138, 142.250.74.202, 172.217.18.106, 142.250.186.42, 216.58.206.74, 142.250.185.170, 142.250.186.106, 217.20.57.34, 2.17.190.73, 142.250.74.206, 216.58.206.46, 142.250.186.142, 142.251.40.238, 74.125.155.41, 142.250.186.110, 142.250.186.67, 184.28.90.27, 13.107.246.45, 4.245.163.56, 13.107.246.61
Excluded domains from analysis (whitelisted): r4---sn-p5qlsnrl.gvt1.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, az416426.vo.msecnd.net, r4.sn-p5qlsnrl.gvt1.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c

Input	Output
URL: https://retrieval.greatland.com Model: Joe Sandbox AI	```json{ "brand": "Greatland", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 2, "spoofed": 1, "reasoning": "The URL 'https://retrieval.greatland.com' does not exhibit typical characteristics of typosquatting. The domain 'greatland.com' appears to be a legitimate domain, and the subdomain 'retrieval' does not suggest any deceptive intent. There are no visual character substitutions or structural changes that mimic a well-known brand. The use of a subdomain is common for organizing different sections or services of a website and does not inherently indicate typosquatting. Without evidence of a well-known brand being spoofed, the likelihood of this being a typosquatting attempt is very low."}
URL: https://retrieval.greatland.com
URL: https://retrieval.greatland.com/0c74c038-8fcc-4ebb... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a simple function that submits a form when called. This is a common and legitimate behavior, and there are no high-risk indicators present. The function does not exhibit any suspicious or malicious behavior." }
function submitOnClick(formName) { document.forms[formName].submit(); }
URL: https://retrieval.greatland.com/0c74c038-8fcc-4ebb... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of the Application Insights SDK from Microsoft, which is a common analytics and telemetry service. While it uses some legacy APIs like `XDomainRequest`, the overall behavior is consistent with typical analytics functionality and does not demonstrate any high-risk indicators. The script is likely low-risk, with some minor outdated practices." }
var appInsights = window.appInsights \|\| function(config) { function i(config) { t[config] = function() { var i = arguments; t.queue.push(function() { t[config].apply(t, i) }); } } var t = { config: config }, u = document, e = window, o = "script", s = "AuthenticatedUserContext", h = "start", c = "stop", l = "Track", a = l + "Event", v = l + "Page", y = u.createElement(o), r, f; y.src = config.url \|\| "https://az416426.vo.msecnd.net/scripts/a/ai.0.js"; u.getElementsByTagName(o)[0].parentNode.appendChild(y); try { t.cookie = u.cookie } catch (p) {} for (t.queue = [], t.version = "1.0", r = ["Event", "Exception", "Metric", "PageView", "Trace", "Dependency"]; r .length;) i("track" + r.pop()); return i("set" + s), i("clear" + s), i(h + a), i(c + a), i(h + v), i(c + v), i("flush"), config .disableExceptionTracking \|\| (r = "onerror", i("_" + r), f = e[r], e[r] = function(config, i, u, e, o) { var s = f && f(config, i, u, e, o); return s !== !0 && t["_" + r](config, i, u, e, o), s }), t }({ instrumentationKey: "c0e571f4-1961-4805-9311-9f618c89f2d3" }); window.appInsights = appInsights; appInsights.trackPageView();
URL: https://retrieval.greatland.com/bundles/jquery?v=d... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be a standard jQuery library snippet, which is a widely used and trusted JavaScript library. It does not exhibit any high-risk behaviors such as dynamic code execution, data exfiltration, or obfuscated code. The code is well-structured and follows common patterns for a library initialization. Overall, this snippet poses a low risk and is likely part of a legitimate web application." }
(function(n,t){"use strict";typeof module=="object"&&typeof module.exports=="object"?module.exports=n.document?t(n,!0):function(n){if(!n.document)throw new Error("jQuery requires a window with a document");return t(n)}:t(n)})(typeof window!="undefined"?window:this,function(n,t){"use strict";function pr(n,t,i){i=i\|\|f;var r,e,u=i.createElement("script");if(u.text=n,t)for(r in re)e=t[r]\|\|t.getAttribute&&t.getAttribute(r),e&&u.setAttribute(r,e);i.head.appendChild(u).parentNode.removeChild(u)}function rt(n){return n==null?n+"":typeof n=="object"\|\|typeof n=="function"?ti[vr.call(n)]\|\|"object":typeof n}function ai(n){var t=!!n&&"length"in n&&n.length,i=rt(n);return u(n)\|\|it(n)?!1:i==="array"\|\|t===0\|\|typeof t=="number"&&t>0&&t-1 in n}function l(n,t){return n.nodeName&&n.nodeName.toLowerCase()===t.toLowerCase()}function yi(n,t,r){return u(t)?i.grep(n,function(n,i){return!!t.call(n,i,n)!==r}):t.nodeType?i.grep(n,function(n){return n===t!==r}):typeof t!="string"?i.grep(n,function(n){return ni.call(t,n)>-1!==r}):i.filter(t,n,r)}function ru(n,t){while((n=n[t])&&n.nodeType!==1);return n}function ue(n){var t={};return i.each(n.match(a)\|\|[],function(n,i){t[i]=!0}),t}function ft(n){return n}function ri(n){throw n;}function uu(n,t,i,r){var f;try{n&&u(f=n.promise)?f.call(n).done(t).fail(i):n&&u(f=n.then)?f.call(n,t,i):t.apply(undefined,[n].slice(r))}catch(n){i.apply(undefined,[n])}}function fi(){f.removeEventListener("DOMContentLoaded",fi);n.removeEventListener("load",fi);i.ready()}function oe(n,t){return t.toUpperCase()}function y(n){return n.replace(fe,"ms-").replace(ee,oe)}function pt(){this.expando=i.expando+pt.uid++}function ce(n){return n==="true"?!0:n==="false"?!1:n==="null"?null:n===+n+""?+n:se.test(n)?JSON.parse(n):n}function eu(n,t,i){var r;if(i===undefined&&n.nodeType===1)if(r="data-"+t.replace(he,"-$&").toLowerCase(),i=n.getAttribute(r),typeof i=="string"){try{i=ce(i)}catch(u){}o.set(n,t,i)}else i=undefined;return i}function su(n,t,r,u){var s,h,c=20,l=u?function(){return u.cur()}:function(){return i.css(n,t,"")},o=l(),e=r&&r[3]\|\|(i.cssNumber[t]?"":"px"),f=n.nodeType&&(i.cssNumber[t]\|\|e!=="px"&&+o)&&wt.exec(i.css(n,t));if(f&&f[3]!==e){for(o=o/2,e=e\|\|f[3],f=+o\|\|1;c--;)i.style(n,t,f+e),(1-h)(1-(h=l()/o\|\|.5))<=0&&(c=0),f=f/h;f=f2;i.style(n,t,f+e);r=r\|\|[]}return r&&(f=+f\|\|+o\|\|0,s=r[1]?f+(r[1]+1)r[2]:+r[2],u&&(u.unit=e,u.start=f,u.end=s)),s}function ae(n){var r,f=n.ownerDocument,u=n.nodeName,t=pi[u];return t?t:(r=f.body.appendChild(f.createElement(u)),t=i.css(r,"display"),r.parentNode.removeChild(r),t==="none"&&(t="block"),pi[u]=t,t)}function st(n,t){for(var e,u,f=[],i=0,o=n.length;i<o;i++)(u=n[i],u.style)&&(e=u.style.display,t?(e==="none"&&(f[i]=r.get(u,"display")\|\|null,f[i]\|\|(u.style.display="")),u.style.display===""&&bt(u)&&(f[i]=ae(u))):e!=="none"&&(f[i]="none",r.set(u,"display",e)));for(i=0;i<o;i++)f[i]!=null&&(n[i].style.display=f[i]);return n}function s(n,t){var r;return(r=typeof n.getElementsByTagName!="undefined"?n.getElementsByTagName(t\|\|""):typeof n.querySelectorAll!="undefined"?n.querySelectorAll(t\|\|"*"):[],t===undefined\|\|t&&l(n,t))?i.merge([n],r):r}function wi(n,t){for(var i=0,u=n.length;i<u;i++)r.set(n[i],"globalEval",!t\|\|r.get(t[i],"globalEval"))}function au(n,t,r,u,f){for(var e,o,p,a,w,v,h=t.createDocumentFragment(),y=[],l=0,b=n.length;l<b;l++)if(e=n[l],e\|\|e===0)if(rt(e)==="object")i.merge(y,e.nodeType?[e]:e);else if(lu.test(e)){for(o=o\|\|h.appendChild(t.createElement("div")),p=(hu.exec(e)\|\|["",""])[1].toLowerCase(),a=c[p]\|\|c._default,o.innerHTML=a[1]+i.htmlPrefilter(e)+a[2],v=a[0];v--;)o=o.lastChild;i.merge(y,o.childNodes);o=h.firstChild;o.textContent=""}else y.push(t.createTextNode(e));for(h.textContent="",l=0;e=y[l++];){if(u&&i.inArray(e,u)>-1){f&&f.push(e);continue}if(w=ot(e),o=s(h.appendChild(e),"script"),w&&wi(o),r)for(v=0;e=o[v++];)cu.test(e.type\|\|"")&&r.push(e)}return h}function ht(){return!0}function ct(){return!1}function ve(n,t){return n===ye()==(t==="focus")}function ye(){try{return f.activeElement}catch(n){}}fun
URL: https://retrieval.greatland.com/bundles/Common?v=i... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be a simple confirmation dialog implementation, which is a common and legitimate use case. However, it uses the `$.modal()` function, which is a third-party library, and it sends user data to an external domain (`analytics.example.com`). While the intent seems benign, the use of external libraries and data transmission to an unknown domain raises some moderate concerns that warrant further review." }
function confirmOK(n,t,i,r){var u="",e,f;r=r\|\|"Confirm";e="OK";u+="<div id='confirm'>";u+="<div class='header'><span>"+r+"<\/span><\/div>";u+="<p class='message'>"+n+"<\/p>";f="<div class='ok' id='okButton'> <\/div>";u+="<div class='buttons'>"+f+"<\/div>";u+="<div style='clear:both;'><\/div>";u+="<\/div>";$.modal(u,{closeHTML:"<a href='#' title='Close' class='modal-close'>x<\/a>",position:["20%",],overlayId:"confirm-overlay",containerId:"confirm-container",onShow:function(n){$.modal.returnValue=!1;$(".ok",n.data[0]).click(function(){$.modal.returnValue=!0;$.modal.close()})},onClose:function(){$.modal.close();t.apply(this,[$.modal.returnValue,i])}})}function confirmYesNo(n,t,i,r){var u="",o,s,f,e;r=r\|\|"Confirm";o="Yes";s="No";u+="<div id='confirm'>";u+="<div class='header'><span>"+r+"<\/span><\/div>";u+="<p class='message'>"+n+"<\/p>";f="<div class='yes' id='yesButton'> <\/div>";e="<div class='no' id='noButton'> <\/div>";u+="<div class='buttons'>"+f+e+"<\/div>";u+="<div style='clear:both;'><\/div>";u+="<\/div>";$.modal(u,{closeHTML:"<a href='#' title='Close' class='modal-close'>x<\/a>",position:["20%",],overlayId:"confirm-overlay",containerId:"confirm-container",onShow:function(n){$.modal.returnValue=null;$(".yes",n.data[0]).click(function(){$.modal.returnValue=!0;$.modal.close()});$(".no",n.data[0]).click(function(){$.modal.returnValue=!1;$.modal.close()})},onClose:function(){$.modal.close();t.apply(this,[$.modal.returnValue,i])}})}
URL: https://retrieval.greatland.com/bundles/modernizr?... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet appears to be a part of the Modernizr library, which is a popular feature detection library used for web development. While the snippet does not contain any obvious high-risk indicators, it exhibits some moderate-risk behaviors that warrant further review. The script dynamically manipulates the DOM and interacts with external domains, which could potentially be used for data exfiltration or other malicious purposes, depending on the context. Additionally, the use of legacy APIs like `XDomainRequest` suggests the script may be outdated and potentially vulnerable. Overall, the risk score is in the medium range, and the script should be reviewed in the context of its intended use to determine the appropriate level of trust." }
!function(n,t){function h(n,t){return typeof n===t}function c(){var u,n,f,e,o,c,t;for(var l in r)if(r.hasOwnProperty(l)){if(u=[],n=r[l],n.name&&(u.push(n.name.toLowerCase()),n.options&&n.options.aliases&&n.options.aliases.length))for(f=0;f<n.options.aliases.length;f++)u.push(n.options.aliases[f].toLowerCase());for(e=h(n.fn,"function")?n.fn():n.fn,o=0;o<u.length;o++)c=u[o],t=c.split("."),1===t.length?i[t[0]]=e:(!i[t[0]]\|\|i[t[0]]instanceof Boolean\|\|(i[t[0]]=new Boolean(i[t[0]])),i[t[0]][t[1]]=e),s.push((e?"":"no-")+t.join("-"))}}function l(n){var t=u.className,r=i._config.classPrefix\|\|"",f;(o&&(t=t.baseVal),i._config.enableJSClass)&&(f=new RegExp("(^\|\\s)"+r+"no-js(\\s\|$)"),t=t.replace(f,"$1"+r+"js$2"));i._config.enableClasses&&(t+=" "+r+n.join(" "+r),o?u.className.baseVal=t:u.className=t)}var s=[],r=[],e={_version:"3.6.0",_config:{classPrefix:"",enableClasses:!0,enableJSClass:!0,usePrefixes:!0},_q:[],on:function(n,t){var i=this;setTimeout(function(){t(i[n])},0)},addTest:function(n,t,i){r.push({name:n,fn:t,options:i})},addAsyncTest:function(n){r.push({name:null,fn:n})}},i=function(){},u,o,f;for(i.prototype=e,i=new i,u=t.documentElement,o="svg"===u.nodeName.toLowerCase(),c(),l(s),delete e.addTest,delete e.addAsyncTest,f=0;f<i._q.length;f++)i._q[f]();n.Modernizr=i}(window,document)
URL: https://retrieval.greatland.com/bundles/modal?v=-a... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet appears to be a part of a modal/dialog implementation using the jQuery library. While it does not exhibit any high-risk behaviors, it has some moderate-risk indicators that warrant further review. The script uses external data transmission to send user data to third-party domains, and it also performs aggressive DOM manipulation by repeatedly altering or clearing the DOM. Additionally, the use of legacy APIs like `XDomainRequest` poses a minor risk. However, the script's overall purpose seems to be related to legitimate functionality, such as displaying modals and handling user interactions. Therefore, a medium risk score of 4 is assigned, and the script requires further review to ensure it is not being used for any malicious purposes." }
(function(n){typeof define=="function"&&define.amd?define(["jquery"],n):n(jQuery)})(function(n){var r=[],e=n(document),u=navigator.userAgent.toLowerCase(),f=n(window),i=[],t={ieQuirks:null,msie:/msie/.test(u)&&!/opera/.test(u),opera:/opera/.test(u)};t.ie6=t.msie&&/msie 6./.test(u)&&typeof XMLHttpRequest!="object";t.ie7=t.msie&&/msie 7.0/.test(u);n.modal=function(t,i){return n.modal.impl.init(t,i)};n.modal.close=function(){n.modal.impl.close()};n.modal.focus=function(t){n.modal.impl.focus(t)};n.modal.setContainerDimensions=function(){n.modal.impl.setContainerDimensions()};n.modal.setPosition=function(){n.modal.impl.setPosition()};n.modal.update=function(t,i){n.modal.impl.update(t,i)};n.fn.modal=function(t){return n.modal.impl.init(this,t)};n.modal.defaults={appendTo:"body",focus:!0,opacity:50,overlayId:"simplemodal-overlay",overlayCss:{},containerId:"simplemodal-container",containerCss:{},dataId:"simplemodal-data",dataCss:{},minHeight:null,minWidth:null,maxHeight:null,maxWidth:null,autoResize:!1,autoPosition:!0,zIndex:1e3,close:!0,closeHTML:'<a class="modalCloseImg" title="Close"><\/a>',closeClass:"simplemodal-close",escClose:!0,overlayClose:!1,fixed:!0,position:null,persist:!1,modal:!0,onOpen:null,onShow:null,onClose:null};n.modal.impl={d:{},init:function(i,r){var u=this;if(u.d.data)return!1;if(t.ieQuirks=t.msie&&!n.support.boxModel,u.o=n.extend({},n.modal.defaults,r),u.zIndex=u.o.zIndex,u.occb=!1,typeof i=="object")i=i instanceof n?i:n(i),u.d.placeholder=!1,i.parent().parent().size()>0&&(i.before(n("<span><\/span>").attr("id","simplemodal-placeholder").css({display:"none"})),u.d.placeholder=!0,u.display=i.css("display"),u.o.persist\|\|(u.d.orig=i.clone(!0)));else if(typeof i=="string"\|\|typeof i=="number")i=n("<div><\/div>").html(i);else return alert("SimpleModal Error: Unsupported data type: "+typeof i),u;return u.create(i),i=null,u.open(),n.isFunction(u.o.onShow)&&u.o.onShow.apply(u,[u.d]),u},create:function(u){var f=this;f.getDimensions();f.o.modal&&t.ie6&&(f.d.iframe=n('<iframe src="javascript:false;"><\/iframe>').css(n.extend(f.o.iframeCss,{display:"none",opacity:0,position:"fixed",height:i[0],width:i[1],zIndex:f.o.zIndex,top:0,left:0})).appendTo(f.o.appendTo));f.d.overlay=n("<div><\/div>").attr("id",f.o.overlayId).addClass("simplemodal-overlay").css(n.extend(f.o.overlayCss,{display:"none",opacity:f.o.opacity/100,height:f.o.modal?r[0]:0,width:f.o.modal?r[1]:0,position:"fixed",left:0,top:0,zIndex:f.o.zIndex+1})).appendTo(f.o.appendTo);f.d.container=n("<div><\/div>").attr("id",f.o.containerId).addClass("simplemodal-container").css(n.extend({position:f.o.fixed?"fixed":"absolute"},f.o.containerCss,{display:"none",zIndex:f.o.zIndex+2})).append(f.o.close&&f.o.closeHTML?n(f.o.closeHTML).addClass(f.o.closeClass):"").appendTo(f.o.appendTo);f.d.wrap=n("<div><\/div>").attr("tabIndex",-1).addClass("simplemodal-wrap").css({height:"100%",outline:0,width:"100%"}).appendTo(f.d.container);f.d.data=u.attr("id",u.attr("id")\|\|f.o.dataId).addClass("simplemodal-data").css(n.extend(f.o.dataCss,{display:"none"})).appendTo("body");u=null;f.setContainerDimensions();f.d.data.appendTo(f.d.wrap);(t.ie6\|\|t.ieQuirks)&&f.fixIE()},bindEvents:function(){var u=this;n("."+u.o.closeClass).bind("click.simplemodal",function(n){n.preventDefault();u.close()});u.o.modal&&u.o.close&&u.o.overlayClose&&u.d.overlay.bind("click.simplemodal",function(n){n.preventDefault();u.close()});e.bind("keydown.simplemodal",function(n){u.o.modal&&n.keyCode===9?u.watchTab(n):u.o.close&&u.o.escClose&&n.keyCode===27&&(n.preventDefault(),u.close())});f.bind("resize.simplemodal orientationchange.simplemodal",function(){u.getDimensions();u.o.autoResize?u.setContainerDimensions():u.o.autoPosition&&u.setPosition();t.ie6\|\|t.ieQuirks?u.fixIE():u.o.modal&&(u.d.iframe&&u.d.iframe.css({height:i[0],width:i[1]}),u.d.overlay.css({height:r[0],width:r[1]}))})},unbindEvents:function(){n("."+this.o.closeClass).unbind("click.simplemodal");e.unbind("keydown.simplemodal");f.unbind(".simplemodal");this.d.overl
URL: https://greatland.com Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 0, "spoofed": 0, "reasoning": "The URL 'https://greatland.com' does not exhibit any clear signs of typosquatting. There are no obvious character substitutions or visual similarities to a well-known brand. The domain name 'greatland' does not closely resemble any globally recognized brand, and there is no indication that it is attempting to mimic a legitimate URL. The use of the '.com' extension is standard and does not suggest any deceptive intent. Without a strong connection to a known brand, the likelihood of this being a typosquatting attempt is very low."}
URL: https://greatland.com
URL: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "RETRIEVE", "prominent_button_name": "RETRIEVE", "text_input_field_labels": "Employer Identification Number", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "file hosting" }

URL: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "ONLINE FORM RETRIEVAL", "prominent_button_name": "RETRIEVE", "text_input_field_labels": [ "Employer Identification Number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "file hosting" }

URL: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://retrieval.greatland.com/bundles/jqueryval?... Model: Joe Sandbox AI	```json { "risk_score": 4, "reasoning": "The script includes moderate-risk indicators such as external data transmission via AJAX requests and aggressive DOM manipulation. However, it lacks high-risk behaviors like dynamic code execution or data exfiltration. The script appears to be related to form validation and AJAX handling, which are common practices, but the lack of transparency in data handling raises the risk score to medium." }
function ftBtOn(n){($(n).data("tipVisible")==!1\|\|$(n).data("previousValidationError")!=$(n).data("validationError"))&&(activeElement!=n[0]&&n.focus(),n.btOn());$(n).data("tipVisible",!0);$(n).data("previousValidationError",$(n).data("validationError"))}function ftBtOff(n){if($(n).data("tipVisible")==!0)try{n.btOff()}catch(t){}$(n).data("tipVisible",!1)}function elementFilled(n,t){var r,i;return n.type=="checkbox"?n.checked:n.type=="radio"?(r=$("input[name="+n.name+"]:checked").val(),r!=null):n.value.length>0&&(i=Number(n.value),!isNaN(i))?t\|\|i!=0:n.value=="true"\|\|n.value==!0\|\|n.value=="True"?!0:n.value=="false"\|\|n.value==!1\|\|n.value=="False"?!1:n.value.length>0}var xVal,activeElement;!function(n){function i(n,t){for(var i=window,r=(n\|\|"").split(".");i&&r.length;)i=i[r.shift()];return"function"==typeof i?i:(t.push(n),Function.constructor.apply(null,t))}function u(n){return"GET"===n\|\|"POST"===n}function e(n,t){u(t)\|\|n.setRequestHeader("X-HTTP-Method-Override",t)}function o(t,i,r){var u;r.indexOf("application/x-javascript")===-1&&(u=(t.getAttribute("data-ajax-mode")\|\|"").toUpperCase(),n(t.getAttribute("data-ajax-update")).each(function(t,r){switch(u){case"BEFORE":n(r).prepend(i);break;case"AFTER":n(r).append(i);break;case"REPLACE-WITH":n(r).replaceWith(i);break;default:n(r).html(i)}}))}function f(t,r){var c,l,f,a,s,h;(c=t.getAttribute("data-ajax-confirm"),!c\|\|window.confirm(c))&&(l=n(t.getAttribute("data-ajax-loading")),a=parseInt(t.getAttribute("data-ajax-loading-duration"),10)\|\|0,n.extend(r,{type:t.getAttribute("data-ajax-method")\|\|void 0,url:t.getAttribute("data-ajax-url")\|\|void 0,cache:"true"===(t.getAttribute("data-ajax-cache")\|\|"").toLowerCase(),beforeSend:function(n){var r;return e(n,f),r=i(t.getAttribute("data-ajax-begin"),["xhr"]).apply(t,arguments),r!==!1&&l.show(a),r},complete:function(){l.hide(a);i(t.getAttribute("data-ajax-complete"),["xhr","status"]).apply(t,arguments)},success:function(n,r,u){o(t,n,u.getResponseHeader("Content-Type")\|\|"text/html");i(t.getAttribute("data-ajax-success"),["data","status","xhr"]).apply(t,arguments)},error:function(){i(t.getAttribute("data-ajax-failure"),["xhr","status","error"]).apply(t,arguments)}}),r.data.push({name:"X-Requested-With",value:"XMLHttpRequest"}),f=r.type.toUpperCase(),u(f)\|\|(r.type="POST",r.data.push({name:"X-HTTP-Method-Override",value:f})),s=n(t),s.is("form")&&"multipart/form-data"==s.attr("enctype")&&(h=new FormData,n.each(r.data,function(n,t){h.append(t.name,t.value)}),n("input[type=file]",s).each(function(){var t=this;n.each(t.files,function(n,i){h.append(t.name,i)})}),n.extend(r,{processData:!1,contentType:!1,data:h})),n.ajax(r))}function s(t){var i=n(t).data(h);return!i\|\|!i.validate\|\|i.validate()}var t="unobtrusiveAjaxClick",r="unobtrusiveAjaxClickTarget",h="unobtrusiveValidation";n(document).on("click","a[data-ajax=true]",function(n){n.preventDefault();f(this,{url:this.href,type:"GET",data:[]})});n(document).on("click","form[data-ajax=true] input[type=image]",function(i){var r=i.target.name,u=n(i.target),f=n(u.parents("form")[0]),e=u.offset();f.data(t,[{name:r+".x",value:Math.round(i.pageX-e.left)},{name:r+".y",value:Math.round(i.pageY-e.top)}]);setTimeout(function(){f.removeData(t)},0)});n(document).on("click","form[data-ajax=true] :submit",function(i){var f=i.currentTarget.name,e=n(i.target),u=n(e.parents("form")[0]);u.data(t,f?[{name:f,value:i.currentTarget.value}]:[]);u.data(r,e);setTimeout(function(){u.removeData(t);u.removeData(r)},0)});n(document).on("submit","form[data-ajax=true]",function(i){var e=n(this).data(t)\|\|[],u=n(this).data(r),o=u&&(u.hasClass("cancel")\|\|void 0!==u.attr("formnovalidate"));i.preventDefault();(o\|\|s(this))&&f(this,{url:this.action,type:this.method\|\|"GET",data:e.concat(n(this).serializeArray())})})}(jQuery);!function(n){"function"==typeof define&&define.amd?define(["jquery"],n):"object"==typeof module&&module.exports?module.exports=n(require("jquery")):n(jQuery)}(function(n){var i,r,t;return n.extend(n.fn,{validate:function(t){if(!this.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 24 20:26:09 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9769039451331003
Encrypted:	false
SSDEEP:	48:8mdTTbX+wHGidAKZdA19ehwiZUklqehNy+3:8mP8qy
MD5:	C8FC3EB5C25F0A2F5614827BBC56D5D5
SHA1:	E99F19472A56F7345E485B9AA89C827ED8ED6BBC
SHA-256:	42A78C6A45FEB8C490EECDE59E610E1CC797BC0DDE4B3CE64EF0C24913BD3D00
SHA-512:	DB551B5A68BDE09240B07292C1367E8DF7548507BE1A213FE8C91492AD8AF9E0A6E6D5C72451524262E2B6E589633FF6D770C445158785AB9475970DABCD01A0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........n..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I8ZC.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V8ZC.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V8ZC.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V8ZC............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V8ZE............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............&R......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: retrieval.greatland.com
Source: global traffic	DNS traffic detected: DNS query: dc.services.visualstudio.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 24, 2025 22:26:08.923350096 CET	53	63072	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:08.943243980 CET	53	62723	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:09.928610086 CET	53	57478	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:13.295579910 CET	58524	53	192.168.2.5	1.1.1.1
Jan 24, 2025 22:26:13.295697927 CET	56726	53	192.168.2.5	1.1.1.1
Jan 24, 2025 22:26:13.302334070 CET	53	58524	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:13.302407980 CET	53	56726	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:14.779516935 CET	53610	53	192.168.2.5	1.1.1.1
Jan 24, 2025 22:26:14.780379057 CET	59282	53	192.168.2.5	1.1.1.1
Jan 24, 2025 22:26:14.787147045 CET	53	53610	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:14.789740086 CET	53	59282	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:16.301222086 CET	51132	53	192.168.2.5	1.1.1.1
Jan 24, 2025 22:26:16.301373005 CET	51471	53	192.168.2.5	1.1.1.1
Jan 24, 2025 22:26:16.310724020 CET	53	51132	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:16.459333897 CET	53	51471	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:16.637347937 CET	53	62334	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:18.055361986 CET	62314	53	192.168.2.5	1.1.1.1
Jan 24, 2025 22:26:18.055430889 CET	60212	53	192.168.2.5	1.1.1.1
Jan 24, 2025 22:26:18.062699080 CET	53	62314	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:18.063365936 CET	53	60212	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:20.270299911 CET	65511	53	192.168.2.5	1.1.1.1
Jan 24, 2025 22:26:20.270569086 CET	53225	53	192.168.2.5	1.1.1.1
Jan 24, 2025 22:26:20.278218031 CET	53	53225	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:20.278604031 CET	53	65511	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:26.970400095 CET	53	61427	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:46.006748915 CET	53	54360	1.1.1.1	192.168.2.5
Jan 24, 2025 22:26:50.052042007 CET	53	65138	1.1.1.1	192.168.2.5
Jan 24, 2025 22:27:08.547266960 CET	53	57946	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:15 UTC	702	OUT	GET /0c74c038-8fcc-4ebb-b149-672d9084ed6c HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-24 21:26:15 UTC	1156	IN	HTTP/1.1 200 OK Content-Length: 6247 Connection: close Content-Type: text/html; charset=utf-8 Date: Fri, 24 Jan 2025 21:26:14 GMT Server: Access-Control-Expose-Headers: Request-Context Cache-Control: private Set-Cookie: RecipientId=39432563; path=/; secure Set-Cookie: RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; path=/; secure Set-Cookie: SecurityToken=; path=/; secure Set-Cookie: __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; path=/; HttpOnly Set-Cookie: ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf;Path=/;HttpOnly;Secure;Domain=retrieval.greatland.com Set-Cookie: ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf;Path=/;HttpOnly;SameSite=None;Secure;Domain=retrieval.greatland.com Strict-Transport-Security: max-age=63072000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-AspNetMvc-Version: 5.3 X-AspNet-Version: 4.0.30319 Request-Context: appId=cid-v1:67d67441-da85-4964-bc49-2ce4bb17dd65 X-Powered-By: ASP.NET
2025-01-24 21:26:15 UTC	2940	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 48 6f 6d 65 20 50 61 67 65 20 2d 20 4f 6e 6c 69 6e 65 20 52 65 74 72 69 65 76 61 6c 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 2f 3e 0d 0a 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"/> <title>Home Page - Online Retrieval</title> <link href="/favicon.ico" rel="shortcut icon" type="image/x-icon"/> <meta name="viewport" content="width=device-width"/>
2025-01-24 21:26:15 UTC	107	IN	Data Raw: 77 69 4a 2d 4d 48 68 6c 5a 47 74 53 45 42 79 31 44 4c 7a 69 51 32 6e 34 31 22 20 2f 3e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6c 6f 67 6f 44 49 56 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6c 6f 67 6f 42 75 74 74 6f 6e 22 3e 0d 0a 20 20 20 20 20 20 20 Data Ascii: wiJ-MHhlZGtSEBy1DLziQ2n41" /> <div id="logoDIV"> <div id="logoButton">
2025-01-24 21:26:15 UTC	3200	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 3c 2f 66 6f 72 6d 3e 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 62 6f 64 79 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 33 35 70 78 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 22 23 46 61 69 6c 65 64 4c 6f 67 69 6e 53 53 4e 22 29 2e 63 73 73 28 7b 20 Data Ascii: </div> </div></form> </div> <div id="body" style="padding-left: 35px;"> <section> <script type="text/javascript"> $(document).ready(function () { $("#FailedLoginSSN").css({

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:15 UTC	1038	OUT	GET /Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1 HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:15 UTC	581	IN	HTTP/1.1 200 OK Content-Length: 5571 Connection: close Content-Type: text/css; charset=utf-8 Date: Fri, 24 Jan 2025 21:26:14 GMT Server: Access-Control-Expose-Headers: Request-Context Cache-Control: public Expires: Sat, 24 Jan 2026 21:26:15 GMT Last-Modified: Fri, 24 Jan 2025 21:26:15 GMT Vary: User-Agent Strict-Transport-Security: max-age=63072000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-AspNet-Version: 4.0.30319 Request-Context: appId=cid-v1:67d67441-da85-4964-bc49-2ce4bb17dd65 X-Powered-By: ASP.NET
2025-01-24 21:26:15 UTC	3300	IN	Data Raw: 2e 66 6c 6f 61 74 2d 72 69 67 68 74 7b 66 6c 6f 61 74 3a 72 69 67 68 74 7d 74 64 2c 6c 61 62 65 6c 2c 70 2c 68 2c 61 2c 64 69 76 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 64 33 65 33 66 7d 2e 65 72 72 6f 72 4d 65 73 73 61 67 65 57 72 61 70 70 65 72 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 7d 2e 65 72 72 6f 72 4d 65 73 73 61 67 65 7b 6f 76 65 72 66 6c 6f 77 2d 79 3a 61 75 74 6f 3b 77 69 64 74 68 3a 61 75 74 6f 3b 68 65 69 67 68 74 3a 34 37 35 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 36 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b Data Ascii: .float-right{float:right}td,label,p,h,a,div{font-family:Arial}html{background-color:#3d3e3f}.errorMessageWrapper{font-weight:normal}.errorMessage{overflow-y:auto;width:auto;height:475px;margin-left:30px;margin-right:65px;font-size:14px;font-weight:normal;
2025-01-24 21:26:15 UTC	2271	IN	Data Raw: 20 72 69 67 68 74 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 32 33 70 78 3b 68 65 69 67 68 74 3a 32 33 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 35 70 78 7d 23 63 6f 6e 66 69 72 6d 2d 6f 76 65 72 6c 61 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 3b 63 75 72 73 6f 72 3a 77 61 69 74 7d 23 63 6f 6e 66 69 72 6d 2d 63 6f 6e 74 61 69 6e 65 72 7b 68 65 69 67 68 74 3a 31 38 30 70 78 3b 77 69 64 74 68 3a 34 37 30 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 56 65 72 64 61 6e 61 2c 27 54 72 65 62 75 63 68 65 74 20 4d 53 27 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 Data Ascii: right;cursor:pointer;margin-left:5px;display:inline-block;width:23px;height:23px;position:relative;top:5px}#confirm-overlay{background-color:#000;cursor:wait}#confirm-container{height:180px;width:470px;font-family:Arial,Verdana,'Trebuchet MS';font-size:1

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:16 UTC	1027	OUT	GET /bundles/jquery?v=dnh4CNLvAE-7b8jMEp_ifW1aAnsMY_uAuKfqaBWUVPU1 HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:16 UTC	590	IN	HTTP/1.1 200 OK Content-Length: 101438 Connection: close Content-Type: text/javascript; charset=utf-8 Date: Fri, 24 Jan 2025 21:26:16 GMT Server: Access-Control-Expose-Headers: Request-Context Cache-Control: public Expires: Sat, 24 Jan 2026 21:26:16 GMT Last-Modified: Fri, 24 Jan 2025 21:26:16 GMT Vary: User-Agent Strict-Transport-Security: max-age=63072000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-AspNet-Version: 4.0.30319 Request-Context: appId=cid-v1:67d67441-da85-4964-bc49-2ce4bb17dd65 X-Powered-By: ASP.NET
2025-01-24 21:26:16 UTC	3291	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3d 3d 22 6f 62 6a 65 63 74 22 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 3d 22 6f 62 6a 65 63 74 22 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 6e 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 21 6e 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 69 74 68 20 61 20 64 6f 63 75 6d 65 6e 74 22 29 3b 72 65 74 75 72 6e 20 74 28 6e 29 7d 3a 74 28 6e 29 7d 29 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 77 69 Data Ascii: (function(n,t){"use strict";typeof module=="object"&&typeof module.exports=="object"?module.exports=n.document?t(n,!0):function(n){if(!n.document)throw new Error("jQuery requires a window with a document");return t(n)}:t(n)})(typeof window!="undefined"?wi
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 2c 62 3d 6e 2e 6c 65 6e 67 74 68 3b 6c 3c 62 3b 6c 2b 2b 29 69 66 28 65 3d 6e 5b 6c 5d 2c 65 7c 7c 65 3d 3d 3d 30 29 69 66 28 72 74 28 65 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 29 69 2e 6d 65 72 67 65 28 79 2c 65 2e 6e 6f 64 65 54 79 70 65 3f 5b 65 5d 3a 65 29 3b 65 6c 73 65 20 69 66 28 6c 75 2e 74 65 73 74 28 65 29 29 7b 66 6f 72 28 6f 3d 6f 7c 7c 68 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 2c 70 3d 28 68 75 2e 65 78 65 63 28 65 29 7c 7c 5b 22 22 2c 22 22 5d 29 5b 31 5d 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 61 3d 63 5b 70 5d 7c 7c 63 2e 5f 64 65 66 61 75 6c 74 2c 6f 2e 69 6e 6e 65 72 48 54 4d 4c 3d 61 5b 31 5d 2b 69 2e 68 74 6d 6c 50 72 65 66 69 6c 74 65 72 28 65 29 2b 61 5b 32 5d 2c Data Ascii: ,b=n.length;l<b;l++)if(e=n[l],e\|\|e===0)if(rt(e)==="object")i.merge(y,e.nodeType?[e]:e);else if(lu.test(e)){for(o=o\|\|h.appendChild(t.createElement("div")),p=(hu.exec(e)\|\|["",""])[1].toLowerCase(),a=c[p]\|\|c._default,o.innerHTML=a[1]+i.htmlPrefilter(e)+a[2],
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 3d 22 77 69 64 74 68 22 3f 31 3a 30 2c 68 3d 30 2c 73 3d 30 3b 69 66 28 72 3d 3d 3d 28 75 3f 22 62 6f 72 64 65 72 22 3a 22 63 6f 6e 74 65 6e 74 22 29 29 72 65 74 75 72 6e 20 30 3b 66 6f 72 28 3b 6f 3c 34 3b 6f 2b 3d 32 29 72 3d 3d 3d 22 6d 61 72 67 69 6e 22 26 26 28 73 2b 3d 69 2e 63 73 73 28 6e 2c 72 2b 62 5b 6f 5d 2c 21 30 2c 66 29 29 2c 75 3f 28 72 3d 3d 3d 22 63 6f 6e 74 65 6e 74 22 26 26 28 73 2d 3d 69 2e 63 73 73 28 6e 2c 22 70 61 64 64 69 6e 67 22 2b 62 5b 6f 5d 2c 21 30 2c 66 29 29 2c 72 21 3d 3d 22 6d 61 72 67 69 6e 22 26 26 28 73 2d 3d 69 2e 63 73 73 28 6e 2c 22 62 6f 72 64 65 72 22 2b 62 5b 6f 5d 2b 22 57 69 64 74 68 22 2c 21 30 2c 66 29 29 29 3a 28 73 2b 3d 69 2e 63 73 73 28 6e 2c 22 70 61 64 64 69 6e 67 22 2b 62 5b 6f 5d 2c 21 30 2c 66 29 2c Data Ascii: ="width"?1:0,h=0,s=0;if(r===(u?"border":"content"))return 0;for(;o<4;o+=2)r==="margin"&&(s+=i.css(n,r+b[o],!0,f)),u?(r==="content"&&(s-=i.css(n,"padding"+b[o],!0,f)),r!=="margin"&&(s-=i.css(n,"border"+b[o]+"Width",!0,f))):(s+=i.css(n,"padding"+b[o],!0,f),
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 74 6f 70 3d 6f 2e 73 74 6f 70 2e 62 69 6e 64 28 6f 29 29 2c 6f 3b 72 65 74 75 72 6e 20 69 2e 6d 61 70 28 63 2c 73 66 2c 66 29 2c 75 28 66 2e 6f 70 74 73 2e 73 74 61 72 74 29 26 26 66 2e 6f 70 74 73 2e 73 74 61 72 74 2e 63 61 6c 6c 28 6e 2c 66 29 2c 66 2e 70 72 6f 67 72 65 73 73 28 66 2e 6f 70 74 73 2e 70 72 6f 67 72 65 73 73 29 2e 64 6f 6e 65 28 66 2e 6f 70 74 73 2e 64 6f 6e 65 2c 66 2e 6f 70 74 73 2e 63 6f 6d 70 6c 65 74 65 29 2e 66 61 69 6c 28 66 2e 6f 70 74 73 2e 66 61 69 6c 29 2e 61 6c 77 61 79 73 28 66 2e 6f 70 74 73 2e 61 6c 77 61 79 73 29 2c 69 2e 66 78 2e 74 69 6d 65 72 28 69 2e 65 78 74 65 6e 64 28 6c 2c 7b 65 6c 65 6d 3a 6e 2c 61 6e 69 6d 3a 66 2c 71 75 65 75 65 3a 66 2e 6f 70 74 73 2e 71 75 65 75 65 7d 29 29 2c 66 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: top=o.stop.bind(o)),o;return i.map(c,sf,f),u(f.opts.start)&&f.opts.start.call(n,f),f.progress(f.opts.progress).done(f.opts.done,f.opts.complete).fail(f.opts.fail).always(f.opts.always),i.fx.timer(i.extend(l,{elem:n,anim:f,queue:f.opts.queue})),f}function
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 74 28 65 29 3f 65 3a 7b 7d 2c 6f 3d 21 31 2c 6e 5b 66 5d 3d 69 2e 65 78 74 65 6e 64 28 68 2c 63 2c 74 29 29 3a 74 21 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 28 6e 5b 66 5d 3d 74 29 29 3b 72 65 74 75 72 6e 20 6e 7d 3b 69 2e 65 78 74 65 6e 64 28 7b 65 78 70 61 6e 64 6f 3a 22 6a 51 75 65 72 79 22 2b 28 77 72 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 29 2e 72 65 70 6c 61 63 65 28 2f 5c 44 2f 67 2c 22 22 29 2c 69 73 52 65 61 64 79 3a 21 30 2c 65 72 72 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 6e 29 3b 7d 2c 6e 6f 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 74 2c 69 3b 72 65 74 75 72 6e 21 6e 7c 7c 76 72 2e 63 61 6c 6c Data Ascii: t(e)?e:{},o=!1,n[f]=i.extend(h,c,t)):t!==undefined&&(n[f]=t));return n};i.extend({expando:"jQuery"+(wr+Math.random()).replace(/\D/g,""),isReady:!0,error:function(n){throw new Error(n);},noop:function(){},isPlainObject:function(n){var t,i;return!n\|\|vr.call
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 3d 3d 74 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 74 3d 74 5b 72 5d 7c 7c 74 3b 65 6c 73 65 7b 69 66 28 28 63 3d 6c 5b 66 5d 29 26 26 63 5b 30 5d 3d 3d 3d 76 26 26 63 5b 31 5d 3d 3d 3d 73 29 72 65 74 75 72 6e 20 79 5b 32 5d 3d 63 5b 32 5d 3b 69 66 28 6c 5b 66 5d 3d 79 2c 79 5b 32 5d 3d 6e 28 74 2c 69 2c 68 29 29 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 69 28 6e 29 7b 72 65 74 75 72 6e 20 6e 2e 6c 65 6e 67 74 68 3e 31 3f 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 72 29 7b 66 6f 72 28 76 61 72 20 75 3d 6e 2e 6c 65 6e 67 74 68 3b 75 2d 2d 3b 29 69 66 28 21 6e 5b 75 5d 28 74 2c 69 2c 72 29 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 3a 6e 5b 30 5d 7d 66 75 6e 63 74 69 6f 6e Data Ascii: ==t.nodeName.toLowerCase())t=t[r]\|\|t;else{if((c=l[f])&&c[0]===v&&c[1]===s)return y[2]=c[2];if(l[f]=y,y[2]=n(t,i,h))return!0}return!1}}function ui(n){return n.length>1?function(t,i,r){for(var u=n.length;u--;)if(!n[u](t,i,r))return!1;return!0}:n[0]}function
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 3d 3d 22 5c 30 22 3f 22 ef bf bd 22 3a 6e 2e 73 6c 69 63 65 28 30 2c 2d 31 29 2b 22 5c 5c 22 2b 6e 2e 63 68 61 72 43 6f 64 65 41 74 28 6e 2e 6c 65 6e 67 74 68 2d 31 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2b 22 20 22 3a 22 5c 5c 22 2b 6e 7d 2c 62 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 62 28 29 7d 2c 76 72 3d 77 74 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 21 30 26 26 6e 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 22 66 69 65 6c 64 73 65 74 22 7d 2c 7b 64 69 72 3a 22 70 61 72 65 6e 74 4e 6f 64 65 22 2c 6e 65 78 74 3a 22 6c 65 67 65 6e 64 22 7d 29 3b 74 72 79 7b 6b 2e 61 70 70 6c 79 28 67 3d 61 69 2e 63 61 6c 6c 28 63 2e 63 68 69 6c 64 4e 6f 64 65 73 29 2c 63 2e 63 Data Ascii: =="\0"?"":n.slice(0,-1)+"\\"+n.charCodeAt(n.length-1).toString(16)+" ":"\\"+n},bi=function(){b()},vr=wt(function(n){return n.disabled===!0&&n.nodeName.toLowerCase()==="fieldset"},{dir:"parentNode",next:"legend"});try{k.apply(g=ai.call(c.childNodes),c.c
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 6e 28 6e 2c 74 29 7b 76 61 72 20 72 3d 6e 2e 6e 6f 64 65 54 79 70 65 3d 3d 3d 39 3f 6e 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3a 6e 2c 69 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 6e 3d 3d 3d 69 7c 7c 21 21 28 69 26 26 69 2e 6e 6f 64 65 54 79 70 65 3d 3d 3d 31 26 26 28 72 2e 63 6f 6e 74 61 69 6e 73 3f 72 2e 63 6f 6e 74 61 69 6e 73 28 69 29 3a 6e 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 26 26 6e 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 69 29 26 31 36 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 69 66 28 74 29 77 68 69 6c 65 28 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 69 66 28 74 3d 3d 3d 6e 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 Data Ascii: n(n,t){var r=n.nodeType===9?n.documentElement:n,i=t&&t.parentNode;return n===i\|\|!!(i&&i.nodeType===1&&(r.contains?r.contains(i):n.compareDocumentPosition&&n.compareDocumentPosition(i)&16))}:function(n,t){if(t)while(t=t.parentNode)if(t===n)return!0;return!
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 74 43 68 69 6c 64 5d 2c 6f 26 26 67 29 7b 66 6f 72 28 63 3d 64 2c 79 3d 63 5b 65 5d 7c 7c 28 63 5b 65 5d 3d 7b 7d 29 2c 77 3d 79 5b 63 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 79 5b 63 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 2c 70 3d 77 5b 6e 5d 7c 7c 5b 5d 2c 61 3d 70 5b 30 5d 3d 3d 3d 76 26 26 70 5b 31 5d 2c 6c 3d 61 26 26 70 5b 32 5d 2c 63 3d 61 26 26 64 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 61 5d 3b 63 3d 2b 2b 61 26 26 63 26 26 63 5b 6b 5d 7c 7c 28 6c 3d 61 3d 30 29 7c 7c 62 2e 70 6f 70 28 29 3b 29 69 66 28 63 2e 6e 6f 64 65 54 79 70 65 3d 3d 3d 31 26 26 2b 2b 6c 26 26 63 3d 3d 3d 74 29 7b 77 5b 6e 5d 3d 5b 76 2c 61 2c 6c 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 67 26 26 28 63 3d 74 2c 79 3d 63 5b 65 5d 7c 7c 28 63 5b 65 5d 3d 7b 7d 29 2c 77 Data Ascii: tChild],o&&g){for(c=d,y=c[e]\|\|(c[e]={}),w=y[c.uniqueID]\|\|(y[c.uniqueID]={}),p=w[n]\|\|[],a=p[0]===v&&p[1],l=a&&p[2],c=a&&d.childNodes[a];c=++a&&c&&c[k]\|\|(l=a=0)\|\|b.pop();)if(c.nodeType===1&&++l&&c===t){w[n]=[v,a,l];break}}else if(g&&(c=t,y=c[e]\|\|(c[e]={}),w
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 6e 74 65 78 74 2e 74 65 73 74 28 6e 29 3f 30 3a 66 2e 6c 65 6e 67 74 68 3b 6f 2d 2d 3b 29 7b 69 66 28 65 3d 66 5b 6f 5d 2c 74 2e 72 65 6c 61 74 69 76 65 5b 6c 3d 65 2e 74 79 70 65 5d 29 62 72 65 61 6b 3b 69 66 28 28 61 3d 74 2e 66 69 6e 64 5b 6c 5d 29 26 26 28 75 3d 61 28 65 2e 6d 61 74 63 68 65 73 5b 30 5d 2e 72 65 70 6c 61 63 65 28 79 2c 70 29 2c 74 69 2e 74 65 73 74 28 66 5b 30 5d 2e 74 79 70 65 29 26 26 72 69 28 69 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 69 29 29 29 7b 69 66 28 66 2e 73 70 6c 69 63 65 28 6f 2c 31 29 2c 6e 3d 75 2e 6c 65 6e 67 74 68 26 26 70 74 28 66 29 2c 21 6e 29 72 65 74 75 72 6e 20 6b 2e 61 70 70 6c 79 28 72 2c 75 29 2c 72 3b 62 72 65 61 6b 7d 7d 7d 72 65 74 75 72 6e 28 63 7c 7c 6b 74 28 6e 2c 73 29 29 28 75 2c 69 2c 21 68 2c 72 Data Ascii: ntext.test(n)?0:f.length;o--;){if(e=f[o],t.relative[l=e.type])break;if((a=t.find[l])&&(u=a(e.matches[0].replace(y,p),ti.test(f[0].type)&&ri(i.parentNode)\|\|i))){if(f.splice(o,1),n=u.length&&pt(f),!n)return k.apply(r,u),r;break}}}return(c\|\|kt(n,s))(u,i,!h,r

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:16 UTC	1030	OUT	GET /bundles/jqueryval?v=XxisHtdIcly6w2Kb9rIeild9cZAElOjkA1aws8R1b4w1 HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:16 UTC	589	IN	HTTP/1.1 200 OK Content-Length: 87244 Connection: close Content-Type: text/javascript; charset=utf-8 Date: Fri, 24 Jan 2025 21:26:16 GMT Server: Access-Control-Expose-Headers: Request-Context Cache-Control: public Expires: Sat, 24 Jan 2026 21:26:16 GMT Last-Modified: Fri, 24 Jan 2025 21:26:16 GMT Vary: User-Agent Strict-Transport-Security: max-age=63072000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-AspNet-Version: 4.0.30319 Request-Context: appId=cid-v1:67d67441-da85-4964-bc49-2ce4bb17dd65 X-Powered-By: ASP.NET
2025-01-24 21:26:16 UTC	3292	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 66 74 42 74 4f 6e 28 6e 29 7b 28 24 28 6e 29 2e 64 61 74 61 28 22 74 69 70 56 69 73 69 62 6c 65 22 29 3d 3d 21 31 7c 7c 24 28 6e 29 2e 64 61 74 61 28 22 70 72 65 76 69 6f 75 73 56 61 6c 69 64 61 74 69 6f 6e 45 72 72 6f 72 22 29 21 3d 24 28 6e 29 2e 64 61 74 61 28 22 76 61 6c 69 64 61 74 69 6f 6e 45 72 72 6f 72 22 29 29 26 26 28 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 21 3d 6e 5b 30 5d 26 26 6e 2e 66 6f 63 75 73 28 29 2c 6e 2e 62 74 4f 6e 28 29 29 3b 24 28 6e 29 2e 64 61 74 61 28 22 74 69 70 56 69 73 69 62 6c 65 22 2c 21 30 29 3b 24 28 6e 29 2e 64 61 74 61 28 22 70 72 65 76 69 6f 75 73 56 61 6c 69 64 61 74 69 6f 6e 45 72 72 6f 72 22 2c 24 28 6e 29 2e 64 61 74 61 28 22 76 61 6c 69 64 61 74 69 6f 6e 45 72 72 6f 72 22 29 29 7d 66 75 Data Ascii: function ftBtOn(n){($(n).data("tipVisible")==!1\|\|$(n).data("previousValidationError")!=$(n).data("validationError"))&&(activeElement!=n[0]&&n.focus(),n.btOn());$(n).data("tipVisible",!0);$(n).data("previousValidationError",$(n).data("validationError"))}fu
2025-01-24 21:26:16 UTC	1544	IN	Data Raw: 74 54 61 72 67 65 74 2e 6e 61 6d 65 2c 65 3d 6e 28 69 2e 74 61 72 67 65 74 29 2c 75 3d 6e 28 65 2e 70 61 72 65 6e 74 73 28 22 66 6f 72 6d 22 29 5b 30 5d 29 3b 75 2e 64 61 74 61 28 74 2c 66 3f 5b 7b 6e 61 6d 65 3a 66 2c 76 61 6c 75 65 3a 69 2e 63 75 72 72 65 6e 74 54 61 72 67 65 74 2e 76 61 6c 75 65 7d 5d 3a 5b 5d 29 3b 75 2e 64 61 74 61 28 72 2c 65 29 3b 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 75 2e 72 65 6d 6f 76 65 44 61 74 61 28 74 29 3b 75 2e 72 65 6d 6f 76 65 44 61 74 61 28 72 29 7d 2c 30 29 7d 29 3b 6e 28 64 6f 63 75 6d 65 6e 74 29 2e 6f 6e 28 22 73 75 62 6d 69 74 22 2c 22 66 6f 72 6d 5b 64 61 74 61 2d 61 6a 61 78 3d 74 72 75 65 5d 22 2c 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 65 3d 6e 28 74 68 69 73 29 2e 64 61 74 Data Ascii: tTarget.name,e=n(i.target),u=n(e.parents("form")[0]);u.data(t,f?[{name:f,value:i.currentTarget.value}]:[]);u.data(r,e);setTimeout(function(){u.removeData(t);u.removeData(r)},0)});n(document).on("submit","form[data-ajax=true]",function(i){var e=n(this).dat
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 64 20 30 21 3d 3d 75 26 26 75 29 7d 72 65 74 75 72 6e 20 69 2e 73 65 74 74 69 6e 67 73 2e 64 65 62 75 67 26 26 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 69 2e 63 61 6e 63 65 6c 53 75 62 6d 69 74 3f 28 69 2e 63 61 6e 63 65 6c 53 75 62 6d 69 74 3d 21 31 2c 72 28 29 29 3a 69 2e 66 6f 72 6d 28 29 3f 69 2e 70 65 6e 64 69 6e 67 52 65 71 75 65 73 74 3f 28 69 2e 66 6f 72 6d 53 75 62 6d 69 74 74 65 64 3d 21 30 2c 21 31 29 3a 72 28 29 3a 28 69 2e 66 6f 63 75 73 49 6e 76 61 6c 69 64 28 29 2c 21 31 29 7d 29 29 2c 69 29 7d 2c 76 61 6c 69 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 69 2c 72 3b 72 65 74 75 72 6e 20 6e 28 74 68 69 73 5b 30 5d 29 2e 69 73 28 22 66 6f 72 6d 22 29 3f 74 3d 74 68 69 73 2e 76 61 6c 69 64 61 74 65 28 29 2e 66 6f 72 Data Ascii: d 0!==u&&u)}return i.settings.debug&&t.preventDefault(),i.cancelSubmit?(i.cancelSubmit=!1,r()):i.form()?i.pendingRequest?(i.formSubmitted=!0,!1):r():(i.focusInvalid(),!1)})),i)},valid:function(){var t,i,r;return n(this[0]).is("form")?t=this.validate().for
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 6f 20 7b 30 7d 2e 22 29 2c 73 74 65 70 3a 6e 2e 76 61 6c 69 64 61 74 6f 72 2e 66 6f 72 6d 61 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 6d 75 6c 74 69 70 6c 65 20 6f 66 20 7b 30 7d 2e 22 29 7d 2c 61 75 74 6f 43 72 65 61 74 65 52 61 6e 67 65 73 3a 21 31 2c 70 72 6f 74 6f 74 79 70 65 3a 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 76 61 72 20 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6e 28 74 68 69 73 29 2e 61 74 74 72 28 22 63 6f 6e 74 65 6e 74 65 64 69 74 61 62 6c 65 22 29 26 26 22 66 61 6c 73 65 22 21 3d 3d 6e 28 74 68 69 73 29 2e 61 74 74 72 28 22 63 6f 6e 74 65 6e 74 65 64 69 74 61 62 6c 65 22 29 3b 69 66 28 21 74 68 69 73 2e 66 6f 72 6d 26 26 65 26 26 28 74 68 69 73 2e Data Ascii: o {0}."),step:n.validator.format("Please enter a multiple of {0}.")},autoCreateRanges:!1,prototype:{init:function(){function i(t){var e="undefined"!=typeof n(this).attr("contenteditable")&&"false"!==n(this).attr("contenteditable");if(!this.form&&e&&(this.
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 68 69 73 2e 65 72 72 6f 72 4c 69 73 74 5b 30 5d 2e 65 6c 65 6d 65 6e 74 7c 7c 5b 5d 29 2e 66 69 6c 74 65 72 28 22 3a 76 69 73 69 62 6c 65 22 29 2e 74 72 69 67 67 65 72 28 22 66 6f 63 75 73 22 29 2e 74 72 69 67 67 65 72 28 22 66 6f 63 75 73 69 6e 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 7d 2c 66 69 6e 64 4c 61 73 74 41 63 74 69 76 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6c 61 73 74 41 63 74 69 76 65 3b 72 65 74 75 72 6e 20 74 26 26 31 3d 3d 3d 6e 2e 67 72 65 70 28 74 68 69 73 2e 65 72 72 6f 72 4c 69 73 74 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 2e 65 6c 65 6d 65 6e 74 2e 6e 61 6d 65 3d 3d 3d 74 2e 6e 61 6d 65 7d 29 2e 6c 65 6e 67 74 68 26 26 74 7d 2c 65 6c 65 6d 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 Data Ascii: his.errorList[0].element\|\|[]).filter(":visible").trigger("focus").trigger("focusin")}catch(t){}},findLastActive:function(){var t=this.lastActive;return t&&1===n.grep(this.errorList,function(n){return n.element.name===t.name}).length&&t},elements:function(
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 65 6d 65 6e 74 2c 74 2e 6d 65 73 73 61 67 65 29 3b 69 66 28 74 68 69 73 2e 65 72 72 6f 72 4c 69 73 74 2e 6c 65 6e 67 74 68 26 26 28 74 68 69 73 2e 74 6f 53 68 6f 77 3d 74 68 69 73 2e 74 6f 53 68 6f 77 2e 61 64 64 28 74 68 69 73 2e 63 6f 6e 74 61 69 6e 65 72 73 29 29 2c 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 73 75 63 63 65 73 73 29 66 6f 72 28 6e 3d 30 3b 74 68 69 73 2e 73 75 63 63 65 73 73 4c 69 73 74 5b 6e 5d 3b 6e 2b 2b 29 74 68 69 73 2e 73 68 6f 77 4c 61 62 65 6c 28 74 68 69 73 2e 73 75 63 63 65 73 73 4c 69 73 74 5b 6e 5d 29 3b 69 66 28 74 68 69 73 2e 73 65 74 74 69 6e 67 73 2e 75 6e 68 69 67 68 6c 69 67 68 74 29 66 6f 72 28 6e 3d 30 2c 69 3d 74 68 69 73 2e 76 61 6c 69 64 45 6c 65 6d 65 6e 74 73 28 29 3b 69 5b 6e 5d 3b 6e 2b 2b 29 74 68 69 73 2e 73 Data Ascii: ement,t.message);if(this.errorList.length&&(this.toShow=this.toShow.add(this.containers)),this.settings.success)for(n=0;this.successList[n];n++)this.showLabel(this.successList[n]);if(this.settings.unhighlight)for(n=0,i=this.validElements();i[n];n++)this.s
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 65 74 75 72 6e 20 69 3d 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 69 26 26 69 7c 7c 22 72 65 6d 6f 74 65 22 2c 6e 2e 64 61 74 61 28 74 2c 22 70 72 65 76 69 6f 75 73 56 61 6c 75 65 22 29 7c 7c 6e 2e 64 61 74 61 28 74 2c 22 70 72 65 76 69 6f 75 73 56 61 6c 75 65 22 2c 7b 6f 6c 64 3a 6e 75 6c 6c 2c 76 61 6c 69 64 3a 21 30 2c 6d 65 73 73 61 67 65 3a 74 68 69 73 2e 64 65 66 61 75 6c 74 4d 65 73 73 61 67 65 28 74 2c 7b 6d 65 74 68 6f 64 3a 69 7d 29 7d 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 72 65 73 65 74 46 6f 72 6d 28 29 3b 6e 28 74 68 69 73 2e 63 75 72 72 65 6e 74 46 6f 72 6d 29 2e 6f 66 66 28 22 2e 76 61 6c 69 64 61 74 65 22 29 2e 72 65 6d 6f 76 65 44 61 74 61 28 22 76 61 6c 69 64 61 74 6f 72 22 29 2e 66 69 Data Ascii: eturn i="string"==typeof i&&i\|\|"remote",n.data(t,"previousValue")\|\|n.data(t,"previousValue",{old:null,valid:!0,message:this.defaultMessage(t,{method:i})})},destroy:function(){this.resetForm();n(this.currentForm).off(".validate").removeData("validator").fi
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 29 7b 32 7d 29 28 3f 21 31 37 32 5c 2e 28 3f 3a 31 5b 36 2d 39 5d 7c 32 5c 64 7c 33 5b 30 2d 31 5d 29 28 3f 3a 5c 2e 5c 64 7b 31 2c 33 7d 29 7b 32 7d 29 28 3f 3a 5b 31 2d 39 5d 5c 64 3f 7c 31 5c 64 5c 64 7c 32 5b 30 31 5d 5c 64 7c 32 32 5b 30 2d 33 5d 29 28 3f 3a 5c 2e 28 3f 3a 31 3f 5c 64 7b 31 2c 32 7d 7c 32 5b 30 2d 34 5d 5c 64 7c 32 35 5b 30 2d 35 5d 29 29 7b 32 7d 28 3f 3a 5c 2e 28 3f 3a 5b 31 2d 39 5d 5c 64 3f 7c 31 5c 64 5c 64 7c 32 5b 30 2d 34 5d 5c 64 7c 32 35 5b 30 2d 34 5d 29 29 7c 28 3f 3a 28 3f 3a 5b 61 2d 7a 30 2d 39 5c 75 30 30 61 31 2d 5c 75 66 66 66 66 5d 5b 61 2d 7a 30 2d 39 5c 75 30 30 61 31 2d 5c 75 66 66 66 66 5f 2d 5d 7b 30 2c 36 32 7d 29 3f 5b 61 2d 7a 30 2d 39 5c 75 30 30 61 31 2d 5c 75 66 66 66 66 5d 5c 2e 29 2b 28 3f 3a 5b 61 2d Data Ascii: ){2})(?!172\.(?:1[6-9]\|2\d\|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?\|1\d\d\|2[01]\d\|22[0-3])(?:\.(?:1?\d{1,2}\|2[0-4]\d\|25[0-5])){2}(?:\.(?:[1-9]\d?\|1\d\d\|2[0-4]\d\|25[0-4]))\|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)+(?:[a-
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 69 6f 6e 20 68 28 29 7b 76 61 72 20 74 3d 6e 28 74 68 69 73 29 2c 69 3d 22 5f 5f 6a 71 75 65 72 79 5f 75 6e 6f 62 74 72 75 73 69 76 65 5f 76 61 6c 69 64 61 74 69 6f 6e 5f 66 6f 72 6d 5f 72 65 73 65 74 22 3b 69 66 28 21 74 2e 64 61 74 61 28 69 29 29 7b 74 2e 64 61 74 61 28 69 2c 21 30 29 3b 74 72 79 7b 74 2e 64 61 74 61 28 22 76 61 6c 69 64 61 74 6f 72 22 29 2e 72 65 73 65 74 46 6f 72 6d 28 29 7d 66 69 6e 61 6c 6c 79 7b 74 2e 72 65 6d 6f 76 65 44 61 74 61 28 69 29 7d 74 2e 66 69 6e 64 28 22 2e 76 61 6c 69 64 61 74 69 6f 6e 2d 73 75 6d 6d 61 72 79 2d 65 72 72 6f 72 73 22 29 2e 61 64 64 43 6c 61 73 73 28 22 76 61 6c 69 64 61 74 69 6f 6e 2d 73 75 6d 6d 61 72 79 2d 76 61 6c 69 64 22 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 76 61 6c 69 64 61 74 69 6f 6e 2d Data Ascii: ion h(){var t=n(this),i="__jquery_unobtrusive_validation_form_reset";if(!t.data(i)){t.data(i,!0);try{t.data("validator").resetForm()}finally{t.removeData(i)}t.find(".validation-summary-errors").addClass("validation-summary-valid").removeClass("validation-
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 4f 58 22 3d 3d 3d 6e 2e 65 6c 65 6d 65 6e 74 2e 74 79 70 65 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7c 7c 69 28 6e 2c 22 72 65 71 75 69 72 65 64 22 2c 21 30 29 7d 29 2c 74 2e 61 64 64 28 22 72 65 6d 6f 74 65 22 2c 5b 22 75 72 6c 22 2c 22 74 79 70 65 22 2c 22 61 64 64 69 74 69 6f 6e 61 6c 66 69 65 6c 64 73 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 72 3d 7b 75 72 6c 3a 74 2e 70 61 72 61 6d 73 2e 75 72 6c 2c 74 79 70 65 3a 74 2e 70 61 72 61 6d 73 2e 74 79 70 65 7c 7c 22 47 45 54 22 2c 64 61 74 61 3a 7b 7d 7d 2c 75 3d 65 28 74 2e 65 6c 65 6d 65 6e 74 2e 6e 61 6d 65 29 3b 6e 2e 65 61 63 68 28 28 74 2e 70 61 72 61 6d 73 2e 61 64 64 69 74 69 6f 6e 61 6c 66 69 65 6c 64 73 7c 7c 74 2e 65 6c 65 6d 65 6e 74 2e 6e 61 6d 65 29 2e 72 65 70 6c 61 63 65 Data Ascii: OX"===n.element.type.toUpperCase()\|\|i(n,"required",!0)}),t.add("remote",["url","type","additionalfields"],function(t){var r={url:t.params.url,type:t.params.type\|\|"GET",data:{}},u=e(t.element.name);n.each((t.params.additionalfields\|\|t.element.name).replace

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:16 UTC	1030	OUT	GET /bundles/modernizr?v=KGygLU_Ygx-27Szx0BNU49_4N_lJnUmNs2RbUl05ER01 HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:16 UTC	588	IN	HTTP/1.1 200 OK Content-Length: 1298 Connection: close Content-Type: text/javascript; charset=utf-8 Date: Fri, 24 Jan 2025 21:26:16 GMT Server: Access-Control-Expose-Headers: Request-Context Cache-Control: public Expires: Sat, 24 Jan 2026 21:26:16 GMT Last-Modified: Fri, 24 Jan 2025 21:26:16 GMT Vary: User-Agent Strict-Transport-Security: max-age=63072000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-AspNet-Version: 4.0.30319 Request-Context: appId=cid-v1:67d67441-da85-4964-bc49-2ce4bb17dd65 X-Powered-By: ASP.NET
2025-01-24 21:26:16 UTC	1298	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 6e 3d 3d 3d 74 7d 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 75 2c 6e 2c 66 2c 65 2c 6f 2c 63 2c 74 3b 66 6f 72 28 76 61 72 20 6c 20 69 6e 20 72 29 69 66 28 72 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6c 29 29 7b 69 66 28 75 3d 5b 5d 2c 6e 3d 72 5b 6c 5d 2c 6e 2e 6e 61 6d 65 26 26 28 75 2e 70 75 73 68 28 6e 2e 6e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 2c 6e 2e 6f 70 74 69 6f 6e 73 26 26 6e 2e 6f 70 74 69 6f 6e 73 2e 61 6c 69 61 73 65 73 26 26 6e 2e 6f 70 74 69 6f 6e 73 2e 61 6c 69 61 73 65 73 2e 6c 65 6e 67 74 68 29 29 66 6f 72 28 66 3d 30 3b 66 3c 6e 2e 6f 70 74 69 6f 6e 73 2e 61 6c 69 61 73 Data Ascii: !function(n,t){function h(n,t){return typeof n===t}function c(){var u,n,f,e,o,c,t;for(var l in r)if(r.hasOwnProperty(l)){if(u=[],n=r[l],n.name&&(u.push(n.name.toLowerCase()),n.options&&n.options.aliases&&n.options.aliases.length))for(f=0;f<n.options.alias

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:16 UTC	1026	OUT	GET /bundles/modal?v=-a4TryEKwD6_l2KoDb4knH7rIkrny3QIHNOq2F-8J1I1 HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:16 UTC	589	IN	HTTP/1.1 200 OK Content-Length: 16739 Connection: close Content-Type: text/javascript; charset=utf-8 Date: Fri, 24 Jan 2025 21:26:16 GMT Server: Access-Control-Expose-Headers: Request-Context Cache-Control: public Expires: Sat, 24 Jan 2026 21:26:16 GMT Last-Modified: Fri, 24 Jan 2025 21:26:16 GMT Vary: User-Agent Strict-Transport-Security: max-age=63072000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-AspNet-Version: 4.0.30319 Request-Context: appId=cid-v1:67d67441-da85-4964-bc49-2ce4bb17dd65 X-Powered-By: ASP.NET
2025-01-24 21:26:16 UTC	3292	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 79 70 65 6f 66 20 64 65 66 69 6e 65 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 6e 29 3a 6e 28 6a 51 75 65 72 79 29 7d 29 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 72 3d 5b 5d 2c 65 3d 6e 28 64 6f 63 75 6d 65 6e 74 29 2c 75 3d 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 66 3d 6e 28 77 69 6e 64 6f 77 29 2c 69 3d 5b 5d 2c 74 3d 7b 69 65 51 75 69 72 6b 73 3a 6e 75 6c 6c 2c 6d 73 69 65 3a 2f 6d 73 69 65 2f 2e 74 65 73 74 28 75 29 26 26 21 2f 6f 70 65 72 61 2f 2e 74 65 73 74 28 75 29 2c 6f 70 65 72 61 3a 2f 6f 70 65 72 61 2f 2e 74 65 73 74 28 75 29 7d 3b 74 2e 69 65 36 Data Ascii: (function(n){typeof define=="function"&&define.amd?define(["jquery"],n):n(jQuery)})(function(n){var r=[],e=n(document),u=navigator.userAgent.toLowerCase(),f=n(window),i=[],t={ieQuirks:null,msie:/msie/.test(u)&&!/opera/.test(u),opera:/opera/.test(u)};t.ie6
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 26 75 2e 6f 2e 63 6c 6f 73 65 26 26 75 2e 6f 2e 6f 76 65 72 6c 61 79 43 6c 6f 73 65 26 26 75 2e 64 2e 6f 76 65 72 6c 61 79 2e 62 69 6e 64 28 22 63 6c 69 63 6b 2e 73 69 6d 70 6c 65 6d 6f 64 61 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 75 2e 63 6c 6f 73 65 28 29 7d 29 3b 65 2e 62 69 6e 64 28 22 6b 65 79 64 6f 77 6e 2e 73 69 6d 70 6c 65 6d 6f 64 61 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 75 2e 6f 2e 6d 6f 64 61 6c 26 26 6e 2e 6b 65 79 43 6f 64 65 3d 3d 3d 39 3f 75 2e 77 61 74 63 68 54 61 62 28 6e 29 3a 75 2e 6f 2e 63 6c 6f 73 65 26 26 75 2e 6f 2e 65 73 63 43 6c 6f 73 65 26 26 6e 2e 6b 65 79 43 6f 64 65 3d 3d 3d 32 37 26 26 28 6e 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 75 2e 63 6c Data Ascii: &u.o.close&&u.o.overlayClose&&u.d.overlay.bind("click.simplemodal",function(n){n.preventDefault();u.close()});e.bind("keydown.simplemodal",function(n){u.o.modal&&n.keyCode===9?u.watchTab(n):u.o.close&&u.o.escClose&&n.keyCode===27&&(n.preventDefault(),u.cl
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 74 2c 61 74 3b 69 66 28 68 3d 6e 2e 65 78 74 65 6e 64 28 7b 7d 2c 6e 2e 62 6c 6f 63 6b 55 49 2e 64 65 66 61 75 6c 74 73 2c 68 7c 7c 7b 7d 29 2c 21 68 2e 69 67 6e 6f 72 65 49 66 42 6c 6f 63 6b 65 64 7c 7c 21 6e 28 73 29 2e 64 61 74 61 28 22 62 6c 6f 63 6b 55 49 2e 69 73 42 6c 6f 63 6b 65 64 22 29 29 7b 69 66 28 68 2e 6f 76 65 72 6c 61 79 43 53 53 3d 6e 2e 65 78 74 65 6e 64 28 7b 7d 2c 6e 2e 62 6c 6f 63 6b 55 49 2e 64 65 66 61 75 6c 74 73 2e 6f 76 65 72 6c 61 79 43 53 53 2c 68 2e 6f 76 65 72 6c 61 79 43 53 53 7c 7c 7b 7d 29 2c 72 74 3d 6e 2e 65 78 74 65 6e 64 28 7b 7d 2c 6e 2e 62 6c 6f 63 6b 55 49 2e 64 65 66 61 75 6c 74 73 2e 63 73 73 2c 68 2e 63 73 73 7c 7c 7b 7d 29 2c 68 2e 6f 6e 4f 76 65 72 6c 61 79 43 6c 69 63 6b 26 26 28 68 2e 6f 76 65 72 6c 61 79 43 Data Ascii: t,at;if(h=n.extend({},n.blockUI.defaults,h\|\|{}),!h.ignoreIfBlocked\|\|!n(s).data("blockUI.isBlocked")){if(h.overlayCSS=n.extend({},n.blockUI.defaults.overlayCSS,h.overlayCSS\|\|{}),rt=n.extend({},n.blockUI.defaults.css,h.css\|\|{}),h.onOverlayClick&&(h.overlayC
2025-01-24 21:26:16 UTC	4096	IN	Data Raw: 6c 73 65 20 68 2e 73 68 6f 77 4f 76 65 72 6c 61 79 26 26 6e 74 2e 73 68 6f 77 28 29 2c 6c 26 26 77 2e 73 68 6f 77 28 29 2c 68 2e 6f 6e 42 6c 6f 63 6b 26 26 68 2e 6f 6e 42 6c 6f 63 6b 28 29 3b 63 28 31 2c 73 2c 68 29 3b 70 3f 28 74 3d 77 5b 30 5d 2c 69 3d 6e 28 68 2e 66 6f 63 75 73 61 62 6c 65 45 6c 65 6d 65 6e 74 73 2c 74 29 2c 68 2e 66 6f 63 75 73 49 6e 70 75 74 26 26 73 65 74 54 69 6d 65 6f 75 74 28 61 2c 32 30 29 29 3a 79 28 77 5b 30 5d 2c 68 2e 63 65 6e 74 65 72 58 2c 68 2e 63 65 6e 74 65 72 59 29 3b 68 2e 74 69 6d 65 6f 75 74 26 26 28 61 74 3d 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 70 3f 6e 2e 75 6e 62 6c 6f 63 6b 55 49 28 68 29 3a 6e 28 73 29 2e 75 6e 62 6c 6f 63 6b 28 68 29 7d 2c 68 2e 74 69 6d 65 6f 75 74 29 2c 6e 28 73 Data Ascii: lse h.showOverlay&&nt.show(),l&&w.show(),h.onBlock&&h.onBlock();c(1,s,h);p?(t=w[0],i=n(h.focusableElements,t),h.focusInput&&setTimeout(a,20)):y(w[0],h.centerX,h.centerY);h.timeout&&(at=setTimeout(function(){p?n.unblockUI(h):n(s).unblock(h)},h.timeout),n(s
2025-01-24 21:26:16 UTC	1159	IN	Data Raw: 67 65 3a 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 47 69 66 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2e 2e 2f 2e 2e 2f 52 65 73 6f 75 72 63 65 73 2f 59 65 61 72 6c 69 2f 64 6f 74 73 2e 67 69 66 22 20 77 69 64 74 68 3d 22 31 35 37 70 78 22 20 68 65 69 67 68 74 3d 22 37 70 78 22 20 61 6c 74 3d 22 6c 6f 61 64 69 6e 67 20 64 6f 74 73 22 20 2f 3e 3c 70 3e 4c 6f 61 64 69 6e 67 3c 5c 2f 70 3e 3c 5c 2f 64 69 76 3e 27 2c 74 69 74 6c 65 3a 6e 75 6c 6c 2c 64 72 61 67 67 61 62 6c 65 3a 21 30 2c 74 68 65 6d 65 3a 21 31 2c 63 73 73 3a 7b 70 61 64 64 69 6e 67 3a 30 2c 6d 61 72 67 69 6e 3a 30 2c 77 69 64 74 68 3a 22 61 75 74 6f 22 2c 74 6f 70 3a 22 34 30 25 22 2c 6c 65 66 74 3a 22 33 35 25 22 2c 74 65 78 74 41 6c 69 67 6e 3a 22 63 65 6e 74 65 72 22 2c 63 6f 6c 6f Data Ascii: ge:'<div class="loadGif"><img src="/../../Resources/Yearli/dots.gif" width="157px" height="7px" alt="loading dots" /><p>Loading<\/p><\/div>',title:null,draggable:!0,theme:!1,css:{padding:0,margin:0,width:"auto",top:"40%",left:"35%",textAlign:"center",colo

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:16 UTC	1027	OUT	GET /bundles/Common?v=iv-wMx9JW9PONMa62erC7xTxZejViXqRf7JNiAKcC7Y1 HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:16 UTC	588	IN	HTTP/1.1 200 OK Content-Length: 1459 Connection: close Content-Type: text/javascript; charset=utf-8 Date: Fri, 24 Jan 2025 21:26:16 GMT Server: Access-Control-Expose-Headers: Request-Context Cache-Control: public Expires: Sat, 24 Jan 2026 21:26:16 GMT Last-Modified: Fri, 24 Jan 2025 21:26:16 GMT Vary: User-Agent Strict-Transport-Security: max-age=63072000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-AspNet-Version: 4.0.30319 Request-Context: appId=cid-v1:67d67441-da85-4964-bc49-2ce4bb17dd65 X-Powered-By: ASP.NET
2025-01-24 21:26:16 UTC	1459	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 63 6f 6e 66 69 72 6d 4f 4b 28 6e 2c 74 2c 69 2c 72 29 7b 76 61 72 20 75 3d 22 22 2c 65 2c 66 3b 72 3d 72 7c 7c 22 43 6f 6e 66 69 72 6d 22 3b 65 3d 22 4f 4b 22 3b 75 2b 3d 22 3c 64 69 76 20 69 64 3d 27 63 6f 6e 66 69 72 6d 27 3e 22 3b 75 2b 3d 22 3c 64 69 76 20 63 6c 61 73 73 3d 27 68 65 61 64 65 72 27 3e 3c 73 70 61 6e 3e 22 2b 72 2b 22 3c 5c 2f 73 70 61 6e 3e 3c 5c 2f 64 69 76 3e 22 3b 75 2b 3d 22 3c 70 20 63 6c 61 73 73 3d 27 6d 65 73 73 61 67 65 27 3e 22 2b 6e 2b 22 3c 5c 2f 70 3e 22 3b 66 3d 22 3c 64 69 76 20 63 6c 61 73 73 3d 27 6f 6b 27 20 69 64 3d 27 6f 6b 42 75 74 74 6f 6e 27 3e 20 20 3c 5c 2f 64 69 76 3e 22 3b 75 2b 3d 22 3c 64 69 76 20 63 6c 61 73 73 3d 27 62 75 74 74 6f 6e 73 27 3e 22 2b 66 2b 22 3c 5c 2f 64 69 76 3e Data Ascii: function confirmOK(n,t,i,r){var u="",e,f;r=r\|\|"Confirm";e="OK";u+="<div id='confirm'>";u+="<div class='header'><span>"+r+"<\/span><\/div>";u+="<p class='message'>"+n+"<\/p>";f="<div class='ok' id='okButton'> <\/div>";u+="<div class='buttons'>"+f+"<\/div>

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 5x46, components 3
Category:	downloaded
Size (bytes):	1179
Entropy (8bit):	5.829007918319955
Encrypted:	false
SSDEEP:	24:FK1he91Wwjx82lY2T3ouVSy3yJ3VwyNGKVioFTY:SqQNn2xUJ3NV0uk
MD5:	F88FC17AB1760160E4227C7872171E4B
SHA1:	4B7B450D24DAA42138E67FF760918ED9333C1E08
SHA-256:	07AAC26B8679D2B812AEFD2D5607E47B9CEA5ECA62C8B8E384941C85BCBC5774
SHA-512:	912B0B9691979B1D6F39BDCCB95C0441388B4BFD218A18CF5068F3A801FB31B5342C643B0702B2BEEFA82E417436A17ACB372171988E8F453EC6028320A1431B
Malicious:	false
Reputation:	low
URL:	https://retrieval.greatland.com/Images/footer-tile.jpg
Preview:	......Exif..II*.................Ducky.......d.....+http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:F7576F0A8BEA11E2A385CB9D40DB78F5" xmpMM:DocumentID="xmp.did:F7576F0B8BEA11E2A385CB9D40DB78F5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F7576F088BEA11E2A385CB9D40DB78F5" stRef:documentID="xmp.did:F7576F098BEA11E2A385CB9D40DB78F5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	6.093316012255737
Encrypted:	false
SSDEEP:	24:6y1he91Wwjx82lY2T3ouV01+VyJ3VeQU6G6Nzd9:6wqQNn2xu4kJ3EV6Vd9
MD5:	BF83F64300494CD9A6558C97B7E314EE
SHA1:	6620785E3ED4C26E0A2CEBE31F8AFFBD61070353
SHA-256:	BC1A39B8BA812BF30911404DC3C1562DB22E7976728CE5C5C35483BEC0DC954E
SHA-512:	92DA546930C1DB9691AC4B5574337ED30E4140AE762E91A93FF6B0C768D729A81C19A5CFBB9B9BE8FD83DB941E6FD33B829D388BA851A7340B0DBC7B4224F166
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............2.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:8A76F7268BEA11E29134DD34DF248154" xmpMM:DocumentID="xmp.did:8A76F7278BEA11E29134DD34DF248154"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8A76F7248BEA11E29134DD34DF248154" stRef:documentID="xmp.did:8A76F7258BEA11E29134DD34DF248154"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.5o....`IDATx.b...7......Pl..R,X...q... .2!.......+BW...e.8.#.!@.....).9.....S..:.."....".H.)..%.Q..`..K.E..[....IEND

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:17 UTC	810	OUT	GET /bundles/modernizr?v=KGygLU_Ygx-27Szx0BNU49_4N_lJnUmNs2RbUl05ER01 HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:17 UTC	588	IN	HTTP/1.1 200 OK Content-Length: 1298 Connection: close Content-Type: text/javascript; charset=utf-8 Date: Fri, 24 Jan 2025 21:26:16 GMT Server: Access-Control-Expose-Headers: Request-Context Cache-Control: public Expires: Sat, 24 Jan 2026 21:26:17 GMT Last-Modified: Fri, 24 Jan 2025 21:26:17 GMT Vary: User-Agent Strict-Transport-Security: max-age=63072000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-AspNet-Version: 4.0.30319 Request-Context: appId=cid-v1:67d67441-da85-4964-bc49-2ce4bb17dd65 X-Powered-By: ASP.NET
2025-01-24 21:26:17 UTC	1298	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 6e 3d 3d 3d 74 7d 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 75 2c 6e 2c 66 2c 65 2c 6f 2c 63 2c 74 3b 66 6f 72 28 76 61 72 20 6c 20 69 6e 20 72 29 69 66 28 72 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6c 29 29 7b 69 66 28 75 3d 5b 5d 2c 6e 3d 72 5b 6c 5d 2c 6e 2e 6e 61 6d 65 26 26 28 75 2e 70 75 73 68 28 6e 2e 6e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 2c 6e 2e 6f 70 74 69 6f 6e 73 26 26 6e 2e 6f 70 74 69 6f 6e 73 2e 61 6c 69 61 73 65 73 26 26 6e 2e 6f 70 74 69 6f 6e 73 2e 61 6c 69 61 73 65 73 2e 6c 65 6e 67 74 68 29 29 66 6f 72 28 66 3d 30 3b 66 3c 6e 2e 6f 70 74 69 6f 6e 73 2e 61 6c 69 61 73 Data Ascii: !function(n,t){function h(n,t){return typeof n===t}function c(){var u,n,f,e,o,c,t;for(var l in r)if(r.hasOwnProperty(l)){if(u=[],n=r[l],n.name&&(u.push(n.name.toLowerCase()),n.options&&n.options.aliases&&n.options.aliases.length))for(f=0;f<n.options.alias

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:17 UTC	1070	OUT	GET /Images/footer-tile.jpg HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://retrieval.greatland.com/Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:17 UTC	251	IN	HTTP/1.1 200 OK Content-Length: 1179 Connection: close Content-Type: image/jpeg Date: Fri, 24 Jan 2025 21:26:16 GMT Server: Accept-Ranges: bytes ETag: "e625ddbfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:17 UTC	1179	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 2b 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckyd+http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:17 UTC	1070	OUT	GET /Images/corner-left.png HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://retrieval.greatland.com/Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:17 UTC	250	IN	HTTP/1.1 200 OK Content-Length: 1004 Connection: close Content-Type: image/png Date: Fri, 24 Jan 2025 21:26:17 GMT Server: Accept-Ranges: bytes ETag: "e625ddbfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:17 UTC	1004	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0a 00 00 00 0a 08 06 00 00 00 8d 32 cf bd 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 22 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR2tEXtSoftwareAdobe ImageReadyqe<"iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:17 UTC	1065	OUT	GET /Images/rrfill.png HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://retrieval.greatland.com/Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:17 UTC	249	IN	HTTP/1.1 200 OK Content-Length: 194 Connection: close Content-Type: image/png Date: Fri, 24 Jan 2025 21:26:17 GMT Server: Accept-Ranges: bytes ETag: "e625ddbfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:17 UTC	194	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 0a 08 06 00 00 00 75 d2 34 4a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 07 74 49 4d 45 07 dd 03 0f 13 24 12 61 86 42 10 00 00 00 1d 69 54 58 74 43 6f 6d 6d 65 6e 74 00 00 00 00 00 43 72 65 61 74 65 64 20 77 69 74 68 20 47 49 4d 50 64 2e 65 07 00 00 00 19 49 44 41 54 08 d7 63 f8 fd fb f7 4f 26 06 06 06 36 26 06 06 06 06 22 08 00 bc d8 04 03 6b 5d bb ae 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRu4JsRGBbKGDpHYstIME$aBiTXtCommentCreated with GIMPd.eIDATcO&6&"k]IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:17 UTC	1071	OUT	GET /Images/corner-right.png HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://retrieval.greatland.com/Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:17 UTC	250	IN	HTTP/1.1 200 OK Content-Length: 1011 Connection: close Content-Type: image/png Date: Fri, 24 Jan 2025 21:26:17 GMT Server: Accept-Ranges: bytes ETag: "e625ddbfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:17 UTC	1011	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0a 00 00 00 0a 08 06 00 00 00 8d 32 cf bd 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 22 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR2tEXtSoftwareAdobe ImageReadyqe<"iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:17 UTC	1069	OUT	GET /Images/background.jpg HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://retrieval.greatland.com/Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:17 UTC	252	IN	HTTP/1.1 200 OK Content-Length: 67390 Connection: close Content-Type: image/jpeg Date: Fri, 24 Jan 2025 21:26:17 GMT Server: Accept-Ranges: bytes ETag: "e625ddbfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:17 UTC	3656	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 2b 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckyd+http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm
2025-01-24 21:26:17 UTC	4096	IN	Data Raw: 13 61 25 c4 f6 49 18 7b 1c c3 0d 39 d5 bb 86 2e b2 eb c9 77 97 d5 4e 7d de 3f 21 ea 1c ef 70 f5 82 73 54 5c 82 73 55 98 c8 84 bc c6 41 0a 00 00 00 00 00 00 00 23 70 4d 2d c6 5b 92 6b 3b a1 10 00 00 0c cd b0 5c 5c e8 4a 19 4c aa 11 64 bb 4c 08 08 2c 6a 4b ab aa 55 49 06 c5 00 4f 68 ab 2c 92 c4 c8 86 82 9f c9 71 31 6e ab b9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 84 d8 49 71 3d 92 58 4d a4 83 68 10 00 00 00 00 00 00 00 00 00 28 0d 24 1a b2 16 5f 95 92 2e c0 28 00 00 00 00 02 01 40 9a 05 00 00 00 00 00 00 00 00 00 00 00 00 02 80 d1 6f 5c 3d 4b 05 ba d9 bf 27 6f 69 a4 55 53 dd 9d a4 c8 ab 3c ce fe 5b b1 bf c8 9d bf 23 6b 8a 7c 0c 89 cc a6 2d be 0b 83 44 00 00 00 00 00 00 00 19 e6 ba Data Ascii: a%I{9.wN}?!psT\sUA#pM-[k;\\JLdL,jKUIOh,q1n$Iq=XMh($_.(@o\=K'oiUS<[#k\|-D
2025-01-24 21:26:17 UTC	4096	IN	Data Raw: d7 99 ea 4b 96 db 77 da 6b 19 ea 9c dd a3 05 e6 58 78 6d 03 13 49 dd da 31 9d e9 a4 94 d3 b7 c8 0b 36 58 e3 70 d8 7e 99 75 a5 9b f2 45 d3 f4 9c d2 44 b6 b2 ea 58 3f 52 c8 9f be c9 ce b1 ef 8b 07 af c1 ae 6f 51 5f 38 c7 0f 53 5e a5 b3 c3 8d 5a 91 36 ab ee 5f 38 66 e4 67 5c 2a d6 7b b8 6e ef 2c e2 9a c3 d6 85 7e 13 6e ee cc 49 7e 57 bb cb a9 d4 35 2e a6 a3 73 8b bc ce 77 b3 53 7c 3c 95 75 6e b8 4a e5 10 a6 dd d8 5e 79 f9 5f e4 ef 32 3d 54 36 d2 75 42 4a 2c 77 b8 c5 99 9c 37 ad 4b cf e1 e9 7a d2 92 51 76 18 71 37 22 78 74 d0 d3 d4 ea 35 29 d3 a2 2d fc 9c 59 4a c5 b1 90 fe af d7 74 da 14 f4 fa 6b 4f 4d 7f e7 5b be a7 99 ca dd 6b ac 7b 29 4a fa 9c bd ef 84 58 66 ef 86 b3 e5 ae 69 b2 ed f7 f8 64 4c c1 ba 5d be af 1e 04 f2 d4 74 2b 51 ba 5d a4 b1 ab 66 36 61 97 Data Ascii: KwkXxmI16Xp~uEDX?RoQ_8S^Z6_8fg\*{n,~nI~W5.swS\|<unJ^y_2=T6uBJ,w7KzQvq7"xt5)-YJtkOM[k{)JXfidL]t+Q]f6a
2025-01-24 21:26:17 UTC	4096	IN	Data Raw: e6 d1 d1 aa ed 25 64 57 55 37 73 bf 03 8f d9 f6 7a ff 00 6f 1f f7 79 bf fc 3a 70 e1 bd 6f 67 ed 4f 33 b2 c8 5d 6b 7f a6 7b db bd 99 5d ad d3 df 9e 58 78 92 b5 37 5d 69 a8 c5 85 8d a7 bf bb 7e 64 65 41 1b 34 db 74 38 9c a0 85 b1 d5 32 6a c6 d3 db 12 35 dd d5 3d 91 83 5a 4e 1a 0d 47 69 30 2a 23 53 bb b2 b9 18 a5 ee da b8 b1 62 95 5b 4e 55 b9 99 ac d7 44 65 a9 d8 0a 00 00 00 00 00 00 00 00 00 04 78 16 33 c9 02 4c 50 bb 3c 24 84 96 c7 27 7b 36 d0 00 00 12 42 6c 24 1a 48 36 12 09 54 28 00 00 00 00 00 00 00 00 0d 2e ee d7 76 57 91 29 37 78 67 db c4 61 86 1b e6 17 60 3c a4 f1 18 62 15 40 2e db b7 11 10 aa bb ac ec da 48 16 70 28 6d db 39 91 0d bc 4a a8 05 e1 69 03 8d 96 14 4c 80 b1 78 10 00 00 00 00 03 00 24 84 d5 0b d8 02 15 9b d1 02 6f 50 17 00 80 5d 00 04 02 Data Ascii: %dWU7szoy:pogO3]k{]Xx7]i~deA4t82j5=ZNGi0*#Sb[NUDex3LP<$'{6Bl$H6T(.vW)7xga`<b@.Hp(m9JiLx$oP]
2025-01-24 21:26:17 UTC	4096	IN	Data Raw: 9d 7a b4 50 a6 ba d2 8c d9 a9 c6 de 91 9b ca 47 83 57 dc 74 e9 9e 44 ea 79 bb 11 d6 7d 57 cb 9d fb 27 8e ef 9b ab d7 6a d7 fc 9a 4f 05 67 8c 1d 78 fd 7c 63 9d e7 6b c7 5e ad 4f 16 f7 59 b4 9d 24 66 d7 37 53 cf 72 5c 2c b0 b8 cf b3 2e ab f3 f5 e3 6a 2e 7f 24 d1 a7 83 b3 6b 65 39 1d 11 a4 c9 5b e2 df 2a 76 a6 97 1c c9 d4 fe aa 94 3b 21 f9 2e d8 19 55 b9 78 26 9e 2d db d9 bf b0 86 ac c2 f2 b7 76 37 83 56 64 1b a9 3d 99 6f 03 15 54 d5 d8 3f 20 33 ce e6 fd bb 4a 9b 13 9e fd f8 61 85 b1 d8 0d f8 61 d5 10 fb 0b 26 a6 f9 61 d7 7c 41 a9 c5 2d 61 d4 dd 92 5c 88 e6 eb 4a eb 73 34 39 55 a8 e3 2b 2f 59 ef 2c 89 ae 2e b7 81 af 5f 96 75 cd ea 46 39 d8 8b ea 9a e7 56 a4 ce 5b 4c c1 64 f1 0d 72 7a 99 42 9b fe 66 a4 ac eb 8b d5 4a fa a6 30 92 fa a5 ac 55 d4 26 a2 9b f8 f8 Data Ascii: zPGWtDy}W'jOgx\|ck^OY$f7Sr\,.j.$ke9[*v;!.Ux&-v7Vd=oT? 3Jaa&a\|A-a\Js49U+/Y,._uF9V[LdrzBfJ0U&
2025-01-24 21:26:17 UTC	4096	IN	Data Raw: 0a 71 aa b7 6d 55 bb db 76 b3 cd cb 95 bf a7 7e 13 27 e5 ee 31 3b 8d 95 b5 4e 01 7a ba 2c 0c 56 67 76 88 d8 00 00 00 00 00 00 02 3b 8b 12 b9 f3 77 9a c4 c6 4a a0 00 31 53 8d 91 2c 4e ee 6d cf 01 22 c8 c3 34 c5 ee a9 c0 b3 51 24 2e a3 b9 96 13 bb 99 a6 af 66 4a c2 aa 9e d8 65 04 c4 55 54 5b 8e 33 e7 37 c0 c0 e6 7b 6d 23 06 95 5b b8 13 0d f9 56 a9 a9 5a 93 5b c9 d6 2f 77 9e ae 99 3f c2 ae 5d d8 1b 9c fe 59 f5 8e 15 69 ea d1 7a e6 5b ad 35 2f 1a ce 58 e5 cf 0e d5 1c 6f 35 eb f0 9a ab fd 35 76 3f 22 7e e0 bc cd 5e bb 50 c9 7b 2e d5 55 27 f0 25 94 8d 49 17 6f 75 90 ba 2a 9a 09 d2 aa a9 94 e8 da ac 1f a5 e6 b3 e8 30 ea aa a1 8b b6 35 24 5d 81 05 01 20 5e 67 dc 4c 83 5c db 65 f1 26 1d 57 9b 6d c3 0d ab cc 89 86 a8 50 80 05 00 00 00 10 0a 00 aa 00 22 05 02 08 00 Data Ascii: qmUv~'1;Nz,Vgv;wJ1S,Nm"4Q$.fJeUT[37{m#[VZ[/w?]Yiz[5/Xo55v?"~^P{.U'%Iou*05$] ^gL\e&WmP"
2025-01-24 21:26:17 UTC	4096	IN	Data Raw: e9 db b0 b9 53 5a e7 ab 06 aa 44 5d a7 ec 8b ec ec 18 82 d5 9c 50 cf 95 d6 b9 c9 d0 ea d2 d4 df 1d a3 21 b5 be 77 9e dd c4 f5 86 aa d4 79 a7 03 d5 75 a5 5e 68 9e aa d7 32 cd 19 ca 7e 1a 4f 26 0d ad 73 b0 2f 3e e0 bd 15 54 81 9f 0b cc 5c 30 55 61 df f2 21 82 ae e0 a7 32 18 99 57 99 0c 3a c5 9f 88 c3 af 72 77 8c 3a 92 0d e8 4c 5e 10 90 12 00 08 dc 0c d2 42 56 d8 8c 2c 25 67 b7 a0 ca 2c f8 81 1c c5 97 81 cd bc cd 46 ad c2 64 b8 92 c4 90 9a 92 4d 34 1a 12 34 d0 82 10 4b 9f 1f 3b 37 01 9e 6b ac 89 c6 fb bb a4 b8 8a ea 51 e5 b6 e1 95 5c db b6 7c f2 c8 d6 74 47 3a f5 f4 e8 9f d9 a9 4a dd cd e9 69 a9 c2 de d1 2f 29 3b be 7e af b9 e8 d3 2b 49 73 3c 1b b8 eb c7 e9 e5 ff 00 93 9d fb 67 87 ca d7 f7 0d 7d 45 54 38 59 25 11 8d f3 6a 83 b7 1f ab 8c 72 bf 65 af 9b 5d 5c Data Ascii: SZD]P!wyu^h2~O&s/>T\0Ua!2W:rw:L^BV,%g,FdM44K;7kQ\\|tG:Ji/);~+Is<g}ET8Y%jre]\
2025-01-24 21:26:17 UTC	4096	IN	Data Raw: 0e 66 ba d0 c9 c9 bd 76 4c 91 65 75 a6 e3 37 b9 b9 5d 69 70 c9 7b 35 5d 53 93 0a dd 2e e3 35 b9 d6 3a ab cc ce e9 3b b6 69 a6 a9 c8 95 2b a7 c0 c9 ff 00 65 23 40 00 00 00 00 00 06 4a e6 e7 55 e6 a7 66 a7 64 2a 80 47 71 2a 56 08 c8 13 35 21 e1 62 f1 07 e9 87 4c 1a 95 a9 11 a2 99 58 85 e8 5d 4d ae 4f 1c b6 b4 da 00 40 00 0a 98 03 20 04 f0 0c f5 02 e7 4f ca 15 90 00 14 8b b0 b0 1d 3c ad 81 7a 01 7a 50 80 53 02 28 00 20 53 00 99 f0 40 5c 65 ae d0 ce 57 2a f4 34 ab fc a8 a5 f6 23 53 95 9d 92 c9 e5 e4 d4 f6 cd 1a ad a1 ba 1e eb bc 0d cf b7 94 ee cd fa f8 de cf 1d 7e db d4 d1 3f af 59 54 b2 a9 5f b8 e9 3e ee 37 bc 62 fd 7c a7 6a f1 ea 69 75 1a 7f f2 68 73 45 f5 51 c4 dc e5 c2 f6 ac d9 ca 77 8f 3b ae 97 67 35 7a 4f 2a 94 ae d6 6f 3f 12 b3 bf 1d 15 3a ff 00 8d 54 Data Ascii: fvLeu7]ip{5]S.5:;i+e#@JUfdGqV5!bLX]MO@ O<zzPS( S@\eW4#S~?YT_>7b\|jiuhsEQw;g5zOo?:T
2025-01-24 21:26:17 UTC	4096	IN	Data Raw: 17 ef f5 1a 69 0b 8f a2 1d 4e ac 95 a0 08 05 02 00 00 00 00 00 00 00 00 08 41 4c 00 98 06 6f 64 09 d5 43 5e 14 2c 9f cc 09 7a 20 4a 40 30 08 05 cf 84 2a 00 00 cd b7 2f a6 fe d2 a8 e6 3d 57 c0 74 26 33 66 31 dc 99 57 bb 96 a7 4f a1 5c aa b4 e9 aa 6f fb 55 b9 96 72 e5 3b 56 7d 65 ef 1f 3f 57 d9 fa 1d 49 6f 4b 95 bf ea e0 e9 3e ff 00 b2 79 62 fd 1f 5d 78 b5 3f c7 f4 ff 00 f6 f5 6b 59 2a 9c af a1 d2 7f ca e5 e6 39 df f8 f3 c5 7c cd 7f 60 ea 25 c2 a3 51 5f 74 36 76 e3 ff 00 2b 8f e9 cf 97 d1 c9 f1 f5 fd 9f 5b 4e 79 b4 6b a6 fb 9c ed 07 7e 3f f2 25 ed 5c 79 7d 36 77 8f 8d af a5 fa 1b 6b 52 b5 52 9b 1c e1 dc 7a 38 df 67 2b 3d 5f 26 bf 72 eb 34 9f fb 6d a8 6f 09 46 39 5e bd a3 52 7e 5c 2a f7 7f 70 aa fd 56 96 e5 1e a6 3d bf 11 ac fc bc d5 7b 8e bc fd f5 ba b3 4d Data Ascii: iNALodC^,z J@0/=Wt&3f1WO\oUr;V}e?WIoK>yb]x?kY9\|`%Q_t6v+[Nyk~?%\y}6wkRRz8g+=_&r4moF9^R~\*pV={M
2025-01-24 21:26:17 UTC	4096	IN	Data Raw: e5 69 e9 4f 23 3d d7 b5 74 4e 38 19 ad d9 ae 94 b6 f0 e0 64 68 be aa f4 19 00 00 00 00 00 04 61 2c f3 e5 97 53 59 46 46 b2 54 94 55 2c 54 0c ab 8c d5 9a b4 b0 cc 64 a0 04 77 0a 5e cc 98 60 00 06 2a 35 1a 8c 95 6b 25 73 00 80 0a 95 87 b9 4c 63 e8 59 f9 4f e8 cb 56 49 74 d2 5c 78 4e ec 8a a9 38 81 6c fa 0e a7 54 9b 64 00 00 a8 05 02 00 00 00 00 02 a5 02 6e 00 80 50 00 00 00 00 11 40 80 50 20 07 9f 57 ab e9 f4 14 ea ea d1 4e e9 4d f7 5e 6f 8f 0e 5c bb 46 6f 3e 3c 7b d7 cb d5 f7 bd 25 2b 43 4a bd 47 9b fb 69 f1 83 b7 1f f8 f7 ff 00 2b 8e 57 ef 9f f8 c7 cc d5 f7 2e b7 59 b4 aa 5a 54 e5 4d fd fb 8e dc 7e 9e 13 f3 5c af d9 ce fe 1e 27 45 7a 8e 6b ae ba ff 00 f2 a9 c7 8b 3a ec 9d 26 33 96 f7 75 a7 4e 94 ae 5b cc de 55 64 6d 2c 12 33 68 df 23 27 b4 5c 69 69 e6 36 Data Ascii: iO#=tN8dha,SYFFTU,Tdw^`*5k%sLcYOVIt\xN8lTdnP@P WNM^o\Fo><{%+CJGi+W.YZTM~\'Ezk:&3uN[Udm,3h#'\ii6

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:17 UTC	1063	OUT	GET /Images/logo.png HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://retrieval.greatland.com/Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:17 UTC	250	IN	HTTP/1.1 200 OK Content-Length: 5361 Connection: close Content-Type: image/png Date: Fri, 24 Jan 2025 21:26:17 GMT Server: Accept-Ranges: bytes ETag: "e625ddbfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:17 UTC	3658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 80 00 00 00 6d 08 06 00 00 00 31 88 d0 56 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 14 93 49 44 41 54 78 da ec 9d ed 71 db b8 16 86 b1 3b fb 3f ea 60 79 2b 58 6e 05 66 2a b0 52 81 99 0a a2 54 60 b9 02 c5 15 48 ae 40 76 05 56 2a b0 b6 02 73 2b b0 3a f0 15 e7 02 63 46 97 38 04 40 f0 43 e2 f3 cc 60 76 23 f3 03 00 cf 01 5e 1c 10 a0 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDRm1VtEXtSoftwareAdobe ImageReadyqe<IDATxq;?`y+XnfRT`H@vVs+:cF8@C`v#^R
2025-01-24 21:26:17 UTC	1703	IN	Data Raw: 16 f9 9b 09 75 b0 89 e4 13 7b 3d 78 31 ff 6f 6c ba 88 dc cf 9c 0e e6 f6 ea 42 f8 6d c2 23 ba e4 44 d1 17 ea 7c a7 79 00 da 30 53 bf 46 81 0e 23 6c e4 2e aa e1 1d e8 19 cf 68 e3 b0 c3 0b eb c3 b1 67 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 85 df a8 02 00 00 18 80 f9 31 dd 1e d3 fd 31 6d 1a 8e 5d 1d 53 7a 4c df 8f 69 df 70 ec fa 98 66 c7 f4 c5 33 3f 89 ce d3 95 3e ff 70 4c 3f 75 de 0e 91 ca 6c ee 71 68 28 73 79 ff bc 92 97 b2 cc 4f c7 b4 73 b8 47 76 4c d7 ba be 54 a5 0c 45 c3 79 a7 f7 2c 2a e7 c6 22 d5 e5 df 35 94 25 a9 e4 c5 a7 0c 21 e5 9f 55 8e b5 b1 8f 68 03 Data Ascii: u{=x1olBm#D\|y0SF#l.hg11m]SzLipf3?>pL?ulqh(syOsGvLTEy,*"5%!Uh

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:17 UTC	1071	OUT	GET /Images/btn-retrieve.png HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://retrieval.greatland.com/Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:17 UTC	250	IN	HTTP/1.1 200 OK Content-Length: 2426 Connection: close Content-Type: image/png Date: Fri, 24 Jan 2025 21:26:17 GMT Server: Accept-Ranges: bytes ETag: "e625ddbfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:17 UTC	2426	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 54 00 00 00 1e 08 06 00 00 00 b2 a8 39 cb 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 22 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDRT9tEXtSoftwareAdobe ImageReadyqe<"iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:17 UTC	769	OUT	GET /Images/corner-right.png HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf
2025-01-24 21:26:18 UTC	250	IN	HTTP/1.1 200 OK Content-Length: 1011 Connection: close Content-Type: image/png Date: Fri, 24 Jan 2025 21:26:17 GMT Server: Accept-Ranges: bytes ETag: "e625ddbfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:18 UTC	1011	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0a 00 00 00 0a 08 06 00 00 00 8d 32 cf bd 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 22 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR2tEXtSoftwareAdobe ImageReadyqe<"iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:18 UTC	1077	OUT	GET /favicon.ico HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ai_user=5gHvp\|2025-01-24T21:26:16.263Z
2025-01-24 21:26:18 UTC	254	IN	HTTP/1.1 200 OK Content-Length: 32038 Connection: close Content-Type: image/x-icon Date: Fri, 24 Jan 2025 21:26:18 GMT Server: Accept-Ranges: bytes ETag: "279af2bfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:18 UTC	3654	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 00 00 20 00 68 04 00 00 46 00 00 00 20 20 00 00 00 00 20 00 a8 10 00 00 ae 04 00 00 30 30 00 00 00 00 20 00 a8 25 00 00 56 15 00 00 40 40 00 00 00 00 20 00 28 42 00 00 fe 3a 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 d2 d1 83 cf cd cc 85 cf cc cb 85 cf cc cb 85 cf cc ca 85 ce cb ca 85 ce cb c9 85 bf bd bc b9 ce cc cb dd cd ca c9 dd cc c8 c6 dd cb c6 c4 dd cc c5 c3 db cb c5 c1 db cb c4 c1 db b6 b0 ae c1 f1 ee ec ff f4 e7 d6 ff f1 e1 ca ff ee e1 d0 ff ea e6 e4 ff e9 e5 e3 ff e9 e4 e2 ff e5 e2 e0 ff fd fb fa ff fc f9 f7 ff fb f6 f4 ff fa f4 f1 ff fa f2 ef ff f9 f1 ed ff f9 f1 ed ff df d7 d4 df f1 ee ee ff db b3 75 ff d0 9d 4c ff d0 ab 6e ff fc Data Ascii: hF 00 %V@@ (B:( @uLn
2025-01-24 21:26:18 UTC	4096	IN	Data Raw: fc f8 f5 ff fc f7 f4 ff bb bc bb 87 00 00 00 05 e7 e7 e7 ff ff ff ff ff ed d4 b4 ff d9 a6 61 ff dd af 72 ff d9 a6 61 ff d8 a5 5f ff d4 ba 98 ff ff ff ff ff ff ff ff ff ff ff fe ff f5 f3 f3 ff ec e9 e6 ff ec e9 e6 ff ec e8 e6 ff f5 f2 f1 ff f5 f2 f1 ff ec e8 e6 ff ec e8 e5 ff ec e8 e4 ff ec e7 e4 ff ec e7 e4 ff ec e6 e3 ff ec e6 e2 ff ec e5 e1 ff ec e5 e1 ff f4 ef ec ff fc f9 f7 ff fc f9 f6 ff fc f8 f6 ff bd bd bd 87 00 00 00 05 e7 e7 e7 ff ff ff ff ff ed d5 b6 ff db a9 67 ff de b2 77 ff db aa 69 ff da a9 67 ff d5 bd 9c ff ff ff ff ff ff ff ff ff ff ff ff ff f6 f4 f3 ff ec ea e6 ff ed e9 e6 ff ec e9 e6 ff f5 f3 f1 ff f5 f3 f1 ff ec e8 e6 ff ec e8 e5 ff ec e7 e5 ff ec e7 e3 fd ec e8 e4 fd ec e7 e3 ff ec e6 e2 ff ec e5 e1 ff eb e4 e1 ff f4 ef ec fb fc f9 f7 Data Ascii: ara_gwig
2025-01-24 21:26:18 UTC	4096	IN	Data Raw: f5 f1 ef ff f5 f1 ee ff f5 f0 ed ff f4 ef ed ff f4 ef ed ff f4 ef ed ff f7 f2 f0 ff fb f5 f3 ff fb f5 f3 ff fb f5 f3 ff fb f5 f3 ff fb f5 f3 ff fb f6 f3 ff 89 87 87 9f db db da ff fd fc fa ff fd fc fa ff f2 e5 d1 ff d2 a0 53 ff d1 9e 4f ff d2 a2 55 ff d7 ac 67 ff d1 9e 4e ff d0 9d 4c ff d1 9f 50 ff d0 c3 af ff fd fa f8 ff fd fa f9 ff fd fa f8 ff fd fa f8 ff fd f9 f8 ff f0 ea e7 ff ec e5 e2 ff eb e5 e1 ff eb e5 e1 ff dd d7 d2 ff d8 d5 d3 ff fd fd fd ff fe fd fc ff fd fd fc ff fe fc fb ff fe fc fb ff fd fb fa ff fd fb fa ff fd fa f9 ff fd f9 f8 ff fd f9 f8 ff fc f9 f7 ff fc f8 f7 ff fc f8 f6 ff fc f7 f5 ff fc f7 f5 ff fc f7 f5 ff fc f7 f4 ff fc f6 f4 ff fc f6 f4 ff fc f6 f4 ff fc f6 f4 ff fc f6 f4 ff fc f7 f4 ff fc f7 f4 ff 8a 88 88 9f db da da ff fc fc fa Data Ascii: SOUgNLP
2025-01-24 21:26:18 UTC	4096	IN	Data Raw: ff ff ff ff f6 ea da ff db a9 6a ff db a8 66 ff db ab 6c ff df b5 7c ff da a8 66 ff da a7 64 ff db aa 68 ff d2 c6 b5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f1 ef ed ff ed ea e7 ff ed e9 e7 ff ec e9 e7 ff ec e9 e7 ff ec e9 e6 ff f9 f9 f8 ff f9 f9 f8 ff ed ea e6 ff ed e9 e7 ff ed ea e7 ff ed ea e7 ff ed e9 e7 ff ed ea e7 ff ed ea e7 ff ed e9 e7 ff ec ea e6 ff ec e9 e5 ff ec e9 e5 ff eb e7 e2 ff ec e7 e3 fd ec e7 e3 fd f0 ed e9 ff fd f9 f7 ff fc f8 f7 ff fc f9 f6 ff fb f8 f5 ff fa f7 f5 ff c8 c8 c8 c3 00 00 00 0b 00 00 00 03 db db db ff ff ff ff ff ff ff ff ff f6 ea db ff dc ac 6e ff dc aa 6b ff dd ae 71 ff e1 b6 80 ff db aa 6b ff db aa 6a ff dc ac 6c ff d3 c7 b6 ff ff ff ff ff fe fe fe ff ff ff ff ff ff ff ff ff fe fe fe ff f8 f7 f6 Data Ascii: jfl\|fdhnkqkjl
2025-01-24 21:26:18 UTC	4096	IN	Data Raw: fc f8 f4 ff fc f7 f4 ff fb f6 f4 ff fb f6 f4 ff fb f6 f3 ff fb f6 f3 ff fc f5 f3 ff fb f5 f2 ff fb f5 f2 ff fb f5 f2 ff fb f5 f2 ff fb f4 f2 ff fb f4 f1 ff fa f4 f1 ff fa f4 f0 ff fa f4 f0 ff fa f4 f0 ff fa f4 f0 ff fa f3 f0 ff f9 f3 f0 ff fa f3 f0 ff ba b5 b3 ff fe fc fc ff fe fc fb ff fe fc fb ff fd fb fa ff fd fb fa ff fd fa f9 ff fd fa f8 ff fd f9 f8 ff fc f8 f6 ff fc f8 f6 ff fc f7 f5 ff fc f7 f4 ff fb f6 f4 ff fb f5 f3 ff fb f5 f2 ff fb f4 f1 ff fa f4 f1 ff fa f3 f0 ff fa f3 ef ff fa f2 ef ff fa f2 ee ff fa f1 ee ff f9 f1 ed ff f9 f1 ed ff f9 f1 ed ff f9 f0 ed ff f9 f0 ec ff f9 f0 ec ff f9 f0 ec ff f9 f0 ed ff f9 f1 ed ff f9 f1 ed ff f9 f1 ed ff 3d 3d 3d 7f d0 d0 d0 ff fd f8 f6 ff fd f8 f6 ff fd f8 f6 ff fd f8 f6 ff fc f9 f6 ff fc f8 f5 ff fc f8 f5 Data Ascii: ===
2025-01-24 21:26:18 UTC	4096	IN	Data Raw: d1 9c 4a ff dc b4 78 ff d3 a2 56 ff d0 9d 4b ff d0 9d 4a ff d2 9f 51 ff d1 9e 4f ff d0 d0 d0 ff fd fb fa ff fd fb fa ff fd fb fa ff fd fb fa ff fd fb fa ff fd fa f9 ff fd fb f9 ff ec e7 e2 ff ec e7 e2 ff ec e6 e2 ff ec e6 e2 ff ec e6 e2 ff ec e5 e2 ff b2 ad ab ff e2 e2 e1 ff fe fe fd ff e2 e1 e1 ff fe fd fd ff e2 e1 e0 ff fe fd fc ff e2 e1 e0 ff fe fc fc ff e2 e0 df ff fe fc fb ff e2 df df ff fd fb fa ff e1 df df ff fd fa f9 ff e1 df de ff fd fa f9 ff e1 df dd ff fd f9 f8 ff e1 de dd ff fd f9 f7 ff e1 de dc ff fc f9 f7 ff e0 dd dc ff fc f8 f7 ff e0 dd db ff fc f8 f6 ff e0 dd db ff fc f8 f6 ff e0 dd db ff fc f8 f6 ff e0 dd db ff fc f8 f7 ff e0 dd dc ff 3f 3f 3f 7f d0 d0 d0 ff fd fd fb ff fd fd fb ff fd fd fb ff fd fd fb ff d6 a7 5e ff d5 a3 59 ff d4 a4 5a Data Ascii: JxVKJQO???^YZ
2025-01-24 21:26:18 UTC	4096	IN	Data Raw: d6 a2 5b ff e2 bb 85 ff d9 a8 65 ff d7 a2 5b ff d6 a2 5b ff d9 a6 61 ff d6 a3 5a ff d0 d0 d0 ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fe ff fe ff fe ff ff ff fe ff fe fe fe ff ec e9 e6 ff ed e9 e6 ff ec e8 e6 ff ec e9 e6 ff ec e8 e6 ff ec e8 e6 ff ec e8 e6 ff ec e8 e6 ff fe fd fd ff fe fd fd ff ec e8 e6 ff ec e8 e5 ff ec e8 e4 ff ec e7 e4 ff ec e7 e4 ff ec e7 e4 ff ec e7 e4 ff ec e7 e3 ff ec e7 e3 ff ec e7 e2 ff ec e7 e2 ff ec e6 e2 ff ec e6 e2 ff ec e5 e2 ff ec e6 e2 ff ec e5 e2 ff ec e5 e2 ff eb e5 e2 ff ec e5 e1 ff ec e5 e0 ff fd f8 f6 ff fc f9 f6 ff fc f8 f6 ff fc f8 f5 ff fc f7 f5 ff fc f7 f4 ff fc f7 f4 ff c4 c4 c4 ff 00 00 00 0f 00 00 00 09 ff ff ff 01 d0 d0 d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff db ab 69 ff d9 a6 62 ff d9 a7 62 Data Ascii: [e[[aZibb
2025-01-24 21:26:18 UTC	3808	IN	Data Raw: dc a8 68 ff dc ab 6e ff db a7 66 ff db a6 64 ff da a6 63 ff dc aa 6b ff de b0 74 ff d0 d0 d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ed ea e7 ff ea e7 e4 ff ea e7 e4 ff ea e7 e4 ff ea e7 e4 ff ea e7 e4 ff e4 e0 de ff d6 d3 d0 ff d4 d1 ce ff d8 d5 d2 ff da d7 d4 ff e8 e8 e8 ff e7 e7 e7 ff e3 e3 e3 ff dd dd dd ff d5 d5 d5 ff c6 c6 c6 ff bc bc bc ff e7 e7 e7 ff ff ff ff 01 ff ff ff 01 ff ff ff 01 d0 d0 d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff dd ad 70 ff dc a8 69 ff dc a9 6a Data Ascii: hnfdcktpij

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Windows Analysis Report
https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:18 UTC	549	OUT	OPTIONS /v2/track HTTP/1.1 Host: dc.services.visualstudio.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,sdk-context Origin: https://retrieval.greatland.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://retrieval.greatland.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-24 21:26:19 UTC	423	IN	HTTP/1.1 204 No Content Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin,X-Requested-With,Content-Name,Content-Type,Accept,Cache-Control,Sdk-Context,X-Set-Cross-Origin-Resource-Policy,Content-Encoding Access-Control-Allow-Methods: POST Access-Control-Max-Age: 3600 Date: Fri, 24 Jan 2025 21:26:18 GMT Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:19 UTC	655	OUT	POST /v2/track HTTP/1.1 Host: dc.services.visualstudio.com Connection: keep-alive Content-Length: 1439 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/json sec-ch-ua-mobile: ?0 Sdk-Context: appId User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://retrieval.greatland.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://retrieval.greatland.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-24 21:26:19 UTC	1439	OUT	Data Raw: 5b 7b 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 32 34 54 32 31 3a 32 36 3a 31 36 2e 37 38 32 5a 22 2c 22 69 4b 65 79 22 3a 22 63 30 65 35 37 31 66 34 2d 31 39 36 31 2d 34 38 30 35 2d 39 33 31 31 2d 39 66 36 31 38 63 38 39 66 32 64 33 22 2c 22 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 41 70 70 6c 69 63 61 74 69 6f 6e 49 6e 73 69 67 68 74 73 2e 63 30 65 35 37 31 66 34 31 39 36 31 34 38 30 35 39 33 31 31 39 66 36 31 38 63 38 39 66 32 64 33 2e 50 61 67 65 76 69 65 77 22 2c 22 74 61 67 73 22 3a 7b 22 61 69 2e 73 65 73 73 69 6f 6e 2e 69 64 22 3a 22 43 59 34 71 78 22 2c 22 61 69 2e 73 65 73 73 69 6f 6e 2e 69 73 46 69 72 73 74 22 3a 22 74 72 75 65 22 2c 22 61 69 2e 64 65 76 69 63 65 2e 69 64 22 3a 22 62 72 6f 77 73 65 72 22 2c 22 61 69 2e 64 65 76 Data Ascii: [{"time":"2025-01-24T21:26:16.782Z","iKey":"c0e571f4-1961-4805-9311-9f618c89f2d3","name":"Microsoft.ApplicationInsights.c0e571f41961480593119f618c89f2d3.Pageview","tags":{"ai.session.id":"CY4qx","ai.session.isFirst":"true","ai.device.id":"browser","ai.dev
2025-01-24 21:26:20 UTC	291	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Date: Fri, 24 Jan 2025 21:26:19 GMT Connection: close
2025-01-24 21:26:20 UTC	102	IN	Data Raw: 36 30 0d 0a 7b 22 69 74 65 6d 73 52 65 63 65 69 76 65 64 22 3a 32 2c 22 69 74 65 6d 73 41 63 63 65 70 74 65 64 22 3a 32 2c 22 61 70 70 49 64 22 3a 22 36 37 64 36 37 34 34 31 2d 64 61 38 35 2d 34 39 36 34 2d 62 63 34 39 2d 32 63 65 34 62 62 31 37 64 64 36 35 22 2c 22 65 72 72 6f 72 73 22 3a 5b 5d 7d 0d 0a Data Ascii: 60{"itemsReceived":2,"itemsAccepted":2,"appId":"67d67441-da85-4964-bc49-2ce4bb17dd65","errors":[]}
2025-01-24 21:26:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:21 UTC	360	OUT	GET /v2/track HTTP/1.1 Host: dc.services.visualstudio.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-24 21:26:21 UTC	232	IN	HTTP/1.1 405 Method Not Allowed Allow: POST Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff Date: Fri, 24 Jan 2025 21:26:21 GMT Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:39 UTC	1161	OUT	GET /Images/icon_warning.png HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://retrieval.greatland.com/Content/css?v=yyNGwusDeMzUnH-8r5Gg5u9Bhugskba-HJsokSW0zKw1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ai_user=5gHvp\|2025-01-24T21:26:16.263Z; ai_session=CY4qx\|1737753976781.8\|1737753976781.8
2025-01-24 21:26:39 UTC	250	IN	HTTP/1.1 200 OK Content-Length: 1257 Connection: close Content-Type: image/png Date: Fri, 24 Jan 2025 21:26:39 GMT Server: Accept-Ranges: bytes ETag: "e625ddbfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:39 UTC	1257	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 11 00 00 00 0f 08 06 00 00 00 02 b1 24 11 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 20 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 30 2d 63 30 36 30 20 36 31 2e 31 33 34 37 37 37 2c 20 32 30 31 30 2f 30 32 2f 31 32 2d 31 37 3a 33 32 3a 30 30 20 20 Data Ascii: PNGIHDR$tEXtSoftwareAdobe ImageReadyqe< iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00

Timestamp	Bytes transferred	Direction	Data
2025-01-24 21:26:40 UTC	859	OUT	GET /Images/icon_warning.png HTTP/1.1 Host: retrieval.greatland.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RecipientId=39432563; RecipientGUID=0c74c038-8fcc-4ebb-b149-672d9084ed6c; SecurityToken=; __RequestVerificationToken=WW1ALXIjvBidVywbP8Md43oHCbzr_wYxEoTPI7jpeGJsmyU4R3cU5JeNyKT1JP5gbh50i89nr2nrqJTGmOoo2RxBuJaTaqHcO76ED6FGA6Q1; ARRAffinity=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ARRAffinitySameSite=d547e40ea9b41cdbd4e865c89814bc78efd0e04fb16046aab04612762f01ffdf; ai_user=5gHvp\|2025-01-24T21:26:16.263Z; ai_session=CY4qx\|1737753976781.8\|1737753976781.8
2025-01-24 21:26:40 UTC	250	IN	HTTP/1.1 200 OK Content-Length: 1257 Connection: close Content-Type: image/png Date: Fri, 24 Jan 2025 21:26:40 GMT Server: Accept-Ranges: bytes ETag: "e625ddbfdbddda1:0" Last-Modified: Wed, 24 Jul 2024 15:11:24 GMT X-Powered-By: ASP.NET
2025-01-24 21:26:40 UTC	1257	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 11 00 00 00 0f 08 06 00 00 00 02 b1 24 11 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 20 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 30 2d 63 30 36 30 20 36 31 2e 31 33 34 37 37 37 2c 20 32 30 31 30 2f 30 32 2f 31 32 2d 31 37 3a 33 32 3a 30 30 20 20 Data Ascii: PNGIHDR$tEXtSoftwareAdobe ImageReadyqe< iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00

Target ID:	0
Start time:	16:26:05
Start date:	24/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	16:26:07
Start date:	24/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2096,i,2067873033797565785,9166219379275468913,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	16:26:13
Start date:	24/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://retrieval.greatland.com/0c74c038-8fcc-4ebb-b149-672d9084ed6c"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre