Edit tour

Windows Analysis Report
https://url.au.m.mimecastprotect.com/s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com

Overview

General Information

Sample URL:	https://url.au.m.mimecastprotect.com/s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com
Analysis ID:	1647582
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

Detected use of open redirect vulnerability

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2296 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2480,i,12073212339292539700,13735426915157075749,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2508 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5568 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.au.m.mimecastprotect.com/s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
2.16..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.2..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.9.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.10.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 4 entries

Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL '05f18be492a04674a4715d258c134a69.foneads.com' does not match the legitimate domain 'microsoft.com'., The domain 'foneads.com' is not associated with Microsoft., The presence of a long alphanumeric subdomain '05f18be492a04674a4715d258c134a69' is suspicious and often used in phishing., The URL does not contain any direct reference to Microsoft, which is a red flag. DOM: 2.9.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 2.16..script.csv, type: HTML
Source: Yara match	File source: 1.2..script.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.5.pages.csv, type: HTML
Source: Yara match	File source: 2.7.pages.csv, type: HTML
Source: Yara match	File source: 2.8.pages.csv, type: HTML
Source: Yara match	File source: 2.9.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 2.10.pages.csv, type: HTML

Detected use of open redirect vulnerability

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Proxy from: oneconnect.memberdoc.com/v2/emailtracker/click?data=214213_82941695_1~https://t.ly/m5iul to https://t.ly/m5iul

HTTP Parser: Number of links: 0

HTTP Parser: Base64 decoded: 547ab8bc-592c-44e7-abd6-787536c7926b3ab19276-4f25-4352-ad9d-926eb869d339

HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://loadquotation.brownstationers.com/miss/?	HTTP Parser: No favicon
Source: https://loadquotation.brownstationers.com/miss/?	HTTP Parser: No favicon
Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: No favicon

Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.250.176.196:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 124.47.150.19:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 124.47.150.19:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.87.253.48:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.6.133:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49791 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: oneconnect.memberdoc.com to https://t.ly/m5iul
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: t.ly to https://loadquotation.brownstationers.com/miss/?
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: loadquotation.brownstationers.com to https://05f18be492a04674a4715d258c134a69.foneads.com?nuxstwzph=67e1f180d4f608878d14199c

Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com HTTP/1.1Host: url.au.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/e29r4hsA7qrCxBMpcemfoLEBpSrcbyjMy-Pd1IUpEZpbOPR3GVD5cMB7kS5eEuuvYo3FTzjo_dZ2BeICqteslrNPuzPmNYTOTbR-3LK3ZNDNc0rOudJqIzp4wus1OvYpjNtG_JTlE0X0bq_XXl8EhRlas4N7thY1qhu_P_jKtLqSolTXG40cpwMr0OFYG00POYfisczSaEodmh5jRCgHrjv4W-h-K_w8vKJlpjHGik_S0LMjoDSfOyIe3DabIbUqaVmSXhvochWU_7c4iZNfhj0w0zX2jKZVWqS4QbgtRL4melpwa3XOm2hbZJuytTJBxnYKxxEK4oh36MFIr4Oq5fuTTv7UaxKwYdIMQjDmQo4aDG0aTmbplq8AT2H7atIxtSFo-ApUSLqJch6at0QiWDYKdfhLF0MT0Xu0UjneI1GtqkBf4-fDxSoAnobMt9CzjcQ6LB_o8CPEtoRg7yw7Xg_3EJ-49rf7DRwoMPqLpLFDq_Kx5gYj4Kx1gLhlaZt38S8VdebFFqwat7j0OT6UKW77H2O60sqdsX1F5SSu3fY0NJC_8pla_hr_VzNa0qxRv52TmmALWgtzhiAFE0LzC7tFgtKOpgldEptjhoXniXl4UZtqBT7L0VZwtVq19Kx1nypbYR0nzCeRk0izeQINGJYWc1tEWXDlPdeBYITlZaZI2oJ3CIM-MVWT6g8HX5F-v8v7A4Nh9uxlsQswGDBUjsh9KagJfKDi9a8BdtkPgOfS94RMTAxNLS844fm8-VDHYrMLOA1g6P47mV0KYjaw1pDjnV8Z4DtDaOje-a5U7q6yan8Hgci-qNIrwD0eu9zw3E7eDw1D-4GIXIrJo2x2YhoOVsejmQpQptt1tt69rHHdELAOX-0ZjR6q89hAEe8TaT9W_kzh3DJlysoTbqqRr2rIUh8NZB6gZjXZvZDrpw1Sh7-g20Ezq7uGEHM7VQGsGtwOREZfKHYfcqWKHaZhEiD5kAEw8MhIG4Dbx8t91vW0NYWYGYond6ffM2Hn_0eiVgVlFtJVOQ6xHVeKX8MkHIHEQkVqkenizUfEcSd8XxN0cu6qj7Jw6YtldO1dtHxhASgdfpgInU5JKLJAyir5_6kQicz7dTrE_7V_nR7tkPVr2z3xFioW3W5OsX6-1k68bOQMisipVyGQZU7AgsJiRIPoIu4G10gEy_wSKGp5Vy2GvDzlLSb2dSHiExGayw8eGR-c-P2W2jr4n2ENwmQ3ZHEMgJaabpd1JJ2YwcAPWL4eKc8FS18jTCu3-q81BwU3tE1xv2eE8lBjzIcPWwm-Fnck1fVi_y3qJC87CyisBGX7g4XvS9Nr0J_Lc0uTDXNVxN2oyF9JRDopUvBYSoaZn0_fG7z7OCao_5QTatTYODdYwqFDfX3kIJ8YXrTJBYbkbS9jxR0YeocbwfEV8zR7floyinifYNpSNOqaHQcJsmYiIzVlRFT5P2itIqCsZjm94LWZ5V5_LV2BFBDDZd4B40oVerBJzLvZ8Z-CXgOhWLvdKjT0FYjzNEc41oeyKOFNospko1meTlbw4nAykEA2OBBfQZylQaSIvu1RdRUkFIO2cOk011JPsYLCGdx3FC6Tm-QMcMGuzcIgWSST7OLQgh2kcQirMyTz6dCKSQcNIR8ihXoCW2S8YUNXrKFhyPNvBBsFBnkMPxUr1mzQ00VjdczujItzgfVMPq0dOy5HUfJsX6VbRRZmVKDrNXVhkTh8DQWH6mHkjAnwzaC1B6CPbVAaNyicpoWlbiwhlXphLS28qRMRSYWa-n9-chciKokiFLQvtb0s78w9HKC_s6SBUVS864TdkEoqvzFJri0PmPkl-04DQFJkM92pE1bpsYpdz0tK6XfRhzlnZ90dvj5X-Lhy4sfoTurrVQB22XvxXjiitLSDpRvnNazFkEZMLl2COButr9prK9wpvlByNuH4a8I9fkjWK6daSHLH9Yg8R5hH5qi9VtMwBmSujbJszpe5Isdptm5SSXbNUKTXtnv5M5nR3teB_YnUSAXAE_Qc35NLef8iXa_xOdTfHgwzo_pb556ixt8oayXUgU1f-tnMXBaqDLlYVIYi1Q5BZB8szk8051I_bPeHr2hXfCA3Q7Ch-ToK9me9mpdBlpMmuzmRaAdOgKleC5zFG4vAgW75jQm-AAiLi6DjQQXrs5qHRIK_8aaMrR62SON-rZ85DoLz3noDqaXqwcxZZddihznia1Mx5Tl-8DbLleAGiKVKBXzVQWsHHXHXQS4SN6RvtDti_a35OrUSW-ZAYr4wm9rFqNJt0sM_m80Kbo8iL9L4UuWnzHzMEqQB7-WQGAyDAOfa_tRasGko4VD8eQLLpmNvswOUBISlE_EZh2X883wYPnLnE6TYXbKK8puELGkItpRAQ1kcf5gQPjVLVtKtHeDZxuVeq4_6YAckqYHhgJ05kugqRvfw-zRMFVjR9E5T7YF_2SivVFIv7x_P2Q1TpPJSd5JP2ghRquLtyw8Xv0EH2TmFNooDbwr-JO-kj5VBf7MlgWsYU67U6UFzUQLTLsyg8-unBofNQh1VDiAmdwuKZ4jHX2oaMkcfLuUu7tCfH36Xx_z8QiXjif_t0dWguVdPyMsNUlBIbeeIJy647WWMFEzdzHi22nsZp8HMYGu1mtrHWUcATiDT2noPwsafTj7GQialMM-rJ603QwEKyxRWZiwAYZdzOtK_xEU6Z18uSlBAMAJbjfPDFzaZSxfsyB15fehL6YCSxiiiyht8ytJAgXlrgvazNSeG5uMHFRO6vk-PU7Dd2imNNS0f1Wh2xX8m-5z_U1LfgmUdVTpqW6k7gHKPGVyt7UiYCJd90nTz7esErLas7yc-1wpBgaV-riGDN7X4c8chmcwDfK3Yh7rqO06Jm3-KoffAjnS9NKWm20wGQb_-36s_OR_JB6pnQaAAbo8T7C9S2-7elPd-3sTSiCc3vE2tfaumd3Nk-uRgMPBXwRayFZhrnZFlnZ1k6_dYgWE HTTP/
Source: global traffic	HTTP traffic detected: GET /v2/EmailTracker/Click?data=214213_82941695_1~https://t.ly/M5IUL HTTP/1.1Host: oneconnect.memberdoc.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /M5IUL HTTP/1.1Host: t.lyConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /miss/? HTTP/1.1Host: loadquotation.brownstationers.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?NuXSTwzpH=67e1f180d4f608878d14199c HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://loadquotation.brownstationers.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: 6bb2d8867f5d424f935e0d8493ee7e6b.foneads.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://loadquotation.brownstationers.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://loadquotation.brownstationers.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /67e1f180d4f608878d14199c/ HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://05f18be492a04674a4715d258c134a69.foneads.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199cSec-WebSocket-Key: 44StBjxZ41l3i6psagJaIQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /67e1f180d4f608878d14199c/ HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://05f18be492a04674a4715d258c134a69.foneads.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: rk5mlvcATZPo+f6QHFSkSg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /common/handlers/watson HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_r1sg5sxlkljjoa22hvk04g2.js HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: f2debd53b0454135966042a40d6bc27b.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /67e1f180d4f608878d14199c/ HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://05f18be492a04674a4715d258c134a69.foneads.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: I4il3aIq9SLR+w34laksvA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /common/handlers/watson HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4ba7c391e6f3f547d8ce.js HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /67e1f180d4f608878d14199c/ HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://05f18be492a04674a4715d258c134a69.foneads.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=aeb224c7-4f32-4b89-a8ff-37fda12968dd; brcap=0Sec-WebSocket-Key: Umfso1x8q3A1BD7RAnvZRQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: f2debd53b0454135966042a40d6bc27b.foneads.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://05f18be492a04674a4715d258c134a69.foneads.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1Host: 39a460f848a842e4900f91b3f3f12232.foneads.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
Source: global traffic	HTTP traffic detected: GET /67e1f180d4f608878d14199c/ HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://05f18be492a04674a4715d258c134a69.foneads.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=aeb224c7-4f32-4b89-a8ff-37fda12968dd; brcap=0; ai_session=So/ZiyN+Sd1HHWJp0TJRk5\|1742860708765\|1742860708765; MSFPC=GUID=7f9e3679d8b74c6fa1d51c19885f5628&HASH=7f9e&LV=202503&V=4&LU=1742860715548Sec-WebSocket-Key: 6vTES6g6V53PsMcaVpeLcQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: 05f18be492a04674a4715d258c134a69.foneads.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=aeb224c7-4f32-4b89-a8ff-37fda12968dd; brcap=0; ai_session=So/ZiyN+Sd1HHWJp0TJRk5\|1742860708765\|1742860708765; MSFPC=GUID=7f9e3679d8b74c6fa1d51c19885f5628&HASH=7f9e&LV=202503&V=4&LU=1742860715548

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: url.au.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: oneconnect.memberdoc.com
Source: global traffic	DNS traffic detected: DNS query: t.ly
Source: global traffic	DNS traffic detected: DNS query: loadquotation.brownstationers.com
Source: global traffic	DNS traffic detected: DNS query: 05f18be492a04674a4715d258c134a69.foneads.com
Source: global traffic	DNS traffic detected: DNS query: 6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com
Source: global traffic	DNS traffic detected: DNS query: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com
Source: global traffic	DNS traffic detected: DNS query: 7bb7036b135144cd89664486a4033abf.foneads.com
Source: global traffic	DNS traffic detected: DNS query: f2debd53b0454135966042a40d6bc27b.foneads.com
Source: global traffic	DNS traffic detected: DNS query: 39a460f848a842e4900f91b3f3f12232.foneads.com

Source: unknown

HTTP traffic detected: POST /miss/? HTTP/1.1Host: loadquotation.brownstationers.comConnection: keep-aliveContent-Length: 11318Cache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Origin: https://loadquotation.brownstationers.comContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://loadquotation.brownstationers.com/miss/?Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 24 Mar 2025 23:58:07 GMTContent-Type: text/html; charset=utf-8Content-Length: 0Connection: closecache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1743b5e1-650e-4569-8a2c-409a4b6c7900x-ms-ests-server: 2.1.20329.5 - SCUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 24 Mar 2025 23:58:14 GMTContent-Type: text/html; charset=utf-8Content-Length: 0Connection: closecache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: e02fbf24-37ed-40d0-b66e-685f455a7000x-ms-ests-server: 2.1.20329.5 - WUS3 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 24 Mar 2025 23:58:14 GMTContent-Type: text/html; charset=utf-8Content-Length: 0Connection: closecache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 88eeb431-35a1-4819-aebd-860164f55700x-ms-ests-server: 2.1.20329.5 - EUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 24 Mar 2025 23:58:20 GMTContent-Type: text/html; charset=utf-8Content-Length: 0Connection: closecache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 2f92ecc5-c934-4623-b414-33d9901f4800x-ms-ests-server: 2.1.20329.5 - EUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 24 Mar 2025 23:58:27 GMTContent-Type: text/html; charset=utf-8Content-Length: 0Connection: closecache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: d35c6de5-932f-4402-a194-df1e1a573d00x-ms-ests-server: 2.1.20329.5 - EUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 24 Mar 2025 23:58:39 GMTContent-Type: text/html; charset=utf-8Content-Length: 0Connection: closecache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 6ee4bef6-e8e1-4a1f-927d-131514b82800x-ms-ests-server: 2.1.20329.5 - NCUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: chromecache_86.2.dr	String found in binary or memory: https://05f18be492a04674a4715d258c134a69.foneads.com
Source: chromecache_86.2.dr	String found in binary or memory: https://13d163bcd6a047a8b9403a02d55bd6bd.foneads.com
Source: chromecache_86.2.dr	String found in binary or memory: https://249ef71dc2f54078a6a8547b4a9bba96.foneads.com
Source: chromecache_86.2.dr	String found in binary or memory: https://3679bac37f714fdd8886b5c2337688a0.foneads.com
Source: chromecache_86.2.dr	String found in binary or memory: https://39544782e2504076bd5a00d28b7cb580.foneads.com
Source: chromecache_86.2.dr	String found in binary or memory: https://3c41f47a74ec42fc8c86c7e3467a088f.foneads.com
Source: chromecache_86.2.dr	String found in binary or memory: https://692d60f343b54764a026b7effda01030.foneads.com
Source: chromecache_86.2.dr	String found in binary or memory: https://6b76a00060e14d43972234aa6b31d8b6.foneads.com
Source: chromecache_86.2.dr	String found in binary or memory: https://8098ee33668046448a4052e199633903.foneads.com
Source: chromecache_86.2.dr	String found in binary or memory: https://b3a73829fffa4d8298ad4c5f7d31502b.foneads.com
Source: chromecache_86.2.dr	String found in binary or memory: https://c0cd75414b1a47ec91610d5f90522144.foneads.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.250.176.196:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 124.47.150.19:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 124.47.150.19:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.87.253.48:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.6.133:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.230.137.235:443 -> 192.168.2.4:49791 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir2296_1359185186

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir2296_1359185186

Jump to behavior

Source: classification engine

Classification label: mal60.phis.win@23/45@28/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2480,i,12073212339292539700,13735426915157075749,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2508 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.au.m.mimecastprotect.com/s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2480,i,12073212339292539700,13735426915157075749,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2508 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Web Protocols	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://url.au.m.mimecastprotect.com/s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js	0%	Avira URL Cloud	safe
https://05f18be492a04674a4715d258c134a69.foneads.com/?NuXSTwzpH=67e1f180d4f608878d14199c	0%	Avira URL Cloud	safe
https://05f18be492a04674a4715d258c134a69.foneads.com/common/handlers/watson	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js	0%	Avira URL Cloud	safe
https://39544782e2504076bd5a00d28b7cb580.foneads.com	0%	Avira URL Cloud	safe
https://249ef71dc2f54078a6a8547b4a9bba96.foneads.com	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4ba7c391e6f3f547d8ce.js	0%	Avira URL Cloud	safe
https://6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com/login	0%	Avira URL Cloud	safe
https://13d163bcd6a047a8b9403a02d55bd6bd.foneads.com	0%	Avira URL Cloud	safe
https://3679bac37f714fdd8886b5c2337688a0.foneads.com	0%	Avira URL Cloud	safe
https://692d60f343b54764a026b7effda01030.foneads.com	0%	Avira URL Cloud	safe
https://05f18be492a04674a4715d258c134a69.foneads.com/67e1f180d4f608878d14199c/	0%	Avira URL Cloud	safe
https://oneconnect.memberdoc.com/v2/EmailTracker/Click?data=214213_82941695_1~https://t.ly/M5IUL	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	Avira URL Cloud	safe
https://39a460f848a842e4900f91b3f3f12232.foneads.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0	0%	Avira URL Cloud	safe
https://05f18be492a04674a4715d258c134a69.foneads.com/common/GetCredentialType?mkt=en-US	0%	Avira URL Cloud	safe
https://6b76a00060e14d43972234aa6b31d8b6.foneads.com	0%	Avira URL Cloud	safe
https://05f18be492a04674a4715d258c134a69.foneads.com/favicon.ico	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js	0%	Avira URL Cloud	safe
https://05f18be492a04674a4715d258c134a69.foneads.com	0%	Avira URL Cloud	safe
https://8098ee33668046448a4052e199633903.foneads.com	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	0%	Avira URL Cloud	safe
https://f2debd53b0454135966042a40d6bc27b.foneads.com/Me.htm?v=3	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	0%	Avira URL Cloud	safe
https://3c41f47a74ec42fc8c86c7e3467a088f.foneads.com	0%	Avira URL Cloud	safe
https://b3a73829fffa4d8298ad4c5f7d31502b.foneads.com	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js	0%	Avira URL Cloud	safe
https://c0cd75414b1a47ec91610d5f90522144.foneads.com	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_r1sg5sxlkljjoa22hvk04g2.js	0%	Avira URL Cloud	safe
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
url.au.m.mimecastprotect.com	124.47.150.19	true	false	high
05f18be492a04674a4715d258c134a69.foneads.com	173.230.137.235	true	true	unknown
t.ly	104.20.6.133	true	false	high
f2debd53b0454135966042a40d6bc27b.foneads.com	173.230.137.235	true	false	unknown
oneconnect.memberdoc.com	204.87.253.48	true	true	unknown
www.google.com	142.250.176.196	true	false	high
6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com	173.230.137.235	true	false	unknown
7bb7036b135144cd89664486a4033abf.foneads.com	173.230.137.235	true	false	unknown
loadquotation.brownstationers.com	173.230.137.235	true	false	unknown
f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com	173.230.137.235	true	false	unknown
39a460f848a842e4900f91b3f3f12232.foneads.com	173.230.137.235	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	true		unknown
https://05f18be492a04674a4715d258c134a69.foneads.com/common/handlers/watson	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	false	Avira URL Cloud: safe	unknown
https://05f18be492a04674a4715d258c134a69.foneads.com/?NuXSTwzpH=67e1f180d4f608878d14199c	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js	false	Avira URL Cloud: safe	unknown
https://05f18be492a04674a4715d258c134a69.foneads.com/67e1f180d4f608878d14199c/	false	Avira URL Cloud: safe	unknown
https://6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com/login	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4ba7c391e6f3f547d8ce.js	false	Avira URL Cloud: safe	unknown
https://oneconnect.memberdoc.com/v2/EmailTracker/Click?data=214213_82941695_1~https://t.ly/M5IUL	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	Avira URL Cloud: safe	unknown
https://39a460f848a842e4900f91b3f3f12232.foneads.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0	false	Avira URL Cloud: safe	unknown
https://loadquotation.brownstationers.com/miss/?	false		unknown
https://05f18be492a04674a4715d258c134a69.foneads.com/common/GetCredentialType?mkt=en-US	false	Avira URL Cloud: safe	unknown
https://url.au.m.mimecastprotect.com/s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com	false		high
https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false		unknown
https://t.ly/M5IUL	false		high
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	false	Avira URL Cloud: safe	unknown
https://05f18be492a04674a4715d258c134a69.foneads.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	false	Avira URL Cloud: safe	unknown
https://f2debd53b0454135966042a40d6bc27b.foneads.com/Me.htm?v=3	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	false	Avira URL Cloud: safe	unknown
https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_r1sg5sxlkljjoa22hvk04g2.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://249ef71dc2f54078a6a8547b4a9bba96.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
https://39544782e2504076bd5a00d28b7cb580.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
https://692d60f343b54764a026b7effda01030.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
https://13d163bcd6a047a8b9403a02d55bd6bd.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
https://3679bac37f714fdd8886b5c2337688a0.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
https://6b76a00060e14d43972234aa6b31d8b6.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
https://05f18be492a04674a4715d258c134a69.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
https://8098ee33668046448a4052e199633903.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
https://c0cd75414b1a47ec91610d5f90522144.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
https://b3a73829fffa4d8298ad4c5f7d31502b.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown
https://3c41f47a74ec42fc8c86c7e3467a088f.foneads.com	chromecache_86.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
204.87.253.48	oneconnect.memberdoc.com	United States	11716	WON-ASUS	true
142.250.176.196	www.google.com	United States	15169	GOOGLEUS	false
173.230.137.235	05f18be492a04674a4715d258c134a69.foneads.com	United States	63949	LINODE-APLinodeLLCUS	true
124.47.150.19	url.au.m.mimecastprotect.com	Australia	17477	MCT-SYDNEYMacquarieTelecomAU	false
104.20.6.133	t.ly	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1647582
Start date and time:	2025-03-25 00:56:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://url.au.m.mimecastprotect.com/s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@23/45@28/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.65.206, 142.250.176.195, 142.250.72.110, 172.253.63.84, 142.251.40.206, 142.251.40.238, 142.250.65.238, 142.250.81.238, 184.31.68.248, 23.210.73.6, 142.250.80.78, 142.250.176.206, 142.250.64.78, 142.250.65.174, 142.251.32.110, 142.251.32.99, 142.251.35.174, 142.251.41.10, 172.217.165.138, 142.250.65.170, 142.250.64.106, 142.251.40.106, 142.250.65.202, 142.250.80.42, 142.250.80.74, 142.251.40.138, 142.251.40.170, 142.250.65.234, 142.250.64.74, 142.251.35.170, 142.250.72.106, 142.250.81.234, 142.251.32.106, 142.250.80.35, 184.31.69.3, 204.79.197.222, 4.245.163.56
Excluded domains from analysis (whitelisted): fp.msedge.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, ocsp.digicert.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://url.au.m.mimecastprotect.com/s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 00:57:29.789563894 CET	53	50224	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:29.839071989 CET	53	49957	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:30.343130112 CET	53	52982	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:30.464260101 CET	53	55584	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:31.104945898 CET	65118	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:31.105381012 CET	55217	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:31.202296019 CET	53	65118	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:31.202507019 CET	53	55217	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:35.635145903 CET	64227	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:35.637300968 CET	59102	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:35.759993076 CET	53	64227	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:35.760997057 CET	53	59102	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:47.546071053 CET	53	60621	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:50.376041889 CET	53801	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:50.376189947 CET	49382	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:50.478630066 CET	53	49382	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:50.478652954 CET	53	53801	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:51.109251976 CET	53106	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:51.109414101 CET	57600	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:51.206223965 CET	53	53106	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:51.208674908 CET	53	57600	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:51.767594099 CET	50969	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:51.767791033 CET	56708	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:51.877650976 CET	53	56708	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:52.020159960 CET	53	50969	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:55.242263079 CET	59555	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:55.242605925 CET	57450	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:55.458849907 CET	53	57450	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:55.474814892 CET	53	59555	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:57.722718000 CET	59391	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:57.722867966 CET	58116	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:57:57.930649042 CET	53	59391	1.1.1.1	192.168.2.4
Mar 25, 2025 00:57:57.931991100 CET	53	58116	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:02.998817921 CET	59312	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:02.999008894 CET	64980	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:03.206322908 CET	53	64980	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:03.207362890 CET	53	59312	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:06.342643023 CET	53	59041	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:14.458791971 CET	55966	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:14.459196091 CET	60746	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:14.560966969 CET	53	55966	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:14.666744947 CET	53	60746	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:15.023459911 CET	57516	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:15.024465084 CET	63189	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:15.132869005 CET	54399	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:15.132869005 CET	64155	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:15.230614901 CET	53	57516	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:15.230683088 CET	53	63189	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:15.341995955 CET	53	64155	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:15.342675924 CET	53	54399	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:24.171739101 CET	54388	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:24.171902895 CET	65233	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:24.323935032 CET	53	65233	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:24.382075071 CET	53	54388	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:28.992120981 CET	53	51663	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:28.992599010 CET	53	55870	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:30.221889973 CET	53	54371	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:31.717284918 CET	60159	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:31.717485905 CET	57309	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:31.872476101 CET	53	57309	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:31.927966118 CET	53	60159	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:31.998635054 CET	53	52940	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:33.834709883 CET	138	138	192.168.2.4	192.168.2.255
Mar 25, 2025 00:58:35.853374958 CET	51575	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:35.853637934 CET	64283	53	192.168.2.4	1.1.1.1
Mar 25, 2025 00:58:36.008280993 CET	53	51575	1.1.1.1	192.168.2.4
Mar 25, 2025 00:58:36.015763044 CET	53	64283	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 25, 2025 00:57:29.826646090 CET	192.168.2.4	1.1.1.1	c233	(Port unreachable)	Destination Unreachable
Mar 25, 2025 00:58:14.667092085 CET	192.168.2.4	1.1.1.1	c24d	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:57:36 UTC	737	OUT	GET /s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com HTTP/1.1 Host: url.au.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 23:57:38 UTC	3224	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 24 Mar 2025 23:57:38 GMT Content-Length: 0 Connection: close Location: https://url.au.m.mimecastprotect.com/r/e29r4hsA7qrCxBMpcemfoLEBpSrcbyjMy-Pd1IUpEZpbOPR3GVD5cMB7kS5eEuuvYo3FTzjo_dZ2BeICqteslrNPuzPmNYTOTbR-3LK3ZNDNc0rOudJqIzp4wus1OvYpjNtG_JTlE0X0bq_XXl8EhRlas4N7thY1qhu_P_jKtLqSolTXG40cpwMr0OFYG00POYfisczSaEodmh5jRCgHrjv4W-h-K_w8vKJlpjHGik_S0LMjoDSfOyIe3DabIbUqaVmSXhvochWU_7c4iZNfhj0w0zX2jKZVWqS4QbgtRL4melpwa3XOm2hbZJuytTJBxnYKxxEK4oh36MFIr4Oq5fuTTv7UaxKwYdIMQjDmQo4aDG0aTmbplq8AT2H7atIxtSFo-ApUSLqJch6at0QiWDYKdfhLF0MT0Xu0UjneI1GtqkBf4-fDxSoAnobMt9CzjcQ6LB_o8CPEtoRg7yw7Xg_3EJ-49rf7DRwoMPqLpLFDq_Kx5gYj4Kx1gLhlaZt38S8VdebFFqwat7j0OT6UKW77H2O60sqdsX1F5SSu3fY0NJC_8pla_hr_VzNa0qxRv52TmmALWgtzhiAFE0LzC7tFgtKOpgldEptjhoXniXl4UZtqBT7L0VZwtVq19Kx1nypbYR0nzCeRk0izeQINGJYWc1tEWXDlPdeBYITlZaZI2oJ3CIM-MVWT6g8HX5F-v8v7A4Nh9uxlsQswGDBUjsh9KagJfKDi9a8BdtkPgOfS94RMTAxNLS844fm8-VDHYrMLOA1g6P47mV0KYjaw1pDjnV8Z4DtDaOje-a5U7q6yan8Hgci-qNIrwD0eu9zw3E7eDw1D-4GIXIrJo2x2YhoOVsejmQpQptt1tt69rHHdELAOX-0ZjR6q89hAEe8TaT9W_kzh3DJlysoTbqqRr2rIUh8NZB6gZjXZvZDrpw1Sh7-g20Ezq7uGEHM7VQGsGtwOREZfKHYfcqW [TRUNCATED] Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:57:38 UTC	3667	OUT	GET /r/e29r4hsA7qrCxBMpcemfoLEBpSrcbyjMy-Pd1IUpEZpbOPR3GVD5cMB7kS5eEuuvYo3FTzjo_dZ2BeICqteslrNPuzPmNYTOTbR-3LK3ZNDNc0rOudJqIzp4wus1OvYpjNtG_JTlE0X0bq_XXl8EhRlas4N7thY1qhu_P_jKtLqSolTXG40cpwMr0OFYG00POYfisczSaEodmh5jRCgHrjv4W-h-K_w8vKJlpjHGik_S0LMjoDSfOyIe3DabIbUqaVmSXhvochWU_7c4iZNfhj0w0zX2jKZVWqS4QbgtRL4melpwa3XOm2hbZJuytTJBxnYKxxEK4oh36MFIr4Oq5fuTTv7UaxKwYdIMQjDmQo4aDG0aTmbplq8AT2H7atIxtSFo-ApUSLqJch6at0QiWDYKdfhLF0MT0Xu0UjneI1GtqkBf4-fDxSoAnobMt9CzjcQ6LB_o8CPEtoRg7yw7Xg_3EJ-49rf7DRwoMPqLpLFDq_Kx5gYj4Kx1gLhlaZt38S8VdebFFqwat7j0OT6UKW77H2O60sqdsX1F5SSu3fY0NJC_8pla_hr_VzNa0qxRv52TmmALWgtzhiAFE0LzC7tFgtKOpgldEptjhoXniXl4UZtqBT7L0VZwtVq19Kx1nypbYR0nzCeRk0izeQINGJYWc1tEWXDlPdeBYITlZaZI2oJ3CIM-MVWT6g8HX5F-v8v7A4Nh9uxlsQswGDBUjsh9KagJfKDi9a8BdtkPgOfS94RMTAxNLS844fm8-VDHYrMLOA1g6P47mV0KYjaw1pDjnV8Z4DtDaOje-a5U7q6yan8Hgci-qNIrwD0eu9zw3E7eDw1D-4GIXIrJo2x2YhoOVsejmQpQptt1tt69rHHdELAOX-0ZjR6q89hAEe8TaT9W_kzh3DJlysoTbqqRr2rIUh8NZB6gZjXZvZDrpw1Sh7-g20Ezq7uGEHM7VQGsGtwOREZfKHYfcqWKHaZhEiD5kAEw8MhIG4Dbx8t91vW0NYWYGYond6ffM [TRUNCATED] Host: url.au.m.mimecastprotect.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 23:57:50 UTC	366	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 24 Mar 2025 23:57:50 GMT Content-Length: 0 Connection: close Location: http://oneconnect.memberdoc.com/v2/EmailTracker/Click?data=214213_82941695_1~https://t.ly/M5IUL Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:57:50 UTC	737	OUT	GET /v2/EmailTracker/Click?data=214213_82941695_1~https://t.ly/M5IUL HTTP/1.1 Host: oneconnect.memberdoc.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 23:57:51 UTC	299	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://t.ly/M5IUL Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.2 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Mon, 24 Mar 2025 23:57:50 GMT Connection: close Content-Length: 135
2025-03-24 23:57:51 UTC	135	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 2e 6c 79 2f 4d 35 49 55 4c 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://t.ly/M5IUL">here</a>.</h2></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:57:51 UTC	659	OUT	GET /M5IUL HTTP/1.1 Host: t.ly Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 23:57:51 UTC	1025	IN	HTTP/1.1 302 Found Date: Mon, 24 Mar 2025 23:57:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private location: https://loadquotation.brownstationers.com/miss/? x-robots-tag: noindex x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff x-whom: tly-app x-do-app-origin: 86336e98-11a6-477d-b2fb-e3113d9e1e21 x-do-orig-status: 302 Set-Cookie: __cf_bm=NxtS9QO5Pu3T_WRLIvzlBDNKq6G0h_SVI30OgfPYi6w-1742860671-1.0.1.1-aSp0n1Xi_cIApQyXjy1_G9rG6m9PiXlrB3.5Y_4.qZa38PVFt8F.4pnw_5lQf2gZjN8EvvfEnL6.k833GeLjv.k3.yB_Rr_wjtNvUUh0BF4; path=/; expires=Tue, 25-Mar-25 00:27:51 GMT; domain=.t.ly; HttpOnly; Secure; SameSite=None Vary: Accept-Encoding CF-Cache-Status: BYPASS Server-Timing: cfCacheStatus;desc="BYPASS" Strict-Transport-Security: max-age=15552000; includeSubDomains; preload speculation-rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 925a1cfd7e5641b2-EWR alt-svc: h3=":443"; ma=86400
2025-03-24 23:57:51 UTC	344	IN	Data Raw: 33 38 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 6c 6f 61 64 71 75 6f 74 61 74 69 6f 6e 2e 62 72 6f 77 6e 73 74 61 74 69 6f 6e 65 72 73 2e 63 6f 6d 2f 6d 69 73 73 2f 3f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 6c 6f 61 64 71 75 6f 74 61 74 69 6f 6e 2e 62 72 6f 77 6e 73 74 61 74 69 6f 6e 65 72 73 2e 63 6f 6d 2f 6d 69 73 73 2f Data Ascii: 38e<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://loadquotation.brownstationers.com/miss/?'" /> <title>Redirecting to https://loadquotation.brownstationers.com/miss/
2025-03-24 23:57:51 UTC	573	IN	Data Raw: 6f 77 6e 73 74 61 74 69 6f 6e 65 72 73 2e 63 6f 6d 2f 6d 69 73 73 2f 3f 22 3e 68 74 74 70 73 3a 2f 2f 6c 6f 61 64 71 75 6f 74 61 74 69 6f 6e 2e 62 72 6f 77 6e 73 74 61 74 69 6f 6e 65 72 73 2e 63 6f 6d 2f 6d 69 73 73 2f 3f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 64 65 66 65 72 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 63 6c 6f 75 64 66 6c 61 72 65 69 6e 73 69 67 68 74 73 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2e 6d 69 6e 2e 6a 73 2f 76 63 64 31 35 63 62 65 37 37 37 32 66 34 39 63 33 39 39 63 36 61 35 62 61 62 66 32 32 63 31 32 34 31 37 31 37 36 38 39 31 37 36 30 31 35 22 20 69 6e 74 65 67 72 69 74 79 3d 22 73 68 61 35 31 32 2d 5a 70 73 4f 6d 6c 52 51 56 36 79 39 30 37 54 49 30 64 4b 42 48 71 39 4d 64 32 39 6e 6e 61 45 49 50 6c Data Ascii: ownstationers.com/miss/?">https://loadquotation.brownstationers.com/miss/?</a>. <script defer src="https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015" integrity="sha512-ZpsOmlRQV6y907TI0dKBHq9Md29nnaEIPl
2025-03-24 23:57:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:57:52 UTC	689	OUT	GET /miss/? HTTP/1.1 Host: loadquotation.brownstationers.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 23:57:53 UTC	177	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:57:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 649385 Connection: close Vary: Accept-Encoding
2025-03-24 23:57:53 UTC	7103	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 66 75 6e 63 74 69 6f 6e 20 61 30 76 28 29 7b 76 61 72 20 49 35 3d 5b 27 73 74 72 69 6e 67 27 2c 27 73 79 6d 62 6f 6c 27 2c 27 63 6c 61 73 73 4c 69 73 74 27 2c 27 5f 5f 70 72 6f 74 6f 5f 5f 27 2c 27 69 4c 66 75 4f 27 2c 27 70 72 6f 74 6f 74 79 70 65 27 2c 27 76 79 6a 68 5a 27 2c 27 63 6c 6f 73 65 27 2c 27 6e 6f 6e 65 27 2c 27 63 61 6c 6c 65 65 27 2c 27 63 68 61 72 43 6f 64 65 41 74 27 2c 27 73 65 74 27 2c 27 70 61 72 73 65 46 72 6f 6d 53 74 72 69 6e 67 27 2c 27 66 61 63 61 64 65 27 2c 27 4d 61 74 68 27 2c 27 61 70 70 6c 79 27 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <script type="text/javascript"> function a0v(){var I5=['string','symbol','classList','__proto__','iLfuO','prototype','vyjhZ','close','none','callee','charCodeAt','set','parseFromString','facade','Math','apply'
2025-03-24 23:57:53 UTC	16384	IN	Data Raw: 30 78 31 38 64 29 5d 26 26 44 28 4b 34 2c 46 59 28 30 78 65 64 29 2c 7b 27 76 61 6c 75 65 27 3a 4b 36 5b 27 61 72 69 74 79 27 5d 7d 29 3b 74 72 79 7b 4b 36 26 26 45 28 4b 36 2c 27 63 6f 6e 73 74 72 75 63 74 6f 72 27 29 26 26 4b 36 5b 46 59 28 30 78 31 38 33 29 5d 3f 6d 26 26 44 28 4b 34 2c 46 59 28 30 78 31 39 33 29 2c 7b 27 77 72 69 74 61 62 6c 65 27 3a 21 30 78 31 7d 29 3a 4b 34 5b 46 59 28 30 78 31 39 33 29 5d 26 26 28 4b 34 5b 46 59 28 30 78 31 39 33 29 5d 3d 76 6f 69 64 20 30 78 30 29 3b 7d 63 61 74 63 68 28 4b 38 29 7b 7d 76 61 72 20 4b 37 3d 52 28 4b 34 29 3b 72 65 74 75 72 6e 20 45 28 4b 37 2c 27 73 6f 75 72 63 65 27 29 7c 7c 28 4b 37 5b 46 59 28 30 78 39 38 29 5d 3d 4b 30 28 4b 32 2c 46 59 28 30 78 31 38 65 29 3d 3d 74 79 70 65 6f 66 20 4b 35 3f Data Ascii: 0x18d)]&&D(K4,FY(0xed),{'value':K6['arity']});try{K6&&E(K6,'constructor')&&K6[FY(0x183)]?m&&D(K4,FY(0x193),{'writable':!0x1}):K4[FY(0x193)]&&(K4[FY(0x193)]=void 0x0);}catch(K8){}var K7=R(K4);return E(K7,'source')\|\|(K7[FY(0x98)]=K0(K2,FY(0x18e)==typeof K5?
2025-03-24 23:57:53 UTC	16384	IN	Data Raw: 4b 38 29 2c 4b 4b 3d 4b 32 3f 4b 37 28 4b 39 2c 30 78 37 2c 2d 30 78 31 29 3a 4b 36 28 4b 39 2c 4b 35 2c 27 24 31 27 29 3b 72 65 74 75 72 6e 27 27 3d 3d 3d 4b 4b 3f 76 6f 69 64 20 30 78 30 3a 4b 4b 3b 7d 7d 29 2c 77 28 7b 27 67 6c 6f 62 61 6c 27 3a 21 30 78 30 2c 27 63 6f 6e 73 74 72 75 63 74 6f 72 27 3a 21 30 78 30 2c 27 66 6f 72 63 65 64 27 3a 21 30 78 30 7d 2c 7b 27 53 79 6d 62 6f 6c 27 3a 4b 31 7d 29 3b 7d 65 6c 73 65 7b 76 61 72 20 4b 39 2c 4b 4b 2c 4b 46 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 78 30 3d 3d 3d 4a 3f 76 74 28 30 78 31 66 31 29 3a 6e 75 6c 6c 3d 3d 3d 56 3f 76 74 28 30 78 31 34 33 29 3a 76 74 28 30 78 31 38 65 29 3d 3d 74 79 70 65 6f 66 28 4b 4b 3d 66 75 6e 63 74 69 6f 6e 28 4b 76 2c 4b 4e 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 4b 76 Data Ascii: K8),KK=K2?K7(K9,0x7,-0x1):K6(K9,K5,'$1');return''===KK?void 0x0:KK;}}),w({'global':!0x0,'constructor':!0x0,'forced':!0x0},{'Symbol':K1});}else{var K9,KK,KF;return void 0x0===J?vt(0x1f1):null===V?vt(0x143):vt(0x18e)==typeof(KK=function(Kv,KN){try{return Kv
2025-03-24 23:57:53 UTC	16384	IN	Data Raw: 29 2c 4b 47 3d 4b 32 28 30 78 31 65 33 61 29 2c 4b 64 3d 4b 32 28 30 78 31 34 61 61 29 2c 4b 4a 3d 4b 32 28 30 78 65 34 61 29 2c 4b 6c 3d 4b 32 28 30 78 38 65 36 29 2c 4b 48 3d 4b 32 28 30 78 37 65 34 29 2c 4b 75 3d 4b 32 28 30 78 31 30 66 62 29 2c 4b 41 3d 4b 32 28 30 78 31 33 36 31 29 2c 4b 59 3d 4b 32 28 30 78 31 36 63 62 29 2c 4b 4c 3d 4b 32 28 30 78 31 36 61 37 29 2c 4b 70 3d 4b 32 28 30 78 31 64 62 62 29 2c 4b 50 3d 4b 32 28 30 78 31 65 65 61 29 2c 4b 53 3d 4b 32 28 30 78 66 31 38 29 2c 4b 73 3d 4b 32 28 30 78 31 63 35 37 29 2c 4b 43 3d 4b 32 28 30 78 31 35 32 31 29 2c 4b 61 3d 4b 32 28 30 78 35 65 33 29 2c 4b 63 3d 4b 32 28 30 78 37 34 61 29 2c 4b 6b 3d 4b 32 28 30 78 31 29 2c 4b 69 3d 4b 32 28 30 78 31 34 66 64 29 2c 4b 42 3d 4b 32 28 30 78 31 65 Data Ascii: ),KG=K2(0x1e3a),Kd=K2(0x14aa),KJ=K2(0xe4a),Kl=K2(0x8e6),KH=K2(0x7e4),Ku=K2(0x10fb),KA=K2(0x1361),KY=K2(0x16cb),KL=K2(0x16a7),Kp=K2(0x1dbb),KP=K2(0x1eea),KS=K2(0xf18),Ks=K2(0x1c57),KC=K2(0x1521),Ka=K2(0x5e3),Kc=K2(0x74a),Kk=K2(0x1),Ki=K2(0x14fd),KB=K2(0x1e
2025-03-24 23:57:53 UTC	9281	IN	Data Raw: 7d 63 61 74 63 68 28 54 29 7b 7d 62 3f 51 5b 45 5d 3d 68 3a 4f 5b 27 66 27 5d 28 51 2c 45 2c 7b 27 76 61 6c 75 65 27 3a 68 2c 27 65 6e 75 6d 65 72 61 62 6c 65 27 3a 21 30 78 31 2c 27 63 6f 6e 66 69 67 75 72 61 62 6c 65 27 3a 21 6d 5b 5a 64 28 30 78 64 31 29 5d 2c 27 77 72 69 74 61 62 6c 65 27 3a 21 6d 5b 5a 64 28 30 78 31 31 64 29 5d 7d 29 3b 7d 65 6c 73 65 7b 69 66 28 49 28 47 29 29 72 65 74 75 72 6e 20 64 3b 74 68 72 6f 77 20 6e 65 77 20 4a 28 6c 28 48 29 2b 5a 64 28 30 78 31 37 39 29 29 3b 7d 7d 72 65 74 75 72 6e 20 51 3b 7d 3b 7d 2c 30 78 31 66 62 38 3a 28 42 2c 66 2c 6a 29 3d 3e 7b 69 66 28 27 65 59 6d 47 4a 27 3d 3d 3d 27 65 59 6d 47 4a 27 29 7b 76 61 72 20 4d 3d 6a 28 30 78 35 63 62 29 2c 4f 3d 6a 28 30 78 32 32 33 39 29 2c 77 3d 54 79 70 65 45 72 Data Ascii: }catch(T){}b?Q[E]=h:O['f'](Q,E,{'value':h,'enumerable':!0x1,'configurable':!m[Zd(0xd1)],'writable':!m[Zd(0x11d)]});}else{if(I(G))return d;throw new J(l(H)+Zd(0x179));}}return Q;};},0x1fb8:(B,f,j)=>{if('eYmGJ'==='eYmGJ'){var M=j(0x5cb),O=j(0x2239),w=TypeEr
2025-03-24 23:57:53 UTC	7103	IN	Data Raw: 37 38 36 65 32 35 34 33 33 32 32 35 33 38 33 38 35 37 37 36 35 35 34 66 37 38 34 36 36 62 32 35 33 35 34 33 34 34 32 35 34 33 33 32 32 35 33 38 33 22 2c 20 22 35 35 34 37 35 36 35 37 35 36 64 37 34 37 39 32 35 33 33 34 35 36 63 32 35 34 33 33 32 32 35 33 38 33 37 37 37 32 35 34 33 33 32 32 35 33 38 33 36 35 35 37 34 36 36 32 35 34 33 33 32 32 35 33 38 33 30 35 37 32 35 33 37 34 34 36 63 37 36 36 64 34 66 36 39 32 35 33 37 34 32 36 62 35 38 32 35 33 35 34 34 35 66 36 36 32 35 33 35 22 2c 20 22 34 35 32 35 33 35 34 34 32 35 33 33 34 36 36 36 32 35 33 35 34 35 35 37 32 35 33 33 34 35 36 62 34 38 34 63 33 39 36 66 34 65 32 35 33 33 34 32 37 32 36 38 34 37 34 65 32 35 33 37 34 33 36 63 37 34 35 66 32 35 34 33 33 32 32 35 33 38 33 37 35 37 35 39 36 35 32 35 33 Data Ascii: 786e2543322538385776554f78466b2535434425433225383", "5547565756d74792533456c25433225383777254332253836557466254332253830572537446c766d4f692537426b582535445f662535", "4525354425334666253545572533456b484c396f4e2533427268474e2537436c745f254332253837575965253
2025-03-24 23:57:53 UTC	16384	IN	Data Raw: 34 36 37 32 35 33 33 34 32 35 66 37 36 36 66 32 35 33 33 34 36 32 35 33 33 34 32 37 31 35 36 32 35 33 35 34 32 32 35 33 37 34 33 33 38 36 34 35 37 35 37 36 66 36 64 34 61 32 35 33 33 34 35 37 32 22 2c 20 22 36 62 35 39 33 38 37 35 36 63 34 66 37 37 37 35 36 65 37 31 36 38 37 36 36 61 32 35 33 33 34 33 33 37 32 35 33 37 34 32 36 34 37 30 37 34 32 35 33 37 34 34 36 35 34 32 36 39 37 36 35 30 32 35 33 33 34 32 35 37 37 35 36 62 34 38 35 39 32 35 34 33 33 32 32 35 33 38 33 34 36 65 37 31 35 35 32 35 33 37 34 33 36 63 35 66 32 35 33 22 2c 20 22 33 34 31 37 30 36 64 34 38 37 33 37 61 36 64 37 34 35 37 36 65 35 33 35 37 32 35 33 35 34 35 32 35 33 33 34 34 36 63 34 66 32 35 33 35 34 32 32 35 33 37 34 32 36 31 37 37 34 64 33 33 36 61 34 65 32 35 33 37 34 32 32 35 Data Ascii: 4672533425f766f2533462533427156253542253743386457576f6d4a25334572", "6b5938756c4f77756e7168766a25334337253742647074253744654269765025334257756b48592543322538346e71552537436c5f253", "341706d48737a6d74576e53572535452533446c4f25354225374261774d336a4e25374225
2025-03-24 23:57:53 UTC	9281	IN	Data Raw: 30 35 30 33 35 35 35 34 65 32 35 33 35 34 35 32 35 33 37 34 32 36 63 37 36 32 35 33 37 34 36 37 34 35 36 35 66 33 30 33 33 36 38 33 32 36 36 36 65 36 63 37 31 34 66 37 61 35 37 35 39 35 38 37 32 35 22 2c 20 22 31 34 61 34 38 32 35 34 33 33 32 32 35 33 38 33 38 35 33 34 62 37 34 32 35 33 37 34 32 36 66 32 35 34 33 33 32 32 35 33 38 33 37 33 38 32 35 33 35 34 32 36 38 32 35 33 35 34 32 34 65 37 32 32 35 33 35 34 34 35 37 35 36 32 35 34 33 33 32 32 35 33 38 33 31 36 66 32 35 33 33 34 32 35 36 32 35 33 37 34 33 36 38 32 35 33 35 34 33 22 2c 20 22 32 35 33 33 34 33 37 30 36 63 35 66 33 38 37 39 36 63 34 66 37 35 32 35 33 37 34 33 36 66 37 36 36 66 33 30 35 36 32 35 33 35 34 32 32 35 33 37 34 33 33 38 36 34 35 37 35 37 36 66 36 63 37 31 37 39 37 35 35 36 32 35 Data Ascii: 05035554e2535452537426c7625374674565f30336832666e6c714f7a575958725", "14a48254332253838534b742537426f25433225383738253542682535424e7225354457562543322538316f2533425625374368253543", "253343706c5f38796c4f752537436f766f3056253542253743386457576f6c7179755625
2025-03-24 23:57:53 UTC	16384	IN	Data Raw: 36 62 34 65 34 64 37 35 36 64 37 34 35 66 32 35 34 33 33 32 32 35 33 38 33 30 35 31 35 38 36 31 32 35 33 33 34 36 36 64 37 30 35 32 33 36 36 63 35 36 34 22 2c 20 22 37 32 35 33 37 34 34 35 34 34 65 32 35 33 35 34 35 32 35 33 37 34 33 36 61 37 37 32 35 33 37 34 32 37 37 35 35 32 35 33 35 34 35 32 35 33 37 34 36 33 31 36 37 32 35 33 35 34 35 35 36 36 66 36 66 32 35 33 35 34 33 32 35 33 37 34 36 32 35 33 33 34 32 35 37 34 61 36 64 32 35 33 37 34 32 36 34 37 38 37 38 32 35 33 33 34 32 35 35 22 2c 20 22 34 65 36 38 32 35 33 37 34 33 32 35 33 35 34 33 32 35 34 33 33 32 32 35 33 38 33 37 32 35 33 37 34 32 35 35 35 30 35 66 35 38 32 35 33 37 34 33 35 36 37 35 35 61 32 35 33 37 34 34 36 64 34 38 36 66 36 38 36 66 34 65 37 38 35 36 35 33 35 32 34 62 37 37 35 36 35 Data Ascii: 6b4e4d756d745f2543322538305158612533466d7052366c564", "7253744544e2535452537436a7725374277552535452537463167253545566f6f253543253746253342574a6d25374264787825334255", "4e6825374325354325433225383725374255505f5825374356755a2537446d486f686f4e785653524b77565
2025-03-24 23:57:53 UTC	16384	IN	Data Raw: 37 32 36 36 34 62 37 38 37 37 36 37 37 33 32 35 33 35 34 34 32 35 33 37 34 32 36 34 32 35 33 33 34 35 32 35 33 35 34 35 37 36 36 64 33 31 32 35 33 33 34 33 22 2c 20 22 37 37 35 34 32 35 33 35 34 35 32 35 33 37 34 34 32 35 34 33 33 32 32 35 33 38 33 36 36 31 35 38 32 35 33 35 34 34 32 35 33 33 34 33 36 64 37 35 32 35 33 33 34 36 36 36 36 63 34 66 36 39 37 36 36 63 32 35 33 33 34 33 33 37 37 30 35 36 32 35 33 35 34 35 37 38 33 36 35 37 32 35 33 37 34 33 35 61 32 35 33 33 34 31 36 63 34 66 34 22 2c 20 22 36 32 35 34 33 33 32 32 35 33 38 33 36 36 62 34 38 35 30 34 34 36 62 33 36 37 37 32 35 33 33 34 36 36 36 32 35 33 35 34 35 35 37 36 65 36 64 34 38 32 35 33 34 33 30 32 35 34 33 33 32 32 35 33 38 33 37 35 38 34 62 35 36 32 35 33 37 34 33 36 66 34 36 34 37 33 Data Ascii: 72664b7877677325354425374264253345253545766d31253343", "775425354525374425433225383661582535442533436d75253346666c4f69766c2533433770562535457836572537435a2533416c4f4", "62543322538366b4850446b367725334666253545576e6d48253430254332253837584b562537436f46473

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:57:54 UTC	885	OUT	POST /miss/? HTTP/1.1 Host: loadquotation.brownstationers.com Connection: keep-alive Content-Length: 11318 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: https://loadquotation.brownstationers.com Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://loadquotation.brownstationers.com/miss/? Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 23:57:54 UTC	11318	OUT	Data Raw: 31 67 74 79 39 7a 37 34 72 63 67 75 3d 25 35 42 25 35 42 25 32 32 36 66 37 34 37 65 37 34 33 31 32 35 33 36 33 30 32 35 33 37 34 34 37 38 32 35 33 37 34 36 37 34 37 39 33 34 37 61 33 34 33 36 37 32 36 62 36 34 37 32 32 35 33 37 34 32 36 39 36 31 36 63 37 38 33 38 32 35 33 33 25 32 32 25 32 43 25 32 32 34 31 36 64 37 31 32 35 33 37 34 33 37 38 32 35 33 37 34 32 36 33 37 65 33 34 33 36 33 30 33 31 33 34 33 37 33 34 33 36 33 32 33 33 33 32 33 31 33 32 33 39 33 39 33 37 33 33 25 32 32 25 35 44 25 32 43 25 32 32 34 36 30 31 34 37 34 36 32 33 25 32 32 25 32 43 25 32 32 36 33 39 33 32 37 30 25 32 32 25 32 43 34 25 35 44 26 75 6b 65 77 62 65 3d 25 35 42 25 35 42 25 32 32 33 35 36 65 32 35 33 37 34 32 37 34 36 61 37 30 32 35 33 33 34 32 36 63 32 35 33 33 34 36 37 Data Ascii: 1gty9z74rcgu=%5B%5B%226f747e7431253630253744782537467479347a3436726b647225374269616c78382533%22%2C%22416d7125374378253742637e3436303134373436323332313239393733%22%5D%2C%224601474623%22%2C%226393270%22%2C4%5D&ukewbe=%5B%5B%22356e253742746a702533426c2533467
2025-03-24 23:57:55 UTC	251	IN	HTTP/1.1 302 Found Server: nginx Date: Mon, 24 Mar 2025 23:57:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close location: https://05f18be492a04674a4715d258c134a69.foneads.com?NuXSTwzpH=67e1f180d4f608878d14199c

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:57:55 UTC	794	OUT	GET /?NuXSTwzpH=67e1f180d4f608878d14199c HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://loadquotation.brownstationers.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 23:57:57 UTC	929	IN	HTTP/1.1 302 Found Server: nginx Date: Mon, 24 Mar 2025 23:57:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 120308 Connection: close cache-control: no-store, no-cache pragma: no-cache location: https://6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com/login# p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 9e39e4c7-af7a-473d-a1b5-48b0092e3f00 x-ms-ests-server: 2.1.20329.5 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: * set-cookie: NuXSTwzpH=67e1f180d4f608878d14199c; Domain=foneads.com; HttpOnly; Path=/; SameSite=none; Secure
2025-03-24 23:57:57 UTC	15450	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 7b 31 3a 28 74 2c 72 2c 65 29 3d 3e 7b 76 61 72 20 6e 3d 65 28 35 35 37 38 29 2c 6f 3d 65 28 37 32 35 35 29 2c 69 3d 65 28 35 37 35 35 29 2c 75 3d 65 28 31 38 36 36 29 2c 63 3d 65 28 36 30 32 39 29 2c 61 3d 65 28 35 30 32 32 29 2c 73 3d 6e 2e 53 79 6d 62 6f 6c 2c 66 3d 6f 28 22 77 6b 73 22 29 2c 6c 3d 61 3f 73 2e 66 6f 72 7c 7c 73 3a 73 26 26 73 2e 77 69 74 68 6f 75 74 53 65 74 74 65 72 7c 7c 75 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 Data Ascii: <html><head><title>Object moved</title><script type="text/javascript">(()=>{"use strict";var t={1:(t,r,e)=>{var n=e(5578),o=e(7255),i=e(5755),u=e(1866),c=e(6029),a=e(5022),s=n.Symbol,f=o("wks"),l=a?s.for\|\|s:s&&s.withoutSetter\|\|u;t.exports=function(t){retu
2025-03-24 23:57:57 UTC	16384	IN	Data Raw: 2e 75 6e 69 63 6f 64 65 2c 75 2e 6c 61 73 74 49 6e 64 65 78 3d 30 29 3b 66 6f 72 28 76 61 72 20 54 2c 49 3d 5b 5d 3b 6e 75 6c 6c 21 3d 3d 28 54 3d 67 28 75 2c 63 29 29 26 26 28 4f 28 49 2c 54 29 2c 6d 29 3b 29 7b 22 22 3d 3d 3d 76 28 54 5b 30 5d 29 26 26 28 75 2e 6c 61 73 74 49 6e 64 65 78 3d 64 28 63 2c 70 28 75 2e 6c 61 73 74 49 6e 64 65 78 29 2c 79 29 29 7d 66 6f 72 28 76 61 72 20 6a 2c 50 3d 22 22 2c 43 3d 30 2c 41 3d 30 3b 41 3c 49 2e 6c 65 6e 67 74 68 3b 41 2b 2b 29 7b 66 6f 72 28 76 61 72 20 6b 2c 52 3d 76 28 28 54 3d 49 5b 41 5d 29 5b 30 5d 29 2c 4e 3d 78 28 77 28 6c 28 54 2e 69 6e 64 65 78 29 2c 63 2e 6c 65 6e 67 74 68 29 2c 30 29 2c 44 3d 5b 5d 2c 4d 3d 31 3b 4d 3c 54 2e 6c 65 6e 67 74 68 3b 4d 2b 2b 29 4f 28 44 2c 76 6f 69 64 20 30 3d 3d 3d 28 Data Ascii: .unicode,u.lastIndex=0);for(var T,I=[];null!==(T=g(u,c))&&(O(I,T),m);){""===v(T[0])&&(u.lastIndex=d(c,p(u.lastIndex),y))}for(var j,P="",C=0,A=0;A<I.length;A++){for(var k,R=v((T=I[A])[0]),N=x(w(l(T.index),c.length),0),D=[],M=1;M<T.length;M++)O(D,void 0===(

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:57:58 UTC	808	OUT	GET /login HTTP/1.1 Host: 6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://loadquotation.brownstationers.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:00 UTC	1319	IN	HTTP/1.1 302 Found Server: nginx Date: Mon, 24 Mar 2025 23:58:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close location: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 request-context: appId= referrer-policy: strict-origin-when-cross-origin x-ua-compatible: IE=edge,chrome=1 request-id: 27cdaef1-806f-45ad-af1d-891077b9c27a x-cache: CONFIG_NOCACHE access-control-allow-origin: * access-control-allow-headers: *

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:01 UTC	1655	OUT	GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://loadquotation.brownstationers.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:02 UTC	797	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 141723 Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 685aded0-533c-4ae8-9b27-59cb06aa4b00 x-ms-ests-server: 2.1.20329.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-clitelem: 1,50168,0,, x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-03-24 23:58:02 UTC	6446	IN	Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 2f 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 2f 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 32 2e 30 2c Data Ascii: <!DOCTYPE html><html><head><title>Redirecting</title><meta content="text/html; charset=utf-8" http-equiv="Content-Type"/><meta content="IE=edge" http-equiv="X-UA-Compatible"/><meta content="width=device-width, initial-scale=1.0, maximum-scale=2.0,
2025-03-24 23:58:02 UTC	16384	IN	Data Raw: 48 33 58 58 58 58 22 2c 22 76 65 72 22 3a 7b 22 76 22 3a 5b 32 2c 31 2c 32 30 33 32 39 2c 35 5d 7d 2c 22 72 74 22 3a 22 32 30 32 35 2d 30 33 2d 32 34 54 32 33 3a 35 38 3a 30 32 22 2c 22 65 74 22 3a 34 7d 2c 22 63 6c 69 65 6e 74 45 76 65 6e 74 73 22 3a 7b 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 74 65 6c 65 6d 65 74 72 79 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 75 73 65 4f 6e 65 44 53 45 76 65 6e 74 41 70 69 22 3a 74 72 75 65 2c 22 66 6c 75 73 68 22 3a 36 30 30 30 30 2c 22 61 75 74 6f 50 6f 73 74 22 3a 74 72 75 65 2c 22 61 75 74 6f 50 6f 73 74 44 65 6c 61 79 22 3a 31 30 30 30 2c 22 6d 69 6e 45 76 65 6e 74 73 22 3a 31 2c 22 6d 61 78 45 76 65 6e 74 73 22 3a 31 2c 22 70 6c 74 44 65 6c 61 79 22 3a 35 30 30 2c 22 61 70 70 49 6e 73 69 67 68 74 73 43 Data Ascii: H3XXXX","ver":{"v":[2,1,20329,5]},"rt":"2025-03-24T23:58:02","et":4},"clientEvents":{"enabled":true,"telemetryEnabled":true,"useOneDSEventApi":true,"flush":60000,"autoPost":true,"autoPostDelay":1000,"minEvents":1,"maxEvents":1,"pltDelay":500,"appInsightsC
2025-03-24 23:58:03 UTC	16384	IN	Data Raw: 69 6f 6e 28 74 29 7b 76 61 72 20 72 3d 6e 28 74 29 3b 75 26 26 72 26 26 21 72 5b 63 5d 26 26 6f 28 72 2c 63 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 7d 29 7d 7d 2c 32 37 34 3a 28 74 2c 72 2c 65 29 3d 3e 7b 76 61 72 20 6e 3d 65 28 38 34 37 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2e 62 69 6e 64 28 29 3b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 7c 7c 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 70 72 6f 74 6f 74 79 70 65 22 29 7d 29 29 7d 2c 33 34 38 3a 28 74 2c 72 2c 65 29 3d 3e 7b 76 61 72 20 6e 3d 65 28 31 38 30 37 29 2c Data Ascii: ion(t){var r=n(t);u&&r&&!r[c]&&o(r,c,{configurable:!0,get:function(){return this}})}},274:(t,r,e)=>{var n=e(8473);t.exports=!n((function(){var t=function(){}.bind();return"function"!=typeof t\|\|t.hasOwnProperty("prototype")}))},348:(t,r,e)=>{var n=e(1807),
2025-03-24 23:58:03 UTC	16384	IN	Data Raw: 36 31 32 29 2c 6f 3d 65 28 32 33 34 37 29 2c 69 3d 65 28 33 36 35 38 29 3b 6e 28 7b 74 61 72 67 65 74 3a 22 4f 62 6a 65 63 74 22 2c 73 74 61 74 3a 21 30 2c 66 6f 72 63 65 64 3a 65 28 38 34 37 33 29 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 28 31 29 7d 29 29 7d 2c 7b 6b 65 79 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 69 28 6f 28 74 29 29 7d 7d 29 7d 2c 33 38 31 35 3a 28 74 2c 72 2c 65 29 3d 3e 7b 76 61 72 20 6e 3d 65 28 32 33 35 35 29 2c 6f 3d 65 28 31 34 32 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 72 3d 6e 28 74 2c 22 73 74 72 69 6e 67 22 29 3b 72 65 74 75 72 6e 20 6f 28 72 29 3f 72 3a 72 2b 22 22 7d 7d 2c 33 38 35 32 3a 28 74 2c 72 2c 65 29 3d 3e 7b 76 61 72 20 6e 3d 65 28 37 33 35 29 2c Data Ascii: 612),o=e(2347),i=e(3658);n({target:"Object",stat:!0,forced:e(8473)((function(){i(1)}))},{keys:function(t){return i(o(t))}})},3815:(t,r,e)=>{var n=e(2355),o=e(1423);t.exports=function(t){var r=n(t,"string");return o(r)?r:r+""}},3852:(t,r,e)=>{var n=e(735),
2025-03-24 23:58:03 UTC	9938	IN	Data Raw: 43 4f 4e 53 54 52 55 43 54 4f 52 2c 75 3d 65 28 32 38 33 32 29 2c 63 3d 65 28 31 34 30 39 29 2c 61 3d 65 28 31 34 38 33 29 2c 73 3d 65 28 37 39 31 34 29 2c 66 3d 75 26 26 75 2e 70 72 6f 74 6f 74 79 70 65 3b 69 66 28 6e 28 7b 74 61 72 67 65 74 3a 22 50 72 6f 6d 69 73 65 22 2c 70 72 6f 74 6f 3a 21 30 2c 66 6f 72 63 65 64 3a 69 2c 72 65 61 6c 3a 21 30 7d 2c 7b 63 61 74 63 68 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 74 29 7d 7d 29 2c 21 6f 26 26 61 28 75 29 29 7b 76 61 72 20 6c 3d 63 28 22 50 72 6f 6d 69 73 65 22 29 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 74 63 68 3b 66 2e 63 61 74 63 68 21 3d 3d 6c 26 26 73 28 66 2c 22 63 61 74 63 68 22 2c 6c 2c 7b 75 6e 73 61 66 65 3a 21 30 7d 29 7d 7d 2c Data Ascii: CONSTRUCTOR,u=e(2832),c=e(1409),a=e(1483),s=e(7914),f=u&&u.prototype;if(n({target:"Promise",proto:!0,forced:i,real:!0},{catch:function(t){return this.then(void 0,t)}}),!o&&a(u)){var l=c("Promise").prototype.catch;f.catch!==l&&s(f,"catch",l,{unsafe:!0})}},
2025-03-24 23:58:03 UTC	6446	IN	Data Raw: 2c 72 2c 65 29 3d 3e 7b 76 61 72 20 6e 3d 65 28 33 38 32 29 2c 6f 3d 65 28 35 38 33 35 29 2c 69 3d 65 28 37 37 33 38 29 3b 74 2e 65 78 70 6f 72 74 73 3d 6e 3f 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 65 29 7b 72 65 74 75 72 6e 20 6f 2e 66 28 74 2c 72 2c 69 28 31 2c 65 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 65 29 7b 72 65 74 75 72 6e 20 74 5b 72 5d 3d 65 2c 74 7d 7d 2c 39 31 30 35 3a 28 74 2c 72 2c 65 29 3d 3e 7b 76 61 72 20 6e 3d 65 28 34 37 36 32 29 2c 6f 3d 65 28 33 30 30 35 29 2c 69 3d 65 28 36 32 36 31 29 2c 75 3d 65 28 33 33 31 32 29 2c 63 3d 6e 28 22 22 2e 63 68 61 72 41 74 29 2c 61 3d 6e 28 22 22 2e 63 68 61 72 43 6f 64 65 41 74 29 2c 73 3d 6e 28 22 22 2e 73 6c 69 63 65 29 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 Data Ascii: ,r,e)=>{var n=e(382),o=e(5835),i=e(7738);t.exports=n?function(t,r,e){return o.f(t,r,i(1,e))}:function(t,r,e){return t[r]=e,t}},9105:(t,r,e)=>{var n=e(4762),o=e(3005),i=e(6261),u=e(3312),c=n("".charAt),a=n("".charCodeAt),s=n("".slice),f=function(t){return
2025-03-24 23:58:03 UTC	9938	IN	Data Raw: 6e 20 72 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 45 72 72 6f 72 2e 70 72 6f 74 6f 74 79 70 65 29 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 72 2c 72 7d 76 61 72 20 79 3d 64 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 72 29 7b 74 28 74 68 69 73 29 2c 74 68 69 73 2e 6d 65 73 73 61 67 65 3d 72 3f 72 2e 6c 65 6e 67 74 68 2b 22 20 65 72 72 6f 72 73 20 6f 63 63 75 72 72 65 64 20 64 75 72 69 6e 67 20 75 6e 73 75 62 73 63 72 69 70 74 69 6f 6e 3a 5c 6e 22 2b 72 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 72 2b 31 2b 22 29 20 22 2b 74 2e 74 6f 53 74 72 69 6e 67 28 29 7d 29 29 2e 6a 6f 69 6e 28 22 5c 6e 20 20 22 29 3a Data Ascii: n r.prototype=Object.create(Error.prototype),r.prototype.constructor=r,r}var y=d((function(t){return function(r){t(this),this.message=r?r.length+" errors occurred during unsubscription:\n"+r.map((function(t,r){return r+1+") "+t.toString()})).join("\n "):
2025-03-24 23:58:03 UTC	16384	IN	Data Raw: 53 74 61 74 75 73 65 73 28 74 29 2c 72 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 74 72 69 6d 42 75 66 66 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 72 3d 74 2e 5f 62 75 66 66 65 72 53 69 7a 65 2c 65 3d 74 2e 5f 74 69 6d 65 73 74 61 6d 70 50 72 6f 76 69 64 65 72 2c 6e 3d 74 2e 5f 62 75 66 66 65 72 2c 6f 3d 74 2e 5f 69 6e 66 69 6e 69 74 65 54 69 6d 65 57 69 6e 64 6f 77 2c 69 3d 28 6f 3f 31 3a 32 29 2a 72 3b 69 66 28 72 3c 31 2f 30 26 26 69 3c 6e 2e 6c 65 6e 67 74 68 26 26 6e 2e 73 70 6c 69 63 65 28 30 2c 6e 2e 6c 65 6e 67 74 68 2d 69 29 2c 21 6f 29 7b 66 6f 72 28 76 61 72 20 75 3d 65 2e 6e 6f 77 28 29 2c 63 3d 30 2c 61 3d 31 3b 61 3c 6e 2e 6c 65 6e 67 74 68 26 26 6e 5b 61 5d 3c 3d 75 3b 61 2b 3d 32 29 63 3d 61 3b 63 26 26 Data Ascii: Statuses(t),r},r.prototype._trimBuffer=function(){var t=this,r=t._bufferSize,e=t._timestampProvider,n=t._buffer,o=t._infiniteTimeWindow,i=(o?1:2)*r;if(r<1/0&&i<n.length&&n.splice(0,n.length-i),!o){for(var u=e.now(),c=0,a=1;a<n.length&&n[a]<=u;a+=2)c=a;c&&
2025-03-24 23:58:03 UTC	16384	IN	Data Raw: 74 69 6f 6e 3a 35 65 33 2c 65 78 63 6c 75 64 65 64 53 74 61 74 75 73 43 6f 64 65 73 3a 5b 5d 7d 2c 6e 3d 41 74 2c 6f 3d 76 6f 69 64 20 30 3d 3d 3d 65 3f 7b 7d 3a 65 2c 69 3d 6f 5b 6e 28 33 30 30 29 5d 2c 75 3d 76 6f 69 64 20 30 3d 3d 3d 69 3f 33 3a 69 2c 63 3d 6f 5b 6e 28 32 36 34 29 5d 2c 61 3d 76 6f 69 64 20 30 3d 3d 3d 63 3f 31 65 33 3a 63 2c 73 3d 6f 5b 6e 28 33 30 32 29 5d 2c 66 3d 76 6f 69 64 20 30 3d 3d 3d 73 3f 5b 5d 3a 73 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 70 69 70 65 28 6c 74 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 76 61 72 20 65 3d 52 74 2c 6e 3d 72 2b 31 3b 72 65 74 75 72 6e 20 6e 3e 75 7c 7c 66 5b 65 28 33 30 38 29 5d 28 28 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 72 3d 3d 3d 74 5b Data Ascii: tion:5e3,excludedStatusCodes:[]},n=At,o=void 0===e?{}:e,i=o[n(300)],u=void 0===i?3:i,c=o[n(264)],a=void 0===c?1e3:c,s=o[n(302)],f=void 0===s?[]:s,r=function(t){return t.pipe(lt((function(t,r){var e=Rt,n=r+1;return n>u\|\|f[e(308)]((function(r){return r===t[
2025-03-24 23:58:03 UTC	16384	IN	Data Raw: 72 3d 21 30 2c 6e 75 6c 6c 7d 2c 65 5b 6c 5d 28 22 22 29 2c 21 72 7d 29 29 3b 69 66 28 21 76 7c 7c 21 79 7c 7c 65 29 7b 76 61 72 20 67 3d 2f 2e 2f 5b 6c 5d 2c 68 3d 72 28 6c 2c 22 22 5b 74 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 65 2c 6f 2c 61 29 7b 76 61 72 20 75 3d 72 2e 65 78 65 63 3b 72 65 74 75 72 6e 20 75 3d 3d 3d 69 7c 7c 75 3d 3d 3d 66 2e 65 78 65 63 3f 76 26 26 21 61 3f 7b 64 6f 6e 65 3a 21 30 2c 76 61 6c 75 65 3a 6e 28 67 2c 72 2c 65 2c 6f 29 7d 3a 7b 64 6f 6e 65 3a 21 30 2c 76 61 6c 75 65 3a 6e 28 74 2c 65 2c 72 2c 6f 29 7d 3a 7b 64 6f 6e 65 3a 21 31 7d 7d 29 29 3b 6f 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 74 2c 68 5b 30 5d 29 2c 6f 28 66 2c 6c 2c 68 5b 31 5d 29 7d 70 26 26 63 28 66 5b 6c 5d 2c 22 73 68 61 6d 22 2c 21 30 Data Ascii: r=!0,null},e[l](""),!r}));if(!v\|\|!y\|\|e){var g=/./[l],h=r(l,""[t],(function(t,r,e,o,a){var u=r.exec;return u===i\|\|u===f.exec?v&&!a?{done:!0,value:n(g,r,e,o)}:{done:!0,value:n(t,e,r,o)}:{done:!1}}));o(String.prototype,t,h[0]),o(f,l,h[1])}p&&c(f[l],"sham",!0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:03 UTC	689	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1 Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:05 UTC	833	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:05 GMT Content-Type: application/x-javascript Content-Length: 50033 Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 29 Jan 2025 22:53:23 GMT etag: 0x8DD40B7BBC6F429 x-ms-request-id: 3d0f2649-401e-0072-80d9-9cb3a6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250324T235804Z-15494cb576bk2c29hC1ATL3bkc0000000ck000000000ebnk x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT x-cache-info: L1_T2 accept-ranges: bytes content-encoding: gzip
2025-03-24 23:58:05 UTC	15546	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 b4 3b 77 1a d2 dd cc 00 61 08 4c cf 2e b0 5c 4e ac 80 a7 83 9d b5 1d 68 06 72 7e fb a9 17 c9 96 1d 87 ee d9 3d d7 f9 f2 cc 0b b1 a5 92 2c 95 aa 4a 55 a5 92 b4 f9 d3 da ff 54 7e aa 6c fc f8 3f 95 e1 79 ef ec bc 32 f8 58 39 ff 7c 78 76 50 39 85 b7 7f 54 4e 06 e7 87 fb fd 1f af 07 3f 8a ff 9f df f9 71 65 e2 4f 45 05 7e 47 6e 2c bc 4a 18 54 c2 a8 e2 07 e3 30 9a 85 91 9b 88 b8 72 0f 7f 23 df 9d 56 26 51 78 5f 49 ee 44 65 16 85 7f 88 71 12 57 a6 7e 9c 40 a1 91 98 86 8f 95 2a 54 17 79 95 53 37 4a 9e 2a 87 a7 66 1d ea 17 50 9b 7f eb 07 50 7a 1c ce 9e e0 f9 2e a9 04 61 e2 8f 45 c5 0d 3c aa 6d 0a 2f 41 2c 2a f3 c0 13 51 e5 f1 ce 1f df 55 8e fd 71 14 c6 e1 24 a9 44 62 2c Data Ascii: m[80OL;waL.\Nhr~=,JUT~l?y2X9\|xvP9TN?qeOE~Gn,JT0r#V&Qx_IDeqW~@TyS7JfPPz.aE<m/A,*QUq$Db,
2025-03-24 23:58:05 UTC	12561	IN	Data Raw: 27 8e fd 5b 9e 3a 2e 7e 47 3c 2a 2d a6 61 1d 87 7f b8 b8 f1 88 e6 55 7d 33 00 9f 10 14 ff e6 46 a8 dc 3b cf 52 04 61 91 fb 6f 38 ad de 7f e3 c0 52 24 21 3a 1f 62 46 8b ce 18 11 da 56 6f bd c0 4b 37 7a 6c 61 91 4f 02 67 b6 79 32 05 f2 e6 3d b4 bc ac 6c e3 46 27 60 80 5c 1a 1d 4e 71 e4 3e 81 ac 53 c7 06 30 cb 1e e1 4d 62 b8 83 b4 81 13 10 1d 54 41 bb 9e b8 1b dc 72 ae 43 ee f2 c0 f1 c3 7e 2f 9b bc 8d d2 cd 1c cd 74 23 0e 4e 2a e9 06 24 7a 6b b3 de c2 e7 6f f0 fe 12 7a de 2e 39 3e 00 d9 82 9b 2c d1 57 92 8f 4d 90 cb 5b 25 99 4d 29 af b4 d8 e0 d9 1c b7 f7 e0 75 58 39 9d e3 4c e0 89 3d a4 71 e0 03 9e 10 7c 26 1e 84 3a 3d 63 c5 0e 11 ea 6f 5a 87 dc 70 c2 81 cc bc 73 04 87 36 7d e9 4d 12 a5 bd d2 e6 3a 3c 62 69 0e c3 72 24 6e 71 6a dd d2 40 39 82 f8 89 d1 f2 21 Data Ascii: '[:.~G<-aU}3F;Rao8R$!:bFVoK7zlaOgy2=lF'`\Nq>S0MbTArC~/t#N$zkoz.9>,WM[%M)uX9L=q\|&:=coZps6}M:<bir$nqj@9!
2025-03-24 23:58:05 UTC	16384	IN	Data Raw: f5 4d fb fe c7 a3 60 fc 91 08 cd bd 87 99 5f 46 22 0e b8 ce 47 07 98 2f f4 bf e0 f6 e8 9f 1f 9d 63 ef 9b 8f ce ed 03 eb de 03 ba f5 e0 f6 bf ac 3b ff 45 77 fe eb f6 e1 c7 8f df e0 db ff fc e6 f8 96 7e 8e e9 c7 43 bc 4d 3f 1f de 3e 7c 18 7c f3 31 bf 7d 68 bd 45 0f c7 0f af be c1 57 3e 56 a1 ff f0 f8 e8 9f fe 47 e7 c1 7f dd 10 83 f3 30 3c fa f8 f1 f8 f8 1b 7e d6 bd 2b 6f 1c 53 d7 4f 1d 70 26 0f 8f a8 17 ce 83 a7 bb ff a0 ce ed ed fe 70 72 0f b9 52 60 8a a4 13 c5 09 f7 7d 05 38 cc 3f 85 ae d3 4f a4 81 6e 10 44 de c5 21 6d e7 ab 38 8c fd 18 01 0b 97 d6 61 c8 32 97 21 29 99 a5 8c 61 75 91 d9 d9 87 38 e1 55 1e 5c 9d 7b 57 92 9b 08 28 72 99 aa 48 7f 5a cc 44 f3 ed 3b f4 8d 94 c4 1f 6d 29 99 f0 0e 48 d9 f5 9c 38 2f df b8 b6 21 31 ea b4 88 76 f6 43 2a 51 a8 95 9e Data Ascii: M`_F"G/c;Ew~CM?>\|\|1}hEW>VG0<~+oSOp&prR`}8?OnD!m8a2!)au8U\{W(rHZD;m)H8/!1vC*Q
2025-03-24 23:58:05 UTC	5542	IN	Data Raw: c8 5d 54 6c f7 ae 85 fc ad 2c e4 3d 59 c8 fb b2 90 1f ed b5 16 f2 a3 47 58 c9 f4 f7 5b e0 67 2b d6 35 a1 f5 cc ce f0 ca bf 75 41 d7 d2 b7 ca 47 a6 4f 26 2f 77 2e 75 9a 7e 62 44 b1 c6 e9 e8 11 cf d0 24 44 98 46 41 b7 17 2f e9 c4 2b d6 c9 4f 6b 3a 89 90 34 26 58 bc 2f b3 0b c9 42 f2 13 bd 43 bd 67 90 0c 1c f2 92 c0 fd e9 2a 3b 88 f3 b8 bc f6 4f d9 f3 13 6d 01 4b 55 f9 17 82 f8 6e 76 cb a5 91 40 b0 02 9e 11 25 e5 f4 4d f5 61 4a dc 4f 52 49 52 28 7d e1 8d ff 44 c3 b1 10 a7 71 1c 86 74 3a 65 a5 24 ac 3e 0d a8 25 6f d7 90 98 7c 67 df f1 77 00 1b 57 17 1f de 1f e8 38 07 4f c1 e3 2d 9b 1d 08 5e c9 30 b7 24 a4 89 3a ef 4d f9 ae 51 ab 53 ad 27 65 ca be 9a c6 59 03 5b 17 77 de e4 b0 7d ad 4b c0 c3 8b c6 e8 24 9e 73 10 96 c3 32 1f 11 63 68 95 38 27 c6 05 74 e4 6d 48 Data Ascii: ]Tl,=YGX[g+5uAGO&/w.u~bD$DFA/+Ok:4&X/BCg*;OmKUnv@%MaJORIR(}Dqt:e$>%o\|gwW8O-^0$:MQS'eY[w}K$s2ch8'tmH

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:06 UTC	627	OUT	GET /67e1f180d4f608878d14199c/ HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://05f18be492a04674a4715d258c134a69.foneads.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c Sec-WebSocket-Key: 44StBjxZ41l3i6psagJaIQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-03-24 23:58:07 UTC	719	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 24 Mar 2025 23:58:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 1743b5e1-650e-4569-8a2c-409a4b6c7900 x-ms-ests-server: 2.1.20329.5 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:06 UTC	708	OUT	GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1 Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:08 UTC	833	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:08 GMT Content-Type: application/x-javascript Content-Length: 40487 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 26 Feb 2021 06:13:13 GMT etag: 0x8D8DA1D997CA245 x-ms-request-id: 0ce385ee-401e-0018-3cd9-9c1c31000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250324T235807Z-15494cb576bkwhc6hC1ATLrh1g0000000cd000000000gf7h x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT x-cache-info: L1_T2 accept-ranges: bytes content-encoding: gzip
2025-03-24 23:58:08 UTC	15551	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff bc bd 7b 7b db c6 b5 37 fa ff 79 9e f3 1d 44 34 65 01 73 48 91 76 93 77 17 14 c2 c7 91 9d c4 6d ee 72 9a a4 14 93 07 26 87 12 62 0a 60 00 50 b2 22 72 7f f6 b3 7e 6b 2e 18 5c 28 a7 dd fb 3d 6e 23 e2 32 98 eb 9a 35 eb be 4e 9f f4 4e 7e fd 76 27 f3 fb 93 db 67 a3 0f 47 93 93 fd 89 bf 0c 4e fe 7e 71 f2 69 b6 4b 57 71 99 64 e9 49 9c ae 4e b2 f2 5a e6 27 cb 2c 2d f3 e4 cd ae cc f2 82 8a fe fa 1b 3e 1d 65 f9 d5 e9 26 59 ca b4 90 27 4f 4e ff df ff a7 b7 de a5 4b 7c e9 4b 51 06 0f de 8e 9e 17 f4 dd b2 f4 a6 5e f6 e6 57 49 17 51 54 de 6f 65 b6 3e b9 c9 56 bb 8d ec f7 8f bc 18 c9 77 db 2c 2f 8b 59 fd 36 92 a3 55 b6 dc dd c8 b4 9c 95 d4 4c 6f 1c 84 55 ab c1 43 b2 f6 7b 55 91 a0 bc ce b3 bb 93 54 de 9d bc cc f3 2c f7 3d 3d e8 5c fe b6 4b Data Ascii: {{7yD4esHvwmr&b`P"r~k.\(=n#25NN~v'gGN~qiKWqdINZ',->e&Y'ONK\|KQ^WIQToe>Vw,/Y6ULoUC{UT,==\K
2025-03-24 23:58:08 UTC	12556	IN	Data Raw: f4 55 44 15 6d 9c e3 6f 02 1d 81 49 3f d7 a9 6a 37 f6 54 a3 53 80 b3 8b 66 36 d9 40 66 71 a7 f6 7e 7d 00 14 84 9b 6a 1d b2 83 5d d2 8d da ac bb b3 f2 bd 5f 19 87 ca 1d c8 fc 82 69 71 c0 49 8d 1e 0f 1e ba 8d 49 5b bc 03 11 00 0f 32 25 34 62 ec 48 9b 76 a5 6c df c9 61 61 5c 4f 16 6d 24 85 0d 90 a4 90 0a ba 89 4a bb de d5 f4 93 8f 7e de 7e 43 e8 ad 69 d7 7a 6c 7c 9a e7 7d cf 90 ee f2 a4 34 d7 8a e3 52 19 21 e0 4f da 1d 6b 64 6e cd 83 17 33 19 e2 a0 d0 33 c9 66 73 1a 23 84 0f b0 32 47 ba a8 4f 76 6f b4 55 ae 60 10 0e 1f 98 80 ec b0 a1 44 87 91 13 40 37 b4 d5 48 aa 34 21 34 e9 20 41 05 10 f7 96 c2 e8 33 e8 8e a3 2d aa ed 01 1e 4d 20 eb b9 66 38 fe ef b4 42 4d 8c 0f 95 18 bd c3 1a d4 e0 87 7f b3 11 7d 8a da 76 f6 7b 7e 1f f3 c9 fd 46 d2 fe 96 bb 54 4d ac 8b e5 Data Ascii: UDmoI?j7TSf6@fq~}j]_iqII[2%4bHvlaa\Om$J~~Cizl\|}4R!Okdn33fs#2GOvoU`D@7H4!4 A3-M f8BM}v{~FTM
2025-03-24 23:58:08 UTC	12380	IN	Data Raw: 0b 17 98 c1 b2 be 7c 86 7c 82 2e 66 8f a3 d4 a0 d5 59 69 ff 8c d4 0a 8a ea fa 32 6c 32 86 90 b7 4c 02 fc 76 fc 87 b7 e3 1b e9 2a 55 31 db 2d c8 ca 68 ab 5a 16 45 b3 9e 8f c2 27 4a 7b 7c 4e f1 2b e5 05 9c e9 17 47 58 fb 5a a6 5e d7 f9 4d d9 dc 5e 0a 7b 70 21 4e e6 56 a4 b8 b9 01 de f3 af b9 21 e8 fa 9e 65 1e ee df ef 77 a0 bd 0c 0a 83 3c c4 e8 02 ca 5c bd 68 cb 1d f2 c8 7d 54 8e 9c b3 0d e0 2f 35 5f 19 56 42 5b 1a cb 7b c7 4c 4d f7 2c b7 18 18 30 b5 bf 9c db 3d 54 fc 0f 79 03 d1 34 15 ae 05 cf 1d a5 e3 5b b7 9e 14 bb 74 c2 d1 19 52 95 f2 13 76 05 b7 1f ad 7a 74 60 4a e9 02 bb c8 e3 e5 38 cd 55 c0 a9 fa 10 36 2a 05 29 31 97 4c 20 da fc 53 53 23 1b 00 3f 46 b2 41 a4 63 f9 95 f3 be dc 93 3c 82 ba b1 b4 4a 37 97 99 49 5c 92 d0 aa 4c cf 73 d4 fe f5 cd eb 57 45 Data Ascii: \|\|.fYi2l2LvU1-hZE'J{\|N+GXZ^M^{p!NV!ew<\h}T/5_VB[{LM,0=Ty4[tRvzt`J8U6)1L SS#?FAc<J7I\LsWE

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:08 UTC	697	OUT	GET /ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js HTTP/1.1 Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:10 UTC	832	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:10 GMT Content-Type: application/x-javascript Content-Length: 4910 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 22 Oct 2020 20:43:21 GMT etag: 0x8D876CB1D67B929 x-ms-request-id: ae079a95-901e-0079-4cd9-9c3f72000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250324T235810Z-15494cb576bp2x4mhC1ATLyrqn0000000c9g000000009smz x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT x-cache-info: L1_T2 accept-ranges: bytes content-encoding: gzip
2025-03-24 23:58:10 UTC	4910	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff b5 5a 7b 73 db b6 96 ff 5f 9f 02 46 73 1d 32 a2 28 f9 11 37 95 c2 6a dd d8 d9 fa 6e 6b 7b 6d 67 7a bb 92 d2 a1 24 50 62 4a 91 2a 08 c6 f6 58 fa ee fb 3b 00 29 92 b2 d2 e6 76 67 33 13 0b cf 83 f3 7e 00 6c bf da 63 ad af ff c7 6e ef 4e 6f ee d8 d5 7b 76 f7 e3 c5 cd 19 bb 46 ef 57 76 79 75 77 f1 ee fc eb e1 34 1a 77 f3 30 65 41 18 09 86 df b1 9f 8a 29 4b 62 96 48 16 c6 93 44 2e 13 e9 2b 91 b2 05 fe ca d0 8f 58 20 93 05 53 73 c1 96 32 f9 24 26 2a 65 51 98 2a 6c 1a 8b 28 b9 67 16 c0 c9 29 bb f6 a5 7a 64 17 d7 b6 cb ee b0 36 91 e1 2c 8c b1 7b 92 2c 1f d1 9e 2b 16 27 2a 9c 08 e6 c7 53 0d 2d 42 27 4e 05 cb e2 a9 90 ec 7e 1e 4e e6 ec e7 70 22 93 34 09 14 93 62 22 c2 cf 38 24 cd 30 5e 3f c2 61 be 14 2c 15 8a 05 89 54 73 83 87 cb 6e 69 Data Ascii: Z{s_Fs2(7jnk{mgz$PbJX;)vg3~lcnNo{vFWvyuw4w0eA)KbHD.+X Ss2$&eQl(g)zd6,{,+'S-B'N~Np"4b"8$0^?a,Tsni

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:10 UTC	687	OUT	GET /ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js HTTP/1.1 Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:12 UTC	832	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:12 GMT Content-Type: application/x-javascript Content-Length: 3921 Connection: close cache-control: public, max-age=31536000 last-modified: Tue, 28 Jun 2022 20:27:38 GMT etag: 0x8DA5944A4FF258E x-ms-request-id: c97debd1-c01e-0048-36d9-9ce1cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250324T235812Z-15494cb576bkwhc6hC1ATLrh1g0000000ce000000000datp x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT x-cache-info: L1_T2 accept-ranges: bytes content-encoding: gzip
2025-03-24 23:58:12 UTC	3921	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff ad 5a 6b 73 e3 36 b2 fd 3e bf 82 46 b9 64 32 82 39 f2 66 93 dd 95 86 a3 f5 2b 3b ce f5 2b e3 c9 ce 56 c9 2a 17 45 42 12 c7 14 a0 80 a4 6d 5d 4b ff 7d 4f 03 24 45 c9 9e ca 24 f7 a6 32 36 89 47 a3 d1 38 7d ba d1 f4 ce b8 90 51 9e 28 e9 7a cf d5 a3 23 f0 a2 45 5e 68 e9 3e f9 a9 8a 42 6a f5 e7 5a e5 2a 52 e9 72 c9 98 e7 47 4a a2 dd 65 6f df 32 de 18 34 55 59 2e c3 99 58 2e b7 1a bd 55 2d 5e bb c2 7b 4e c6 f4 33 d7 8b e7 87 50 3b 3a 78 5b 77 bb fe f3 01 5f 79 b7 ee 5b 2e 03 ed 8b 27 11 b9 82 d6 cb 72 5d 44 b9 d2 7e ae 6e 72 9d c8 89 eb 79 3d ab a7 23 5b 2d e9 a7 42 4e f2 e9 fb 83 be 1c 1c 0c bb 8c ad b0 7e 34 a5 75 56 2b 3b 0e 6d f5 3a d2 15 5c 73 69 55 69 b5 b4 f7 2c 97 4b 57 04 02 f2 cf d5 a3 d0 c7 61 26 68 89 b1 d2 2e 29 99 07 Data Ascii: Zks6>Fd29f+;+VEBm]K}O$E$26G8}Q(z#E^h>BjZRrGJeo24UY.X.U-^{N3P;:x[w_y[.'r]D~nry=#[-BN~4uV+;m:\siUi,KWa&h.)

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:12 UTC	2571	OUT	GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-03-24 23:58:15 UTC	1018	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 168341 Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache link: <https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com>; rel=preconnect; ,<https://f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com>; rel=dns-prefetch,<https://7bb7036b135144cd89664486a4033abf.foneads.com>; rel=dns-prefetch p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 9c7814a3-993e-49dc-bc00-07d0229c0f00 x-ms-ests-server: 2.1.20329.5 - EUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-clitelem: 1,0,0,, x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-03-24 23:58:15 UTC	15361	IN	Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 22 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 2f 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 2f 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 Data Ascii: <!DOCTYPE html><html class="" dir="ltr" lang="en"><head><title>Sign in to your account</title><meta content="text/html; charset=utf-8" http-equiv="Content-Type"/><meta content="IE=edge" http-equiv="X-UA-Compatible"/><meta content="width=device-wid
2025-03-24 23:58:15 UTC	12584	IN	Data Raw: 4c 63 4c 4a 58 70 4f 49 43 59 69 46 63 7a 31 52 48 75 4c 6c 43 62 56 72 4e 57 58 41 6c 47 78 56 6b 34 63 45 39 44 33 6d 54 34 33 63 5f 63 59 58 54 54 4f 75 67 51 34 76 38 54 71 31 6e 31 6a 4d 69 59 66 41 50 4f 2d 51 76 59 48 42 59 41 5a 7a 59 4a 45 72 4f 62 6d 5a 76 30 67 76 57 55 38 4b 65 42 64 4c 69 41 41 5c 75 30 30 32 36 6a 73 68 73 3d 30 22 2c 22 75 72 6c 44 65 76 69 63 65 46 69 6e 67 65 72 70 72 69 6e 74 69 6e 67 22 3a 22 22 2c 22 75 72 6c 50 49 41 45 6e 64 41 75 74 68 22 3a 22 68 74 74 70 73 3a 2f 2f 30 35 66 31 38 62 65 34 39 32 61 30 34 36 37 34 61 34 37 31 35 64 32 35 38 63 31 33 34 61 36 39 2e 66 6f 6e 65 61 64 73 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 50 49 41 2f 45 6e 64 41 75 74 68 22 2c 22 75 72 6c 53 74 61 72 74 54 6c 72 22 3a 22 68 74 74 70 Data Ascii: LcLJXpOICYiFcz1RHuLlCbVrNWXAlGxVk4cE9D3mT43c_cYXTTOugQ4v8Tq1n1jMiYfAPO-QvYHBYAZzYJErObmZv0gvWU8KeBdLiAA\u0026jshs=0","urlDeviceFingerprinting":"","urlPIAEndAuth":"https://05f18be492a04674a4715d258c134a69.foneads.com/common/PIA/EndAuth","urlStartTlr":"http
2025-03-24 23:58:15 UTC	16384	IN	Data Raw: 38 55 4b 63 6d 59 2d 5f 68 4a 5f 57 45 4a 66 6c 67 71 58 5a 55 4f 52 4f 34 4d 74 42 58 6d 44 50 32 72 42 48 2d 31 42 5f 31 34 38 4c 5f 73 33 74 78 36 72 31 78 65 75 32 64 2d 61 42 6d 2d 76 54 72 36 6a 2d 46 66 33 6f 46 65 76 66 76 79 68 32 5f 5f 65 50 33 37 7a 5a 2d 64 46 34 65 66 73 70 4d 78 44 36 54 4d 6d 64 58 71 79 55 56 48 5a 59 54 4e 67 4d 64 6a 51 46 75 43 6d 58 62 6c 59 65 33 69 67 68 5a 4e 62 35 33 65 59 36 33 37 33 31 57 67 33 79 72 51 50 77 32 22 2c 22 75 72 6c 44 73 73 6f 53 74 61 74 75 73 22 3a 22 68 74 74 70 73 3a 2f 2f 30 35 66 31 38 62 65 34 39 32 61 30 34 36 37 34 61 34 37 31 35 64 32 35 38 63 31 33 34 61 36 39 2e 66 6f 6e 65 61 64 73 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 69 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 2f 64 73 73 6f 73 74 61 Data Ascii: 8UKcmY-_hJ_WEJflgqXZUORO4MtBXmDP2rBH-1B_148L_s3tx6r1xeu2d-aBm-vTr6j-Ff3oFevfvyh2__eP37zZ-dF4efspMxD6TMmdXqyUVHZYTNgMdjQFuCmXblYe3ighZNb53eY63731Wg3yrQPw2","urlDssoStatus":"https://05f18be492a04674a4715d258c134a69.foneads.com/common/instrumentation/dssosta
2025-03-24 23:58:15 UTC	16384	IN	Data Raw: 26 26 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 29 7b 76 61 72 20 73 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 61 29 3b 73 26 26 72 2e 70 75 73 68 28 73 29 7d 7d 63 61 74 63 68 28 65 29 7b 72 2e 70 75 73 68 28 67 28 65 29 29 7d 7d 7d 7d 7d 63 61 74 63 68 28 65 29 7b 72 2e 70 75 73 68 28 67 28 65 29 29 7d 72 65 74 75 72 6e 20 72 7d 76 61 72 20 68 3d 77 69 6e 64 6f 77 2c 70 3d 68 2e 24 43 6f 6e 66 69 67 7c 7c 7b 7d 2c 79 3d 70 2e 77 61 74 73 6f 6e 2c 6d 3d 68 2e 24 44 6f 3b 69 66 28 21 68 2e 24 57 65 62 57 61 74 73 6f 6e 26 26 79 29 7b 76 61 72 20 62 3d 5b 5d 2c 45 3d 21 31 2c 4c 3d 21 31 2c 77 3d 31 30 2c 24 3d 68 2e 24 57 65 62 57 61 74 73 6f 6e 3d 6e 65 77 20 69 3b 24 2e 43 42 3d 7b 7d 2c 24 2e 5f 6f 72 67 45 72 72 6f 72 48 61 6e 64 6c 65 72 3d 68 Data Ascii: &&JSON.stringify){var s=JSON.stringify(a);s&&r.push(s)}}catch(e){r.push(g(e))}}}}}catch(e){r.push(g(e))}return r}var h=window,p=h.$Config\|\|{},y=p.watson,m=h.$Do;if(!h.$WebWatson&&y){var b=[],E=!1,L=!1,w=10,$=h.$WebWatson=new i;$.CB={},$._orgErrorHandler=h
2025-03-24 23:58:15 UTC	16384	IN	Data Raw: 76 6f 69 64 20 30 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3f 76 6f 69 64 20 30 3a 66 28 61 72 67 75 6d 65 6e 74 73 5b 30 5d 29 2c 72 3d 73 28 68 2c 74 68 69 73 29 3f 6e 65 77 20 76 28 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 28 29 3a 76 28 74 29 3b 72 65 74 75 72 6e 22 22 3d 3d 3d 74 26 26 28 64 5b 72 5d 3d 21 30 29 2c 72 7d 3b 70 28 79 2c 76 29 2c 79 2e 70 72 6f 74 6f 74 79 70 65 3d 68 2c 68 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 79 3b 76 61 72 20 62 3d 22 53 79 6d 62 6f 6c 28 64 65 73 63 72 69 70 74 69 6f 6e 20 64 65 74 65 63 74 69 6f 6e 29 22 3d 3d 3d 53 74 72 69 6e 67 28 76 28 22 64 65 73 63 72 69 70 74 69 6f 6e 20 64 65 74 65 63 74 69 6f 6e 22 29 29 2c 67 3d 75 28 68 2e 76 61 6c 75 65 4f 66 29 2c 6d 3d 75 28 68 2e 74 6f 53 74 72 69 6e 67 29 Data Ascii: void 0===arguments[0]?void 0:f(arguments[0]),r=s(h,this)?new v(t):void 0===t?v():v(t);return""===t&&(d[r]=!0),r};p(y,v),y.prototype=h,h.constructor=y;var b="Symbol(description detection)"===String(v("description detection")),g=u(h.valueOf),m=u(h.toString)
2025-03-24 23:58:15 UTC	16384	IN	Data Raw: 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 5b 6f 62 6a 65 63 74 20 22 2b 6f 28 74 68 69 73 29 2b 22 5d 22 7d 7d 2c 35 37 35 35 3a 28 74 2c 72 2c 65 29 3d 3e 7b 76 61 72 20 6e 3d 65 28 34 37 36 32 29 2c 6f 3d 65 28 32 33 34 37 29 2c 69 3d 6e 28 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 29 3b 74 2e 65 78 70 6f 72 74 73 3d 4f 62 6a 65 63 74 2e 68 61 73 4f 77 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 69 28 6f 28 74 29 2c 72 29 7d 7d 2c 35 37 37 34 3a 28 74 2c 72 2c 65 29 3d 3e 7b 76 61 72 20 6e 3d 65 28 38 36 31 32 29 2c 6f 3d 65 28 31 34 30 39 29 2c 69 3d 65 28 39 35 35 37 29 2c 75 3d 65 28 32 38 33 32 29 2c 63 3d 65 28 35 35 30 32 29 2e 43 4f 4e 53 54 52 55 43 54 4f 52 2c 61 3d 65 28 32 31 37 32 29 2c 73 3d 6f 28 22 50 72 Data Ascii: ion(){return"[object "+o(this)+"]"}},5755:(t,r,e)=>{var n=e(4762),o=e(2347),i=n({}.hasOwnProperty);t.exports=Object.hasOwn\|\|function(t,r){return i(o(t),r)}},5774:(t,r,e)=>{var n=e(8612),o=e(1409),i=e(9557),u=e(2832),c=e(5502).CONSTRUCTOR,a=e(2172),s=o("Pr
2025-03-24 23:58:15 UTC	16384	IN	Data Raw: 33 33 29 2c 65 28 34 37 30 31 29 2c 65 28 32 30 38 34 29 2c 65 28 34 39 36 32 29 2c 65 28 37 31 32 32 29 2c 65 28 39 37 38 31 29 2c 65 28 33 38 31 30 29 2c 65 28 38 35 35 37 29 2c 65 28 37 36 29 2c 65 28 35 30 32 31 29 2c 65 28 33 39 39 34 29 2c 65 28 33 30 36 32 29 2c 65 28 32 33 36 37 29 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 6e 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 72 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 72 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 Data Ascii: 33),e(4701),e(2084),e(4962),e(7122),e(9781),e(3810),e(8557),e(76),e(5021),e(3994),e(3062),e(2367);var n=function(t,r){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,r){t.__proto__=r}\|\|function(t,r){for(var e in r)Object.prototy
2025-03-24 23:58:15 UTC	16384	IN	Data Raw: 3b 65 26 26 65 2e 6e 65 78 74 28 76 6f 69 64 20 30 29 2c 72 26 26 72 2e 63 6f 64 65 3f 63 2e 63 6c 6f 73 65 28 72 2e 63 6f 64 65 2c 72 2e 72 65 61 73 6f 6e 29 3a 75 2e 65 72 72 6f 72 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 57 65 62 53 6f 63 6b 65 74 53 75 62 6a 65 63 74 2e 65 72 72 6f 72 20 6d 75 73 74 20 62 65 20 63 61 6c 6c 65 64 20 77 69 74 68 20 61 6e 20 6f 62 6a 65 63 74 20 77 69 74 68 20 61 6e 20 65 72 72 6f 72 20 63 6f 64 65 2c 20 61 6e 64 20 61 6e 20 6f 70 74 69 6f 6e 61 6c 20 72 65 61 73 6f 6e 3a 20 7b 20 63 6f 64 65 3a 20 6e 75 6d 62 65 72 2c 20 72 65 61 73 6f 6e 3a 20 73 74 72 69 6e 67 20 7d 22 29 29 2c 74 2e 5f 72 65 73 65 74 53 74 61 74 65 28 29 7d 29 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 2e 5f 63 6f 6e 66 69 67 Data Ascii: ;e&&e.next(void 0),r&&r.code?c.close(r.code,r.reason):u.error(new TypeError("WebSocketSubject.error must be called with an object with an error code, and an optional reason: { code: number, reason: string }")),t._resetState()}),(function(){var r=t._config
2025-03-24 23:58:15 UTC	16384	IN	Data Raw: 2c 72 2e 70 72 6f 74 6f 74 79 70 65 5b 74 28 33 31 33 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 2c 65 3d 7b 74 6f 70 69 63 3a 72 28 32 35 33 29 2c 6d 65 73 73 61 67 65 3a 22 70 69 6e 67 22 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 5b 72 28 32 37 32 29 5d 28 29 7d 3b 74 68 69 73 5b 72 28 33 30 33 29 5d 28 65 29 7d 2c 72 7d 28 29 3b 4e 74 28 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 72 2c 65 2c 6e 3b 72 65 74 75 72 6e 20 44 74 28 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 76 61 72 20 69 3d 52 74 3b 74 72 79 7b 74 3d 4d 61 74 68 5b 69 28 33 31 38 29 5d 28 34 29 2c 72 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 31 38 29 2c 65 3d 4d 61 74 68 Data Ascii: ,r.prototype[t(313)]=function(){var r=t,e={topic:r(253),message:"ping",timestamp:(new Date)[r(272)]()};this[r(303)](e)},r}();Nt(void 0,void 0,void 0,(function(){var t,r,e,n;return Dt(this,(function(o){var i=Rt;try{t=Math[i(318)](4),r=Math.floor(18),e=Math
2025-03-24 23:58:15 UTC	16384	IN	Data Raw: 39 31 30 35 29 2e 63 68 61 72 41 74 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 65 29 7b 72 65 74 75 72 6e 20 72 2b 28 65 3f 6e 28 74 2c 72 29 2e 6c 65 6e 67 74 68 3a 31 29 7d 7d 2c 34 34 38 33 3a 28 74 2c 72 2c 65 29 3d 3e 7b 76 61 72 20 6e 2c 6f 2c 69 2c 61 3d 65 28 34 36 34 34 29 2c 75 3d 65 28 35 35 37 38 29 2c 63 3d 65 28 31 37 30 34 29 2c 73 3d 65 28 39 30 33 37 29 2c 66 3d 65 28 35 37 35 35 29 2c 70 3d 65 28 31 38 33 31 29 2c 6c 3d 65 28 35 34 30 39 29 2c 76 3d 65 28 31 35 30 37 29 2c 79 3d 22 4f 62 6a 65 63 74 20 61 6c 72 65 61 64 79 20 69 6e 69 74 69 61 6c 69 7a 65 64 22 2c 67 3d 75 2e 54 79 70 65 45 72 72 6f 72 2c 68 3d 75 2e 57 65 61 6b 4d 61 70 3b 69 66 28 61 7c 7c 70 2e 73 74 61 74 65 29 7b 76 61 72 20 64 3d 70 2e Data Ascii: 9105).charAt;t.exports=function(t,r,e){return r+(e?n(t,r).length:1)}},4483:(t,r,e)=>{var n,o,i,a=e(4644),u=e(5578),c=e(1704),s=e(9037),f=e(5755),p=e(1831),l=e(5409),v=e(1507),y="Object already initialized",g=u.TypeError,h=u.WeakMap;if(a\|\|p.state){var d=p.

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:12 UTC	2056	OUT	POST /common/handlers/watson HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: keep-alive Content-Length: 13083 sec-ch-ua-platform: "Windows" hpgid: 6 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" hpgact: 1800 canary: PAQABDgEAAABVrSpeuWamRam2jAF1XRQEymbSw1u_ROmI41WQfQsS_MtUWoTrOugs3NJKkXfQaKKiLA6NLmXs_o7Uj0xT3z5U38oyuahKYtQabCSkLwgGnMj2fu55e7B8Myh2hNLjxhWFL9_5XidDZAHVm1ud8kj0sU3vD07jemzFrHyxQf2y7IgT9tZrLNMF4BX_1_hF0HKuPLq7SozMN_QeI_Z3Q1g5wIx04oLCS0A6JZYE53NqYiAA sec-ch-ua-mobile: ?0 client-request-id: 7284660c-0043-454a-aa81-852512bd10b1 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json Content-Type: application/json; charset=UTF-8 Origin: https://05f18be492a04674a4715d258c134a69.foneads.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-03-24 23:58:12 UTC	13083	OUT	Data Raw: 7b 22 65 63 22 3a 22 54 79 70 65 45 72 72 6f 72 3a 54 79 70 65 45 72 72 6f 72 3a 20 43 61 6e 6e 6f 74 20 72 65 61 64 20 70 72 6f 70 65 72 74 69 65 73 20 6f 66 20 6e 75 6c 6c 20 28 72 65 61 64 69 6e 67 20 27 74 6f 70 69 63 27 29 22 2c 22 77 65 63 22 3a 22 33 34 22 2c 22 69 64 78 22 3a 31 2c 22 70 6e 22 3a 22 22 2c 22 73 63 22 3a 31 30 31 33 2c 22 68 70 67 22 3a 36 2c 22 6d 73 67 22 3a 22 55 6e 63 61 75 67 68 74 20 54 79 70 65 45 72 72 6f 72 3a 20 43 61 6e 6e 6f 74 20 72 65 61 64 20 70 72 6f 70 65 72 74 69 65 73 20 6f 66 20 6e 75 6c 6c 20 28 72 65 61 64 69 6e 67 20 27 74 6f 70 69 63 27 29 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 30 35 66 31 38 62 65 34 39 32 61 30 34 36 37 34 61 34 37 31 35 64 32 35 38 63 31 33 34 61 36 39 2e 66 6f 6e 65 61 64 73 Data Ascii: {"ec":"TypeError:TypeError: Cannot read properties of null (reading 'topic')","wec":"34","idx":1,"pn":"","sc":1013,"hpg":6,"msg":"Uncaught TypeError: Cannot read properties of null (reading 'topic')","url":"https://05f18be492a04674a4715d258c134a69.foneads
2025-03-24 23:58:14 UTC	829	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:14 GMT Content-Type: application/json; charset=utf-8 Content-Length: 265 Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: 7284660c-0043-454a-aa81-852512bd10b1 x-ms-request-id: b009d0bf-a1a7-4a17-9355-5d51df228900 x-ms-ests-server: 2.1.20329.5 - EUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-03-24 23:58:14 UTC	265	IN	Data Raw: 7b 22 61 70 69 43 61 6e 61 72 79 22 3a 22 50 41 51 41 42 44 67 45 41 41 41 42 56 72 53 70 65 75 57 61 6d 52 61 6d 32 6a 41 46 31 58 52 51 45 43 38 67 43 43 78 37 53 52 41 62 49 53 76 46 75 4a 54 66 62 4d 4c 38 49 49 65 76 4e 77 43 41 79 4d 53 42 31 79 59 51 5f 75 4d 64 65 61 58 4c 39 6f 6f 33 4c 37 4a 51 43 43 34 42 78 48 4e 32 39 55 4d 75 6a 32 6a 78 45 6b 76 4e 6a 53 6f 5a 44 7a 39 6b 6c 4e 44 65 46 5a 38 62 41 62 66 5a 65 39 2d 48 41 66 6e 47 74 49 4c 69 36 53 35 70 79 76 78 6f 39 30 62 75 4c 46 57 32 73 34 69 37 37 54 42 68 53 62 4d 6b 6c 73 56 5f 4f 71 71 42 44 42 43 31 62 55 67 38 67 30 56 74 78 76 74 59 34 4f 33 46 5a 62 52 4b 75 64 51 4e 6e 4a 37 6e 42 62 68 44 2d 48 38 6e 6d 39 51 45 35 49 35 74 2d 71 70 57 68 38 65 43 35 56 50 53 51 59 68 41 71 Data Ascii: {"apiCanary":"PAQABDgEAAABVrSpeuWamRam2jAF1XRQEC8gCCx7SRAbISvFuJTfbML8IIevNwCAyMSB1yYQ_uMdeaXL9oo3L7JQCC4BxHN29UMuj2jxEkvNjSoZDz9klNDeFZ8bAbfZe9-HAfnGtILi6S5pyvxo90buLFW2s4i77TBhSbMklsV_OqqBDBC1bUg8g0VtxvtY4O3FZbRKudQNnJ7nBbhD-H8nm9QE5I5t-qpWh8eC5VPSQYhAq

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:12 UTC	1589	OUT	GET /favicon.ico HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-03-24 23:58:14 UTC	719	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 24 Mar 2025 23:58:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: e02fbf24-37ed-40d0-b66e-685f455a7000 x-ms-ests-server: 2.1.20329.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:13 UTC	669	OUT	GET /67e1f180d4f608878d14199c/ HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://05f18be492a04674a4715d258c134a69.foneads.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1 Sec-WebSocket-Key: rk5mlvcATZPo+f6QHFSkSg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-03-24 23:58:14 UTC	718	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 24 Mar 2025 23:58:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 88eeb431-35a1-4819-aebd-860164f55700 x-ms-ests-server: 2.1.20329.5 - EUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://url.au.m.mimecastprotect.com/s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Chrome Cache Entry: 97

Static File Info

Network Behavior

Windows Analysis Report
https://url.au.m.mimecastprotect.com/s/6K8YCK1Dn0inYwKuptAU5sVmz?domain=oneconnect.memberdoc.com

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:14 UTC	516	OUT	GET /common/handlers/watson HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-03-24 23:58:16 UTC	750	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:16 GMT Content-Type: application/json; charset=utf-8 Content-Length: 164 Connection: close cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: aea60d9c-ab56-4516-898f-462723953500 x-ms-ests-server: 2.1.20329.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-03-24 23:58:16 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 33 64 35 33 61 31 62 35 2d 37 37 33 31 2d 34 34 35 39 2d 38 38 32 34 2d 30 63 34 61 34 66 62 62 63 34 30 30 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 33 2d 32 34 20 32 33 3a 35 38 3a 31 36 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"3d53a1b5-7731-4459-8824-0c4a4fbbc400","timestamp":"2025-03-24 23:58:16Z","message":"AADSTS900561"}}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:15 UTC	714	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1 Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:16 UTC	817	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:16 GMT Content-Type: text/css Content-Length: 20410 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 08 Nov 2024 04:59:25 GMT etag: 0x8DCFFB21E496F3A x-ms-request-id: a780be71-301e-0060-8073-9abfc9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250324T235816Z-15494cb576bs9n94hC1ATLt1200000000ch000000000guqw x-fd-int-roxy-purgeid: 4554691 x-cache-info: L1_T2 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-03-24 23:58:16 UTC	6403	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff ed 7d 6b 93 db 36 b2 e8 77 ff 0a ee a4 52 eb c9 4a 8c 48 3d 47 53 49 ad e3 78 93 39 c7 af b2 9d 7d 54 2a b5 c5 91 a8 11 8f 29 51 97 a4 66 3c ab a3 ff 7e f1 46 03 68 90 d4 78 b2 d9 7b 2b eb 8d 2d a2 1b 0d a0 d1 68 a0 81 6e e0 eb af fe 10 3c 2f 76 f7 65 76 b3 ae 83 a7 cf cf 83 57 d9 a2 2c aa 62 55 93 f4 72 57 94 49 9d 15 db 30 78 96 e7 01 43 aa 82 32 ad d2 f2 36 5d 86 c1 57 5f 7f fd d5 1f 9e f4 bb ff 2f 78 ff e1 d9 bb 0f c1 9b bf 04 1f 7e bc 7a f7 7d f0 96 7c fd 23 78 fd e6 c3 d5 f3 17 41 67 2a 4f 9e 7c 58 67 55 b0 ca f2 34 20 ff 5e 27 55 ba 0c 8a 6d 50 94 41 b6 5d 88 5a a7 55 b0 21 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 b4 21 cf aa 9a 64 ba 4e f3 e2 2e 78 4a c8 95 cb e0 6d 52 d6 f7 c1 d5 db f3 30 f8 40 70 0b d2 Data Ascii: }k6wRJH=GSIx9}T)Qf<~Fhx{+-hn</vevW,bUrWI0xC26]W_/x~z}\|#xAgO\|XgU4 ^'UmPA]ZU!Y:ve?!dN.xJmR0@p
2025-03-24 23:58:16 UTC	14007	IN	Data Raw: 46 82 1d eb 46 02 3c d6 8d 04 7b ac 1b 09 46 ac 1b c5 06 8f 75 a3 e0 1e eb 46 c1 1d eb 46 41 3c d6 8d 82 7b ac 1b 05 47 ac 1b 05 f3 58 37 0a ee b1 6e 14 dc b1 6e 14 c4 63 dd 28 c1 f0 58 37 0a 8e 58 37 0a e6 b1 6e 14 dc 63 dd 28 b8 6b dd 30 10 66 dd 48 00 6a dd 48 20 6a dd 48 a0 6b dd 48 08 6e dd 48 28 6e dd 48 a8 6d dd c8 74 dc ba 91 50 dc ba 91 50 d7 ba 51 ad c7 ad 1b 05 c6 ad 1b 05 b6 ad 1b 05 c0 ad 1b 05 c6 ad 1b 05 76 ad 1b 05 c2 ad 1b 05 c6 ad 1b 05 b6 ad 1b 05 c0 ad 1b 25 06 b8 75 a3 c0 ae 75 a3 40 b8 75 a3 c0 b8 75 a3 c0 8e 75 43 20 4d d6 8d 06 37 59 37 1a ab c9 ba d1 58 5e eb 46 a3 34 5a 37 1a ad d1 ba d1 68 1e eb 46 23 34 5a 37 1a ad d1 ba d1 68 5e eb 06 b0 b3 d1 ba 01 78 8d d6 0d c0 f3 58 37 00 a3 d1 ba 01 78 8d d6 0d c0 f3 5a 37 00 a7 d1 ba 01 Data Ascii: FF<{FuFFA<{GX7nnc(X7X7nc(k0fHjH jHkHnH(nHmtPPQv%uu@uuuC M7Y7X^F4Z7hF#4Z7h^xX7xZ7

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:15 UTC	691	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js HTTP/1.1 Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:18 UTC	813	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:18 GMT Content-Type: application/x-javascript Content-Length: 122983 Connection: close cache-control: public, max-age=31536000 last-modified: Tue, 25 Feb 2025 19:12:56 GMT etag: 0x8DD55D0698478AA x-ms-request-id: 6063b8c1-001e-0019-1507-9d43ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250324T235816Z-15494cb576bnlvtthC1ATL6zkw0000000c60000000004n8u x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-03-24 23:58:18 UTC	15566	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff e4 bd 7b 77 e3 38 8e 38 fa ff fd 14 8e 66 6e da ee 28 2e cb 6f 2b ad ce ba 9c a4 2a db 49 9c 89 93 ea de 4d 65 72 64 89 76 d4 91 25 af 24 e7 31 8e f7 b3 ff 00 90 94 28 5b 4e 55 f5 ee b9 f7 dc 73 e7 51 b1 48 f0 05 82 20 00 82 e0 87 9f 77 fe af d2 cf a5 fd ef ff 4f 69 74 dd bf ba 2e 0d 4f 4a d7 9f 4f af 8e 4a 97 f0 f5 1f a5 8b e1 f5 e9 e0 f8 fb eb c1 46 f1 ff d7 0f 5e 5c 9a 78 3e 2b c1 df b1 1d 33 b7 14 06 a5 30 2a 79 81 13 46 f3 30 b2 13 16 97 66 f0 6f e4 d9 7e 69 12 85 b3 52 f2 c0 4a f3 28 fc 93 39 49 5c f2 bd 38 81 42 63 e6 87 cf a5 32 54 17 b9 a5 4b 3b 4a 5e 4b a7 97 95 2a d4 cf a0 36 6f ea 05 50 da 09 e7 af f0 fb 21 29 05 61 e2 39 ac 64 07 2e d5 e6 c3 47 10 b3 d2 22 70 59 54 7a 7e f0 9c 87 d2 b9 e7 44 61 1c 4e 92 52 c4 1c Data Ascii: {w88fn(.o+IMerdv%$1([NUsQH wOit.OJOJF^\x>+30yF0fo~iRJ(9I\8Bc2TK;J^K*6oP!)a9d.G"pYTz~DaNR
2025-03-24 23:58:18 UTC	12561	IN	Data Raw: 03 f1 67 05 fc 0c 15 7f f4 7a b5 50 39 15 a2 36 7e 6f 2a 3b 65 69 42 a8 a0 c1 00 61 ca dc 80 91 9a 07 0a 14 24 84 57 d4 85 24 3c 1d 0d 39 f0 a1 52 9f 92 5c 46 9a 50 32 72 b6 07 f9 7c 1b 6e fd 56 11 63 44 3d eb 20 a9 32 04 12 97 7d 12 b4 f7 50 c8 35 80 a5 34 d8 fa 52 fb 90 b5 d9 65 a5 f8 76 6b 07 2a 91 80 3d be 45 58 1b e2 01 ac 39 10 56 52 a5 da 56 6a b7 76 6a ba 5d 65 e8 0b 81 21 72 be 53 15 04 8d 44 0a de 59 59 cb 03 2d 01 38 f0 13 1e 2f 94 2b 42 ea 2e 2f 03 1e 93 40 b3 fd 67 fb 35 d6 56 15 68 10 77 03 18 ef 70 8e 1d 8a 01 2f 36 71 19 27 f2 c6 f9 fe 2b f5 67 10 e5 4c a0 05 14 04 e8 a7 44 5a 4c c2 9d 0c ca 6a a1 39 63 8f 65 ae bc e2 84 a1 85 6c 36 c7 bb 3d dc 01 c4 2a da 73 80 a7 00 e0 30 1b 0c cb 2a ac 7c c3 e4 74 90 d9 37 3c e9 c7 fd de b4 e9 68 02 30 Data Ascii: gzP96~o;eiBa$W$<9R\FP2r\|nVcD= 2}P54Revk=EX9VRVjvj]e!rSDYY-8/+B./@g5Vhwp/6q'+gLDZLj9cel6=s0\|t7<h0
2025-03-24 23:58:18 UTC	16384	IN	Data Raw: 2e de b2 05 98 9f ce 93 d9 c8 66 08 73 1f 3d 86 58 eb aa 76 62 c3 41 4a b6 2c 68 51 76 84 d1 99 8b 09 e9 80 79 96 be e2 a3 ca 17 f3 9a f5 fc 31 cb 4d 94 8b f4 db ca 90 68 1c df f6 91 02 0a d3 e6 3b ae cd b7 16 74 91 24 f0 4a 01 53 6e 2d b7 a2 4a 92 05 27 70 a5 da 88 e3 84 07 53 f9 de 21 a2 8d 29 c3 14 0d 9f 74 bb 9b f2 ae ab 5e 1a ca cc 4c 4e 41 4f bf 76 ca d6 60 b0 c9 b2 cd b1 19 1f 5c 6f 26 83 3f 06 45 79 93 12 a2 8a bc 04 44 52 06 49 7c 0f 88 04 94 29 f1 55 20 12 d0 98 55 de 06 22 29 82 24 f3 50 43 43 a5 f2 d0 12 69 53 68 50 83 78 6a ac f9 a2 15 3a 5d 8e 01 45 2b f2 28 71 4e 03 47 ae 6b 35 e4 07 33 f2 5e d3 ee 46 ed 20 31 0b 0b e6 17 56 7e fd 8d c5 e9 17 70 a5 cc ca dd 2c 0a d6 39 03 23 bb 4a 2d 33 e2 fa 01 8a de 6c 29 a4 95 39 84 e6 31 31 47 a6 81 5c Data Ascii: .fs=XvbAJ,hQvy1Mh;t$JSn-J'pS!)t^LNAOv`\o&?EyDRI\|)U U")$PCCiShPxj:]E+(qNGk53^F 1V~p,9#J-3l)911G\
2025-03-24 23:58:18 UTC	16384	IN	Data Raw: 3f 59 45 b5 6c f4 67 e5 4e c0 b3 5e d1 51 df af 1f 0d ad ea c1 e9 30 36 a4 a0 f7 68 f4 29 bc ea 0b 67 87 44 94 34 af 17 f7 28 9c d3 39 1e 74 fc b7 8f 74 03 4d f2 0f 49 8f a6 54 20 52 fa 05 e1 37 f2 a4 27 2e 7a 51 ef 86 7e e6 b2 4d a5 9f a2 95 cb 89 dc 01 c7 43 bf 70 77 fa 7e d6 2b e0 cd 89 1f bb ef ea 55 1b 78 3a 31 9b 40 90 2e 83 70 8c 92 ca 7d 9b e0 a5 99 61 10 c3 86 95 ac 20 45 67 ee 59 df 58 78 58 54 57 00 60 12 8b d4 75 f6 44 14 14 d4 83 d8 fa 2b e8 d2 3f eb 5f f3 d2 b5 ed 98 46 69 14 22 5d 05 c7 1b 0c 0d fc eb c1 75 11 4f f6 05 4f f0 f4 34 70 e6 1d b7 8d 1b 3d 35 98 37 a0 6a 42 da f8 8e 1e 99 71 af ba 1f 9b 0f 0f 52 05 a9 82 85 9f 0b 16 e6 0d 46 c0 35 51 67 51 81 2c f4 33 69 8f 6a cb 1c 3f 53 c1 20 42 b8 4b aa 95 c1 24 61 b7 cf fa bc 2c 5e 5c 77 86 Data Ascii: ?YElgN^Q06h)gD4(9ttMIT R7'.zQ~MCpw~+Ux:1@.p}a EgYXxXTW`uD+?_Fi"]uOO4p=57jBqRF5QgQ,3ij?S BK$a,^\w
2025-03-24 23:58:18 UTC	16384	IN	Data Raw: 0a 13 f3 88 ed 99 0f 4a 86 f0 6e 6e 21 c9 75 a6 bd 24 44 a1 e2 cd 89 2f a3 33 4f 42 82 32 85 6d eb 84 85 d2 50 4c f4 9d 3a fd e4 98 83 7b 22 b6 59 93 d2 4e bc b6 ab b4 3f 27 2e 16 de fa 3d a3 5a 9b 06 24 3c 3b 39 93 47 27 d0 2f 89 94 9c 7c 90 3a 90 39 79 84 b5 57 62 27 07 aa 63 e8 60 34 ea 41 83 b2 5a ae 06 ab 19 49 28 ab d1 c0 9d 3f 3c 4c e8 ac 2c 70 ba 4d 19 69 c0 44 2b 41 b2 98 c0 69 9a b8 66 a0 c7 cd 1a 5e df 81 f2 3a 67 3c af 61 de a5 5d e8 50 65 65 c3 cc 4f bc 19 f8 2c 91 a8 e8 49 ed 11 8c 35 48 25 79 cf bb 00 e7 20 e5 26 31 df 56 4b a7 05 e7 dc 75 f4 72 e8 5e 20 54 91 d5 2b 92 b8 9a 2a 47 cc b7 1f 10 1b 01 68 5a df 55 6a 2f 7a 68 8c ca ec 4a ab e2 c1 58 e5 d0 0c f0 f8 2a 2d 03 68 36 56 92 21 d7 7c b1 be 20 d6 2e 99 00 65 12 7f d3 8c c8 07 d5 60 82 Data Ascii: Jnn!u$D/3OB2mPL:{"YN?'.=Z$<;9G'/\|:9yWb'c`4AZI(?<L,pMiD+Aif^:g<a]PeeO,I5H%y &1VKur^ T+GhZUj/zhJX-h6V!\| .e`
2025-03-24 23:58:18 UTC	16384	IN	Data Raw: 18 d2 7a 60 f2 e0 eb fc 24 cd fc 48 13 c4 53 e3 a9 ca 70 f3 37 e0 54 bd 73 b0 6a 4c 47 51 69 ff fd 66 f2 e1 6b 17 a3 9b df e8 58 a8 2d e8 4f d5 68 9d 5f a7 00 cc cf 08 78 1a 16 e3 b5 6c 10 e3 56 b2 87 cf 08 b3 ea 69 a0 4e 1c f1 89 e8 a9 9e 8a 1b 69 28 d6 63 69 50 a7 fd 38 b2 b2 f9 fd 6b 83 64 86 c5 75 5f 29 6b 50 6f 28 8e ea a7 e7 fd 08 da 25 1d c0 fc 6b 71 41 d9 a0 5b 47 6c b7 07 ae 51 f8 ea 9d bf d1 fe 4a b1 8a 6b b8 7b 97 c6 df 3c 9a 8d db e1 89 4e 18 b2 60 b4 1f aa b3 f4 0b ca c2 56 be d7 57 56 50 26 1e ac 6d 9d 13 a7 1c 7d b8 ba d3 d9 62 ae 13 f5 cc a7 4f 08 1d 74 6e d6 e1 e0 2d 1d c2 92 8b 7c 40 48 f1 fd b3 e9 e0 87 01 c0 3d 79 3e 55 b9 f6 81 2e 52 61 0f 09 0d a0 d9 93 f1 5b 52 1c 5b d5 ac 39 ed 60 e9 ff 9a 84 3c 4b ba 47 6b f8 4e 6e 8f ae 04 4e 52 Data Ascii: z`$HSp7TsjLGQifkX-Oh_xlViNi(ciP8kdu_)kPo(%kqA[GlQJk{<N`VWVP&m}bOtn-\|@H=y>U.Ra[R[9`<KGkNnNR
2025-03-24 23:58:18 UTC	16384	IN	Data Raw: 38 29 7a 34 9c 2f 0b ca 5a 3b a3 fa 60 1a ad f0 70 b4 b6 8c eb 2d 4f 7b 99 f9 f4 db ff ff 97 b7 f7 fe e7 5b 30 75 f0 b3 3f c9 f6 12 76 6d 76 5a 4c 5a 2a 3a 38 d9 e5 da c3 02 30 df 81 22 27 01 22 cc f5 3a a0 dd a9 d9 f6 9d 35 8c 87 66 fb b4 83 3b 6b c8 d6 8b 5e 5a 71 e8 9c 2f 97 4a c5 56 1a 63 bb f9 15 b1 7d 22 32 76 7d 32 eb a1 a3 35 28 24 d0 ae 1f d7 cc 70 ba a8 fd 89 fd cc d9 00 5c 88 cb 77 66 b5 5e 2c 66 d3 c1 d9 72 79 51 4d be fd d6 e6 9e 14 22 8a b8 f0 23 3f cb 44 62 f3 98 d2 8c 44 71 e4 53 68 cc 38 2f e7 92 09 3a 60 78 fe ad 16 47 d5 b7 fc db f3 6a cc e6 6c f6 7e 59 f0 ea 10 96 fd a1 3b 3e 2f e6 e4 de ac d1 a9 a8 1e 5c 5c 1c cf 21 a9 cf 96 ea a4 80 14 d3 3b 4e fd f1 42 9f 8f 57 63 f8 fb a5 bc 94 a0 b4 1b 48 85 5a 48 29 29 ab fe 39 ea f0 33 48 5e 3a Data Ascii: 8)z4/Z;`p-O{[0u?vmvZLZ*:80"'":5f;k^Zq/JVc}"2v}25($p\wf^,fryQM"#?DbDqSh8/:`xGjl~Y;>/\\!;NBWcHZH))93H^:
2025-03-24 23:58:18 UTC	12936	IN	Data Raw: 45 c8 30 ac e4 2c 64 de 5d b7 82 78 19 11 0a 21 10 1a 0c d3 b4 45 94 4f 95 94 0f 2f c2 e7 59 57 5a 0e 4c a6 f1 45 ac cc 38 7b 93 4a 93 30 b4 bb 3b 0d 6e 98 89 fe 22 3c 82 79 dd 78 46 a3 8e 9c 99 13 d7 70 a6 5c f2 7b 13 26 be e7 3b 4c 2e 3c a8 68 af 83 0d 01 fc f2 0c 34 94 27 3b 7a de 55 45 47 3c 8b fd 8e 2f 92 d8 03 3b 8b e9 9c 3a 78 27 32 ad 42 3f 53 e4 0f 37 d0 9b 56 13 69 b9 d9 36 92 8e 07 af 63 28 96 23 fd 56 fb c9 13 da da b1 80 3a 69 72 e1 df 50 e0 2f 2d b5 c3 f0 d2 04 0e 63 c0 3f 98 50 0a 08 0a 27 e1 0e 9e 70 a4 dd dd dd ad 7f af c7 1a 88 0b 3d 75 a9 77 d9 4d 1a 24 aa 72 7e 67 d5 5a f7 4c c4 90 10 6c 24 6f 76 e4 f7 92 1a e2 74 48 67 ce 97 97 0e 72 46 bb 4c 91 58 79 a8 a2 3f 44 28 ea 21 55 07 e5 48 88 aa ce 80 27 56 d5 06 05 ed 10 cb dc 39 57 a7 88 Data Ascii: E0,d]x!EO/YWZLE8{J0;n"<yxFp\{&;L.<h4';zUEG</;:x'2B?S7Vi6c(#V:irP/-c?P'p=uwM$r~gZLl$ovtHgrFLXy?D(!UH'V9W

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:15 UTC	710	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_r1sg5sxlkljjoa22hvk04g2.js HTTP/1.1 Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:17 UTC	833	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:17 GMT Content-Type: application/x-javascript Content-Length: 16623 Connection: close cache-control: public, max-age=31536000 last-modified: Mon, 03 Mar 2025 20:34:37 GMT etag: 0x8DD5A92D0BABA3E x-ms-request-id: f76d4537-901e-0079-1f11-9c3f72000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250324T235816Z-15494cb576bttdmghC1ATLfb840000000ceg00000000a2kw x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT x-cache-info: L1_T2 accept-ranges: bytes content-encoding: gzip
2025-03-24 23:58:17 UTC	15546	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff dd 7d 4d 73 23 c7 92 d8 dd bf 02 0f cf f1 86 5c f5 40 f8 e0 27 46 d0 18 04 c1 19 ec 90 00 04 80 33 52 48 32 a2 09 14 c0 7e 04 ba b1 dd 8d e1 f0 51 e3 78 37 1f f6 e0 ab 7d f3 c1 27 1f 7d f1 dd 3f 65 23 d6 bf c3 f9 51 55 5d d5 dd 00 c8 91 56 6f d7 0a c5 10 dd 5d 95 55 95 95 95 95 99 95 99 f5 87 d9 da 9f c4 5e e0 ef 89 fd 47 f5 bb 10 ec f9 fb 8f de 6c cf fb d1 ff 79 3f 14 f1 3a f4 0b f8 bb 24 3e ad 82 30 8e 5e 7d 74 c3 42 d8 c0 57 8d 47 f9 ae fe f8 d9 f1 a6 75 df 59 04 ee 54 4c eb 7f a8 7c 7e 25 ab 0a ac 3a 71 17 8b bd 50 41 70 42 27 f9 1d ec c3 03 57 6b fc a1 9c 7c f8 8c cd 78 8d 47 0d 28 28 2d 1b c2 09 4a 93 86 07 ff ae 1a c5 a2 13 ec 95 f7 3f ef fd 98 0c c3 09 1c 0f 3a bf 57 dd a7 5e fa 0d 6f af 02 f0 e1 cf e1 be 13 c3 9f a3 Data Ascii: }Ms#\@'F3RH2~Qx7}'}?e#QU]Vo]U^Gly?:$>0^}tBWGuYTL\|~%:qPApB'Wk\|xG((-J?:W^o
2025-03-24 23:58:17 UTC	1077	IN	Data Raw: 3f 45 86 3e 10 3e df 75 41 5e da 40 67 54 5c a8 17 55 0b 04 37 2c fb 39 44 ff d4 1e a8 48 e2 13 ee 02 f4 d8 f1 e9 a9 aa 3f 62 e6 26 18 be fc 48 4f 84 01 ce 46 d6 99 6a 68 17 32 7f 18 a2 8f 10 40 0f 55 e5 34 4e 86 86 59 50 af 25 6c 88 0a 10 30 a0 33 4a ab f6 38 72 6f 80 c4 49 03 46 b2 6d 47 13 17 e3 62 8e 9d e1 ca 45 7c 60 fc c3 5c 5c af 30 cc 04 7f 9d e3 36 51 3b 20 5c d4 0e 9d b7 c1 92 22 92 9b b0 de ef b1 d4 09 ff a4 62 07 65 0c 1c 83 a6 2e c5 2c ae 9f 56 9c 8b 23 0a 50 7b e3 e2 49 e0 f4 0c 48 f9 48 47 9b f7 66 fd 20 8a 98 a5 35 1e ad a5 43 c2 c9 64 e5 16 1d 0e c2 a0 75 c0 2f e9 b9 e8 5c 51 e2 57 14 c7 a8 e0 98 13 c1 8e 6f e1 05 11 e0 f5 6a 1e ba 53 71 e5 cd 79 eb b8 fe 1e f1 a8 a4 98 b2 73 15 fc d9 c5 c0 23 da 57 cd 60 00 99 09 ed bd 1b a2 70 df 78 94 Data Ascii: ?E>>uA^@gT\U7,9DH?b&HOFjh2@U4NYP%l03J8roIFmGbE\|`\\06Q; \"be.,V#P{IHHGf 5Cdu/\QWojSqys#W`px

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:15 UTC	782	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: f2debd53b0454135966042a40d6bc27b.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:17 UTC	490	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3680 Connection: close Vary: Accept-Encoding cache-control: max-age=315360000 p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" referrer-policy: strict-origin-when-cross-origin x-ms-route-info: C556_BAY x-ms-request-id: 7868e08b-4894-4948-b9b4-ebe1314da5ed ppserver: PPV: 30 H: PH1PEPF0001E391 V: 0 access-control-allow-origin: * access-control-allow-headers: *
2025-03-24 23:58:17 UTC	3680	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 73 20 69 6e 20 65 29 74 5b 73 5d 3d 65 5b 73 5d 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 6e 29 7b 69 66 28 73 5b 6e 5d 29 72 65 74 75 72 6e 20 73 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 73 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 65 29 2c 69 2e 6c 6f 61 64 65 64 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 73 3d 7b 7d 3b 72 65 74 75 72 6e 20 65 2e 6d 3d 74 Data Ascii: <script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:18 UTC	673	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:21 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:21 GMT Content-Type: application/x-javascript Content-Length: 61215 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 25 May 2023 17:22:47 GMT etag: 0x8DB5D44A8CEE4F4 x-ms-request-id: 61b562dd-401e-0079-1a25-9c00df000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250324T235820Z-15494cb576bn8h6hhC1ATL8f6c0000000cmg00000000bc93 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-03-24 23:58:21 UTC	15567	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff cc bd 6b 77 db b6 b2 30 fc fd fc 0a 99 ab c7 9b dc 46 14 c9 4e d2 44 0a eb e3 d8 4a a2 c6 b7 fa d2 b4 db f1 f6 a2 29 c8 62 22 91 2a 49 d9 f1 b6 f5 df 9f 99 c1 85 00 45 ca 76 db f3 9e 77 b5 b1 48 70 70 1f 0c 06 83 b9 b8 37 51 3c 48 6e 9a 39 1f f3 09 cf d3 db 8b 1b 7e 39 0d c2 6f 3f 67 49 3c f5 97 7e bd bf 3f 3b f7 9a d3 59 36 72 cf ce d6 cf d9 19 63 6c 38 8b c3 3c 4a 62 97 b3 9c c5 de 9d 33 cb 78 23 cb d3 28 cc 9d 6e dc 4c dd dc 63 71 73 e0 e6 cc f9 35 18 cf f8 27 a8 c0 61 ae ce e6 dd a5 3c 9f a5 71 23 6d f2 b9 a7 61 7b d7 3c ce 77 83 9c c7 e1 6d 0d 78 50 06 3f e4 69 16 65 98 85 d7 64 b9 34 b2 9c a4 41 c8 77 f9 35 1f d7 00 0f 0c e0 ad e9 b4 1f 67 d1 d5 28 cf b6 93 b4 ba f8 c8 6a d1 bb 20 e3 b5 a0 66 d1 17 bd ef d0 e4 01 1f f4 Data Ascii: kw0FNDJ)b"*IEvwHpp7Q<Hn9~9o?gI<~?;Y6rcl8<Jb3x#(nLcqs5'a<q#ma{<wmxP?ied4Aw5g(j f
2025-03-24 23:58:21 UTC	12561	IN	Data Raw: 6d d8 d3 60 99 10 15 83 de a5 68 51 59 ac c3 11 ac cc 06 8a e0 b1 ef 62 b5 88 9f bf be 44 99 e8 2a 6d 41 9d 99 5c b0 c1 60 a0 0f d7 7d 1d e3 cc 5e bf e4 b2 8d 8e e4 5a 66 4f 28 53 93 17 95 1e 70 6c 51 4b c9 53 1a 5a b9 67 47 51 2b 2a 18 b1 5b d6 63 fb 54 cd 0a 4a 84 8a a2 50 d7 b3 10 25 65 9e 7b 5b be 8d 12 a3 a8 8b c5 cd 95 9c 1e e9 22 74 f1 44 69 fa 8a bc 8c b8 11 09 eb 90 0b 67 06 85 24 c8 43 fb a7 eb 1c af 12 b2 29 ec 00 ab ab f6 3b b4 8b 85 a6 4a 3c e4 0f ed 8b cd db da e1 11 5a 64 42 f4 22 b8 e4 9b 0a 72 a9 ec 33 a9 6d 42 5b 9d c9 59 60 68 98 56 34 96 45 fe 0f a8 85 82 3b a0 64 0c 44 e4 9f de f7 7c 7b 78 85 d7 66 fa 1e c3 8c ba 54 e5 6d 9b 1c 6d c7 42 58 83 05 01 f7 49 2e 99 35 cb 8f 00 a4 8d 9c 9b fe 86 82 b9 3b 02 4a 92 bb 37 14 e3 0f 50 fa 33 57 Data Ascii: m`hQYbDmA\`}^ZfO(SplQKSZgGQ+[cTJP%e{["tDig$C);J<ZdB"r3mB[Y`hV4E;dD\|{xfTmmBXI.5;J7P3W
2025-03-24 23:58:21 UTC	16384	IN	Data Raw: e0 27 d1 3d ef 2d 42 21 7c 9a ba 11 be 18 20 f8 31 94 cf db 23 ea 71 46 75 a6 b7 bc b4 f4 1e c9 f7 ad 4d 7a 19 fa b7 f7 83 8f fc 7e 1a 45 28 de 2f 53 b8 44 48 7b 83 b6 15 75 e5 f3 d6 fe 21 9a 89 e6 e5 05 f7 c9 2d 09 2f 4d 9f 11 2a a3 c9 b9 f2 86 78 5b 62 20 7e 68 30 66 53 85 9d 41 de c4 92 8d a4 14 2d cd e7 1a 75 12 88 31 94 f1 75 52 cc fc 57 4a ea 08 4e 28 e4 86 bf 7d 78 ff ae 28 26 f2 bc 6b 41 c7 da 5a ea 0e a0 4b 20 65 ef 97 35 4a 9b 97 af 1f 27 61 9e ef 7d 09 1f 0e 59 22 01 68 17 0a 7d af 8c d1 41 ae 03 ee df 68 71 59 5f 30 1c e7 0e d4 70 07 0d da b6 82 29 09 29 d0 b7 8a 82 5f 1a ca 7c 84 86 4a a7 85 c3 3e cf e7 73 ff fb 74 13 ea 79 82 99 c1 af 79 53 5b 22 5e ca 79 0c 97 72 40 53 a3 c4 bb da 12 83 a5 7c a3 e9 52 6e 5d be 94 8b 3a 5a ca 47 1b 2f e5 80 Data Ascii: '=-B!\| 1#qFuMz~E(/SDH{u!-/M*x[b ~h0fSA-u1uRWJN(}x(&kAZK e5J'a}Y"h}AhqY_0p))_\|J>styyS["^yr@S\|Rn]:ZG/
2025-03-24 23:58:21 UTC	16384	IN	Data Raw: 33 12 4b ad 2e b3 5a 4b 43 cb c8 b0 54 ae 90 fe 0d d3 56 5e 41 dc aa 35 1a 4b e6 a7 75 26 c9 c9 37 75 87 8c 0e 99 fa 57 20 bb ad 45 d2 cf 07 1e d1 25 f6 8a e1 c2 b1 f2 11 67 45 9a 92 ac ad 49 97 cb 48 c4 6a 4e 83 8c e0 88 d8 09 fe d4 0e df b2 70 cc 72 de 06 2e 7e 02 41 30 e9 ed cb 5e c9 0b 8e 58 12 19 82 6d 3e e4 15 ad 28 33 c8 51 64 4a bd 2b ac 8b 8c 9b 41 99 cb 61 7a 16 85 d9 30 bd af f3 8d 92 05 92 1d 2c 7d f7 b3 ec 64 41 57 37 29 a5 29 15 8d 5d 16 aa b0 0f 29 eb 70 a2 06 eb ec c2 19 1c 00 0a 9f 82 e9 f7 8a b3 06 4a 9c 35 fe f7 e0 ff a6 f2 ed b7 29 2e 80 4d 19 dd eb 85 80 ff b8 17 46 f2 1a 85 aa c7 ee a6 f0 ed 87 eb b5 2f ef 8b 3b bc 9b be fe 4c 8c 29 52 f2 45 c4 5f 2e a0 52 5b 9a f7 68 01 33 4c 27 1a ec da 01 46 d3 fc 50 a1 cc af 6c 47 99 82 0b 07 13 Data Ascii: 3K.ZKCTV^A5Ku&7uW E%gEIHjNpr.~A0^Xm>(3QdJ+Aaz0,}dAW7))])pJ5).MF/;L)RE_.R[h3L'FPlG
2025-03-24 23:58:21 UTC	319	IN	Data Raw: 7b 78 de 67 6c 8d 46 d6 68 6c bd b3 2b 8d ad 15 92 e6 16 1b 5b a3 d1 35 1a 5b ef 48 24 4d 34 25 76 4d d2 57 4d 87 6b a3 cb 3a a7 bc d2 c6 d7 71 ba ad b0 f8 d6 41 4c 48 0a b9 1e 9d 0a 16 68 5a 74 5a 8e 30 02 12 a6 d4 3a 95 94 94 c0 f7 8c f2 3a 6e 86 28 bd c7 7c 37 a5 bb 3a 7d b2 f1 0d 4f d8 85 b9 20 ef 82 ba c0 2e 83 c5 02 46 2e 9e 5d 94 05 9e c0 74 a9 a6 6a 5c 17 29 1d a0 29 1f 56 6e a2 57 a0 72 48 4e be 8a d1 6d c3 77 23 99 e8 22 05 b6 27 6c ee e3 e9 8c 87 49 6e 6d a6 16 0c af bd 96 4b 96 a2 81 87 20 39 9a d0 f2 c9 59 7e 4f 24 30 7c b5 0c f7 95 73 1c d6 3b b6 04 f9 41 9b dc 0c 86 f4 67 26 69 6e 26 29 ac db 9f a9 29 76 44 f6 6d df 80 a9 90 6f d2 77 19 4f a8 db 12 ab d1 89 40 4a b1 a9 5e b7 23 4e 80 14 13 f7 a6 76 a0 ee 96 30 a1 d6 ba db 42 c7 2c ed ee dc Data Ascii: {xglFhl+[5[H$M4%vMWMk:qALHhZtZ0::n(\|7:}O .F.]tj\))VnWrHNmw#"'lInmK 9Y~O$0\|s;Ag&in&))vDmowO@J^#Nv0B,

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:18 UTC	669	OUT	GET /67e1f180d4f608878d14199c/ HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://05f18be492a04674a4715d258c134a69.foneads.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1 Sec-WebSocket-Key: I4il3aIq9SLR+w34laksvA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-03-24 23:58:20 UTC	718	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 24 Mar 2025 23:58:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 2f92ecc5-c934-4623-b414-33d9901f4800 x-ms-ests-server: 2.1.20329.5 - EUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:18 UTC	2075	OUT	POST /common/handlers/watson HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: keep-alive Content-Length: 14060 sec-ch-ua-platform: "Windows" hpgid: 1104 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" hpgact: 1800 canary: PAQABDgEAAABVrSpeuWamRam2jAF1XRQEq0spwZPyemps2-W5Iw-5YmsFKqKQX0lfBbtgpHyaMTmtdPhC-QM178xc3gYJOz2JTn9A9BDkwhg5DadcuR5qHV0OkmkVbv8EhpmQXfGcU5Q7thGksZTo4XskNfdXDnJzel6kaLdKXFdSagKMPZZ3CWowQteZ3YwSmgn2PCOAuSDafuOumjwblKcL-m4nPcRaZbJiacre3VWyMsePm4zp2SAA sec-ch-ua-mobile: ?0 client-request-id: 7284660c-0043-454a-aa81-852512bd10b1 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json Content-Type: application/json; charset=UTF-8 Origin: https://05f18be492a04674a4715d258c134a69.foneads.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F6bb2d8867f5d424f935e0d8493ee7e6b.foneads.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638784574804944548.NTQ3YWI4YmMtNTkyYy00NGU3LWFiZDYtNzg3NTM2Yzc5MjZiM2FiMTkyNzYtNGYyNS00MzUyLWFkOWQtOTI2ZWI4NjlkMzM5&ui_locales=en-US&mkt=en-US&client-request-id=7284660c-0043-454a-aa81-852512bd10b1&state=aVn8UytFuvTfh8QU9eZSoIGJrjsLNaNN6ODgbDfb8IghCBTO15TDep2NUaD9YO77eGtb45NfeJPLWZTF-vxMvUC6IoTGfFQZJZIRp3CzHbwZkyY3YGOryZ7et4vveAyNSbnDN9zPTTFBfzuaZa-Vvj3TxonwBfDc8Em4dLGfODj5gCiVm0nSUuuiiNBL5RPifzHeZNJ-aoR9UYgjzTDK4y7A6rply2PjZbYKWj8DFHxaWsyzkDka8jNx8GfxY-R1VPf1HflRk8zEnHaCYZBaRA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-03-24 23:58:18 UTC	14060	OUT	Data Raw: 7b 22 65 63 22 3a 22 54 79 70 65 45 72 72 6f 72 3a 54 79 70 65 45 72 72 6f 72 3a 20 43 61 6e 6e 6f 74 20 72 65 61 64 20 70 72 6f 70 65 72 74 69 65 73 20 6f 66 20 6e 75 6c 6c 20 28 72 65 61 64 69 6e 67 20 27 74 6f 70 69 63 27 29 22 2c 22 77 65 63 22 3a 22 33 34 22 2c 22 69 64 78 22 3a 31 2c 22 70 6e 22 3a 22 43 6f 6e 76 65 72 67 65 64 53 69 67 6e 49 6e 22 2c 22 73 63 22 3a 31 30 31 33 2c 22 68 70 67 22 3a 31 31 30 34 2c 22 6d 73 67 22 3a 22 55 6e 63 61 75 67 68 74 20 54 79 70 65 45 72 72 6f 72 3a 20 43 61 6e 6e 6f 74 20 72 65 61 64 20 70 72 6f 70 65 72 74 69 65 73 20 6f 66 20 6e 75 6c 6c 20 28 72 65 61 64 69 6e 67 20 27 74 6f 70 69 63 27 29 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 30 35 66 31 38 62 65 34 39 32 61 30 34 36 37 34 61 34 37 31 35 64 Data Ascii: {"ec":"TypeError:TypeError: Cannot read properties of null (reading 'topic')","wec":"34","idx":1,"pn":"ConvergedSignIn","sc":1013,"hpg":1104,"msg":"Uncaught TypeError: Cannot read properties of null (reading 'topic')","url":"https://05f18be492a04674a4715d
2025-03-24 23:58:20 UTC	830	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 265 Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: 7284660c-0043-454a-aa81-852512bd10b1 x-ms-request-id: d7fa5972-7ec5-482d-ad9d-c81a97738600 x-ms-ests-server: 2.1.20329.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-03-24 23:58:20 UTC	265	IN	Data Raw: 7b 22 61 70 69 43 61 6e 61 72 79 22 3a 22 50 41 51 41 42 44 67 45 41 41 41 42 56 72 53 70 65 75 57 61 6d 52 61 6d 32 6a 41 46 31 58 52 51 45 32 58 4a 74 4e 48 55 7a 61 4c 66 35 36 66 66 5f 4a 39 4d 75 54 5a 4c 68 4e 6d 41 65 72 51 54 56 34 63 66 2d 4d 59 41 6d 44 52 56 47 31 44 6a 2d 42 79 67 4b 46 58 35 5f 47 6e 77 71 50 2d 72 30 31 77 48 33 52 30 37 5a 46 6e 52 68 63 59 68 66 71 56 31 62 5a 4f 31 51 33 6b 2d 4a 63 39 32 41 4a 75 4b 67 63 37 4a 61 45 6c 35 6a 69 6a 76 59 6f 53 59 50 73 64 6f 44 6f 7a 57 50 6f 65 54 6a 45 54 75 42 5f 57 66 2d 5f 70 59 71 7a 35 74 6e 77 51 70 4d 73 32 36 31 6d 5f 59 5f 67 58 52 73 31 5a 73 30 50 67 63 30 64 35 4f 4a 51 68 4c 70 4a 67 69 75 66 68 43 49 73 39 37 58 56 61 58 51 45 37 64 32 5f 58 63 5a 71 5a 55 77 4e 59 46 6e Data Ascii: {"apiCanary":"PAQABDgEAAABVrSpeuWamRam2jAF1XRQE2XJtNHUzaLf56ff_J9MuTZLhNmAerQTV4cf-MYAmDRVG1Dj-BygKFX5_GnwqP-r01wH3R07ZFnRhcYhfqV1bZO1Q3k-Jc92AJuKgc7JaEl5jijvYoSYPsdoDozWPoeTjETuB_Wf-_pYqz5tnwQpMs261m_Y_gXRs1Zs0Pgc0d5OJQhLpJgiufhCIs97XVaXQE7d2_XcZqZUwNYFn

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:21 UTC	516	OUT	GET /common/handlers/watson HTTP/1.1 Host: 05f18be492a04674a4715d258c134a69.foneads.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-03-24 23:58:22 UTC	750	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:22 GMT Content-Type: application/json; charset=utf-8 Content-Length: 164 Connection: close cache-control: no-store, no-cache pragma: no-cache p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: fff7b7d4-d4f4-40de-b5e1-d67eb32e6000 x-ms-ests-server: 2.1.20329.5 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://80cb199b82b240e9b51f5724bccf8481.foneads.com/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-03-24 23:58:22 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 62 38 30 65 38 35 31 37 2d 64 66 65 39 2d 34 36 66 61 2d 62 32 32 61 2d 39 32 37 62 36 30 30 32 62 34 64 63 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 33 2d 32 34 20 32 33 3a 35 38 3a 32 32 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"b80e8517-dfe9-46fa-b22a-927b6002b4dc","timestamp":"2025-03-24 23:58:22Z","message":"AADSTS900561"}}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 23:58:22 UTC	745	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: f5f83dbe6c1248eba35aa1cb7a621d4c.foneads.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://05f18be492a04674a4715d258c134a69.foneads.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NuXSTwzpH=67e1f180d4f608878d14199c
2025-03-24 23:58:24 UTC	759	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Mar 2025 23:58:23 GMT Content-Type: image/x-icon Content-Length: 20428 Connection: close cache-control: public, max-age=31536000 last-modified: Sun, 18 Oct 2020 03:02:03 GMT etag: 0x8D8731230C851A6 x-ms-request-id: 5d11a028-401e-0069-5401-9cc5b7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250324T235823Z-15494cb576blckhkhC1ATLnh700000000c8000000000d9h7 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes
2025-03-24 23:58:24 UTC	15625	IN	Data Raw: 00 00 01 00 06 00 10 10 00 00 00 00 20 00 4c 02 00 00 66 00 00 00 18 18 00 00 00 00 20 00 c4 04 00 00 b2 02 00 00 20 20 00 00 00 00 20 00 93 08 00 00 76 07 00 00 30 30 00 00 00 00 20 00 4f 13 00 00 09 10 00 00 40 40 00 00 00 00 20 00 41 22 00 00 58 23 00 00 80 80 00 00 00 00 20 00 33 0a 00 00 99 45 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 02 13 49 44 41 54 78 9c 2d 92 4b 8e 1b 57 0c 45 cf e5 7b 55 25 a9 d5 56 da 08 90 79 56 94 5d 04 c8 2c 48 56 90 15 78 3b d9 8a a7 86 e1 41 6c 23 9d 6a 7d 4a af 1e 6f 06 aa 01 41 80 04 81 0b 9e a3 f9 97 9f 17 9b 19 f1 04 ae a0 c5 26 f6 93 86 e1 5b f9 f0 fb 5f 1f db 4f a9 3f 6f 57 a7 4d 46 60 9b 2b 90 88 5a 6d 23 a9 d8 58 d2 62 50 c8 e7 9e 3a 0e 70 47 4c Data Ascii: Lf v00 O@@ A"X# 3EPNGIHDRaIDATx-KWE{U%VyV],HVx;Al#j}JoA&[_O?oWMF`+Zm#XbP:pGL
2025-03-24 23:58:24 UTC	4803	IN	Data Raw: c3 18 70 84 15 fb 80 33 60 53 29 c5 89 cd 36 b0 c4 fd cf c8 a9 a3 ae 8f 33 9a 7c 99 bc 7a 0d 74 81 60 b8 37 ac 66 df a5 1a ec 82 3f 4e 4e 15 c2 43 88 3f 8d fb 60 3d 8c 6f 54 03 45 83 f4 12 99 0f 81 93 84 a8 a4 55 21 54 33 44 ef 60 95 33 2e 37 c7 e6 85 bc ee 16 3c 09 5c 24 71 96 6d fe 01 81 86 8e 8e be 05 df e2 2c 89 7c 11 63 44 c3 0e ce 01 f0 2c 99 03 12 1f a2 3c 4e a1 5e 07 46 ef 60 73 a6 c0 00 58 30 40 e9 a7 d2 47 c0 3d 74 78 7f 6a a9 75 f0 01 e3 c9 3f 44 75 40 d7 3a ab 43 03 fd 12 d8 08 8d 7d 1f a6 19 9f c0 1d aa 66 c2 68 33 22 bc 08 cc a8 9b 48 c9 85 f1 b6 92 56 2f 61 65 86 0a 84 aa 02 94 6e f1 02 a3 89 52 da 5f 01 47 a9 ab 0a 6e 29 a9 84 6b 24 0a 50 13 f8 26 1d a7 39 20 af cb e2 25 99 37 08 28 63 be 45 66 1b e1 90 29 e7 d8 e0 0c 4e 66 c0 6f 51 73 8d Data Ascii: p3`S)63\|zt`7f?NNC?`=oTEU!T3D`3.7<\$qm,\|cD,<N^F`sX0@G=txju?Du@:C}fh3"HV/aenR_Gn)k$P&9 %7(cEf)NfoQs