Edit tour

Windows Analysis Report
https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h

Overview

General Information

Sample URL:	https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h
Analysis ID:	1650520
Infos:

Detection

Score:	2
Range:	0 - 100
Confidence:	100%

Signatures

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTTP GET or POST without a user agent

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 5372 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

chrome.exe (PID: 4884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,9676452063610803519,10853376293006389434,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2104 /prefetch:11 MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

chrome.exe (PID: 6596 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h" MD5: DBE43C1D0092437B88CFF7BD9ABC336C)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i

HTTP Parser: Number of links: 0

HTTP Parser: <input type="password" .../> found but no <form action="...

HTTP Parser: <input type="password" .../> found

Source: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i	HTTP Parser: No <meta name="author".. found
Source: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i	HTTP Parser: No <meta name="author".. found
Source: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i	HTTP Parser: No <meta name="author".. found
Source: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i	HTTP Parser: No <meta name="author".. found

Source: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i	HTTP Parser: No <meta name="copyright".. found
Source: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i	HTTP Parser: No <meta name="copyright".. found
Source: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i	HTTP Parser: No <meta name="copyright".. found
Source: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.250.81.228:443 -> 192.168.2.24:60838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.139.111.117:443 -> 192.168.2.24:60839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.139.111.117:443 -> 192.168.2.24:60840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.139.110.115:443 -> 192.168.2.24:60841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.8.230:443 -> 192.168.2.24:60850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.36.213.229:443 -> 192.168.2.24:60851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.211.31.115:443 -> 192.168.2.24:60858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.211.31.115:443 -> 192.168.2.24:60859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60871 version: TLS 1.2

Source: global traffic

HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743101030065&w=0&anoncknm=al_app_anon&NoResponseBody=true HTTP/1.1Accept-Encoding: gzip, deflateContent-Length: 3656Content-Type: application/json; charset=UTF-8Host: browser.events.data.msn.cnConnection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.122.66
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /s/146LCmZky3h5z20p7FBi1URTA8h HTTP/1.1Host: protect-us.mimecast.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIlqHLAQiKo8sBCIWgzQEI/aXOAQiB1s4BCPzbzgEIxeDOAQiu5M4BCN/kzgEIjOXOARiW5c4BSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/assets/entypo/font/entypo.css HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/assets/font-awesome/css/font-awesome.css HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/assets/mimecast-icons/css/mimecast-icons.css HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/login/cache.647aa7b26e87d650a310e593a0edd3e2.login-lib.js HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/login/cache.fbcb25980edc88e8c170bab371b118d9.login.js HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/galindo.js HTTP/1.1Host: static.srcspot.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://rsm.login-us.mimecast.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /agent/static/0600cd7b-e6b2-4ba9-4249-ab1342c3631b/pendo.js HTTP/1.1Host: cdn.pendo.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://rsm.login-us.mimecast.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/login/assets/languages/en.json?ver=1.16.1 HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, /sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/login/app-version.jsp HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, /sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/rest/branding/get-branding-item/XHEvsJVPT_EZoLeMOMeG5weyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiNGJ3cURMVnF3ZHVEekVvdyJ9.1kh7WKb40TgeYxkLGNv5ule9WZ3k1oH_.FZzBolsUTrqulVWX.YiMBEE9mOE80jIG0UY77oEynpbMlOaXcisP_rHZADKcm9lMCSqYyeJDBe2bVGDuBwOiJkqUVlDaajiyjpq35eJ3dk-7fEZnuJskOOdrnjCz5T_11_bArxLzcXNxMrG8rKaON3Es66uMV-WxYkD6jZLTYM9X5zoyLTxfLOESKE8mxXsB9VCrscmzzRBDBv6EZt-ROVd5jf9aB1_3hE8tDijIUNoqmSzwJqtlOdK2Hyo-5p9tZSSGrtkg_PPxBHfroLY-_eocn653LuhhrkT4Qommz5yFJ7UsSGUcdPpbrgotgbk2kqED-xzemr33WyluyD7LRDI2f15IE28fvL2ZKsJAeCrFaTcCnKkrcjJCdPBtB6JDegctmI2I_vVj7fLnI-HXl4YlBCfm-KDTlhMxJVkm3M-00UeKtQigxDiRKyLSaR10vtGlw6MXZKSLlDnVBtkYXYSuGtUuw0Nf86bZLQJQztsvYgr0tLfNHEVaDCFD9zAuUBVZnyGgXJHO8Hc8RoMXEh8I_IaOuH-mdVSw8rJ9-6SJXb5k43mPMyAdhw3sGBbxusjQKKFTiBqSDY_UL7owuqMLcalmY3YBdq4B9.QTubUwtzUgczdyK8fjx-gA?tkn=rsm HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/assets/font-awesome/fonts/fontawesome-webfont.woff2?v=4.3.0 HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-aliveOrigin: https://rsm.login-us.mimecast.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://rsm.login-us.mimecast.com/u/assets/font-awesome/css/font-awesome.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/login/app-version.jsp HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/login/assets/languages/en.json?ver=1.16.1 HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/rest/branding/get-branding-item/XHEvsJVPT_EZoLeMOMeG5weyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiNGJ3cURMVnF3ZHVEekVvdyJ9.1kh7WKb40TgeYxkLGNv5ule9WZ3k1oH_.FZzBolsUTrqulVWX.YiMBEE9mOE80jIG0UY77oEynpbMlOaXcisP_rHZADKcm9lMCSqYyeJDBe2bVGDuBwOiJkqUVlDaajiyjpq35eJ3dk-7fEZnuJskOOdrnjCz5T_11_bArxLzcXNxMrG8rKaON3Es66uMV-WxYkD6jZLTYM9X5zoyLTxfLOESKE8mxXsB9VCrscmzzRBDBv6EZt-ROVd5jf9aB1_3hE8tDijIUNoqmSzwJqtlOdK2Hyo-5p9tZSSGrtkg_PPxBHfroLY-_eocn653LuhhrkT4Qommz5yFJ7UsSGUcdPpbrgotgbk2kqED-xzemr33WyluyD7LRDI2f15IE28fvL2ZKsJAeCrFaTcCnKkrcjJCdPBtB6JDegctmI2I_vVj7fLnI-HXl4YlBCfm-KDTlhMxJVkm3M-00UeKtQigxDiRKyLSaR10vtGlw6MXZKSLlDnVBtkYXYSuGtUuw0Nf86bZLQJQztsvYgr0tLfNHEVaDCFD9zAuUBVZnyGgXJHO8Hc8RoMXEh8I_IaOuH-mdVSw8rJ9-6SJXb5k43mPMyAdhw3sGBbxusjQKKFTiBqSDY_UL7owuqMLcalmY3YBdq4B9.QTubUwtzUgczdyK8fjx-gA?tkn=rsm HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/rest/branding/get-branding-item/m-NHsBWUn2FkP75AbBfvJgeyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiUGdiWUxmb1dKX3IzekpaMyJ9.SRrXMDqzliuYRzcQnlBLYHuRjaCRsNpp.GK8LKFYWHnmCG6F-.FA9MnLU1ka3gMv_Jxa6IrCuLjY7rmhVZhrROtJPkOloN3fWPhI7Dc8jcvoyeBdmbJ_rQVUZCRFLkTXQkPfVz0a17CsNBe2DB3KH_XObdaRQ72jdTKtX-XrznQG2uE_vuk3HdR9i4MdaLvlwwK5v3homKCSoQL8TPogsKZCJ5Ukd174trpoNI4V0mThlRMpa567sN6F_bPa_OjcuumLjEHFGbxbmSUIg54D_pnFU0SVgm2TdQiBKtNl3IEPDaYpwfVNYihJClZIJwd1zamfb3GWqCcwcTa0ZNCWFBH1EYGKkMWvyjKNTjqCL67Vfc33FOvgrMxucLZ3JKksW9HH-mYOPw7d4FQLwfFjqjeWDxLE2mi6NnrVC8C1haV9pCPSnM4xuZHpn4ClMTkYgBJi3skodd6XjdjYD79pX9pyYN4i0lwt34zY7oq0lwVpsGn2ggwvbB7stQROP91JB6B7DX-FH8V700EWkgst_DvyU7MqWETbn1wI_AtCQofFogz-9Ng5BvYcGuz_ZHLA1oejotWLaVwG6VXUMFDErhRFHPkXjkfXF6VdaNQyzFgclxOWGwaA.Jxy9xzFgiE1nZEawEmi6tQ?tkn=rsm HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/ptm.gif/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?v=2.269.1_prod&ct=1743101048724&jzb=eJztU02PozgU_C-stKcQPhOgpdEqSScdGsgn-erVChkwAQI22IaEjPq_j9O9M9rLznUu4xOvilc8nqv-_iqwroLCk1BCBoSeEBJ8pZAELCs5qhi6psiKrJuGbPaENqMZwyTIYt4QrKaL52XgBxY5jde-5d03BhdoSMHJlLGKPkkSoWW_wOcMiQ3tl1wzApT1I1xKjfSBS3-dGfhCYdQQ-Ce7oC9av755zjCZWGR0wrNLXCUdeq4hWbhmPb6dquO18sAyTOfoJrauouq2gwbrDhQZsSscgkwr74O5W1jbeuoU9XBq6KaXNAYV6b51dfoqV2_bZ3SMnBWKGqzNwNLW3Xzm7slofD2GWf-6rTGcv8ibXNmznVEYqKXV6A8pSgE6Q7EClF4xiSV7j-v6dbia-kf3NvBcy8d5flv4gejUk312QuUJJEoQW8symJkotu1uAucQyKMk3HlmOn5F4lEBC6ed3-BVjrZwH69fVkEmOifkvFwu0ztWHVfcT7O3U-7v7HVxn5eXzsnbXF42YT6OX_C6s-vJuqYZdc_TlRXjO8L3NNm6CVx0mjtIzbT2rU27hKai7GR1sMFOELuVeMfus7dvWTZa7Ci9hTczr3ULHqByPL-Zfr4Sh5PXQ9iuOTken-z5eua1l05fis4kH6gHOeO3XRFcUeHp63drPB5_5o6Cb7AB54fhIAp2W-G9J4Aowg1ivJUXFSAQsdF_oRiwx_uqIcmapPI_4DotJDTD6AH31aHVVwI-SfxQ-xTwQWjzMVBTFD2BfRbC0XWbLfOtBYQ-PQw3XCchoIQfJBlDT0-bTB6dV91xeeAkhfTxkQ9avePDcDqa785ySgeJ_kHXDUQRn03muekY5IswNeu99yNTBQbxzzKlaL8z9TtT_5uph33-NY0uG0pftb4f09R_kdWVH1Y3NP39n2_I_xLb HTTP/1.1Host: app.pendo.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://rsm.login-us.mimecast.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/guide.js/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?id=17&jzb=eJx9Uk2PokAQ_S9ssqdBPvyCSSYbUVSkEVFkZC6kgVYboRtoQGAz_32YPWz2tLeq915Vpareb67BDFe0NGLulQsO-n5lB26glr7muKrVH-fcC1eX6UDeqypnr4JQsmyU0hsmfM1GGc5QBFk1imgm1MIfXPh1q-AbQ1Fdop_Vg7yNR0VrmbPrUi0XPl0_4vzakVWByj1QCq3188szt6Ad3rek5RsgyRPDJFOngykujZyGEI-zfroFqXoqdDMtZvp8oljXes545jVgwnZi_nFakUtkHkhU0_Ea2sYEJGvglQvteQnx6HkqKNpuxGMiedV5ns5Jw_LFDyG6Q3JDfA4Ze9IyFgyPFsVudtDdC2inFlBdmiTt3g14s1h62CeZD69SEKt2FqwVEhtGt0RbBMXFNTxbyl3bEf4iwb3ZbFv0FKMT8mJncwgwb_rE3Dweek9lE_Cejj_8xD0bTtpvs0dnJk0i2nWYaPGGOp1RLJ2CYQZu-kGNaU9of7-ewBXtuzGY3pV74arHxkaKJJ1FeXqkZhCDnO8pWFleU-HF_sxYG7ZKUkxU9I6ky-1DcZMDP1vu3sPGGUhN842ts7aaRzexeXOZTOV3EQ_fzlAFY1hB7vWvOb5D_B-DpMMRa3hDgwKR4HziPl84GEW0JtVQOiQ5LBGpFv9Cw4hvvTwXxLEgD0sMfRpUMkzJNzySZ-pICvKSxtzn5xe5-ORX&v=2.269.1_prod&ct=1743101048727 HTTP/1.1Host: app.pendo.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://rsm.login-us.mimecast.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/guide.gif/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1743101048728&v=2.269.1_prod HTTP/1.1Host: app.pendo.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://rsm.login-us.mimecast.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/proxy/api/login/get-password-rules HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/rest/branding/get-branding-item/m-NHsBWUn2FkP75AbBfvJgeyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiUGdiWUxmb1dKX3IzekpaMyJ9.SRrXMDqzliuYRzcQnlBLYHuRjaCRsNpp.GK8LKFYWHnmCG6F-.FA9MnLU1ka3gMv_Jxa6IrCuLjY7rmhVZhrROtJPkOloN3fWPhI7Dc8jcvoyeBdmbJ_rQVUZCRFLkTXQkPfVz0a17CsNBe2DB3KH_XObdaRQ72jdTKtX-XrznQG2uE_vuk3HdR9i4MdaLvlwwK5v3homKCSoQL8TPogsKZCJ5Ukd174trpoNI4V0mThlRMpa567sN6F_bPa_OjcuumLjEHFGbxbmSUIg54D_pnFU0SVgm2TdQiBKtNl3IEPDaYpwfVNYihJClZIJwd1zamfb3GWqCcwcTa0ZNCWFBH1EYGKkMWvyjKNTjqCL67Vfc33FOvgrMxucLZ3JKksW9HH-mYOPw7d4FQLwfFjqjeWDxLE2mi6NnrVC8C1haV9pCPSnM4xuZHpn4ClMTkYgBJi3skodd6XjdjYD79pX9pyYN4i0lwt34zY7oq0lwVpsGn2ggwvbB7stQROP91JB6B7DX-FH8V700EWkgst_DvyU7MqWETbn1wI_AtCQofFogz-9Ng5BvYcGuz_ZHLA1oejotWLaVwG6VXUMFDErhRFHPkXjkfXF6VdaNQyzFgclxOWGwaA.Jxy9xzFgiE1nZEawEmi6tQ?tkn=rsm HTTP/1.1Host: rsm.login-us.mimecast.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/guide.gif/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1743101048728&v=2.269.1_prod HTTP/1.1Host: app.pendo.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/ptm.gif/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?v=2.269.1_prod&ct=1743101048724&jzb=eJztU02PozgU_C-stKcQPhOgpdEqSScdGsgn-erVChkwAQI22IaEjPq_j9O9M9rLznUu4xOvilc8nqv-_iqwroLCk1BCBoSeEBJ8pZAELCs5qhi6psiKrJuGbPaENqMZwyTIYt4QrKaL52XgBxY5jde-5d03BhdoSMHJlLGKPkkSoWW_wOcMiQ3tl1wzApT1I1xKjfSBS3-dGfhCYdQQ-Ce7oC9av755zjCZWGR0wrNLXCUdeq4hWbhmPb6dquO18sAyTOfoJrauouq2gwbrDhQZsSscgkwr74O5W1jbeuoU9XBq6KaXNAYV6b51dfoqV2_bZ3SMnBWKGqzNwNLW3Xzm7slofD2GWf-6rTGcv8ibXNmznVEYqKXV6A8pSgE6Q7EClF4xiSV7j-v6dbia-kf3NvBcy8d5flv4gejUk312QuUJJEoQW8symJkotu1uAucQyKMk3HlmOn5F4lEBC6ed3-BVjrZwH69fVkEmOifkvFwu0ztWHVfcT7O3U-7v7HVxn5eXzsnbXF42YT6OX_C6s-vJuqYZdc_TlRXjO8L3NNm6CVx0mjtIzbT2rU27hKai7GR1sMFOELuVeMfus7dvWTZa7Ci9hTczr3ULHqByPL-Zfr4Sh5PXQ9iuOTken-z5eua1l05fis4kH6gHOeO3XRFcUeHp63drPB5_5o6Cb7AB54fhIAp2W-G9J4Aowg1ivJUXFSAQsdF_oRiwx_uqIcmapPI_4DotJDTD6AH31aHVVwI-SfxQ-xTwQWjzMVBTFD2BfRbC0XWbLfOtBYQ-PQw3XCchoIQfJBlDT0-bTB6dV91xeeAkhfTxkQ9avePDcDqa785ySgeJ_kHXDUQRn03muekY5IswNeu99yNTBQbxzzKlaL8z9TtT_5uph33-NY0uG0pftb4f09R_kdWVH1Y3NP39n2_I_xLb HTTP/1.1Host: app.pendo.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: protect-us.mimecast.com
Source: global traffic	DNS traffic detected: DNS query: rsm.login-us.mimecast.com
Source: global traffic	DNS traffic detected: DNS query: static.srcspot.com
Source: global traffic	DNS traffic detected: DNS query: cdn.pendo.io
Source: global traffic	DNS traffic detected: DNS query: app.pendo.io
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com

Source: unknown

Source: chromecache_103.1.dr	String found in binary or memory: http://daneden.me/animate
Source: chromecache_101.1.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_101.1.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_103.1.dr	String found in binary or memory: http://janstevens.github.io/angular-growl-2
Source: chromecache_103.1.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: chromecache_103.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_103.1.dr	String found in binary or memory: http://www.opensource.org/licenses/MIT
Source: chromecache_85.1.dr	String found in binary or memory: https://agent.pendo.io/licenses
Source: chromecache_85.1.dr	String found in binary or memory: https://api.feedback.us.pendo.io
Source: chromecache_82.1.dr	String found in binary or memory: https://app.dmarcanalyzer.com/register?utm_medium=pendo&utm_source=adcon&utm_campaign=7013l000001JNB
Source: chromecache_103.1.dr	String found in binary or memory: https://cdn.pendo.io/agent/static/
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/article/cybergraph-cybergraph-1-0-configuration-settings
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/article/cybergraph-cybergraph-2-0-configuration-settings
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/article/email-security-cloud-gateway-configuring-url-protection
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/article/email-security-cloud-gateway-continuity-guides
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/article/email-security-cloud-gateway-secure-messaging-getting-start
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/article/email-security-cloud-gateway-targeted-threat-protection-int
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/article/email-security-cloud-gateway-ttp-attachment-protect-configu
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/article/email-security-cloud-gateway-ttp-impersonation-protection-g
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/article/end-user-applications-large-file-send-getting-started
Source: chromecache_82.1.dr	String found in binary or memory: https://community.mimecast.com/s/education-free-courses?utm_medium=pendo&utm_source=adcon&utm_campai
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/knowledge-hub-api-and-integrations
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/knowledge-hub-awareness-training
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/knowledge-hub-brand-exploit-protect
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/knowledge-hub-case-review-application
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/knowledge-hub-dmarc-analyzer
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/knowledge-hub-email-security-cg
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/knowledge-hub-supervision
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/knowledge-hub-sync-and-recover
Source: chromecache_108.1.dr	String found in binary or memory: https://community.mimecast.com/s/knowledge-hub-web-security
Source: chromecache_82.1.dr	String found in binary or memory: https://community.mimecast.com/s/mimecast-education?utm_medium=pendo&utm_source=adcon&utm_campaign=7
Source: chromecache_85.1.dr	String found in binary or memory: https://feedback.us.pendo.io
Source: chromecache_103.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_103.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_103.1.dr	String found in binary or memory: https://github.com/dbtek/angular-aside
Source: chromecache_103.1.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: chromecache_103.1.dr	String found in binary or memory: https://github.com/mgcrea/angular-motion
Source: chromecache_103.1.dr	String found in binary or memory: https://github.com/nickpettit/glide
Source: chromecache_103.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_82.1.dr	String found in binary or memory: https://info.mimecast.com/AT-IEP-Demo.html?utm_medium=pendo&utm_source=adcon&utm_campaign=7013l00000
Source: chromecache_82.1.dr	String found in binary or memory: https://info.mimecast.com/Continuity-and-Recovery-Demo-.html?utm_medium=pendo&utm_source=adcon&utm_c
Source: chromecache_82.1.dr	String found in binary or memory: https://info.mimecast.com/Safe_Phish_Demo.html?utm_medium=pendo&utm_source=adcon&utm_campaign=7013l0
Source: chromecache_82.1.dr	String found in binary or memory: https://info.mimecast.com/SolutionFrameworkRequest?utm_medium=pendo&utm_source=adcon&utm_campaign=70
Source: chromecache_82.1.dr	String found in binary or memory: https://info.mimecast.com/Web-Security-Service.html?utm_medium=pendo&utm_source=adcon&utm_campaign=7
Source: chromecache_82.1.dr	String found in binary or memory: https://info.mimecast.com/security-awareness-remote-resources.html?utm_medium=pendo&utm_source=adcon
Source: chromecache_82.1.dr	String found in binary or memory: https://login-alpha.mimecast.com/administration/app/#/l/accountassessment
Source: chromecache_85.1.dr	String found in binary or memory: https://pendo-io-static.storage.googleapis.com/agent/static/0600cd7b-e6b2-4ba9-4249-ab1342c3631b/pen
Source: chromecache_85.1.dr	String found in binary or memory: https://pendo-static-5707797427912704.storage.googleapis.com
Source: chromecache_86.1.dr	String found in binary or memory: https://play.vidyard.com/LE2oaRu3qApZkgaw4JjwZM.jpg
Source: chromecache_86.1.dr	String found in binary or memory: https://play.vidyard.com/embed/v4.js
Source: chromecache_103.1.dr	String found in binary or memory: https://static.srcspot.com/libs/galindo.js
Source: chromecache_103.1.dr	String found in binary or memory: https://summernote.org
Source: chromecache_103.1.dr	String found in binary or memory: https://us-api.mimecast.com
Source: chromecache_82.1.dr	String found in binary or memory: https://www.mimecast.com/coronavirus/?utm_medium=pendo&utm_source=adcon&utm_campaign=7013l000001JNBI
Source: chromecache_82.1.dr	String found in binary or memory: https://www.mimecast.com/state-of-email-security/download-hub/?utm_medium=pendo&utm_source=adcon&utm

Source: unknown	Network traffic detected: HTTP traffic on port 60848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60817
Source: unknown	Network traffic detected: HTTP traffic on port 60854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60850
Source: unknown	Network traffic detected: HTTP traffic on port 60838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60859
Source: unknown	Network traffic detected: HTTP traffic on port 60867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60858
Source: unknown	Network traffic detected: HTTP traffic on port 60844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60852
Source: unknown	Network traffic detected: HTTP traffic on port 60851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60904
Source: unknown	Network traffic detected: HTTP traffic on port 60839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60860
Source: unknown	Network traffic detected: HTTP traffic on port 60841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60863
Source: unknown	Network traffic detected: HTTP traffic on port 60871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60838
Source: unknown	Network traffic detected: HTTP traffic on port 60817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60871
Source: unknown	Network traffic detected: HTTP traffic on port 60861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60870
Source: unknown	Network traffic detected: HTTP traffic on port 60842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60840
Source: unknown	Network traffic detected: HTTP traffic on port 60860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60847
Source: unknown	Network traffic detected: HTTP traffic on port 60904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60842
Source: unknown	Network traffic detected: HTTP traffic on port 60868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60841

Source: unknown	HTTPS traffic detected: 142.250.81.228:443 -> 192.168.2.24:60838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.139.111.117:443 -> 192.168.2.24:60839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.139.111.117:443 -> 192.168.2.24:60840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.139.110.115:443 -> 192.168.2.24:60841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.8.230:443 -> 192.168.2.24:60850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.36.213.229:443 -> 192.168.2.24:60851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.211.31.115:443 -> 192.168.2.24:60858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.211.31.115:443 -> 192.168.2.24:60859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.107.204.85:443 -> 192.168.2.24:60871 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5372_1361663383

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5372_1361663383

Jump to behavior

Source: classification engine

Classification label: clean2.win@21/79@25/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,9676452063610803519,10853376293006389434,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2104 /prefetch:11
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,9676452063610803519,10853376293006389434,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2104 /prefetch:11	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://rsm.login-us.mimecast.com/u/rest/branding/get-branding-item/XHEvsJVPT_EZoLeMOMeG5weyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiNGJ3cURMVnF3ZHVEekVvdyJ9.1kh7WKb40TgeYxkLGNv5ule9WZ3k1oH_.FZzBolsUTrqulVWX.YiMBEE9mOE80jIG0UY77oEynpbMlOaXcisP_rHZADKcm9lMCSqYyeJDBe2bVGDuBwOiJkqUVlDaajiyjpq35eJ3dk-7fEZnuJskOOdrnjCz5T_11_bArxLzcXNxMrG8rKaON3Es66uMV-WxYkD6jZLTYM9X5zoyLTxfLOESKE8mxXsB9VCrscmzzRBDBv6EZt-ROVd5jf9aB1_3hE8tDijIUNoqmSzwJqtlOdK2Hyo-5p9tZSSGrtkg_PPxBHfroLY-_eocn653LuhhrkT4Qommz5yFJ7UsSGUcdPpbrgotgbk2kqED-xzemr33WyluyD7LRDI2f15IE28fvL2ZKsJAeCrFaTcCnKkrcjJCdPBtB6JDegctmI2I_vVj7fLnI-HXl4YlBCfm-KDTlhMxJVkm3M-00UeKtQigxDiRKyLSaR10vtGlw6MXZKSLlDnVBtkYXYSuGtUuw0Nf86bZLQJQztsvYgr0tLfNHEVaDCFD9zAuUBVZnyGgXJHO8Hc8RoMXEh8I_IaOuH-mdVSw8rJ9-6SJXb5k43mPMyAdhw3sGBbxusjQKKFTiBqSDY_UL7owuqMLcalmY3YBdq4B9.QTubUwtzUgczdyK8fjx-gA?tkn=rsm	0%	Avira URL Cloud	safe
https://info.mimecast.com/Safe_Phish_Demo.html?utm_medium=pendo&utm_source=adcon&utm_campaign=7013l0	0%	Avira URL Cloud	safe
https://info.mimecast.com/AT-IEP-Demo.html?utm_medium=pendo&utm_source=adcon&utm_campaign=7013l00000	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/proxy/api/login/get-password-rules	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/assets/font-awesome/css/font-awesome.css	0%	Avira URL Cloud	safe
https://info.mimecast.com/security-awareness-remote-resources.html?utm_medium=pendo&utm_source=adcon	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/assets/entypo/font/entypo.css	0%	Avira URL Cloud	safe
https://info.mimecast.com/SolutionFrameworkRequest?utm_medium=pendo&utm_source=adcon&utm_campaign=70	0%	Avira URL Cloud	safe
https://login-alpha.mimecast.com/administration/app/#/l/accountassessment	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/login/cache.fbcb25980edc88e8c170bab371b118d9.login.js	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/login/app-version.jsp	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/assets/mimecast-icons/css/mimecast-icons.css	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/rest/branding/get-branding-item/m-NHsBWUn2FkP75AbBfvJgeyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiUGdiWUxmb1dKX3IzekpaMyJ9.SRrXMDqzliuYRzcQnlBLYHuRjaCRsNpp.GK8LKFYWHnmCG6F-.FA9MnLU1ka3gMv_Jxa6IrCuLjY7rmhVZhrROtJPkOloN3fWPhI7Dc8jcvoyeBdmbJ_rQVUZCRFLkTXQkPfVz0a17CsNBe2DB3KH_XObdaRQ72jdTKtX-XrznQG2uE_vuk3HdR9i4MdaLvlwwK5v3homKCSoQL8TPogsKZCJ5Ukd174trpoNI4V0mThlRMpa567sN6F_bPa_OjcuumLjEHFGbxbmSUIg54D_pnFU0SVgm2TdQiBKtNl3IEPDaYpwfVNYihJClZIJwd1zamfb3GWqCcwcTa0ZNCWFBH1EYGKkMWvyjKNTjqCL67Vfc33FOvgrMxucLZ3JKksW9HH-mYOPw7d4FQLwfFjqjeWDxLE2mi6NnrVC8C1haV9pCPSnM4xuZHpn4ClMTkYgBJi3skodd6XjdjYD79pX9pyYN4i0lwt34zY7oq0lwVpsGn2ggwvbB7stQROP91JB6B7DX-FH8V700EWkgst_DvyU7MqWETbn1wI_AtCQofFogz-9Ng5BvYcGuz_ZHLA1oejotWLaVwG6VXUMFDErhRFHPkXjkfXF6VdaNQyzFgclxOWGwaA.Jxy9xzFgiE1nZEawEmi6tQ?tkn=rsm	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/login/cache.647aa7b26e87d650a310e593a0edd3e2.login-lib.js	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/login/assets/languages/en.json?ver=1.16.1	0%	Avira URL Cloud	safe
https://info.mimecast.com/Web-Security-Service.html?utm_medium=pendo&utm_source=adcon&utm_campaign=7	0%	Avira URL Cloud	safe
http://janstevens.github.io/angular-growl-2	0%	Avira URL Cloud	safe
https://info.mimecast.com/Continuity-and-Recovery-Demo-.html?utm_medium=pendo&utm_source=adcon&utm_c	0%	Avira URL Cloud	safe
https://rsm.login-us.mimecast.com/u/assets/font-awesome/fonts/fontawesome-webfont.woff2?v=4.3.0	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
protect-us.mimecast.com	205.139.111.117	true	false	high
app.pendo.io	34.107.204.85	true	false	high
rsm.login-us.mimecast.com	205.139.110.115	true	false	high
cdn.pendo.io	34.36.213.229	true	false	high
static.srcspot.com	35.190.8.230	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.72.99	true	false	high
www.google.com	142.250.81.228	true	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rsm.login-us.mimecast.com/u/assets/entypo/font/entypo.css	false	Avira URL Cloud: safe	unknown
https://rsm.login-us.mimecast.com/u/rest/branding/get-branding-item/XHEvsJVPT_EZoLeMOMeG5weyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiNGJ3cURMVnF3ZHVEekVvdyJ9.1kh7WKb40TgeYxkLGNv5ule9WZ3k1oH_.FZzBolsUTrqulVWX.YiMBEE9mOE80jIG0UY77oEynpbMlOaXcisP_rHZADKcm9lMCSqYyeJDBe2bVGDuBwOiJkqUVlDaajiyjpq35eJ3dk-7fEZnuJskOOdrnjCz5T_11_bArxLzcXNxMrG8rKaON3Es66uMV-WxYkD6jZLTYM9X5zoyLTxfLOESKE8mxXsB9VCrscmzzRBDBv6EZt-ROVd5jf9aB1_3hE8tDijIUNoqmSzwJqtlOdK2Hyo-5p9tZSSGrtkg_PPxBHfroLY-_eocn653LuhhrkT4Qommz5yFJ7UsSGUcdPpbrgotgbk2kqED-xzemr33WyluyD7LRDI2f15IE28fvL2ZKsJAeCrFaTcCnKkrcjJCdPBtB6JDegctmI2I_vVj7fLnI-HXl4YlBCfm-KDTlhMxJVkm3M-00UeKtQigxDiRKyLSaR10vtGlw6MXZKSLlDnVBtkYXYSuGtUuw0Nf86bZLQJQztsvYgr0tLfNHEVaDCFD9zAuUBVZnyGgXJHO8Hc8RoMXEh8I_IaOuH-mdVSw8rJ9-6SJXb5k43mPMyAdhw3sGBbxusjQKKFTiBqSDY_UL7owuqMLcalmY3YBdq4B9.QTubUwtzUgczdyK8fjx-gA?tkn=rsm	false	Avira URL Cloud: safe	unknown
https://rsm.login-us.mimecast.com/u/assets/font-awesome/css/font-awesome.css	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false		high
https://rsm.login-us.mimecast.com/u/proxy/api/login/get-password-rules	false	Avira URL Cloud: safe	unknown
https://cdn.pendo.io/agent/static/0600cd7b-e6b2-4ba9-4249-ab1342c3631b/pendo.js	false		high
https://app.pendo.io/data/guide.gif/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1743101048728&v=2.269.1_prod	false		high
https://browser.events.data.msn.cn/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743101030065&w=0&anoncknm=al_app_anon&NoResponseBody=true	false		high
https://app.pendo.io/data/ptm.gif/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?v=2.269.1_prod&ct=1743101048724&jzb=eJztU02PozgU_C-stKcQPhOgpdEqSScdGsgn-erVChkwAQI22IaEjPq_j9O9M9rLznUu4xOvilc8nqv-_iqwroLCk1BCBoSeEBJ8pZAELCs5qhi6psiKrJuGbPaENqMZwyTIYt4QrKaL52XgBxY5jde-5d03BhdoSMHJlLGKPkkSoWW_wOcMiQ3tl1wzApT1I1xKjfSBS3-dGfhCYdQQ-Ce7oC9av755zjCZWGR0wrNLXCUdeq4hWbhmPb6dquO18sAyTOfoJrauouq2gwbrDhQZsSscgkwr74O5W1jbeuoU9XBq6KaXNAYV6b51dfoqV2_bZ3SMnBWKGqzNwNLW3Xzm7slofD2GWf-6rTGcv8ibXNmznVEYqKXV6A8pSgE6Q7EClF4xiSV7j-v6dbia-kf3NvBcy8d5flv4gejUk312QuUJJEoQW8symJkotu1uAucQyKMk3HlmOn5F4lEBC6ed3-BVjrZwH69fVkEmOifkvFwu0ztWHVfcT7O3U-7v7HVxn5eXzsnbXF42YT6OX_C6s-vJuqYZdc_TlRXjO8L3NNm6CVx0mjtIzbT2rU27hKai7GR1sMFOELuVeMfus7dvWTZa7Ci9hTczr3ULHqByPL-Zfr4Sh5PXQ9iuOTken-z5eua1l05fis4kH6gHOeO3XRFcUeHp63drPB5_5o6Cb7AB54fhIAp2W-G9J4Aowg1ivJUXFSAQsdF_oRiwx_uqIcmapPI_4DotJDTD6AH31aHVVwI-SfxQ-xTwQWjzMVBTFD2BfRbC0XWbLfOtBYQ-PQw3XCchoIQfJBlDT0-bTB6dV91xeeAkhfTxkQ9avePDcDqa785ySgeJ_kHXDUQRn03muekY5IswNeu99yNTBQbxzzKlaL8z9TtT_5uph33-NY0uG0pftb4f09R_kdWVH1Y3NP39n2_I_xLb	false		high
https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i	false		unknown
https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h	false		high
https://rsm.login-us.mimecast.com/u/login/cache.fbcb25980edc88e8c170bab371b118d9.login.js	false	Avira URL Cloud: safe	unknown
https://rsm.login-us.mimecast.com/u/login/app-version.jsp	false	Avira URL Cloud: safe	unknown
https://rsm.login-us.mimecast.com/u/assets/mimecast-icons/css/mimecast-icons.css	false	Avira URL Cloud: safe	unknown
https://rsm.login-us.mimecast.com/u/rest/branding/get-branding-item/m-NHsBWUn2FkP75AbBfvJgeyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiUGdiWUxmb1dKX3IzekpaMyJ9.SRrXMDqzliuYRzcQnlBLYHuRjaCRsNpp.GK8LKFYWHnmCG6F-.FA9MnLU1ka3gMv_Jxa6IrCuLjY7rmhVZhrROtJPkOloN3fWPhI7Dc8jcvoyeBdmbJ_rQVUZCRFLkTXQkPfVz0a17CsNBe2DB3KH_XObdaRQ72jdTKtX-XrznQG2uE_vuk3HdR9i4MdaLvlwwK5v3homKCSoQL8TPogsKZCJ5Ukd174trpoNI4V0mThlRMpa567sN6F_bPa_OjcuumLjEHFGbxbmSUIg54D_pnFU0SVgm2TdQiBKtNl3IEPDaYpwfVNYihJClZIJwd1zamfb3GWqCcwcTa0ZNCWFBH1EYGKkMWvyjKNTjqCL67Vfc33FOvgrMxucLZ3JKksW9HH-mYOPw7d4FQLwfFjqjeWDxLE2mi6NnrVC8C1haV9pCPSnM4xuZHpn4ClMTkYgBJi3skodd6XjdjYD79pX9pyYN4i0lwt34zY7oq0lwVpsGn2ggwvbB7stQROP91JB6B7DX-FH8V700EWkgst_DvyU7MqWETbn1wI_AtCQofFogz-9Ng5BvYcGuz_ZHLA1oejotWLaVwG6VXUMFDErhRFHPkXjkfXF6VdaNQyzFgclxOWGwaA.Jxy9xzFgiE1nZEawEmi6tQ?tkn=rsm	false	Avira URL Cloud: safe	unknown
https://rsm.login-us.mimecast.com/u/login/assets/languages/en.json?ver=1.16.1	false	Avira URL Cloud: safe	unknown
https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA	false	Avira URL Cloud: safe	unknown
https://rsm.login-us.mimecast.com/u/login/cache.647aa7b26e87d650a310e593a0edd3e2.login-lib.js	false	Avira URL Cloud: safe	unknown
https://static.srcspot.com/libs/galindo.js	false		high
https://rsm.login-us.mimecast.com/u/assets/font-awesome/fonts/fontawesome-webfont.woff2?v=4.3.0	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://app.dmarcanalyzer.com/register?utm_medium=pendo&utm_source=adcon&utm_campaign=7013l000001JNB	chromecache_82.1.dr	false		high
http://fontawesome.io	chromecache_101.1.dr	false		high
https://info.mimecast.com/Safe_Phish_Demo.html?utm_medium=pendo&utm_source=adcon&utm_campaign=7013l0	chromecache_82.1.dr	false	Avira URL Cloud: safe	unknown
https://community.mimecast.com/s/knowledge-hub-case-review-application	chromecache_108.1.dr	false		high
https://info.mimecast.com/security-awareness-remote-resources.html?utm_medium=pendo&utm_source=adcon	chromecache_82.1.dr	false	Avira URL Cloud: safe	unknown
https://login-alpha.mimecast.com/administration/app/#/l/accountassessment	chromecache_82.1.dr	false	Avira URL Cloud: safe	unknown
https://summernote.org	chromecache_103.1.dr	false		high
https://community.mimecast.com/s/article/email-security-cloud-gateway-configuring-url-protection	chromecache_108.1.dr	false		high
https://www.mimecast.com/coronavirus/?utm_medium=pendo&utm_source=adcon&utm_campaign=7013l000001JNBI	chromecache_82.1.dr	false		high
http://daneden.me/animate	chromecache_103.1.dr	false		high
https://community.mimecast.com/s/knowledge-hub-supervision	chromecache_108.1.dr	false		high
https://info.mimecast.com/AT-IEP-Demo.html?utm_medium=pendo&utm_source=adcon&utm_campaign=7013l00000	chromecache_82.1.dr	false	Avira URL Cloud: safe	unknown
https://community.mimecast.com/s/knowledge-hub-awareness-training	chromecache_108.1.dr	false		high
https://community.mimecast.com/s/education-free-courses?utm_medium=pendo&utm_source=adcon&utm_campai	chromecache_82.1.dr	false		high
https://community.mimecast.com/s/article/email-security-cloud-gateway-ttp-impersonation-protection-g	chromecache_108.1.dr	false		high
https://community.mimecast.com/s/knowledge-hub-dmarc-analyzer	chromecache_108.1.dr	false		high
https://play.vidyard.com/embed/v4.js	chromecache_86.1.dr	false		high
https://info.mimecast.com/SolutionFrameworkRequest?utm_medium=pendo&utm_source=adcon&utm_campaign=70	chromecache_82.1.dr	false	Avira URL Cloud: safe	unknown
https://community.mimecast.com/s/mimecast-education?utm_medium=pendo&utm_source=adcon&utm_campaign=7	chromecache_82.1.dr	false		high
https://community.mimecast.com/s/article/email-security-cloud-gateway-secure-messaging-getting-start	chromecache_108.1.dr	false		high
https://agent.pendo.io/licenses	chromecache_85.1.dr	false		high
https://github.com/nickpettit/glide	chromecache_103.1.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	chromecache_103.1.dr	false		high
https://community.mimecast.com/s/article/email-security-cloud-gateway-ttp-attachment-protect-configu	chromecache_108.1.dr	false		high
https://community.mimecast.com/s/article/end-user-applications-large-file-send-getting-started	chromecache_108.1.dr	false		high
https://community.mimecast.com/s/article/email-security-cloud-gateway-continuity-guides	chromecache_108.1.dr	false		high
https://community.mimecast.com/s/article/email-security-cloud-gateway-targeted-threat-protection-int	chromecache_108.1.dr	false		high
https://community.mimecast.com/s/knowledge-hub-sync-and-recover	chromecache_108.1.dr	false		high
http://opensource.org/licenses/MIT	chromecache_103.1.dr	false		high
https://github.com/dbtek/angular-aside	chromecache_103.1.dr	false		high
https://cdn.pendo.io/agent/static/	chromecache_103.1.dr	false		high
https://feedback.us.pendo.io	chromecache_85.1.dr	false		high
https://getbootstrap.com/)	chromecache_103.1.dr	false		high
http://fontawesome.io/license	chromecache_101.1.dr	false		high
http://janstevens.github.io/angular-growl-2	chromecache_103.1.dr	false	Avira URL Cloud: safe	unknown
https://community.mimecast.com/s/knowledge-hub-web-security	chromecache_108.1.dr	false		high
https://us-api.mimecast.com	chromecache_103.1.dr	false		high
https://www.mimecast.com/state-of-email-security/download-hub/?utm_medium=pendo&utm_source=adcon&utm	chromecache_82.1.dr	false		high
http://www.opensource.org/licenses/MIT	chromecache_103.1.dr	false		high
https://community.mimecast.com/s/knowledge-hub-api-and-integrations	chromecache_108.1.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_103.1.dr	false		high
https://community.mimecast.com/s/knowledge-hub-email-security-cg	chromecache_108.1.dr	false		high
https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css	chromecache_103.1.dr	false		high
https://api.feedback.us.pendo.io	chromecache_85.1.dr	false		high
https://info.mimecast.com/Web-Security-Service.html?utm_medium=pendo&utm_source=adcon&utm_campaign=7	chromecache_82.1.dr	false	Avira URL Cloud: safe	unknown
https://info.mimecast.com/Continuity-and-Recovery-Demo-.html?utm_medium=pendo&utm_source=adcon&utm_c	chromecache_82.1.dr	false	Avira URL Cloud: safe	unknown
https://community.mimecast.com/s/article/cybergraph-cybergraph-1-0-configuration-settings	chromecache_108.1.dr	false		high
https://community.mimecast.com/s/article/cybergraph-cybergraph-2-0-configuration-settings	chromecache_108.1.dr	false		high
https://play.vidyard.com/LE2oaRu3qApZkgaw4JjwZM.jpg	chromecache_86.1.dr	false		high
https://github.com/mgcrea/angular-motion	chromecache_103.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.107.204.85	app.pendo.io	United States	15169	GOOGLEUS	false
205.139.111.117	protect-us.mimecast.com	United States	30031	MIMECAST-US	false
35.190.8.230	static.srcspot.com	United States	15169	GOOGLEUS	false
207.211.31.115	unknown	United States	14135	NAVISITE-EAST-2US	false
205.139.110.115	rsm.login-us.mimecast.com	United States	30031	MIMECAST-US	false
34.36.213.229	cdn.pendo.io	United States	2686	ATGS-MMD-ASUS	false
142.250.81.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.24

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1650520
Start date and time:	2025-03-27 19:42:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@21/79@25/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): SystemSettingsBroker.exe, SIHClient.exe, appidcertstorecheck.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.32.110, 142.250.80.99, 172.253.63.84, 142.250.65.238, 142.251.40.106, 142.250.65.163, 142.250.80.42, 142.250.80.74, 142.250.80.106, 142.250.176.202, 142.251.40.202, 142.251.40.234, 142.251.41.10, 172.217.165.138, 142.250.65.170, 142.250.65.202, 142.251.40.138, 142.251.40.170, 142.250.64.74, 142.250.64.106, 142.250.72.106, 142.250.80.10, 142.251.40.123, 142.251.40.155, 142.251.40.187, 142.250.64.91, 142.250.64.123, 142.250.72.123, 142.250.80.27, 142.251.40.219, 142.251.40.251, 142.251.41.27, 142.250.65.187, 142.250.65.219, 142.250.65.251, 142.250.81.251, 142.251.32.123, 142.251.35.187, 23.210.92.197, 142.250.65.234, 142.250.81.234, 142.251.32.106, 142.251.35.170, 142.251.40.163, 52.149.20.212
Excluded domains from analysis (whitelisted): fonts.googleapis.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, www.googleapis.com, pendo-static-5707797427912704.storage.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 56780, version 4.197
Category:	downloaded
Size (bytes):	56780
Entropy (8bit):	7.995500466415841
Encrypted:	true
SSDEEP:	1536:zxwdj+K8kLkunGAASpdw6hsxD/G+zSIoiCQN+n:zxmVY6dwJThoiCQE
MD5:	97493D3F11C0A3BD5CBD959F5D19B699
SHA1:	1075231650F579955905BB2F6527148A8E2B4B16
SHA-256:	AADC3580D2B64FF5A7E6F1425587DB4E8B033EFCBF8F5C332CA52A5ED580C87C
SHA-512:	BFE4679BBE5D1DB21F6ECB2D6C2810DD02D3B698EFDD50004CC355C1D0BC51DE8DD102707C796B26E8250C600B4B64DB88B67D3F28157777B68E36AD7930BFC0
Malicious:	false
Reputation:	low
URL:	https://rsm.login-us.mimecast.com/u/assets/font-awesome/fonts/fontawesome-webfont.woff2?v=4.3.0
Preview:	wOF2...................l........................?FFTM....`..B.....d..Z.6.$....\.. ......?webf.[..q.q{!Q.P.........DA..n..\|1.......... Y.....G@Tu:K[U3....,...G.^.c(p.6b.l.f-k.n...G5..T+3..i...Lp&..el'...\|.&...D!.^fivM3\S).Q..L..N_.+[.!.S...mQ.}..V.o..k.....(.....1AR.]A..P.m.......bN.sEP..7d\|8~E.x..i..k......._.)..j.PK.:t.....=z.&.wd.....-..S..k-{=.....<..@..<....R...>......"..6bc.1..._..Q!.BRZ.$Z%%.@.lTT...(g..uf.7.?..g?..1<......V .w.J.s..]..j]7nj....}.2.......J\|..j."...>t!.1.. 9.c...y...../+..S..$.I...i..`.PJ...I....:....I.I.IJ.,.....6...Q.e..1.w..^.T~oJ..&.....-.....Z.,K.b..b..J..g...9.1...C.I....3.j.H...@t_d..;.'~..9.....9.~%$.H..h..).~.......v...$....G.NL.B .R.J9..<.k..k......2D....i.V.~...P...!..+.i.r.{wOh.+.j..p..I'..{.......I.ZPt....s.....oY..s..#zT........V...`cc.`Do....&.'ST<1P....4.N.P...f..1.bzBz....o..x.V.......xw._.3..Lms..C....1.:..h.x..%....[.*[/.t..p..>..g73..#......K..7.Vs..8....u....x-.nkJ.U...z...........h.[ll4..S...E..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2025 19:43:58.815762043 CET	53	53161	1.1.1.1	192.168.2.24
Mar 27, 2025 19:43:58.830871105 CET	53	50519	1.1.1.1	192.168.2.24
Mar 27, 2025 19:43:59.523782969 CET	53	54487	1.1.1.1	192.168.2.24
Mar 27, 2025 19:43:59.657468081 CET	53	58936	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:02.774837971 CET	55719	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:02.774837971 CET	52462	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:02.857947111 CET	53	55719	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:02.857981920 CET	53	52462	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:04.529515982 CET	49219	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:04.529665947 CET	51702	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:04.636010885 CET	53	49219	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:04.698199034 CET	53	51702	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:05.224699974 CET	56514	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:05.225071907 CET	60525	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:05.328296900 CET	53	60525	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:05.384329081 CET	53	56514	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:06.706444025 CET	53	60227	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:07.794507027 CET	52058	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:07.794842958 CET	62379	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:07.948577881 CET	53	52058	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:07.979089975 CET	53	62379	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:08.062216997 CET	64699	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:08.062480927 CET	57412	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:08.147073984 CET	53	64699	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:08.147097111 CET	53	57412	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:08.565295935 CET	54468	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:08.565428019 CET	49621	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:08.648128986 CET	53	54468	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:08.648228884 CET	53	49621	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:08.837364912 CET	53	61676	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:09.341196060 CET	53114	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:09.341404915 CET	56662	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:09.424118042 CET	53	53114	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:09.448174000 CET	53	56662	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:10.053102970 CET	51558	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:10.053102970 CET	52020	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:44:10.135885954 CET	53	51558	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:10.135915995 CET	53	52020	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:10.466026068 CET	53	57979	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:16.701519012 CET	53	52437	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:24.087116003 CET	137	137	192.168.2.24	192.168.2.255
Mar 27, 2025 19:44:24.837960005 CET	137	137	192.168.2.24	192.168.2.255
Mar 27, 2025 19:44:25.603566885 CET	137	137	192.168.2.24	192.168.2.255
Mar 27, 2025 19:44:27.832674980 CET	53	60124	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:35.716798067 CET	53	63436	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:37.609294891 CET	53	61954	162.159.36.2	192.168.2.24
Mar 27, 2025 19:44:58.263485909 CET	53	56707	1.1.1.1	192.168.2.24
Mar 27, 2025 19:44:58.282589912 CET	53	63514	1.1.1.1	192.168.2.24
Mar 27, 2025 19:45:08.951119900 CET	52552	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:45:08.951591969 CET	58260	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:45:09.035981894 CET	53	52552	1.1.1.1	192.168.2.24
Mar 27, 2025 19:45:09.036535025 CET	53	58260	1.1.1.1	192.168.2.24
Mar 27, 2025 19:45:09.977195978 CET	54245	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:45:09.977344990 CET	63549	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:45:10.061747074 CET	53	54245	1.1.1.1	192.168.2.24
Mar 27, 2025 19:45:10.061798096 CET	53	63549	1.1.1.1	192.168.2.24
Mar 27, 2025 19:45:12.008812904 CET	56940	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:45:12.091675043 CET	53	56940	1.1.1.1	192.168.2.24
Mar 27, 2025 19:45:13.010324001 CET	56940	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:45:13.093177080 CET	53	56940	1.1.1.1	192.168.2.24
Mar 27, 2025 19:45:14.024276018 CET	56940	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:45:14.107223034 CET	53	56940	1.1.1.1	192.168.2.24
Mar 27, 2025 19:45:16.024316072 CET	56940	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:45:16.107161045 CET	53	56940	1.1.1.1	192.168.2.24
Mar 27, 2025 19:45:20.024419069 CET	56940	53	192.168.2.24	1.1.1.1
Mar 27, 2025 19:45:20.107424021 CET	53	56940	1.1.1.1	192.168.2.24

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 27, 2025 19:44:04.698282957 CET	192.168.2.24	1.1.1.1	c235	(Port unreachable)	Destination Unreachable
Mar 27, 2025 19:44:09.448276997 CET	192.168.2.24	1.1.1.1	c253	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:43:51 UTC	473	OUT	POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1743101030065&w=0&anoncknm=al_app_anon&NoResponseBody=true HTTP/1.1 Accept-Encoding: gzip, deflate Content-Length: 3656 Content-Type: application/json; charset=UTF-8 Host: browser.events.data.msn.cn Connection: Keep-Alive Cache-Control: no-cache
2025-03-27 18:43:51 UTC	3656	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 53 65 72 76 65 72 4c 6f 67 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 63 34 39 38 37 31 31 66 30 32 36 35 34 65 64 63 61 38 61 37 31 35 63 61 36 65 31 63 62 34 64 34 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 33 2d 32 37 54 31 38 3a 34 33 3a 34 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 64 61 74 61 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 72 6f 64 75 63 74 22 3a 22 65 6e 74 77 69 6e 64 6f 77 73 64 61 73 68 22 2c 22 61 70 70 54 79 70 65 22 3a 22 77 69 6e 57 69 64 67 65 74 73 22 2c 22 6e 61 6d 65 22 3a 22 77 69 6e 70 32 62 61 63 6b 69 6e 67 61 70 70 22 2c 22 69 73 4d 6f 63 6b 45 6e 76 22 3a 66 61 6c 73 65 2c 22 68 6f 73 74 56 65 72 22 3a 22 35 32 34 2e 33 30 35 30 32 2e 33 30 2e 30 22 2c 22 Data Ascii: {"name":"MS.News.Web.ServerLog","iKey":"o:c498711f02654edca8a715ca6e1cb4d4","time":"2025-03-27T18:43:40Z","ver":"4.0","data":{"page":{"product":"entwindowsdash","appType":"winWidgets","name":"winp2backingapp","isMockEnv":false,"hostVer":"524.30502.30.0","

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:04 UTC	702	OUT	GET /s/146LCmZky3h5z20p7FBi1URTA8h HTTP/1.1 Host: protect-us.mimecast.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:05 UTC	683	IN	HTTP/1.1 307 Temporary Redirect Date: Thu, 27 Mar 2025 18:44:05 GMT Content-Length: 0 Connection: close Location: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA#/change-password/IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8TjP-6CJWbvQssxBBYIHQFMvky4O-KCj52W0i Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:05 UTC	852	OUT	GET /u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:06 UTC	345	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:06 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Vary: Accept-Encoding, User-Agent
2025-03-27 18:44:06 UTC	16039	IN	Data Raw: 33 65 64 35 0d 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 6e 67 2d 61 70 70 22 20 6e 67 2d 61 70 70 3d 22 61 70 70 4c 6f 67 69 6e 22 20 6e 67 2d 63 6c 6f 61 6b 3d 22 22 20 63 6c 61 73 73 3d 22 6e 67 2d 63 6c 6f 61 6b 20 61 6e 69 6d 61 74 65 2d 6f 6e 2d 65 6e 74 65 72 2d 61 6c 74 22 20 6e 67 2d 63 6f 6e 74 72 6f 6c 6c 65 72 3d 22 41 70 70 4c 6f 67 69 6e 43 6f 6e 74 72 6f 6c 6c 65 72 20 61 73 20 61 70 70 43 74 72 6c 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 Data Ascii: 3ed5<!DOCTYPE html><html lang="en" id="ng-app" ng-app="appLogin" ng-cloak="" class="ng-cloak animate-on-enter-alt" ng-controller="AppLoginController as appCtrl"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compati
2025-03-27 18:44:06 UTC	16384	IN	Data Raw: 2d 66 69 6c 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 65 32 30 32 22 3b 0a 7d 0a 2e 67 6c 79 70 68 69 63 6f 6e 2d 6f 70 65 6e 0d 0a 33 30 30 30 0d 0a 2d 66 69 6c 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 65 32 30 33 22 3b 0a 7d 0a 2e 67 6c 79 70 68 69 63 6f 6e 2d 6c 65 76 65 6c 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 65 32 30 34 22 3b 0a 7d 0a 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 6f 70 79 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 65 32 30 35 22 3b 0a 7d 0a 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 61 73 74 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 65 32 30 36 22 3b 0a 7d 0a 2e 67 6c 79 70 68 69 63 6f 6e 2d 61 Data Ascii: -file:before { content: "\e202";}.glyphicon-open3000-file:before { content: "\e203";}.glyphicon-level-up:before { content: "\e204";}.glyphicon-copy:before { content: "\e205";}.glyphicon-paste:before { content: "\e206";}.glyphicon-a
2025-03-27 18:44:06 UTC	16384	IN	Data Raw: 2d 73 6d 2d 37 2c 20 2e 63 6f 6c 2d 73 6d 2d 38 2c 20 2e 63 6f 6c 2d 73 6d 2d 39 2c 20 2e 63 6f 6c 2d 73 6d 2d 31 30 2c 20 2e 63 6f 6c 2d 73 6d 2d 31 31 2c 20 2e 63 6f 6c 2d 73 6d 2d 31 32 20 7b 0a 20 20 0d 0a 32 30 30 30 0d 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 7d 0a 20 20 2e 63 6f 6c 2d 73 6d 2d 31 32 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 7d 0a 20 20 2e 63 6f 6c 2d 73 6d 2d 31 31 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 39 31 2e 36 36 36 36 36 36 36 37 25 3b 0a 20 20 7d 0a 20 20 2e 63 6f 6c 2d 73 6d 2d 31 30 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 38 33 2e 33 33 33 33 33 33 33 33 25 3b 0a 20 20 7d 0a 20 20 2e 63 6f 6c 2d 73 6d 2d 39 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 37 35 25 3b 0a 20 20 7d 0a 20 20 Data Ascii: -sm-7, .col-sm-8, .col-sm-9, .col-sm-10, .col-sm-11, .col-sm-12 { 2000 float: left; } .col-sm-12 { width: 100%; } .col-sm-11 { width: 91.66666667%; } .col-sm-10 { width: 83.33333333%; } .col-sm-9 { width: 75%; }
2025-03-27 18:44:06 UTC	16384	IN	Data Raw: 74 61 62 6c 65 20 3e 20 74 68 65 61 64 20 3e 20 74 72 20 3e 20 74 68 2c 0a 20 20 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 20 3e 20 2e 74 61 62 6c 65 20 3e 20 74 62 6f 64 79 20 3e 20 74 72 20 3e 20 74 68 2c 0a 20 20 2e 74 61 62 6c 65 2d 72 65 0d 0a 32 30 30 30 0d 0a 73 70 6f 6e 73 69 76 65 20 3e 20 2e 74 61 62 6c 65 20 3e 20 74 66 6f 6f 74 20 3e 20 74 72 20 3e 20 74 68 2c 0a 20 20 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 20 3e 20 2e 74 61 62 6c 65 20 3e 20 74 68 65 61 64 20 3e 20 74 72 20 3e 20 74 64 2c 0a 20 20 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 20 3e 20 2e 74 61 62 6c 65 20 3e 20 74 62 6f 64 79 20 3e 20 74 72 20 3e 20 74 64 2c 0a 20 20 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 20 3e 20 2e 74 61 62 6c 65 20 3e Data Ascii: table > thead > tr > th, .table-responsive > .table > tbody > tr > th, .table-re2000sponsive > .table > tfoot > tr > th, .table-responsive > .table > thead > tr > td, .table-responsive > .table > tbody > tr > td, .table-responsive > .table >
2025-03-27 18:44:06 UTC	16384	IN	Data Raw: 20 6c 61 62 65 6c 2c 0a 20 20 2e 66 6f 72 6d 2d 69 6e 6c 69 6e 65 20 2e 63 68 65 63 6b 62 6f 78 20 6c 61 62 65 6c 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 3b 0a 20 20 7d 0a 20 20 2e 66 6f 72 6d 2d 69 6e 6c 69 6e 65 20 2e 72 61 64 69 6f 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2c 0a 20 20 2e 66 6f 72 6d 2d 69 6e 6c 69 6e 65 20 2e 63 68 65 63 6b 62 6f 78 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 0a 20 20 7d 0a 20 20 2e 66 6f 72 6d 2d 69 6e 6c 69 6e 65 20 2e 68 61 73 2d 66 65 65 64 62 61 63 6b 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2d 66 65 65 64 62 Data Ascii: label, .form-inline .checkbox label { padding-left: 0; } .form-inline .radio input[type="radio"], .form-inline .checkbox input[type="checkbox"] { position: relative; margin-left: 0; } .form-inline .has-feedback .form-control-feedb
2025-03-27 18:44:06 UTC	16384	IN	Data Raw: 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 0a 7d 0a 2e 62 74 6e 2d 73 6d 2c 0a 2e 62 74 6e 2d 67 72 6f 75 70 2d 73 6d 20 3e 20 2e 62 74 6e 20 7b 0a 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 20 31 30 70 78 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 35 3b 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 0a 7d 0a 2e 62 74 6e 2d 78 73 2c 0a 2e 62 74 6e 2d 67 72 6f 75 70 2d 78 73 20 3e 20 2e 62 74 6e 20 7b 0a 20 20 70 61 64 64 69 6e 67 3a 20 31 70 78 20 35 70 78 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 35 3b 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 0a 7d 0a 2e 62 74 Data Ascii: order-radius: 6px;}.btn-sm,.btn-group-sm > .btn { padding: 5px 10px; font-size: 12px; line-height: 1.5; border-radius: 6px;}.btn-xs,.btn-group-xs > .btn { padding: 1px 5px; font-size: 12px; line-height: 1.5; border-radius: 6px;}.bt
2025-03-27 18:44:06 UTC	16384	IN	Data Raw: 0a 7d 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 37 36 38 70 78 29 20 7b 0a 20 20 2e 6e 61 76 2d 74 61 62 73 2d 6a 75 73 74 69 66 69 65 64 20 3e 20 6c 69 20 3e 20 61 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 42 32 42 32 42 32 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 20 36 70 78 20 30 20 30 3b 0a 20 20 7d 0a 20 20 2e 6e 61 76 2d 74 61 62 73 2d 6a 75 73 74 69 66 69 65 64 20 3e 20 2e 61 63 74 69 76 65 20 3e 20 61 2c 0a 20 20 2e 6e 61 76 2d 74 61 62 73 2d 6a 75 73 74 69 66 69 65 64 20 3e 20 2e 61 63 74 69 76 65 20 3e 20 61 3a 68 6f 76 65 72 2c 0a 20 20 2e 6e 61 76 2d 74 61 62 73 2d 6a 75 73 74 69 66 69 65 64 20 3e 20 2e 61 63 74 69 76 65 20 3e 20 61 3a 66 Data Ascii: }@media (min-width: 768px) { .nav-tabs-justified > li > a { border-bottom: 1px solid #B2B2B2; border-radius: 6px 6px 0 0; } .nav-tabs-justified > .active > a, .nav-tabs-justified > .active > a:hover, .nav-tabs-justified > .active > a:f
2025-03-27 18:44:06 UTC	16384	IN	Data Raw: 23 66 66 66 3b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 7d 0a 2e 6c 61 62 65 6c 3a 65 6d 70 74 79 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 7d 0a 2e 62 74 6e 20 2e 6c 61 62 65 6c 20 7b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 74 6f 70 3a 20 2d 31 70 78 3b 0a 7d 0a 2e 6c 61 62 65 6c 2d 64 65 66 61 75 6c 74 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 37 30 37 30 37 30 3b 0a 7d 0a 2e 6c 61 62 65 6c 2d 64 65 66 61 75 6c 74 5b 68 72 65 66 5d 3a 68 6f 76 65 72 2c 0a 2e 6c 61 62 65 6c 2d 64 65 66 61 75 6c 74 5b 68 72 65 66 5d 3a 66 6f 63 75 73 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d Data Ascii: #fff; text-decoration: none; cursor: pointer;}.label:empty { display: none;}.btn .label { position: relative; top: -1px;}.label-default { background-color: #707070;}.label-default[href]:hover,.label-default[href]:focus { background-
2025-03-27 18:44:06 UTC	16384	IN	Data Raw: 72 6f 75 70 2d 69 74 65 6d 2d 73 75 63 63 65 73 73 3a 68 6f 76 65 72 2c 0a 61 2e 6c 69 73 74 2d 67 72 6f 75 70 2d 69 74 65 6d 2d 73 75 63 63 65 73 73 3a 66 6f 63 75 73 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 33 63 37 36 33 64 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 64 30 65 39 63 36 3b 0a 7d 0a 61 2e 6c 69 73 74 2d 67 72 6f 75 70 2d 69 74 65 6d 2d 73 75 63 63 65 73 73 2e 61 63 74 69 76 65 2c 0a 61 2e 6c 69 73 74 2d 67 72 6f 75 70 2d 69 74 65 6d 2d 73 75 63 63 65 73 73 2e 61 63 74 69 76 65 3a 68 6f 76 65 72 2c 0a 61 2e 6c 69 73 74 2d 67 72 6f 75 70 2d 69 74 65 6d 2d 73 75 63 63 65 73 73 2e 61 63 74 69 76 65 3a 66 6f 63 75 73 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f Data Ascii: roup-item-success:hover,a.list-group-item-success:focus { color: #3c763d; background-color: #d0e9c6;}a.list-group-item-success.active,a.list-group-item-success.active:hover,a.list-group-item-success.active:focus { color: #fff; background-colo
2025-03-27 18:44:06 UTC	16384	IN	Data Raw: 73 70 6f 6e 73 69 76 65 2c 0a 2e 70 61 6e 65 6c 20 3e 20 2e 74 61 62 6c 65 20 2b 20 2e 70 61 6e 65 6c 2d 62 6f 64 79 2c 0a 2e 70 61 6e 65 6c 20 3e 20 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 20 2b 20 2e 70 61 6e 65 6c 2d 62 6f 64 79 2c 0a 2e 6d 63 2d 73 65 6c 65 63 74 61 62 6c 65 2d 6c 69 73 74 2d 74 72 65 65 20 3e 20 2e 70 61 6e 65 6c 2d 62 6f 64 79 20 2b 20 2e 74 61 62 6c 65 2c 0a 2e 6d 63 2d 73 65 6c 65 63 74 61 62 6c 65 2d 6c 69 73 74 2d 74 72 65 65 20 3e 20 2e 70 61 6e 65 6c 2d 62 6f 64 79 20 2b 20 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 2c 0a 2e 6d 63 2d 73 65 6c 65 63 74 61 62 6c 65 2d 6c 69 73 74 2d 74 72 65 65 20 3e 20 2e 74 61 62 6c 65 20 2b 20 2e 70 61 6e 65 6c 2d 62 6f 64 79 2c 0a 2e 6d 63 2d 73 65 6c 65 63 74 61 62 6c 65 Data Ascii: sponsive,.panel > .table + .panel-body,.panel > .table-responsive + .panel-body,.mc-selectable-list-tree > .panel-body + .table,.mc-selectable-list-tree > .panel-body + .table-responsive,.mc-selectable-list-tree > .table + .panel-body,.mc-selectable

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:06 UTC	579	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIS2yQEIpbbJAQipncoBCIb0ygEIlqHLAQiKo8sBCIWgzQEI/aXOAQiB1s4BCPzbzgEIxeDOAQiu5M4BCN/kzgEIjOXOARiW5c4B Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:06 UTC	1303	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:06 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-DexMqzyMndO5n_HcMY8jYA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-27 18:44:06 UTC	1303	IN	Data Raw: 31 31 62 33 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 73 73 61 73 73 69 6e 20 63 72 65 65 64 20 73 68 61 64 6f 77 73 22 2c 22 73 74 20 61 75 67 75 73 74 69 6e 65 22 2c 22 72 65 66 69 6e 61 6e 63 65 20 6d 6f 72 74 67 61 67 65 20 72 61 74 65 73 22 2c 22 32 30 32 35 20 68 75 72 72 69 63 61 6e 65 20 73 65 61 73 6f 6e 22 2c 22 73 6f 6c 61 72 20 65 63 6c 69 70 73 65 73 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 6d 61 72 63 68 20 32 36 22 2c 22 6f 75 20 76 73 20 77 69 63 68 69 74 61 20 73 74 61 74 65 20 73 6f 66 74 62 61 6c 6c 20 73 63 6f 72 65 22 2c 22 6b 6f 68 6c 20 63 6c 6f 73 69 6e 67 20 73 74 6f 72 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a Data Ascii: 11b3)]}'["",["assassin creed shadows","st augustine","refinance mortgage rates","2025 hurricane season","solar eclipses","nyt connections hints march 26","ou vs wichita state softball score","kohl closing stores"],["","","","","","","",""],[],{"google:
2025-03-27 18:44:06 UTC	1303	IN	Data Raw: 79 53 47 63 72 57 48 52 6e 54 6c 4e 75 59 32 74 74 54 6e 49 32 5a 32 68 57 65 44 64 74 64 32 39 74 62 48 70 51 53 57 39 6a 65 56 64 58 52 69 74 31 54 44 5a 56 51 6b 46 52 4c 7a 4a 75 61 7a 4e 48 54 58 5a 74 59 6c 52 73 61 58 42 71 55 57 59 32 62 6b 45 76 61 46 4e 31 62 6e 6c 6d 53 30 74 73 63 57 78 35 4f 56 42 56 56 45 46 52 64 33 46 6f 53 6c 70 31 51 33 63 34 5a 7a 49 79 51 6b 4a 74 4e 6a 46 4a 5a 46 70 54 54 33 46 4d 53 6b 56 34 54 6e 4a 75 64 55 4e 6b 4e 32 6f 78 53 44 64 5a 54 32 39 4a 59 6a 68 70 63 55 64 78 51 33 46 76 5a 6d 74 34 5a 6c 56 34 54 6d 4d 32 5a 33 59 79 52 45 4a 7a 4f 55 68 73 51 54 68 4d 54 45 39 49 53 44 6c 57 54 57 64 31 62 6c 55 72 57 46 56 33 55 48 63 72 4d 6d 35 42 54 6d 5a 56 55 31 4a 52 62 47 68 5a 64 44 5a 4d 5a 30 39 4a 64 6b Data Ascii: ySGcrWHRnTlNuY2ttTnI2Z2hWeDdtd29tbHpQSW9jeVdXRit1TDZVQkFRLzJuazNHTXZtYlRsaXBqUWY2bkEvaFN1bnlmS0tscWx5OVBVVEFRd3FoSlp1Q3c4ZzIyQkJtNjFJZFpTT3FMSkV4TnJudUNkN2oxSDdZT29JYjhpcUdxQ3FvZmt4ZlV4TmM2Z3YyREJzOUhsQThMTE9ISDlWTWd1blUrWFV3UHcrMm5BTmZVU1JRbGhZdDZMZ09Jdk
2025-03-27 18:44:06 UTC	1303	IN	Data Raw: 4a 34 63 7a 68 79 52 57 64 70 4d 69 39 73 63 30 35 32 55 79 39 32 5a 45 70 44 55 56 42 73 52 45 31 6b 5a 30 52 33 54 56 64 30 4d 44 42 56 63 45 64 78 54 58 67 31 59 54 4a 50 64 46 63 77 64 6d 78 5a 54 6d 56 49 52 44 49 79 62 6b 6f 79 55 6d 39 4a 4d 58 52 6c 55 55 74 4d 62 53 74 42 62 55 64 4d 4e 55 63 33 52 45 5a 4b 65 46 6c 77 55 47 78 71 53 45 6b 34 5a 33 4a 6a 4f 57 78 6c 54 32 64 46 57 6c 70 44 62 30 39 30 63 6d 4d 7a 64 43 39 33 51 57 35 45 56 32 4a 33 52 6d 35 46 51 54 46 54 64 46 4a 79 52 31 42 79 55 44 46 54 55 58 46 74 4f 57 31 50 4d 6e 64 4b 52 6d 67 7a 54 69 39 6c 65 57 35 4b 4f 44 46 73 65 57 38 78 51 6d 6c 6f 52 47 31 6c 55 48 42 7a 5a 57 38 32 52 6c 4a 6d 63 31 5a 4a 4c 32 64 49 63 6d 52 35 5a 6b 63 35 57 48 4e 53 62 44 6c 50 53 45 52 47 5a Data Ascii: J4czhyRWdpMi9sc052Uy92ZEpDUVBsRE1kZ0R3TVd0MDBVcEdxTXg1YTJPdFcwdmxZTmVIRDIybkoyUm9JMXRlUUtMbStBbUdMNUc3REZKeFlwUGxqSEk4Z3JjOWxlT2dFWlpDb090cmMzdC93QW5EV2J3Rm5FQTFTdFJyR1ByUDFTUXFtOW1PMndKRmgzTi9leW5KODFseW8xQmloRG1lUHBzZW82RlJmc1ZJL2dIcmR5Zkc5WHNSbDlPSERGZ
2025-03-27 18:44:06 UTC	630	IN	Data Raw: 44 52 56 46 4e 55 6b 46 45 4f 45 46 30 62 31 6c 72 57 6a 45 31 56 55 4a 74 54 45 73 31 53 6b 68 77 62 6d 70 56 5a 33 46 32 64 45 39 31 62 48 52 79 4e 58 46 52 56 54 46 49 64 45 56 36 63 55 64 6b 53 44 64 42 61 31 6f 30 55 48 5a 36 63 6e 6c 6d 64 45 78 32 52 54 56 56 55 6c 5a 6b 53 58 4a 49 55 44 6c 4c 52 43 73 31 54 32 35 59 64 30 64 35 63 31 59 78 65 47 39 79 5a 56 4d 78 5a 46 5a 52 4d 44 59 33 59 32 70 6c 4b 7a 42 75 4f 45 49 32 4f 58 52 4c 4d 54 49 32 4f 58 51 34 54 57 4e 72 56 6e 52 54 62 33 46 61 56 30 4a 57 57 6b 31 69 52 6b 49 35 4f 47 35 75 4f 55 35 4a 56 46 5a 72 56 7a 4a 6c 5a 56 64 75 61 6d 35 75 61 32 4e 31 4e 33 6c 6a 62 44 4a 4a 4c 33 6f 72 62 58 59 77 4f 57 5a 51 53 53 39 6f 55 6e 42 47 53 45 64 42 51 57 52 72 57 46 42 35 52 32 5a 55 64 48 Data Ascii: DRVFNUkFEOEF0b1lrWjE1VUJtTEs1SkhwbmpVZ3F2dE91bHRyNXFRVTFIdEV6cUdkSDdBa1o0UHZ6cnlmdEx2RTVVUlZkSXJIUDlLRCs1T25Yd0d5c1YxeG9yZVMxZFZRMDY3Y2plKzBuOEI2OXRLMTI2OXQ4TWNrVnRTb3FaV0JWWk1iRkI5OG5uOU5JVFZrVzJlZVduam5ua2N1N3ljbDJJL3orbXYwOWZQSS9oUnBGSEdBQWRrWFB5R2ZUdH
2025-03-27 18:44:06 UTC	87	IN	Data Raw: 35 31 0d 0a 52 61 31 68 35 4d 33 5a 4c 64 6e 64 57 52 6c 42 4f 56 57 4a 7a 59 6c 4a 6e 52 55 51 78 54 31 46 51 4d 6a 46 68 59 6d 77 77 56 6c 70 4d 61 46 56 55 56 44 46 30 64 6d 70 73 62 47 74 5a 62 47 35 4d 54 55 64 51 4d 55 4a 48 61 48 52 31 4e 6c 59 32 0d 0a Data Ascii: 51Ra1h5M3ZLdndWRlBOVWJzYlJnRUQxT1FQMjFhYmwwVlpMaFVUVDF0dmpsbGtZbG5MTUdQMUJHaHR1NlY2
2025-03-27 18:44:06 UTC	997	IN	Data Raw: 39 64 35 0d 0a 59 6d 39 4c 4e 6d 49 72 52 6a 42 56 53 31 5a 56 51 55 4e 35 4e 30 70 59 54 45 70 31 4e 55 46 51 62 54 6c 6c 4b 32 6c 7a 51 7a 6b 33 51 6e 6c 53 54 45 5a 32 59 33 4a 4e 62 45 31 30 64 57 35 6c 56 6a 4a 42 51 79 74 4a 5a 6a 56 32 56 45 39 53 4e 79 73 72 64 47 68 77 5a 58 42 61 57 45 4e 79 59 6e 70 55 57 6b 68 4e 61 6c 4e 42 54 47 35 71 4f 44 6c 57 4e 6d 78 30 59 30 5a 57 55 44 52 56 4d 6a 6c 57 4d 6d 74 71 57 6b 74 35 4c 33 4a 79 52 47 46 4d 54 6c 49 7a 53 6a 59 31 53 79 73 79 4d 56 5a 4c 53 31 64 56 65 48 4a 4b 54 45 39 54 53 45 68 32 4f 45 46 32 4f 56 4a 77 54 6c 4e 70 4e 6c 4e 4b 56 57 78 53 53 33 59 30 56 44 46 43 53 33 70 79 55 47 4e 5a 57 57 77 30 65 44 56 30 4e 56 41 31 52 46 68 68 54 48 42 77 65 6b 78 48 4d 56 52 6b 63 45 70 4f 63 6d Data Ascii: 9d5Ym9LNmIrRjBVS1ZVQUN5N0pYTEp1NUFQbTllK2lzQzk3QnlSTEZ2Y3JNbE10dW5lVjJBQytJZjV2VE9SNysrdGhwZXBaWENyYnpUWkhNalNBTG5qODlWNmx0Y0ZWUDRVMjlWMmtqWkt5L3JyRGFMTlIzSjY1SysyMVZLS1dVeHJKTE9TSEh2OEF2OVJwTlNpNlNKVWxSS3Y0VDFCS3pyUGNZWWw0eDV0NVA1RFhhTHBwekxHMVRkcEpOcm
2025-03-27 18:44:06 UTC	997	IN	Data Raw: 62 54 4e 55 55 30 52 43 59 6a 49 30 4d 57 31 73 65 54 4a 59 55 46 5a 43 61 57 68 31 59 58 4a 56 64 32 59 33 4f 56 42 4b 54 33 52 4c 4f 48 64 6d 51 57 68 74 56 6c 4e 58 54 79 39 32 4d 6a 51 35 54 32 4e 71 56 45 52 61 51 55 74 6f 53 57 46 78 53 32 56 55 57 54 68 6f 54 45 6b 72 52 47 64 6f 63 30 56 46 62 6d 35 4a 65 47 70 32 4e 6d 46 71 63 56 42 4d 52 6d 46 61 54 47 56 68 54 69 39 45 56 30 70 53 56 6d 6c 75 57 6c 67 7a 54 55 5a 48 52 30 63 7a 53 55 4a 33 4d 47 5a 4b 65 55 4e 53 4d 30 49 78 55 33 5a 7a 64 58 46 5a 4e 6e 46 36 55 33 4e 79 61 47 46 6b 59 57 39 4b 52 45 63 33 57 6d 52 57 51 32 39 51 54 57 5a 56 62 6a 6b 35 59 6e 4e 50 57 48 56 74 57 6a 68 31 54 32 78 68 52 7a 5a 59 63 69 73 78 51 33 42 78 53 31 70 46 62 6a 4e 53 53 7a 4e 75 4d 6d 70 48 4e 47 4e Data Ascii: bTNUU0RCYjI0MW1seTJYUFZCaWh1YXJVd2Y3OVBKT3RLOHdmQWhtVlNXTy92MjQ5T2NqVERaQUtoSWFxS2VUWThoTEkrRGdoc0VFbm5JeGp2NmFqcVBMRmFaTGVhTi9EV0pSVmluWlgzTUZHR0czSUJ3MGZKeUNSM0IxU3ZzdXFZNnF6U3NyaGFkYW9KREc3WmRWQ29QTWZVbjk5YnNPWHVtWjh1T2xhRzZYcisxQ3BxS1pFbjNSSzNuMmpHNGN
2025-03-27 18:44:06 UTC	530	IN	Data Raw: 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 45 52 51 4d 56 52 6a 62 30 74 71 59 58 4a 4e 52 30 51 77 4e 47 6c 72 64 56 56 56 5a 33 4e 55 55 7a 68 30 54 48 4e 75 54 56 4e 33 56 55 46 58 4f 47 39 4a 51 6b 46 77 44 48 41 61 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 65 76 65 6e 74 69 64 22 3a 22 2d 34 30 33 30 33 33 39 36 33 31 38 38 35 36 35 32 31 31 35 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 Data Ascii: 3Nfc3NwPWVKemo0dERQMVRjb0tqYXJNR0QwNGlrdVVVZ3NUUzh0THNuTVN3VUFXOG9JQkFwDHAa","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":"-4030339631885652115","google:suggestrelevance":[1257,1256,125
2025-03-27 18:44:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:06 UTC	764	OUT	GET /u/assets/entypo/font/entypo.css HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:07 UTC	427	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:06 GMT Content-Type: text/css Content-Length: 17305 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Last-Modified: Tue, 11 Mar 2025 21:32:20 GMT ETag: W/"2D2A6tVWvNk2D2Bf1JJjeA" Accept-Ranges: bytes Vary: Accept-Encoding, User-Agent
2025-03-27 18:44:07 UTC	15957	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 65 6e 74 79 70 6f 27 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 27 65 6e 74 79 70 6f 2e 65 6f 74 3f 36 30 38 35 39 38 34 34 27 29 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 27 65 6e 74 79 70 6f 2e 65 6f 74 3f 36 30 38 35 39 38 34 34 23 69 65 66 69 78 27 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 0a 20 20 20 20 20 20 20 75 72 6c 28 27 65 6e 74 79 70 6f 2e 77 6f 66 66 3f 36 30 38 35 39 38 34 34 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 0a 20 20 20 20 20 20 20 75 72 6c 28 27 65 6e 74 79 70 6f 2e 74 74 66 3f 36 30 38 35 39 38 34 34 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 0a 20 20 20 20 20 20 20 75 Data Ascii: @font-face { font-family: 'entypo'; src: url('entypo.eot?60859844'); src: url('entypo.eot?60859844#iefix') format('embedded-opentype'), url('entypo.woff?60859844') format('woff'), url('entypo.ttf?60859844') format('truetype'), u
2025-03-27 18:44:07 UTC	1348	IN	Data Raw: 69 72 3a 62 65 66 6f 72 65 20 7b 20 63 6f 6e 74 65 6e 74 3a 20 27 5c 65 39 30 34 27 3b 20 7d 20 2f 2a 20 27 ee a4 84 27 20 2a 2f 0a 2e 69 63 6f 6e 2d 72 69 67 68 74 2d 64 69 72 3a 62 65 66 6f 72 65 20 7b 20 63 6f 6e 74 65 6e 74 3a 20 27 5c 65 39 30 35 27 3b 20 7d 20 2f 2a 20 27 ee a4 85 27 20 2a 2f 0a 2e 69 63 6f 6e 2d 75 70 2d 64 69 72 3a 62 65 66 6f 72 65 20 7b 20 63 6f 6e 74 65 6e 74 3a 20 27 5c 65 39 30 36 27 3b 20 7d 20 2f 2a 20 27 ee a4 86 27 20 2a 2f 0a 2e 69 63 6f 6e 2d 64 6f 77 6e 2d 62 6f 6c 64 3a 62 65 66 6f 72 65 20 7b 20 63 6f 6e 74 65 6e 74 3a 20 27 5c 65 39 30 37 27 3b 20 7d 20 2f 2a 20 27 ee a4 87 27 20 2a 2f 0a 2e 69 63 6f 6e 2d 6c 65 66 74 2d 62 6f 6c 64 3a 62 65 66 6f 72 65 20 7b 20 63 6f 6e 74 65 6e 74 3a 20 27 5c 65 39 30 38 27 3b 20 Data Ascii: ir:before { content: '\e904'; } /* '' /.icon-right-dir:before { content: '\e905'; } / '' /.icon-up-dir:before { content: '\e906'; } / '' /.icon-down-bold:before { content: '\e907'; } / '' */.icon-left-bold:before { content: '\e908';

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:06 UTC	775	OUT	GET /u/assets/font-awesome/css/font-awesome.css HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:07 UTC	427	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:07 GMT Content-Type: text/css Content-Length: 28747 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Last-Modified: Tue, 11 Mar 2025 21:32:00 GMT ETag: W/"i7DPVMs4uZci7DOwUwn7Vw" Accept-Ranges: bytes Vary: Accept-Encoding, User-Agent
2025-03-27 18:44:07 UTC	15957	IN	Data Raw: 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 33 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2f 2a 20 46 4f 4e 54 20 50 41 54 48 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 46 6f 6e 74 41 77 65 73 6f 6d 65 27 3b 0a Data Ascii: /! Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) // FONT PATH * -------------------------- */@font-face { font-family: 'FontAwesome';
2025-03-27 18:44:07 UTC	12790	IN	Data Raw: 66 61 2d 74 65 72 6d 69 6e 61 6c 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 32 30 22 3b 0a 7d 0a 2e 66 61 2d 63 6f 64 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 32 31 22 3b 0a 7d 0a 2e 66 61 2d 6d 61 69 6c 2d 72 65 70 6c 79 2d 61 6c 6c 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 72 65 70 6c 79 2d 61 6c 6c 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 32 32 22 3b 0a 7d 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 2d 65 6d 70 74 79 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 2d 66 75 6c 6c 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 2d 6f 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 32 33 22 3b 0a Data Ascii: fa-terminal:before { content: "\f120";}.fa-code:before { content: "\f121";}.fa-mail-reply-all:before,.fa-reply-all:before { content: "\f122";}.fa-star-half-empty:before,.fa-star-half-full:before,.fa-star-half-o:before { content: "\f123";

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:06 UTC	779	OUT	GET /u/assets/mimecast-icons/css/mimecast-icons.css HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:07 UTC	426	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:06 GMT Content-Type: text/css Content-Length: 9828 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Last-Modified: Tue, 11 Mar 2025 21:32:20 GMT ETag: W/"1W25JGg18J81W24se8qpFs" Accept-Ranges: bytes Vary: Accept-Encoding, User-Agent
2025-03-27 18:44:07 UTC	9828	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6d 69 6d 65 63 61 73 74 2d 69 63 6f 6e 73 27 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 2f 6d 69 6d 65 63 61 73 74 2d 69 63 6f 6e 73 2e 65 6f 74 3f 38 38 38 37 30 34 38 34 27 29 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 2f 6d 69 6d 65 63 61 73 74 2d 69 63 6f 6e 73 2e 65 6f 74 3f 38 38 38 37 30 34 38 34 23 69 65 66 69 78 27 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 0a 20 20 20 20 20 20 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 2f 6d 69 6d 65 63 61 73 74 2d 69 63 6f 6e 73 2e 77 6f 66 66 32 3f 38 38 38 37 30 34 38 34 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 0a 20 20 20 20 Data Ascii: @font-face { font-family: 'mimecast-icons'; src: url('../font/mimecast-icons.eot?88870484'); src: url('../font/mimecast-icons.eot?88870484#iefix') format('embedded-opentype'), url('../font/mimecast-icons.woff2?88870484') format('woff2'),

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:07 UTC	778	OUT	GET /u/login/cache.647aa7b26e87d650a310e593a0edd3e2.login-lib.js HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:07 UTC	473	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:07 GMT Content-Type: application/javascript Content-Length: 1127757 Connection: close Cache-Control: max-age=20160 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Last-Modified: Tue, 11 Mar 2025 21:34:20 GMT ETag: W/"ekiU7ryT96wekiVezujhYE" Accept-Ranges: bytes Vary: Accept-Encoding, User-Agent
2025-03-27 18:44:07 UTC	15911	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 74 79 70 65 6f 66 28 65 29 7b 72 65 74 75 72 6e 28 5f 74 79 70 65 6f 66 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 29 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 74 79 70 65 Data Ascii: function _typeof(e){return(_typeof="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function _type
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 3f 65 21 3d 3d 72 3a 22 5e 3d 22 3d 3d 3d 6e 3f 72 26 26 30 3d 3d 3d 65 2e 69 6e 64 65 78 4f 66 28 72 29 3a 22 2a 3d 22 3d 3d 3d 6e 3f 72 26 26 2d 31 3c 65 2e 69 6e 64 65 78 4f 66 28 72 29 3a 22 24 3d 22 3d 3d 3d 6e 3f 72 26 26 65 2e 73 6c 69 63 65 28 2d 72 2e 6c 65 6e 67 74 68 29 3d 3d 3d 72 3a 22 7e 3d 22 3d 3d 3d 6e 3f 2d 31 3c 28 22 20 22 2b 65 2e 72 65 70 6c 61 63 65 28 58 2c 22 20 22 29 2b 22 20 22 29 2e 69 6e 64 65 78 4f 66 28 72 29 3a 22 7c 3d 22 3d 3d 3d 6e 26 26 28 65 3d 3d 3d 72 7c 7c 65 2e 73 6c 69 63 65 28 30 2c 72 2e 6c 65 6e 67 74 68 2b 31 29 3d 3d 3d 72 2b 22 2d 22 29 29 7d 7d 2c 43 48 49 4c 44 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 65 2c 74 2c 6d 2c 67 29 7b 76 61 72 20 24 3d 22 6e 74 68 22 21 3d 3d 68 2e 73 6c 69 63 65 28 30 2c 33 29 2c 76 Data Ascii: ?e!==r:"^="===n?r&&0===e.indexOf(r):"*="===n?r&&-1<e.indexOf(r):"$="===n?r&&e.slice(-r.length)===r:"~="===n?-1<(" "+e.replace(X," ")+" ").indexOf(r):"\|="===n&&(e===r\|\|e.slice(0,r.length+1)===r+"-"))}},CHILD:function(h,e,t,m,g){var $="nth"!==h.slice(0,3),v
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 72 72 65 64 28 29 29 3b 66 75 6e 63 74 69 6f 6e 20 75 65 28 29 7b 43 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 75 65 29 2c 44 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 75 65 29 2c 45 2e 72 65 61 64 79 28 29 7d 45 2e 66 6e 2e 72 65 61 64 79 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 73 65 2e 74 68 65 6e 28 65 29 5b 22 63 61 74 63 68 22 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 45 2e 72 65 61 64 79 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 29 2c 74 68 69 73 7d 2c 45 2e 65 78 74 65 6e 64 28 7b 69 73 52 65 61 64 79 3a 21 31 2c 72 65 61 64 79 57 61 69 74 3a 31 2c 72 65 61 64 79 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 21 30 3d Data Ascii: rred());function ue(){C.removeEventListener("DOMContentLoaded",ue),D.removeEventListener("load",ue),E.ready()}E.fn.ready=function(e){return se.then(e)["catch"](function(e){E.readyException(e)}),this},E.extend({isReady:!1,readyWait:1,ready:function(e){(!0=
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 29 7d 29 3b 69 66 28 63 26 26 28 74 3d 28 65 3d 53 65 28 72 2c 6e 5b 30 5d 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 21 31 2c 6e 2c 6f 29 29 2e 66 69 72 73 74 43 68 69 6c 64 2c 31 3d 3d 3d 65 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 74 29 2c 74 7c 7c 6f 29 29 7b 66 6f 72 28 73 3d 28 61 3d 45 2e 6d 61 70 28 41 28 65 2c 22 73 63 72 69 70 74 22 29 2c 6a 65 29 29 2e 6c 65 6e 67 74 68 3b 64 3c 63 3b 64 2b 2b 29 75 3d 65 2c 64 21 3d 3d 66 26 26 28 75 3d 45 2e 63 6c 6f 6e 65 28 75 2c 21 30 2c 21 30 29 2c 73 29 26 26 45 2e 6d 65 72 67 65 28 61 2c 41 28 75 2c 22 73 63 72 69 70 74 22 29 29 2c 69 2e 63 61 6c 6c 28 6e 5b 64 5d 2c 75 2c 64 29 3b 69 66 28 73 29 66 6f 72 28 6c 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 2e 6f 77 6e 65 72 44 Data Ascii: )});if(c&&(t=(e=Se(r,n[0].ownerDocument,!1,n,o)).firstChild,1===e.childNodes.length&&(e=t),t\|\|o)){for(s=(a=E.map(A(e,"script"),je)).length;d<c;d++)u=e,d!==f&&(u=E.clone(u,!0,!0),s)&&E.merge(a,A(u,"script")),i.call(n[d],u,d);if(s)for(l=a[a.length-1].ownerD
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 65 74 75 72 6e 20 74 68 69 73 2e 61 6e 69 6d 61 74 65 28 72 2c 65 2c 74 2c 6e 29 7d 7d 29 2c 45 2e 74 69 6d 65 72 73 3d 5b 5d 2c 45 2e 66 78 2e 74 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3d 30 2c 6e 3d 45 2e 74 69 6d 65 72 73 3b 66 6f 72 28 24 74 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 74 3c 6e 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 28 65 3d 6e 5b 74 5d 29 28 29 7c 7c 6e 5b 74 5d 21 3d 3d 65 7c 7c 6e 2e 73 70 6c 69 63 65 28 74 2d 2d 2c 31 29 3b 6e 2e 6c 65 6e 67 74 68 7c 7c 45 2e 66 78 2e 73 74 6f 70 28 29 2c 24 74 3d 75 6e 64 65 66 69 6e 65 64 7d 2c 45 2e 66 78 2e 74 69 6d 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 45 2e 74 69 6d 65 72 73 2e 70 75 73 68 28 65 29 2c 45 2e 66 78 2e 73 74 61 72 74 28 29 7d 2c 45 2e 66 78 2e 69 6e 74 65 Data Ascii: eturn this.animate(r,e,t,n)}}),E.timers=[],E.fx.tick=function(){var e,t=0,n=E.timers;for($t=Date.now();t<n.length;t++)(e=n[t])()\|\|n[t]!==e\|\|n.splice(t--,1);n.length\|\|E.fx.stop(),$t=undefined},E.fx.timer=function(e){E.timers.push(e),E.fx.start()},E.fx.inte
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 2e 61 70 70 65 6e 64 28 74 68 69 73 29 29 2c 74 68 69 73 7d 2c 77 72 61 70 49 6e 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 76 28 6e 29 3f 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 45 28 74 68 69 73 29 2e 77 72 61 70 49 6e 6e 65 72 28 6e 2e 63 61 6c 6c 28 74 68 69 73 2c 65 29 29 7d 29 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 45 28 74 68 69 73 29 2c 74 3d 65 2e 63 6f 6e 74 65 6e 74 73 28 29 3b 74 2e 6c 65 6e 67 74 68 3f 74 2e 77 72 61 70 41 6c 6c 28 6e 29 3a 65 2e 61 70 70 65 6e 64 28 6e 29 7d 29 7d 2c 77 72 61 70 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 76 28 74 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: .append(this)),this},wrapInner:function(n){return v(n)?this.each(function(e){E(this).wrapInner(n.call(this,e))}):this.each(function(){var e=E(this),t=e.contents();t.length?t.wrapAll(n):e.append(n)})},wrap:function(t){var n=v(t);return this.each(function(e
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 70 61 72 73 65 54 77 6f 44 69 67 69 74 59 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 77 28 65 29 2b 28 36 38 3c 77 28 65 29 3f 31 39 30 30 3a 32 65 33 29 7d 3b 76 61 72 20 6b 2c 46 65 3d 49 65 28 22 46 75 6c 6c 59 65 61 72 22 2c 21 30 29 3b 66 75 6e 63 74 69 6f 6e 20 49 65 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 65 3f 28 50 65 28 74 68 69 73 2c 74 2c 65 29 2c 6d 2e 75 70 64 61 74 65 4f 66 66 73 65 74 28 74 68 69 73 2c 6e 29 2c 74 68 69 73 29 3a 4e 65 28 74 68 69 73 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 4e 65 28 65 2c 74 29 7b 69 66 28 21 65 2e 69 73 56 61 6c 69 64 28 29 29 72 65 74 75 72 6e 20 4e 61 4e 3b 76 61 72 20 6e 3d 65 2e 5f 64 2c 72 3d 65 2e 5f Data Ascii: parseTwoDigitYear=function(e){return w(e)+(68<w(e)?1900:2e3)};var k,Fe=Ie("FullYear",!0);function Ie(t,n){return function(e){return null!=e?(Pe(this,t,e),m.updateOffset(this,n),this):Ne(this,t)}}function Ne(e,t){if(!e.isValid())return NaN;var n=e._d,r=e._
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 74 73 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 73 56 61 6c 69 64 28 29 26 26 65 2e 69 73 56 61 6c 69 64 28 29 3f 65 3c 74 68 69 73 3f 74 68 69 73 3a 65 3a 7a 28 29 7d 29 2c 67 65 3d 65 28 22 6d 6f 6d 65 6e 74 28 29 2e 6d 61 78 20 69 73 20 64 65 70 72 65 63 61 74 65 64 2c 20 75 73 65 20 6d 6f 6d 65 6e 74 2e 6d 69 6e 20 69 6e 73 74 65 61 64 2e 20 68 74 74 70 3a 2f 2f 6d 6f 6d 65 6e 74 6a 73 2e 63 6f 6d 2f 67 75 69 64 65 73 2f 23 2f 77 61 72 6e 69 6e 67 73 2f 6d 69 6e 2d 6d 61 78 2f 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 46 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 73 56 61 6c 69 64 28 29 26 26 65 2e 69 73 56 61 6c 69 64 28 29 3f 74 68 69 73 3c 65 3f 74 68 69 73 3a 65 3a Data Ascii: ts);return this.isValid()&&e.isValid()?e<this?this:e:z()}),ge=e("moment().max is deprecated, use moment.min instead. http://momentjs.com/guides/#/warnings/min-max/",function(){var e=F.apply(null,arguments);return this.isValid()&&e.isValid()?this<e?this:e:
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 29 7d 2c 75 2e 77 65 65 6b 3d 75 2e 77 65 65 6b 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6c 6f 63 61 6c 65 44 61 74 61 28 29 2e 77 65 65 6b 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 74 3a 74 68 69 73 2e 61 64 64 28 37 2a 28 65 2d 74 29 2c 22 64 22 29 7d 2c 75 2e 69 73 6f 57 65 65 6b 3d 75 2e 69 73 6f 57 65 65 6b 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 5a 65 28 74 68 69 73 2c 31 2c 34 29 2e 77 65 65 6b 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 74 3a 74 68 69 73 2e 61 64 64 28 37 2a 28 65 2d 74 29 2c 22 64 22 29 7d 2c 75 2e 77 65 65 6b 73 49 6e 59 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 6c 6f 63 61 6c 65 44 61 74 61 28 29 2e 5f 77 65 65 Data Ascii: )},u.week=u.weeks=function(e){var t=this.localeData().week(this);return null==e?t:this.add(7(e-t),"d")},u.isoWeek=u.isoWeeks=function(e){var t=Ze(this,1,4).week;return null==e?t:this.add(7(e-t),"d")},u.weeksInYear=function(){var e=this.localeData()._wee
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 67 28 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 2e 20 50 6c 65 61 73 65 20 75 73 65 20 74 6f 49 53 4f 53 74 72 69 6e 67 28 29 20 69 6e 73 74 65 61 64 20 28 6e 6f 74 69 63 65 20 74 68 65 20 63 61 70 69 74 61 6c 73 29 22 2c 4d 6e 29 2c 4e 2e 6c 61 6e 67 3d 65 74 2c 72 28 22 58 22 2c 30 2c 30 2c 22 75 6e 69 78 22 29 2c 72 28 22 78 22 2c 30 2c 30 2c 22 76 61 6c 75 65 4f 66 22 29 2c 63 28 22 78 22 2c 77 65 29 2c 63 28 22 58 22 2c 2f 5b 2b 2d 5d 3f 5c 64 2b 28 5c 2e 5c 64 7b 31 2c 33 7d 29 3f 2f 29 2c 44 28 22 58 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 5f 64 3d 6e 65 77 20 44 61 74 65 28 31 65 33 2a 70 61 72 73 65 46 6c 6f 61 74 28 65 29 29 7d 29 2c 44 28 22 78 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 5f 64 3d 6e 65 77 Data Ascii: g() is deprecated. Please use toISOString() instead (notice the capitals)",Mn),N.lang=et,r("X",0,0,"unix"),r("x",0,0,"valueOf"),c("x",we),c("X",/[+-]?\d+(\.\d{1,3})?/),D("X",function(e,t,n){n._d=new Date(1e3*parseFloat(e))}),D("x",function(e,t,n){n._d=new

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (372)
Category:	downloaded
Size (bytes):	28747
Entropy (8bit):	4.827937146352761
Encrypted:	false
SSDEEP:	384:95f0j++ArEPSIDqvnIDyYTnBrbkPvVY5JY+n:/0j++A4PSIDqvnI+YTBrQPvVwJjn
MD5:	3F05A51A1E5260F4179DB8CA65307A6A
SHA1:	2148B3DDDCA54F413E8BA50AA48B53B400BD99B8
SHA-256:	C374EFBA54279628793F04E10EBF5D0C1B4DBC36B3F4132D9235F01D64CA5C8E
SHA-512:	5C9DE7B561E5E34A2912213EE9D1A17CAF4D00A38210BAE98E205140AB6EEAE25FF4F962F1763E1E2929EEB945CD8E0494B485B738F1F461A01EA97B3CB49EA2
Malicious:	false
Reputation:	low
URL:	https://rsm.login-us.mimecast.com/u/assets/font-awesome/css/font-awesome.css
Preview:	/!. Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url('../fonts/fontawesome-webfont.eot?v=4.3.0');. src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.3.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.3.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.3.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.3.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.3.0#fontawesomeregular') format('svg');. font-weight: normal;. font-style: normal;.}..fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;. transform: translate(0, 0);.}./ makes the font 33% larger relat

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (540)
Category:	downloaded
Size (bytes):	582760
Entropy (8bit):	5.225829751990983
Encrypted:	false
SSDEEP:	12288:NUQ0hsHtCo/sFhbCimoC8m3CeDKzPmDm2XOFXi9oBb64sj5BFViAJ23R+MvYTh3V:doW
MD5:	3FFC594B26082D46ACF214C2023ADE56
SHA1:	50068FD0ED2FD7A4C12A0475C0C35AC864239F3F
SHA-256:	5BA8F4BAA5B0333578B377ACCD40B2FA88141055CDAA932635DD4DF9AC0DA39A
SHA-512:	891B804C5713BBA18493EA50E52FA1D4EE392DA5B6F98D5918CD9465B205BDBEEF06F2D02F2CB7E882924CA78C6B55627727363CCFA0B648D1106D88338DAF2B
Malicious:	false
Reputation:	low
URL:	https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA
Preview:	..........<!DOCTYPE html>.<html lang="en" id="ng-app" ng-app="appLogin" ng-cloak="" class="ng-cloak animate-on-enter-alt" ng-controller="AppLoginController as appCtrl">. <head>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">.. <title></title>... <link href="../assets/entypo/font/entypo.css" type="text/css" rel="stylesheet"/>. <link href="../assets/font-awesome/css/font-awesome.css" type="text/css" rel="stylesheet"/>. <link href="../assets/mimecast-icons/css/mimecast-icons.css" type="text/css" rel="stylesheet"/>. <link href="https://fonts.googleapis.com/css?family=Open+Sans:400,600,700" rel="stylesheet">.. <script async="async" src="https://static.srcspot.com/libs/galindo.js" type="application/javascript"></script>.. <style type="text/css">.@charset "UTF-8";./* Layout for this specific app /./ S

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	19344
Entropy (8bit):	5.349024943773106
Encrypted:	false
SSDEEP:	384:tCo8KggTA9HtdBprSOT98FYrIUnh6EvvPFCdF1TYBn:tKKggTA/dPrSsVIUnpvMC
MD5:	C48DD271ACE7DAD579785AA20A2C7169
SHA1:	EF142809637BB0E34165B218C1D714262BA451BC
SHA-256:	080BB774D3E2C9A612D10202342AEDC7687BF0A2576C7BA97AB273194914A877
SHA-512:	EA8837E69621C13641E708661AD79C37883451923A249EB948CC1A65C50E743E5587E3A58F1E6B2C0EE5A1A7ED6F8EA3B7E5B1C2DE40F4500D335712BDF9C7D5
Malicious:	false
Reputation:	low
URL:	https://rsm.login-us.mimecast.com/u/login/assets/languages/en.json?ver=1.16.1
Preview:	{.."$I18N_SPINNER_LOADING": "Loading...",.."PWD_RULES_CHECKER_LOWER_CASE": "Include at least one lowercase character (a-z)",.."PWD_RULES_CHECKER_MIN_CHR_AFTER": "characters",.."PWD_RULES_CHECKER_MIN_CHR_BEFORE": "Minimum",.."PWD_RULES_CHECKER_NUMBER": "Include at least one numeric character (0-9)",.."PWD_RULES_CHECKER_UPPER_CASE": "Include at least one uppercase character (A-Z)",.."PWD_RULES_CHECKER_PASSWORDS_DONT_MATCH": "New Password and Confirm Password must match",.."PWD_RULES_CHECKER_PASSWORDS_MATCH": "New Password and Confirm Password must be the same",.."PWD_RULES_CHECKER_PASSWORDS_SAME_AS_CURRENT": "Current and new password can not be similar",.."PWD_RULES_CHECKER_SPECIAL_CHAR": "Include at least one non-alphanumeric ( !@#$..)",.."$I18N_ERR_USER_PREFERENCE_FETCH_HISTORY": "Sorry, we.re unable to load your history. Please try again later. If the problem persists, contact your service delivery team.",.."$I18N_ERR_USER_PREFERENCE_SAVE_HISTORY": "Sorry, we.re unable to save ite

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:07 UTC	774	OUT	GET /u/login/cache.fbcb25980edc88e8c170bab371b118d9.login.js HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:07 UTC	472	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:07 GMT Content-Type: application/javascript Content-Length: 210080 Connection: close Cache-Control: max-age=20160 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Last-Modified: Tue, 11 Mar 2025 21:34:20 GMT ETag: W/"yyFo8+G+OrgyyFpZmacSXg" Accept-Ranges: bytes Vary: Accept-Encoding, User-Agent
2025-03-27 18:44:07 UTC	15912	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 6e 67 75 6c 61 72 2e 6d 6f 64 75 6c 65 28 22 6d 65 73 73 61 67 65 46 6f 72 6d 61 74 74 65 72 2e 64 69 72 65 63 74 69 76 65 22 2c 5b 5d 29 2e 64 69 72 65 63 74 69 76 65 28 22 6d 63 4d 65 73 73 61 67 65 46 6f 72 6d 61 74 74 65 72 22 2c 5b 22 24 74 72 61 6e 73 6c 61 74 65 22 2c 22 24 73 61 6e 69 74 69 7a 65 22 2c 22 24 69 6e 6a 65 63 74 6f 72 22 2c 22 24 77 69 6e 64 6f 77 22 2c 22 24 6c 6f 63 61 74 69 6f 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 73 2c 6c 2c 6f 2c 69 29 7b 72 65 74 75 72 6e 7b 72 65 73 74 72 69 63 74 3a 22 41 22 2c 74 65 6d 70 6c 61 74 65 55 72 6c 3a 22 63 6f 6d 70 6f 6e 65 6e 74 73 2f 6d 65 73 73 61 67 65 2d 66 6f 72 6d 61 74 74 65 72 2f 6d 65 73 73 61 67 65 2d 66 6f 72 6d 61 74 74 65 72 2e 74 70 6c Data Ascii: "use strict";angular.module("messageFormatter.directive",[]).directive("mcMessageFormatter",["$translate","$sanitize","$injector","$window","$location",function(n,s,l,o,i){return{restrict:"A",templateUrl:"components/message-formatter/message-formatter.tpl
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 5c 6e 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 5c 6e 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 61 6e 65 6c 2d 70 61 64 64 69 6e 67 2d 74 6f 70 20 73 65 70 65 72 61 74 6f 72 22 3e 3c 2f 64 69 76 3e 5c 6e 5c 6e 20 20 20 20 3c 6c 61 62 65 6c 20 63 6c 61 73 73 3d 22 74 6f 2d 6c 61 62 65 6c 22 20 74 72 61 6e 73 6c 61 74 65 3d 22 44 41 54 45 5f 52 41 4e 47 45 5f 50 49 43 4b 45 52 5f 53 49 4d 50 4c 45 5f 4c 41 42 45 4c 5f 54 4f 22 3e 3c 2f 6c 61 62 65 6c 3e 5c 6e 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6e 70 75 74 2d 67 72 6f 75 70 20 65 6e 64 2d 64 61 74 65 22 3e 5c 6e 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6e 70 75 74 2d 64 61 74 65 72 61 6e 67 65 20 69 6e 70 75 74 2d 67 72 6f 75 70 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 Data Ascii: \n </div>\n\n <div class="panel-padding-top seperator"></div>\n\n <label class="to-label" translate="DATE_RANGE_PICKER_SIMPLE_LABEL_TO"></label>\n <div class="input-group end-date">\n <div class="input-daterange input-group">\n
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 6d 61 69 6e 73 4d 61 6e 61 67 65 72 42 75 6c 6b 41 64 64 43 74 72 6c 2e 62 75 6c 6b 44 6f 6d 61 69 6e 73 43 6f 6c 6c 65 63 74 69 6f 6e 2e 76 61 6c 69 64 2e 6c 65 6e 67 74 68 20 7c 7c 20 64 6f 6d 61 69 6e 73 4d 61 6e 61 67 65 72 42 75 6c 6b 41 64 64 43 74 72 6c 2e 62 75 6c 6b 44 6f 6d 61 69 6e 73 43 6f 6c 6c 65 63 74 69 6f 6e 2e 76 61 6c 69 64 2e 6c 65 6e 67 74 68 20 3e 20 35 30 22 20 6e 67 2d 69 66 3d 22 64 6f 6d 61 69 6e 73 4d 61 6e 61 67 65 72 42 75 6c 6b 41 64 64 43 74 72 6c 2e 73 65 63 6f 6e 64 53 74 65 70 22 3e 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 3c 2f 64 69 76 3e 27 29 7d 5d 29 2c 61 6e 67 75 6c 61 72 2e 6d 6f 64 75 6c 65 28 22 63 6f 6d 70 6f 6e 65 6e 74 73 2f 64 6f 6d 61 69 6e 73 2d 6d 61 6e 61 67 65 72 2f 6d 6f 64 61 6c 2f 77 69 7a 61 72 64 2d 73 74 Data Ascii: mainsManagerBulkAddCtrl.bulkDomainsCollection.valid.length \|\| domainsManagerBulkAddCtrl.bulkDomainsCollection.valid.length > 50" ng-if="domainsManagerBulkAddCtrl.secondStep"></button>\n</div>')}]),angular.module("components/domains-manager/modal/wizard-st
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 74 70 6c 2e 68 74 6d 6c 22 2c 5b 5d 29 2e 72 75 6e 28 5b 22 24 74 65 6d 70 6c 61 74 65 43 61 63 68 65 22 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 2e 70 75 74 28 22 63 6f 6d 70 6f 6e 65 6e 74 73 2f 69 6e 2d 61 70 70 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2f 69 6e 2d 61 70 70 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2e 74 70 6c 2e 68 74 6d 6c 22 2c 27 3c 64 69 76 20 69 64 3d 22 69 6e 2d 61 70 70 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 22 20 63 6c 61 73 73 3d 22 67 72 6f 77 6c 2d 63 6f 6e 74 61 69 6e 65 72 22 20 6e 67 2d 63 6c 61 73 73 3d 22 77 72 61 70 70 65 72 43 6c 61 73 73 65 73 28 29 22 3e 5c 6e 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 69 74 65 6d 22 20 6e 67 2d 72 65 70 65 61 74 3d 22 6d 65 73 73 61 67 65 20 Data Ascii: tpl.html",[]).run(["$templateCache",function(n){n.put("components/in-app-notification/in-app-notification.tpl.html",'<div id="in-app-notification" class="growl-container" ng-class="wrapperClasses()">\n <div class="notification-item" ng-repeat="message
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 4c 42 41 52 2d 2d 5c 78 33 65 5c 6e 20 20 20 20 20 20 20 20 3c 64 69 76 20 6d 63 2d 6e 6f 72 74 68 3d 22 32 32 22 20 6e 67 2d 69 66 3d 22 63 74 72 6c 2e 73 65 6c 65 63 74 69 6f 6e 4f 70 74 69 6f 6e 73 2e 6c 65 6e 67 74 68 3e 30 22 20 6e 67 2d 69 6e 63 6c 75 64 65 3d 22 5c 27 63 6f 6d 70 6f 6e 65 6e 74 73 2f 6c 69 73 74 2d 64 65 74 61 69 6c 2f 6c 69 73 74 2f 74 6f 6f 6c 62 61 72 2f 6c 69 73 74 2d 74 6f 6f 6c 62 61 72 2e 74 70 6c 2e 68 74 6d 6c 5c 27 22 3e 3c 2f 64 69 76 3e 5c 6e 5c 6e 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 20 53 43 52 4f 4c 4c 41 42 4c 45 20 45 4d 41 49 4c 20 4c 49 53 54 2d 2d 5c 78 33 65 5c 6e 20 20 20 20 20 20 20 20 3c 64 69 76 20 6d 63 2d 63 65 6e 74 65 72 20 6e 67 2d 69 6e 63 6c 75 64 65 3d 22 5c 27 63 6f 6d 70 6f 6e 65 6e 74 73 Data Ascii: LBAR--\x3e\n <div mc-north="22" ng-if="ctrl.selectionOptions.length>0" ng-include="\'components/list-detail/list/toolbar/list-toolbar.tpl.html\'"></div>\n\n \x3c!-- SCROLLABLE EMAIL LIST--\x3e\n <div mc-center ng-include="\'components
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 68 35 3e 2d 2d 5c 78 33 65 5c 6e 5c 6e 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 3c 2f 64 69 76 3e 2d 2d 5c 78 33 65 5c 6e 5c 6e 20 20 20 20 3c 2f 66 6f 72 6d 3e 5c 6e 5c 6e 3c 2f 64 69 76 3e 5c 6e 27 29 7d 5d 29 2c 61 6e 67 75 6c 61 72 2e 6d 6f 64 75 6c 65 28 22 63 6f 6d 70 6f 6e 65 6e 74 73 2f 6c 6f 67 69 6e 2f 64 69 73 63 6c 61 69 6d 65 72 2f 64 69 73 63 6c 61 69 6d 65 72 2e 74 70 6c 2e 68 74 6d 6c 22 2c 5b 5d 29 2e 72 75 6e 28 5b 22 24 74 65 6d 70 6c 61 74 65 43 61 63 68 65 22 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 2e 70 75 74 28 22 63 6f 6d 70 6f 6e 65 6e 74 73 2f 6c 6f 67 69 6e 2f 64 69 73 63 6c 61 69 6d 65 72 2f 64 69 73 63 6c 61 69 6d 65 72 2e 74 70 6c 2e 68 74 6d 6c 22 2c 27 5c 78 33 63 21 2d 2d 20 3c 68 34 20 63 6c 61 73 73 3d 22 6e 6f 2d Data Ascii: h5>--\x3e\n\n \x3c!--</div>--\x3e\n\n </form>\n\n</div>\n')}]),angular.module("components/login/disclaimer/disclaimer.tpl.html",[]).run(["$templateCache",function(n){n.put("components/login/disclaimer/disclaimer.tpl.html",'\x3c!-- <h4 class="no-
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 6e 65 72 22 3e 5c 6e 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 5c 6e 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 31 32 20 74 65 78 74 2d 63 65 6e 74 65 72 20 6c 6f 67 6f 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 6e 67 2d 73 72 63 3d 22 7b 7b 61 70 70 43 74 72 6c 2e 62 72 61 6e 64 69 6e 67 2e 6c 6f 67 6f 7d 7d 22 20 20 61 6c 74 3d 22 4d 69 6d 65 63 61 73 74 22 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 22 2f 3e 5c 6e 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 5c 6e 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 3c 2f 64 69 76 3e 5c 6e 27 29 7d 5d 29 2c 61 6e 67 75 6c 61 72 2e 6d 6f 64 75 6c 65 28 22 63 6f 6d 70 6f 6e 65 6e 74 73 2f 6c 6f 67 69 6e 2f 6f 74 70 2f Data Ascii: ner">\n <div class="row">\n <div class="col-md-12 text-center logo-container">\n <img ng-src="{{appCtrl.branding.logo}}" alt="Mimecast" class="logo"/>\n </div>\n\n </div>\n</div>\n')}]),angular.module("components/login/otp/
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 6e 6f 2d 6d 61 72 67 69 6e 2d 74 6f 70 20 74 65 78 74 2d 74 68 69 6e 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 20 6e 67 2d 63 6c 61 73 73 3d 22 69 63 6f 6e 22 3e 3c 2f 69 3e 7b 7b 5c 27 4d 4f 44 55 4c 45 5f 4e 41 4d 45 5c 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 7d 7d 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 32 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 61 6e 65 6c 2d 62 6f 64 79 20 6e 6f 2d 70 61 64 64 69 6e 67 2d 6c 65 66 74 20 6e 6f 2d 70 61 64 64 69 6e 67 2d 72 69 67 68 74 20 6e 6f 2d 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 22 20 Data Ascii: <h2 class="no-margin-top text-thin">\n <i ng-class="icon"></i>{{\'MODULE_NAME\' \| translate}}\n </h2>\n <div class="panel-body no-padding-left no-padding-right no-padding-bottom"
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 64 65 66 61 75 6c 74 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 63 2d 63 6c 69 63 6b 2d 64 69 73 61 62 6c 65 3d 22 63 6c 6f 73 65 4d 6f 64 61 6c 28 29 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 6c 61 74 65 3d 22 24 49 31 38 4e 5f 4d 4f 44 41 4c 5f 55 53 45 52 5f 43 41 4e 43 45 4c 5f 42 54 4e 22 3e 5c 6e 20 20 20 20 20 20 20 20 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 3c 64 69 76 20 6e 67 2d 69 66 3d 22 69 73 50 61 73 73 77 6f 72 64 43 68 61 6e 67 65 64 22 3e 5c Data Ascii: button>\n <button type="submit"\n class="btn btn-default"\n mc-click-disable="closeModal()"\n translate="$I18N_MODAL_USER_CANCEL_BTN">\n </button>\n </div>\n <div ng-if="isPasswordChanged">\
2025-03-27 18:44:07 UTC	16384	IN	Data Raw: 3d 22 63 6f 6c 2d 73 6d 2d 38 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 67 2d 6d 6f 64 65 6c 3d 22 70 72 65 66 65 72 65 6e 63 65 73 43 6f 6e 74 72 6f 6c 6c 65 72 43 74 72 6c 2e 68 6f 6d 65 70 61 67 65 4d 6f 64 65 6c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6e 67 2d 6f 70 74 69 6f 6e 73 3d 22 68 6f 6d 65 70 61 67 65 2e 6c 61 62 65 6c 20 7c 20 74 72 61 6e 73 6c 61 74 65 20 66 6f 72 20 68 6f 6d 65 70 61 67 65 20 69 6e 20 70 72 65 66 65 72 65 6e 63 65 73 43 6f 6e 74 72 6f 6c 6c 65 72 43 74 72 6c 2e 68 6f 6d 65 70 61 67 65 73 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 22 20 69 64 3d Data Ascii: ="col-sm-8">\n <select ng-model="preferencesControllerCtrl.homepageModel"\n ng-options="homepage.label \| translate for homepage in preferencesControllerCtrl.homepages"\n class="form-control" id=

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:08 UTC	583	OUT	GET /libs/galindo.js HTTP/1.1 Host: static.srcspot.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://rsm.login-us.mimecast.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:08 UTC	788	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AKDAyIufO2-7M-svP3ceYLh4R2WI5IVnZVvaxf1UkxdbYHXL9Jp9x6aBf3KjEhRuGSvCIJGY x-goog-generation: 1736159455110857 x-goog-metageneration: 1 x-goog-stored-content-encoding: gzip x-goog-stored-content-length: 45211 Content-Encoding: gzip x-goog-hash: crc32c=LZm4aQ== x-goog-hash: md5=EgMaQJ5Pr1KNXCouBPEofg== x-goog-storage-class: STANDARD Accept-Ranges: bytes Content-Length: 45211 Server: UploadServer Date: Thu, 27 Mar 2025 18:35:57 GMT Expires: Thu, 27 Mar 2025 18:50:57 GMT Cache-Control: no-transform, public, max-age=900 Age: 491 Last-Modified: Mon, 06 Jan 2025 10:30:55 GMT ETag: "12031a409e4faf528d5c2a2e04f1287e" Content-Type: application/javascript Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-27 18:44:08 UTC	209	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4c bd 6b 93 b2 4a ba 26 fc 57 f6 97 d9 ab 7b aa df 28 2d 51 71 7a d6 4c 94 58 9e 50 40 b0 4c b5 63 c7 04 92 20 8a 88 20 20 ba 63 e6 b7 bf f7 21 5d 33 1f 56 f7 53 55 0a 49 e6 7d b8 ae fb 44 ed 17 ff f6 bf 5a 8d d6 6f f5 fb ba 1e fc f9 af 3f be 27 8d 5c 19 d9 4c ac f2 3f fe f1 c7 8f 97 2c c5 aa 3e 3e f1 07 e1 9e 1d b1 6a cf 0f 3e fe b0 7a ce 85 fd 19 2c 8c 64 84 3f da f9 cf 30 cd a6 42 7b c2 4f 63 eb b5 38 1b c9 15 fe 79 08 ec 5f b1 3a 19 f4 19 2d 18 ea d9 97 e8 b7 e8 02 f6 42 74 6f d2 6b 2a f8 29 4e b3 40 ac 5c 39 99 e3 f7 f1 4a 46 5d 2d f1 63 ce 5e da f5 fa 20 56 82 be 14 cb 59 2e 96 42 c3 Data Ascii: LkJ&W{(-QqzLXP@Lc c!]3VSUI}DZo?'\L?,>>j>z,d?0B{Oc8y_:-Btok*)N@\9JF]-c^ VY.B
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 4b 9c 1f e9 cf 25 cd fa b4 b6 be b4 8d cc 7c 1a 59 48 3f 5e 6b b1 1a 98 27 5e ea 50 7a 5e 36 7b 79 d9 91 ae 78 85 5b 95 d2 ee 68 f4 c9 8b 74 8d 4c 13 bd c9 93 3e 6b d8 87 c2 95 de 04 7e 78 a5 d9 d7 8f 75 b2 e0 9f 79 9a dc 84 db be 0d 69 15 5d cf 14 5a 98 87 f4 83 eb 7d 1d a3 26 98 d1 0f bd b6 99 a7 99 25 b4 13 7d 6e 3b 86 0d 79 09 87 ee 64 ef e5 12 ae 08 5f 38 c3 8f d1 dc f8 10 ce 45 5a b8 b5 27 78 0a e1 7e ca d5 0e 57 1f e8 49 f8 9d 26 5b a1 e1 2a 8c 60 2f ad dd 50 2e f0 87 78 7f 09 bc e2 33 b0 f1 c1 4e 46 36 16 f6 45 ce b6 78 8d 28 aa 07 f9 8c ae 66 24 8e d0 a4 5c 09 9b ee db f2 ef 87 33 fd b3 bb fe 7c 98 eb 88 fe 79 ee 0b db 0d 26 5e 76 a1 4d f1 66 89 8e 0b a7 93 ea 8e 86 70 f3 8b 70 71 9b 47 41 fd 23 7a fb c0 a5 27 d4 a6 86 b0 fb c1 42 cf f0 32 95 91 Data Ascii: K%\|YH?^k'^Pz^6{yx[htL>k~xuyi]Z}&%}n;yd_8EZ'x~WI&[*`/P.x3NF6Ex(f$\3\|y&^vMfppqGA#z'B2
2025-03-27 18:44:08 UTC	997	IN	Data Raw: c4 1d 39 f1 92 61 6d 90 54 0b c7 92 1b 10 d7 91 9e 91 58 6a 95 2f b4 79 f0 bb c0 fb 06 fb 48 3f b7 d8 66 85 3d 32 cd b9 52 37 cf fc 94 bf 29 cb e4 6a 2c d7 46 b6 78 a6 19 fd b5 2b e5 22 4d 26 8f 0e aa 26 f8 bf 25 98 2a fc 5c 34 6b e9 62 e5 37 f8 4f 58 25 08 8b 25 5c fc 4c 3d eb 48 27 05 ef e2 d0 81 db da cf 7d 7a 40 f3 78 68 6e 72 b3 c7 5f de 42 bf 53 b2 13 7b ea 99 2d ec 79 b0 d2 93 1b 29 2c dc a2 57 06 66 8c bb 11 a6 89 04 a7 60 b2 5d f8 d9 6f 82 4d 2e 59 e5 ab 34 db a4 20 92 6c ef dc 11 18 cc c5 c7 45 79 69 6b 0c fa f5 8d 47 73 2b c0 b5 7b 74 1e f7 45 f5 29 fa 3e aa d4 21 1e 89 6f 90 6f 5a 9f d9 ad 27 57 b4 10 a5 9e a5 0f 2f 9b bf 72 92 ac 4f 69 ea 49 ce bb 2f 5c 50 9b b8 3d 12 2b 94 47 7f bf 0e 44 b7 61 87 64 18 99 0d f2 3d f1 d9 31 3e f7 75 9a 19 a2 Data Ascii: 9amTXj/yH?f=2R7)j,Fx+"M&&%*\4kb7OX%%\L=H'}z@xhnr_BS{-y),Wf`]oM.Y4 lEyikGs+{tE)>!ooZ'W/rOiI/\P=+GDad=1>u
2025-03-27 18:44:08 UTC	997	IN	Data Raw: f3 89 ca 60 83 8a dc 1b 5d e9 89 b4 75 9a 26 d7 07 5d d6 69 90 7e ac 45 df 20 ec 97 26 02 a4 5e 8c 26 6f 6b e3 25 8b 27 59 8d 1f ff 26 97 85 64 94 d9 e8 59 12 45 96 74 78 8b da 8d d0 16 df 44 af c0 b8 6c 44 77 1c fc 56 e9 8f e8 5f 02 ab b3 91 73 83 d6 2c 56 1b b9 30 bd bd e8 32 ba f0 43 c0 04 3a 6c 2c fc 94 1a 48 a3 e6 81 57 f2 21 6b 9f 80 2a 22 e6 29 2b 09 46 0f 7c 78 37 1d ff 81 78 1b a0 3a 28 3a cb 71 09 f7 db 09 8d 9d 80 96 16 41 2a e9 2b 07 50 f1 41 ef c4 8f f1 d4 22 df 95 c4 c3 40 d5 7f 2f d6 50 6e 18 2d e9 6d f4 bd e0 5b 68 9f 80 51 fd c6 07 70 f0 f8 88 a5 91 5d c3 af 38 60 f7 ea 6c 5f 43 3d d1 19 ca c8 34 8b 43 23 bb 31 12 90 cd a9 4e bd 6c 81 c7 70 3f 75 11 7c b3 3f eb bb 72 b9 30 77 11 9b d9 46 ba e0 9a 80 bd ec 59 6e 0c 34 c8 73 02 94 a3 3b fa Data Ascii: `]u&]i~E &^&ok%'Y&dYEtxDlDwV_s,V02C:l,HW!k")+F\|x7x:(:qA+PA"@/Pn-m[hQp]8`l_C=4C#1Nlp?u\|?r0wFYn4s;
2025-03-27 18:44:08 UTC	997	IN	Data Raw: f4 e9 9a da 28 c4 c5 c2 aa 10 f7 9d cb 43 3b 0b 99 ed 4f 37 86 79 46 44 2d f7 e6 5c d8 74 96 00 ae 4f df 7a d2 12 3d 76 70 7e e7 58 f5 83 0d 05 32 96 ad 67 ac 18 ab 76 93 53 38 83 fb 91 4f d6 92 33 03 d0 67 d7 44 d7 2d 73 78 c8 95 7e 51 26 0b bc 78 2d b4 17 85 ea 00 36 03 99 ef 02 a4 44 3f 10 17 f6 e0 ea 65 84 e9 c1 09 50 e8 8e 05 47 3b 3b 8f c7 14 ad 46 56 47 83 3c c0 bb 80 0f 1b 01 0d f2 13 56 5c c3 c3 c8 90 e9 b1 90 ac 26 60 69 a2 17 c5 5f 8c 3d 80 93 c9 58 d9 75 f0 12 a0 f9 a0 02 fa 8d 3d ca 3c 03 b4 2e 56 ac 5f e7 26 0c 0b 7e 06 d0 40 17 f8 28 7e 29 69 39 bf f7 3d 99 55 ad d0 d1 5d 4e 98 b4 a3 71 37 bf 5c 39 4d 33 0c 9f 9c 67 a3 d4 af 71 a3 52 73 ab 37 77 14 5f e4 c4 73 61 c9 39 8b 03 58 65 e0 23 df 0b fc d0 68 99 fa c0 51 c9 71 da da e8 b9 f3 39 1a Data Ascii: (C;O7yFD-\tOz=vp~X2gvS8O3gD-sx~Q&x-6D?ePG;;FVG<V\&`i_=Xu=<.V_&~@(~)i9=U]Nq7\9M3gqRs7w_sa9Xe#hQq9
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 45 b1 2e 0f 11 cf 0b 4e 89 8e c2 5b 00 bf 4c e8 8e 45 95 fb 01 87 76 c1 e9 85 41 0a b6 a6 cf ce f5 d0 07 c0 3a e6 ec c1 39 7f a6 c2 25 60 ff 0d a0 ca 14 7f 19 f9 41 1b 8c c0 9d 19 80 63 8c cf f7 9b 24 16 7b be 1f 36 19 2d e3 b9 bb 04 9b 22 66 72 5b 7a d9 fa 0c cc ff c0 96 40 4a 4b 4f fc 51 ca 99 a1 55 1d 08 bb bd bb 11 dc ab d6 7a 39 a7 c5 03 e2 5a ec e3 c0 65 48 e8 8f bf d1 33 13 ec 07 65 df 82 63 97 35 73 9d 5b b0 20 a2 57 95 bc 49 02 fc 33 12 ff 36 1d 4d 8c 1a f9 99 9b e4 74 6c fd fe 13 38 17 d6 b0 c3 f9 eb 26 e9 60 9a 62 18 2c a6 37 8e dd 01 0a 1d a0 d7 10 36 7b 3a 4f 4f 16 f0 67 c5 ab 3e eb c0 c6 43 ba d6 37 69 16 07 0a 3b 15 37 10 8a b9 12 0c 57 1b 86 d5 a7 32 94 2b c3 41 cd f3 c0 c6 a2 e9 9e f6 e5 c4 00 32 eb 12 3e 5f e9 1b 50 e2 5f 95 bc 83 ef 77 Data Ascii: E.N[LEvA:9%`Ac${6-"fr[z@JKOQUz9ZeH3ec5s[ WI36Mtl8&`b,76{:OOg>C7i;7W2+A2>_P_w
2025-03-27 18:44:08 UTC	997	IN	Data Raw: ba 05 6c 1c 9d d3 a8 99 68 e8 be e3 2f 2d 81 6b 4e e9 4e af a7 58 95 98 08 24 90 3f 79 ad fd 8a c3 a8 d7 03 20 88 eb bb d2 a0 09 7e d3 ec 98 89 a9 03 9a 38 cf 96 80 e3 0d 85 e1 3b d2 02 42 06 87 81 29 df 78 3e 44 3b eb 2b 81 ee 6e a4 77 d4 1e a2 1f f2 49 d8 f0 48 57 15 75 d6 44 8e 19 6b b3 22 b1 e9 76 a4 ab 27 a2 88 f8 7e a7 fb 2d 07 73 cb 1e d6 5e 05 93 3d c7 05 ef 29 c0 af 55 71 a4 0c 78 b1 f4 63 c0 8e 04 37 57 ad e3 13 58 c5 18 f7 6f bc 1c 07 36 5f 27 7f 3d 8c 2c a1 18 fd 73 62 c9 05 56 5c 38 6c bd fc a6 c8 5f 68 37 ca da be c3 7e 20 4c 0d cb aa 25 ec 4f 0e 50 65 e6 50 ce f6 67 54 d9 67 5e ca e9 a4 54 4c a7 3f 05 61 d7 75 86 bf a3 ed 4d 5a c0 89 29 86 79 89 ce 1f 45 80 0f 0b 47 7f c1 bd f1 7c d4 a6 67 00 7b 2c 3f 15 64 d0 f4 71 94 62 b8 09 4f e9 9c b7 Data Ascii: lh/-kNNX$?y ~8;B)x>D;+nwIHWuDk"v'~-s^=)Uqxc7WXo6_'=,sbV\8l_h7~ L%OPePgTg^TL?auMZ)yEG\|g{,?dqbO
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 93 10 bd 05 60 dc 29 50 a3 36 57 56 81 9c ea 41 6b cc b0 e6 fb 5e 02 58 2a 55 dd 8e d6 4a c0 5c 05 4b 93 83 eb 49 fc d4 93 5f 55 81 e2 02 26 d4 93 b2 48 33 0c ee 5c bd a4 05 14 f2 4c 26 2e 01 6a b0 9c 0e 28 a2 88 91 81 48 b7 14 c6 d7 c3 02 6c 7f c9 a2 58 1d c1 17 a1 67 06 1c 7d 84 af c3 bf ea 79 07 bd 43 cd 61 91 f1 b1 0a 63 83 eb 6f 16 39 10 b4 10 65 ee 07 d6 01 e4 67 9b b3 49 4e c7 18 be 9e 11 40 32 d2 ec 77 14 55 94 92 b2 c1 56 5b 12 43 59 aa d0 4f d4 53 0d bf 0f 66 d2 bc 18 99 ed 33 14 99 4a ac ca a3 23 f2 ef a1 00 c6 82 21 d2 1a 50 8d b0 2f 18 ce 22 60 be 0a 91 91 b6 78 2b 41 23 5f 49 4b 15 27 61 cc 34 98 5c 98 47 7d 63 fc 16 ee ec ec d9 b4 58 98 c4 ad 46 3a 95 51 19 98 82 73 eb af 92 4f d0 68 63 08 6c c2 51 52 b2 42 96 8b 10 00 21 f9 8f 97 75 ef 9d Data Ascii: `)P6WVAk^X*UJ\KI_U&H3\L&.j(HlXg}yCaco9egIN@2wUV[CYOSf3J#!P/"`x+A#_IK'a4\G}cXF:QsOhclQRB!u
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 77 ce 55 8f bf 72 19 73 72 e3 e2 25 1f 80 51 74 2e 62 6c c0 78 ca ed e7 bb 1e 31 1c 63 80 68 5d a1 c2 95 94 02 9d 1e 19 f9 69 ce 37 58 ef 07 58 28 56 85 0a fc f6 ee f4 57 d9 0f 02 09 ed 7a 64 75 bc 00 c5 99 88 1e ee da 08 43 ce be 64 64 e9 cf 6d 13 1e 12 43 3e 43 3d 1b 86 8b 21 d3 d7 e3 4c 5b 82 8b c3 33 06 97 e7 9c 58 b0 60 e7 01 57 c3 a9 7a c4 0b f4 6c 25 bd 6c fc 62 4b 83 35 6c 93 81 22 cf 9a 0e 06 dc 30 d8 9e 00 5b 4d 82 65 ac 8a 88 2a 3f 55 49 2c 50 56 ac cf d0 6e ac 95 3e a2 4f 87 f1 b7 b0 0b 30 92 6b 8b 20 24 00 0e 7b 18 0f 39 26 73 17 37 4c fd dc c5 4a d5 56 b8 cf d2 44 98 1f cd d7 2f 14 40 22 54 89 7f 05 42 d3 09 38 35 89 10 a1 f3 a9 62 d3 58 99 08 82 a5 82 78 ae b1 00 a9 b1 40 3d 69 13 c1 96 18 b0 c7 9a f1 13 98 17 2c ab 42 93 77 6c b5 7b 05 c3 Data Ascii: wUrsr%Qt.blx1ch]i7XX(VWzduCddmC>C=!L[3X`Wzl%lbK5l"0[Me*?UI,PVn>O0k ${9&s7LJVD/@"TB85bXx@=i,Bwl{
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 99 c4 a1 df 06 94 0c c8 88 69 f7 6a 23 dd a3 19 88 1e c3 eb b1 5c 00 cf dd 78 8c 2c ba ed dd ab bd 78 2a 93 31 d3 29 32 c2 d5 3f e9 af df 92 81 25 94 9e da 5e d6 37 14 23 77 27 09 58 a2 60 91 52 91 f1 ab 69 15 00 4a 52 92 43 0f 2f 0b b0 67 36 3a 56 5d 56 cf fd a1 f5 0e 33 39 f9 73 24 5e 5c 06 32 78 60 4f c9 24 0c d5 b2 a6 8f 3e 1e 25 e5 8d 5a 4f 4d f4 54 33 11 f8 56 e0 87 16 e5 a1 c0 cd 79 20 34 3e 3b c9 63 79 02 45 14 14 7e b2 b7 6b 44 76 d3 a3 ca 0f 01 72 1b ab 4e 98 ee 7a 5c 46 05 0a f8 29 18 58 37 4e 22 db b6 01 80 bf c3 6e 1e e1 97 1d 9e af aa 58 59 8b b1 f9 44 7f 58 78 40 b2 31 22 00 36 1c 12 be 05 1b f4 1e bd 2e ee ec 51 4f f6 c3 34 b1 19 92 34 46 d2 17 2b 78 00 5e c0 1e d4 2f 3b 80 08 52 46 15 f0 77 62 6d 38 d5 74 6f 9d 90 66 d2 63 6b 00 36 1a 6f Data Ascii: ij#\x,x*1)2?%^7#w'X`RiJRC/g6:V]V39s$^\2x`O$>%ZOMT3Vy 4>;cyE~kDvrNz\F)X7N"nXYDXx@1"6.QO44F+x^/;RFwbm8tofck6o

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:08 UTC	620	OUT	GET /agent/static/0600cd7b-e6b2-4ba9-4249-ab1342c3631b/pendo.js HTTP/1.1 Host: cdn.pendo.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://rsm.login-us.mimecast.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:08 UTC	951	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AKDAyIsfq4BcqpvW9b4CKHnJVzFPxQ-xmXzMsLevBp6Q1Kyntu9jpaXNhAofDmA89vGRJhcOS6gzQ4U Date: Thu, 27 Mar 2025 18:44:08 GMT Last-Modified: Thu, 27 Mar 2025 18:20:52 GMT ETag: W/"9865110d5c2abf9433148b778da73796" Vary: Accept-Encoding x-goog-generation: 1743099652499018 x-goog-metageneration: 1 x-goog-stored-content-encoding: gzip x-goog-stored-content-length: 174983 Content-Type: application/javascript; charset=utf-8 x-goog-hash: crc32c=6aR6Yw== x-goog-hash: md5=mGURDVwqv5QzFIt3jac3lg== x-goog-storage-class: STANDARD Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * X-GUploader-Response-Body-Transformations: gunzipped Warning: 214 UploadServer gunzipped Server: UploadServer Cache-Control: public,max-age=450 Strict-Transport-Security: max-age=63072000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2025-03-27 18:44:08 UTC	46	IN	Data Raw: 31 61 34 65 0d 0a 2f 2f 20 50 65 6e 64 6f 20 41 67 65 6e 74 20 57 72 61 70 70 65 72 0a 2f 2f 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 35 Data Ascii: 1a4e// Pendo Agent Wrapper// Copyright 2025
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 20 50 65 6e 64 6f 2e 69 6f 2c 20 49 6e 63 2e 0a 2f 2f 20 45 6e 76 69 72 6f 6e 6d 65 6e 74 3a 20 20 20 20 70 72 6f 64 75 63 74 69 6f 6e 0a 2f 2f 20 41 67 65 6e 74 20 56 65 72 73 69 6f 6e 3a 20 20 32 2e 32 36 39 2e 31 0a 2f 2f 20 49 6e 73 74 61 6c 6c 65 64 3a 20 20 20 20 20 20 32 30 32 35 2d 30 33 2d 32 37 54 31 38 3a 32 30 3a 34 38 5a 0a 28 66 75 6e 63 74 69 6f 6e 20 28 50 65 6e 64 6f 43 6f 6e 66 69 67 29 20 7b 0a 2f 2a 0a 40 6c 69 63 65 6e 73 65 20 68 74 74 70 73 3a 2f 2f 61 67 65 6e 74 2e 70 65 6e 64 6f 2e 69 6f 2f 6c 69 63 65 6e 73 65 73 0a 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 48 77 2c 6a 77 2c 57 77 29 7b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 3b 74 72 79 7b 64 2e 63 61 6c Data Ascii: Pendo.io, Inc.// Environment: production// Agent Version: 2.269.1// Installed: 2025-03-27T18:20:48Z(function (PendoConfig) {/@license https://agent.pendo.io/licenses/!function(Hw,jw,Ww){!function(){var d=Array.prototype.slice;try{d.cal
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 65 3e 3e 31 32 26 36 33 5d 2b 61 5b 65 3e 3e 36 26 36 33 5d 2b 61 5b 36 33 26 65 5d 7d 28 6e 29 3b 73 77 69 74 63 68 28 72 29 7b 63 61 73 65 20 31 3a 6e 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 2c 6f 3d 28 6f 2b 3d 61 5b 6e 3e 3e 32 5d 29 2b 61 5b 6e 3c 3c 34 26 36 33 5d 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 6e 3d 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 32 5d 3c 3c 38 29 2b 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 2c 6f 3d 28 6f 3d 28 6f 2b 3d 61 5b 6e 3e 3e 31 30 5d 29 2b 61 5b 6e 3e 3e 34 26 36 33 5d 29 2b 61 5b 6e 3c 3c 32 26 36 33 5d 7d 72 65 74 75 72 6e 20 6f 7d 7d 7d 28 29 2c 42 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 76 6f 69 64 20 30 21 3d 3d 48 77 3f 48 77 Data Ascii: e>>12&63]+a[e>>6&63]+a[63&e]}(n);switch(r){case 1:n=e[e.length-1],o=(o+=a[n>>2])+a[n<<4&63];break;case 2:n=(e[e.length-2]<<8)+e[e.length-1],o=(o=(o+=a[n>>10])+a[n>>4&63])+a[n<<2&63]}return o}}}(),Bt="undefined"!=typeof globalThis?globalThis:void 0!==Hw?Hw
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 5d 3b 74 5b 6e 5d 3d 61 28 6e 29 7d 72 65 74 75 72 6e 20 74 7d 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 65 76 61 6c 28 22 72 65 71 75 69 72 65 28 27 63 72 79 70 74 6f 27 29 22 29 2c 69 3d 65 76 61 6c 28 22 72 65 71 75 69 72 65 28 27 62 75 66 66 65 72 27 29 2e 42 75 66 66 65 72 22 29 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 29 72 65 74 75 72 6e 20 6e 2e 63 72 65 61 74 65 48 61 73 68 28 22 73 68 61 31 22 29 2e 75 70 64 61 74 65 28 65 2c 22 75 74 66 38 22 29 2e 64 69 67 65 73 74 28 22 68 65 78 22 29 3b 69 66 28 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 41 72 72 61 79 42 75 66 66 65 72 29 65 3d 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 28 65 29 3b 65 6c 73 65 20 69 Data Ascii: ];t[n]=a(n)}return t},c=function(t){var n=eval("require('crypto')"),i=eval("require('buffer').Buffer"),e=function(e){if("string"==typeof e)return n.createHash("sha1").update(e,"utf8").digest("hex");if(e.constructor===ArrayBuffer)e=new Uint8Array(e);else i
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 31 5d 3d 61 5b 31 32 5d 3d 61 5b 31 33 5d 3d 61 5b 31 34 5d 3d 61 5b 31 35 5d 3d 30 29 2c 69 29 66 6f 72 28 6e 3d 74 68 69 73 2e 73 74 61 72 74 3b 72 3c 6f 26 26 6e 3c 36 34 3b 2b 2b 72 29 61 5b 6e 3e 3e 32 5d 7c 3d 65 5b 72 5d 3c 3c 75 5b 33 26 6e 2b 2b 5d 3b 65 6c 73 65 20 66 6f 72 28 6e 3d 74 68 69 73 2e 73 74 61 72 74 3b 72 3c 6f 26 26 6e 3c 36 34 3b 2b 2b 72 29 28 74 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 29 3c 31 32 38 3f 61 5b 6e 3e 3e 32 5d 7c 3d 74 3c 3c 75 5b 33 26 6e 2b 2b 5d 3a 28 74 3c 32 30 34 38 3f 61 5b 6e 3e 3e 32 5d 7c 3d 28 31 39 32 7c 74 3e 3e 36 29 3c 3c 75 5b 33 26 6e 2b 2b 5d 3a 28 74 3c 35 35 32 39 36 7c 7c 35 37 33 34 34 3c 3d 74 3f 61 5b 6e 3e 3e 32 5d 7c 3d 28 32 32 34 7c 74 3e 3e 31 32 29 3c 3c 75 5b 33 26 6e 2b 2b 5d Data Ascii: 1]=a[12]=a[13]=a[14]=a[15]=0),i)for(n=this.start;r<o&&n<64;++r)a[n>>2]\|=e[r]<<u[3&n++];else for(n=this.start;r<o&&n<64;++r)(t=e.charCodeAt(r))<128?a[n>>2]\|=t<<u[3&n++]:(t<2048?a[n>>2]\|=(192\|t>>6)<<u[3&n++]:(t<55296\|\|57344<=t?a[n>>2]\|=(224\|t>>12)<<u[3&n++]
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 79 74 65 73 3e 3e 3e 32 39 2c 65 5b 31 35 5d 3d 74 68 69 73 2e 62 79 74 65 73 3c 3c 33 2c 74 68 69 73 2e 68 61 73 68 28 29 29 7d 2c 6c 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 74 3d 74 68 69 73 2e 68 30 2c 6e 3d 74 68 69 73 2e 68 31 2c 69 3d 74 68 69 73 2e 68 32 2c 72 3d 74 68 69 73 2e 68 33 2c 6f 3d 74 68 69 73 2e 68 34 2c 61 3d 74 68 69 73 2e 62 6c 6f 63 6b 73 2c 73 3d 31 36 3b 73 3c 38 30 3b 2b 2b 73 29 65 3d 61 5b 73 2d 33 5d 5e 61 5b 73 2d 38 5d 5e 61 5b 73 2d 31 34 5d 5e 61 5b 73 2d 31 36 5d 2c 61 5b 73 5d 3d 65 3c 3c 31 7c 65 3e 3e 3e 33 31 3b 66 6f 72 28 73 3d 30 3b 73 3c 32 30 3b 73 2b 3d 35 29 74 3d 28 65 3d 28 6e 3d 28 65 3d 28 69 3d 28 65 3d 28 72 3d 28 65 3d 28 6f 3d 28 65 Data Ascii: ytes>>>29,e[15]=this.bytes<<3,this.hash())},l.prototype.hash=function(){for(var e,t=this.h0,n=this.h1,i=this.h2,r=this.h3,o=this.h4,a=this.blocks,s=16;s<80;++s)e=a[s-3]^a[s-8]^a[s-14]^a[s-16],a[s]=e<<1\|e>>>31;for(s=0;s<20;s+=5)t=(e=(n=(e=(i=(e=(r=(e=(o=(e
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 30 7c 6e 3e 3e 3e 32 29 7c 74 26 69 7c 6e 26 69 29 2b 72 2d 31 38 39 34 30 30 37 35 38 38 2b 61 5b 73 2b 31 5d 3c 3c 30 29 3c 3c 35 7c 72 3e 3e 3e 32 37 29 2b 28 6f 26 28 74 3d 74 3c 3c 33 30 7c 74 3e 3e 3e 32 29 7c 6f 26 6e 7c 74 26 6e 29 2b 69 2d 31 38 39 34 30 30 37 35 38 38 2b 61 5b 73 2b 32 5d 3c 3c 30 29 3c 3c 35 7c 69 3e 3e 3e 32 37 29 2b 28 72 26 28 6f 3d 6f 3c 3c 33 30 7c 6f 3e 3e 3e 32 29 7c 72 26 74 7c 6f 26 74 29 2b 6e 2d 31 38 39 34 30 30 37 35 38 38 2b 61 5b 73 2b 33 5d 3c 3c 30 29 3c 3c 35 7c 6e 3e 3e 3e 32 37 29 2b 28 69 26 28 72 3d 72 3c 3c 33 30 7c 72 3e 3e 3e 32 29 7c 69 26 6f 7c 72 26 6f 29 2b 74 2d 31 38 39 34 30 30 37 35 38 38 2b 61 5b 73 2b 34 5d 3c 3c 30 2c 69 3d 69 3c 3c 33 30 7c 69 3e 3e 3e 32 3b 66 6f 72 28 3b 73 3c 38 30 3b 73 Data Ascii: 0\|n>>>2)\|t&i\|n&i)+r-1894007588+a[s+1]<<0)<<5\|r>>>27)+(o&(t=t<<30\|t>>>2)\|o&n\|t&n)+i-1894007588+a[s+2]<<0)<<5\|i>>>27)+(r&(o=o<<30\|o>>>2)\|r&t\|o&t)+n-1894007588+a[s+3]<<0)<<5\|n>>>27)+(i&(r=r<<30\|r>>>2)\|i&o\|r&o)+t-1894007588+a[s+4]<<0,i=i<<30\|i>>>2;for(;s<80;s
2025-03-27 18:44:08 UTC	714	IN	Data Raw: 3e 31 36 26 31 35 5d 2b 6f 5b 6e 3e 3e 31 32 26 31 35 5d 2b 6f 5b 6e 3e 3e 38 26 31 35 5d 2b 6f 5b 6e 3e 3e 34 26 31 35 5d 2b 6f 5b 31 35 26 6e 5d 2b 6f 5b 69 3e 3e 32 38 26 31 35 5d 2b 6f 5b 69 3e 3e 32 34 26 31 35 5d 2b 6f 5b 69 3e 3e 32 30 26 31 35 5d 2b 6f 5b 69 3e 3e 31 36 26 31 35 5d 2b 6f 5b 69 3e 3e 31 32 26 31 35 5d 2b 6f 5b 69 3e 3e 38 26 31 35 5d 2b 6f 5b 69 3e 3e 34 26 31 35 5d 2b 6f 5b 31 35 26 69 5d 2b 6f 5b 72 3e 3e 32 38 26 31 35 5d 2b 6f 5b 72 3e 3e 32 34 26 31 35 5d 2b 6f 5b 72 3e 3e 32 30 26 31 35 5d 2b 6f 5b 72 3e 3e 31 36 26 31 35 5d 2b 6f 5b 72 3e 3e 31 32 26 31 35 5d 2b 6f 5b 72 3e 3e 38 26 31 35 5d 2b 6f 5b 72 3e 3e 34 26 31 35 5d 2b 6f 5b 31 35 26 72 5d 7d 2c 6c 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 6c 2e 70 Data Ascii: >16&15]+o[n>>12&15]+o[n>>8&15]+o[n>>4&15]+o[15&n]+o[i>>28&15]+o[i>>24&15]+o[i>>20&15]+o[i>>16&15]+o[i>>12&15]+o[i>>8&15]+o[i>>4&15]+o[15&i]+o[r>>28&15]+o[r>>24&15]+o[r>>20&15]+o[r>>16&15]+o[r>>12&15]+o[r>>8&15]+o[r>>4&15]+o[15&r]},l.prototype.toString=l.p
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 38 30 30 30 0d 0a 29 2c 74 2e 73 65 74 55 69 6e 74 33 32 28 34 2c 74 68 69 73 2e 68 31 29 2c 74 2e 73 65 74 55 69 6e 74 33 32 28 38 2c 74 68 69 73 2e 68 32 29 2c 74 2e 73 65 74 55 69 6e 74 33 32 28 31 32 2c 74 68 69 73 2e 68 33 29 2c 74 2e 73 65 74 55 69 6e 74 33 32 28 31 36 2c 74 68 69 73 2e 68 34 29 2c 65 7d 3b 76 61 72 20 66 3d 64 28 29 3b 65 3f 70 2e 65 78 70 6f 72 74 73 3d 66 3a 73 2e 73 68 61 31 3d 66 7d 28 29 7d 28 74 29 2c 74 2e 65 78 70 6f 72 74 73 29 2c 52 3d 65 28 69 29 2c 72 2c 6f 3d 7b 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 2c 63 72 65 61 74 65 48 54 4d 4c 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 78 65 28 65 29 7b Data Ascii: 8000),t.setUint32(4,this.h1),t.setUint32(8,this.h2),t.setUint32(12,this.h3),t.setUint32(16,this.h4),e};var f=d();e?p.exports=f:s.sha1=f}()}(t),t.exports),R=e(i),r,o={createScriptURL:function(e){return e},createHTML:function(e){return e}};function xe(e){
2025-03-27 18:44:08 UTC	997	IN	Data Raw: 29 72 65 74 75 72 6e 20 69 2e 73 72 63 2e 72 65 70 6c 61 63 65 28 2f 5c 2e 6a 73 24 2f 2c 22 2d 73 74 61 67 69 6e 67 2e 6a 73 22 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 42 28 65 2c 74 2c 6e 29 7b 65 3d 55 28 6a 77 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 29 7c 7c 65 2e 73 74 61 67 69 6e 67 41 67 65 6e 74 55 72 6c 3b 72 65 74 75 72 6e 20 6e 26 26 28 6e 3d 22 75 6e 6d 69 6e 69 66 69 65 64 2e 6a 73 22 2c 74 26 26 28 6e 3d 22 73 74 61 67 69 6e 67 2d 22 2b 6e 29 2c 65 3d 65 26 26 65 2e 72 65 70 6c 61 63 65 28 2f 73 74 61 67 69 6e 67 5c 2e 6a 73 24 2f 2c 6e 29 29 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 65 2c 74 29 7b 69 66 28 4e 28 65 3d 65 7c 7c 66 65 28 29 29 29 72 65 74 75 72 6e 21 30 3b 69 66 28 74 3d 74 7c Data Ascii: )return i.src.replace(/\.js$/,"-staging.js")}}function B(e,t,n){e=U(jw.getElementsByTagName("script"))\|\|e.stagingAgentUrl;return n&&(n="unminified.js",t&&(n="staging-"+n),e=e&&e.replace(/staging\.js$/,n)),e}function z(e,t){if(N(e=e\|\|fe()))return!0;if(t=t\|

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:08 UTC	788	OUT	GET /u/login/assets/languages/en.json?ver=1.16.1 HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:08 UTC	435	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:08 GMT Content-Type: application/json Content-Length: 19344 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Last-Modified: Tue, 11 Mar 2025 21:34:20 GMT ETag: W/"9NtQQO69aaM9NtR1WmcZVM" Accept-Ranges: bytes Vary: Accept-Encoding, User-Agent
2025-03-27 18:44:08 UTC	15949	IN	Data Raw: 7b 0a 09 22 24 49 31 38 4e 5f 53 50 49 4e 4e 45 52 5f 4c 4f 41 44 49 4e 47 22 3a 20 22 4c 6f 61 64 69 6e 67 2e 2e 2e 22 2c 0a 09 22 50 57 44 5f 52 55 4c 45 53 5f 43 48 45 43 4b 45 52 5f 4c 4f 57 45 52 5f 43 41 53 45 22 3a 20 22 49 6e 63 6c 75 64 65 20 61 74 20 6c 65 61 73 74 20 6f 6e 65 20 6c 6f 77 65 72 63 61 73 65 20 63 68 61 72 61 63 74 65 72 20 28 61 2d 7a 29 22 2c 0a 09 22 50 57 44 5f 52 55 4c 45 53 5f 43 48 45 43 4b 45 52 5f 4d 49 4e 5f 43 48 52 5f 41 46 54 45 52 22 3a 20 22 63 68 61 72 61 63 74 65 72 73 22 2c 0a 09 22 50 57 44 5f 52 55 4c 45 53 5f 43 48 45 43 4b 45 52 5f 4d 49 4e 5f 43 48 52 5f 42 45 46 4f 52 45 22 3a 20 22 4d 69 6e 69 6d 75 6d 22 2c 0a 09 22 50 57 44 5f 52 55 4c 45 53 5f 43 48 45 43 4b 45 52 5f 4e 55 4d 42 45 52 22 3a 20 22 49 6e Data Ascii: {"$I18N_SPINNER_LOADING": "Loading...","PWD_RULES_CHECKER_LOWER_CASE": "Include at least one lowercase character (a-z)","PWD_RULES_CHECKER_MIN_CHR_AFTER": "characters","PWD_RULES_CHECKER_MIN_CHR_BEFORE": "Minimum","PWD_RULES_CHECKER_NUMBER": "In
2025-03-27 18:44:08 UTC	3395	IN	Data Raw: 64 65 66 61 75 6c 74 20 70 6f 6c 69 63 69 65 73 2e 3c 62 72 2f 3e 3c 62 72 2f 3e 4c 65 74 e2 80 99 73 20 67 65 74 20 73 74 61 72 74 65 64 2e 22 2c 0a 09 22 44 49 53 43 4c 41 49 4d 45 52 5f 54 49 54 4c 45 5f 52 45 56 49 45 57 45 52 22 3a 20 22 43 61 73 65 20 52 65 76 69 65 77 22 2c 0a 09 22 44 49 53 43 4c 41 49 4d 45 52 5f 42 4f 44 59 5f 52 45 56 49 45 57 45 52 22 3a 20 22 43 61 73 65 20 52 65 76 69 65 77 20 65 6e 61 62 6c 65 73 20 73 65 63 75 72 65 20 61 6e 64 20 63 6f 6d 70 61 72 74 6d 65 6e 74 61 6c 69 7a 65 64 20 61 63 63 65 73 73 20 74 6f 20 64 61 74 61 20 66 6f 72 20 65 44 69 73 63 6f 76 65 72 79 2c 20 63 6f 6d 70 6c 69 61 6e 63 65 2c 20 61 6e 64 20 6f 74 68 65 72 20 69 6e 76 65 73 74 69 67 61 74 69 76 65 20 70 75 72 70 6f 73 65 73 2e 20 52 65 76 69 Data Ascii: default policies.<br/><br/>Lets get started.","DISCLAIMER_TITLE_REVIEWER": "Case Review","DISCLAIMER_BODY_REVIEWER": "Case Review enables secure and compartmentalized access to data for eDiscovery, compliance, and other investigative purposes. Revi

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:08 UTC	768	OUT	GET /u/login/app-version.jsp HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:08 UTC	409	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:08 GMT Content-Type: text/html;charset=utf-8 Content-Length: 6 Connection: close Cache-Control: private, max-age=0, no-cache, no-store Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Vary: Accept-Encoding, User-Agent
2025-03-27 18:44:08 UTC	6	IN	Data Raw: 31 2e 31 36 2e 31 Data Ascii: 1.16.1

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:08 UTC	1621	OUT	GET /u/rest/branding/get-branding-item/XHEvsJVPT_EZoLeMOMeG5weyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiNGJ3cURMVnF3ZHVEekVvdyJ9.1kh7WKb40TgeYxkLGNv5ule9WZ3k1oH_.FZzBolsUTrqulVWX.YiMBEE9mOE80jIG0UY77oEynpbMlOaXcisP_rHZADKcm9lMCSqYyeJDBe2bVGDuBwOiJkqUVlDaajiyjpq35eJ3dk-7fEZnuJskOOdrnjCz5T_11_bArxLzcXNxMrG8rKaON3Es66uMV-WxYkD6jZLTYM9X5zoyLTxfLOESKE8mxXsB9VCrscmzzRBDBv6EZt-ROVd5jf9aB1_3hE8tDijIUNoqmSzwJqtlOdK2Hyo-5p9tZSSGrtkg_PPxBHfroLY-_eocn653LuhhrkT4Qommz5yFJ7UsSGUcdPpbrgotgbk2kqED-xzemr33WyluyD7LRDI2f15IE28fvL2ZKsJAeCrFaTcCnKkrcjJCdPBtB6JDegctmI2I_vVj7fLnI-HXl4YlBCfm-KDTlhMxJVkm3M-00UeKtQigxDiRKyLSaR10vtGlw6MXZKSLlDnVBtkYXYSuGtUuw0Nf86bZLQJQztsvYgr0tLfNHEVaDCFD9zAuUBVZnyGgXJHO8Hc8RoMXEh8I_IaOuH-mdVSw8rJ9-6SJXb5k43mPMyAdhw3sGBbxusjQKKFTiBqSDY_UL7owuqMLcalmY3YBdq4B9.QTubUwtzUgczdyK8fjx-gA?tkn=rsm HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:08 UTC	379	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:08 GMT Content-Type: image/png;charset=utf-8 Content-Length: 2274 Connection: close Cache-Control: max-age=1209600 Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Encoding: UTF-8
2025-03-27 18:44:08 UTC	2274	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 00 78 08 06 00 00 00 48 15 cf 20 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 08 84 49 44 41 54 78 da ec dd 41 72 db 36 14 c6 71 a4 93 03 e8 06 51 16 5d 5b 39 41 e8 13 44 39 81 e4 66 a6 9b 2e 6c 77 ba e8 4e f6 ae 8b 4e 15 2f ba e9 4c 1a f9 04 91 4f 20 e6 04 51 d6 5d 54 3d 41 d5 1b 14 cf 7d 4a 58 45 32 01 12 80 28 f2 ff 9b 61 ed 69 64 89 a4 89 4f 0f 30 08 19 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 a1 47 c7 b2 a3 3f fd fc 4b 66 bf 2c 02 3c d5 e9 8f 3f 7c 9f 3f f8 88 37 5f 87 7a ad 34 5e fd 51 fe 7b 7c f3 d7 95 fd ef 84 4b 1e fb da 85 79 f5 24 6f fa 4e 7e c5 ef 09 c0 b1 20 b0 00 10 Data Ascii: PNGIHDR,xH tEXtSoftwareAdobe ImageReadyqe<IDATxAr6qQ][9AD9f.lwNN/LO Q]T=A}JXE2(aidO0hG?Kf,<?\|?7_z4^Q{\|Ky$oN~

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:08 UTC	683	OUT	GET /u/assets/font-awesome/fonts/fontawesome-webfont.woff2?v=4.3.0 HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive Origin: https://rsm.login-us.mimecast.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://rsm.login-us.mimecast.com/u/assets/font-awesome/css/font-awesome.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:09 UTC	394	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:09 GMT Content-Type: font/woff2 Content-Length: 56780 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Last-Modified: Tue, 11 Mar 2025 21:32:02 GMT ETag: W/"xGi+w8jIOMAxGi/Vk/XyVw" Accept-Ranges: bytes
2025-03-27 18:44:09 UTC	15990	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 dd cc 00 0e 00 00 00 01 dc e4 00 00 dd 6c 00 04 00 c5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 1e 06 60 00 85 42 11 08 0a 86 e3 64 85 b4 5a 01 36 02 24 03 91 2a 0b 88 5c 00 04 20 05 87 00 07 ab 1e 3f 77 65 62 66 06 5b 05 80 71 86 71 7b 21 51 d1 9d 50 ea b7 f7 d2 1b 87 19 05 ba 1d 44 41 c5 ef b7 6e 85 ec 7c 31 be a3 fd f9 a9 d9 ff ff ff bf 20 59 8c e1 ee 0f bc 47 40 54 75 3a 4b 5b 55 33 b2 9e fa 84 2c c8 e1 a6 14 47 ca 5e b3 63 28 70 d4 36 62 f2 8a 6c 0a 66 2d 6b bf 6e fe c0 2e 47 35 07 e6 9e 54 2b 33 d5 8a e3 69 8b 15 9e 4c 70 26 e8 c8 65 6c 27 e6 08 d5 7c 88 26 85 cd e2 9f 44 21 99 5e 66 69 76 4d 33 5c 53 29 bd 51 98 07 4c fc e6 8d 4e 5f e6 b6 82 2b 5b f9 21 c8 b8 53 e7 17 bb 6d 51 f8 Data Ascii: wOF2l?FFTM`BdZ6$*\ ?webf[qq{!QPDAn\|1 YG@Tu:K[U3,G^c(p6blf-kn.G5T+3iLp&el'\|&D!^fivM3\S)QLN_+[!SmQ
2025-03-27 18:44:09 UTC	16384	IN	Data Raw: bb 64 6b c7 d8 72 32 93 f3 84 cd 67 03 91 ac 0f c5 99 05 c9 10 f1 9d d1 58 8e 24 6f dc ff ae a8 a8 4c be 6b 74 e9 66 46 f8 34 7f 95 27 d2 e6 14 89 ed a7 37 c9 d4 d9 3d 6d 79 ef a2 20 e5 64 ed 4a 9e 95 00 4e 67 b0 b4 2b 2a 97 36 8e 7e 22 d3 e3 f5 b1 4b 9d a5 d4 fc 91 d4 1c 29 0b ce 4e 5d fc 8a 24 b0 cd 59 42 93 a3 54 d9 b7 2b 68 ec 9e b9 e4 12 e7 e1 8c fd 5d bb 70 4b 24 9a ae 84 6b 0e af bd 88 ed e9 f8 d1 cd b5 8e 8e 60 94 a5 20 55 78 61 2b 06 42 e8 1e 89 ff 25 53 ff 1b be 8f 8a 23 fb 14 67 60 5d 7d a8 dc 46 01 58 3a 78 ea 37 68 58 55 5a 5f 88 27 0e 16 72 ef 15 b8 9e 4d 11 2a 0b b7 ce 76 6a d2 54 ea 14 56 46 f7 9e 51 71 1e dd a5 ae a7 9e 5b e9 22 a3 2b f6 b7 b2 6f 9a 56 ad 62 aa 51 c3 27 3e 6d 9b f6 fc e4 a7 12 b1 b5 9f 59 3b 73 17 65 3e 6b bb f4 60 e8 47 Data Ascii: dkr2gX$oLktfF4'7=my dJNg+6~"K)N]$YBT+h]pK$k` Uxa+B%S#g`]}FX:x7hXUZ_'rMvjTVFQq["+oVbQ'>mY;se>k`G
2025-03-27 18:44:09 UTC	16384	IN	Data Raw: b8 75 61 f6 9b a5 f7 4f 8e 7f dc 9d b7 da a7 23 63 79 db 1f 9b 2e a7 12 f6 63 ba b4 48 42 a0 f3 cf b1 31 d2 26 b3 89 b1 06 3f 5d 91 9f c7 41 2a 52 05 fc 04 8d 12 b8 02 88 ad 87 38 90 2a 90 2c 8b 3a 34 f3 26 22 4e e9 7c 81 fb 05 e7 e4 90 fe 6f 98 10 0e db 6e 16 64 87 84 3a 67 a8 b8 5e 22 13 ce 12 4b 60 ba 3e bb 29 88 60 57 42 6d 07 d8 86 41 2a 4a ad da d8 41 fd b2 a3 21 ef fa 2a 17 b6 85 b3 04 c7 f4 98 86 0e b4 20 52 94 d7 f3 61 cd 6a 38 72 a4 01 44 46 37 29 b0 0e 1e a1 68 02 62 1d ec fc 70 78 7c 3d ec 8c 46 75 6f 80 72 be ce f7 aa 1a 34 58 e6 cf a6 5f 94 3e db 3f c9 2b 96 c4 a3 16 ab d8 bf 00 cf 17 b4 ce 62 a1 14 c0 ad f2 9c 53 f9 82 dc b6 27 7b 9d 3c 88 21 15 40 64 d9 0c 00 d5 9a 05 d4 04 eb 28 54 0a 72 c7 d2 59 1a 1b 80 02 2b 8f 94 20 44 89 42 1b c1 19 Data Ascii: uaO#cy.cHB1&?]AR8,:4&"N\|ond:g^"K`>)`WBmAJA! Raj8rDF7)hbpx\|=Fuor4X_>?+bS'{<!@d(TrY+ DB
2025-03-27 18:44:09 UTC	8022	IN	Data Raw: 91 f1 06 b4 85 2b 46 ee 07 a2 1b 5c 53 f9 d8 54 e8 2b 4f 11 44 0b 27 7d c3 32 b8 1e 22 56 40 91 38 4e 1c fa ce 77 bf 02 08 a2 86 d5 bf c0 33 1d 8c e5 b4 8f 08 c5 fe a9 5a f9 af 3c 2e 9b 58 a8 18 56 91 03 4a 6e e3 b3 7c de 8f da 9f cc 41 7c 5d f1 1d 6d c5 3f d3 42 1b 7b 82 61 7d 58 df 5f 7f 7b 0d 7f bf 1b dc 4e b6 66 25 bc f8 c3 9a f3 65 fe 10 ab 6f 53 63 1f 6d 8f 07 22 d2 82 04 dd 3c 25 7e 38 fe 54 fd 48 ec e9 44 29 f9 9f b9 48 d1 30 58 6a 7f 93 95 67 58 c0 65 ad f2 4f c7 a4 85 fd 69 ac 9c 58 89 d5 75 69 c7 bd aa de 9e 6b 8b 7e 53 bd bd a0 46 b3 1b df 56 bd 08 2d 17 aa f6 1a 28 77 8b e9 1f ad 96 68 f2 52 f5 4f 8f d8 23 81 5b 6d c0 15 95 a0 62 34 8f 2c 14 a0 b4 79 3f 98 c7 bf 2e 37 7e 5a c6 4e 2e 19 4a 7e 10 2e da 63 af 56 bb bb 45 af ea db e6 c3 5e fe 85 Data Ascii: +F\ST+OD'}2"V@8Nw3Z<.XVJn\|A\|]m?B{a}X_{Nf%eoScm"<%~8THD)H0XjgXeOiXuik~SFV-(whRO#[mb4,y?.7~ZN.J~.cVE^

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:08 UTC	412	OUT	GET /u/login/app-version.jsp HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:10 UTC	409	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:09 GMT Content-Type: text/html;charset=utf-8 Content-Length: 6 Connection: close Cache-Control: private, max-age=0, no-cache, no-store Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Vary: Accept-Encoding, User-Agent
2025-03-27 18:44:10 UTC	6	IN	Data Raw: 31 2e 31 36 2e 31 Data Ascii: 1.16.1

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:09 UTC	1089	OUT	POST /u/proxy/api/login/get-password-rules HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive Content-Length: 293 x-mc-date: Thu, 27 Mar 2025 14:44:08 -0400 sec-ch-ua-platform: "Windows" x-mc-req-id: a17e8aa8-a8d9-69f5-0cf9-b678547f6ec3 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" x-mc-app-id: 055188a2-b1f2-4169-a96f-d44f278f4a84 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / x-mc-strict: nopendo Content-Type: application/json;charset=UTF-8 x-mc-api-version: 2017.2.22 Origin: https://rsm.login-us.mimecast.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:09 UTC	293	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 5b 7b 22 66 6f 72 67 6f 74 50 61 73 73 77 6f 72 64 54 6f 6b 65 6e 22 3a 22 49 56 6f 71 71 4a 36 50 45 54 58 4c 78 35 4d 4c 39 54 6f 6a 6a 78 4e 54 5f 2d 4b 71 43 56 69 59 6e 6d 59 61 66 31 5f 64 39 4f 6d 5f 46 38 6e 64 49 49 79 43 65 48 65 61 30 41 66 62 55 4d 38 68 42 4a 6e 2d 58 31 61 4e 4b 76 48 78 65 77 30 63 53 65 56 64 51 47 50 5f 69 2d 4b 59 6e 4b 47 6b 6b 45 7a 6f 32 4b 4c 2d 56 45 69 5a 59 6a 54 55 49 51 6c 7a 48 6d 6b 79 4b 6a 76 6a 30 4f 75 62 6a 42 64 47 6f 51 79 49 71 43 51 71 73 69 73 4c 67 45 50 39 64 6f 7a 6e 6f 7a 68 66 53 4c 66 65 4e 79 33 4c 35 68 38 68 71 54 39 52 76 4f 65 38 31 31 55 30 32 35 52 6f 4b 5f 64 4c 70 2d 7a 6f 4c 44 4d 56 76 74 69 41 4e 55 73 73 78 62 78 38 6a 71 34 39 65 57 65 31 58 67 5a 38 54 6a Data Ascii: {"data":[{"forgotPasswordToken":"IVoqqJ6PETXLx5ML9TojjxNT_-KqCViYnmYaf1_d9Om_F8ndIIyCeHea0AfbUM8hBJn-X1aNKvHxew0cSeVdQGP_i-KYnKGkkEzo2KL-VEiZYjTUIQlzHmkyKjvj0OubjBdGoQyIqCQqsisLgEP9doznozhfSLfeNy3L5h8hqT9RvOe811U025RoK_dLp-zoLDMVvtiANUssxbx8jq49eWe1XgZ8Tj
2025-03-27 18:44:09 UTC	480	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:09 GMT Content-Type: application/json Content-Length: 208 Connection: close Cache-Control: private, max-age=0, no-cache, no-store Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow Vary: Accept-Encoding, User-Agent
2025-03-27 18:44:09 UTC	208	IN	Data Raw: 7b 22 6d 65 74 61 22 3a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 7d 2c 22 64 61 74 61 22 3a 5b 7b 22 6d 69 6e 50 61 73 73 77 6f 72 64 4c 65 6e 67 74 68 22 3a 38 2c 22 6c 6f 77 65 72 63 61 73 65 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 75 70 70 65 72 63 61 73 65 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 6e 75 6d 65 72 69 63 43 68 61 72 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 73 70 65 63 69 61 6c 43 68 61 72 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 65 78 70 69 72 61 74 69 6f 6e 44 61 79 73 22 3a 39 30 2c 22 61 75 74 6f 55 6e 6c 6f 63 6b 22 3a 74 72 75 65 7d 5d 2c 22 66 61 69 6c 22 3a 5b 5d 7d Data Ascii: {"meta":{"status":200},"data":[{"minPasswordLength":8,"lowercaseRequired":true,"uppercaseRequired":true,"numericCharRequired":true,"specialCharRequired":true,"expirationDays":90,"autoUnlock":true}],"fail":[]}

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:09 UTC	1231	OUT	GET /u/rest/branding/get-branding-item/XHEvsJVPT_EZoLeMOMeG5weyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiNGJ3cURMVnF3ZHVEekVvdyJ9.1kh7WKb40TgeYxkLGNv5ule9WZ3k1oH_.FZzBolsUTrqulVWX.YiMBEE9mOE80jIG0UY77oEynpbMlOaXcisP_rHZADKcm9lMCSqYyeJDBe2bVGDuBwOiJkqUVlDaajiyjpq35eJ3dk-7fEZnuJskOOdrnjCz5T_11_bArxLzcXNxMrG8rKaON3Es66uMV-WxYkD6jZLTYM9X5zoyLTxfLOESKE8mxXsB9VCrscmzzRBDBv6EZt-ROVd5jf9aB1_3hE8tDijIUNoqmSzwJqtlOdK2Hyo-5p9tZSSGrtkg_PPxBHfroLY-_eocn653LuhhrkT4Qommz5yFJ7UsSGUcdPpbrgotgbk2kqED-xzemr33WyluyD7LRDI2f15IE28fvL2ZKsJAeCrFaTcCnKkrcjJCdPBtB6JDegctmI2I_vVj7fLnI-HXl4YlBCfm-KDTlhMxJVkm3M-00UeKtQigxDiRKyLSaR10vtGlw6MXZKSLlDnVBtkYXYSuGtUuw0Nf86bZLQJQztsvYgr0tLfNHEVaDCFD9zAuUBVZnyGgXJHO8Hc8RoMXEh8I_IaOuH-mdVSw8rJ9-6SJXb5k43mPMyAdhw3sGBbxusjQKKFTiBqSDY_UL7owuqMLcalmY3YBdq4B9.QTubUwtzUgczdyK8fjx-gA?tkn=rsm HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:09 UTC	379	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:09 GMT Content-Type: image/png;charset=utf-8 Content-Length: 2274 Connection: close Cache-Control: max-age=1209600 Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Encoding: UTF-8
2025-03-27 18:44:09 UTC	2274	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 00 78 08 06 00 00 00 48 15 cf 20 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 08 84 49 44 41 54 78 da ec dd 41 72 db 36 14 c6 71 a4 93 03 e8 06 51 16 5d 5b 39 41 e8 13 44 39 81 e4 66 a6 9b 2e 6c 77 ba e8 4e f6 ae 8b 4e 15 2f ba e9 4c 1a f9 04 91 4f 20 e6 04 51 d6 5d 54 3d 41 d5 1b 14 cf 7d 4a 58 45 32 01 12 80 28 f2 ff 9b 61 ed 69 64 89 a4 89 4f 0f 30 08 19 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 a1 47 c7 b2 a3 3f fd fc 4b 66 bf 2c 02 3c d5 e9 8f 3f 7c 9f 3f f8 88 37 5f 87 7a ad 34 5e fd 51 fe 7b 7c f3 d7 95 fd ef 84 4b 1e fb da 85 79 f5 24 6f fa 4e 7e c5 ef 09 c0 b1 20 b0 00 10 Data Ascii: PNGIHDR,xH tEXtSoftwareAdobe ImageReadyqe<IDATxAr6qQ][9AD9f.lwNN/LO Q]T=A}JXE2(aidO0hG?Kf,<?\|?7_z4^Q{\|Ky$oN~

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Windows Analysis Report
https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:09 UTC	1603	OUT	GET /u/rest/branding/get-branding-item/m-NHsBWUn2FkP75AbBfvJgeyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiUGdiWUxmb1dKX3IzekpaMyJ9.SRrXMDqzliuYRzcQnlBLYHuRjaCRsNpp.GK8LKFYWHnmCG6F-.FA9MnLU1ka3gMv_Jxa6IrCuLjY7rmhVZhrROtJPkOloN3fWPhI7Dc8jcvoyeBdmbJ_rQVUZCRFLkTXQkPfVz0a17CsNBe2DB3KH_XObdaRQ72jdTKtX-XrznQG2uE_vuk3HdR9i4MdaLvlwwK5v3homKCSoQL8TPogsKZCJ5Ukd174trpoNI4V0mThlRMpa567sN6F_bPa_OjcuumLjEHFGbxbmSUIg54D_pnFU0SVgm2TdQiBKtNl3IEPDaYpwfVNYihJClZIJwd1zamfb3GWqCcwcTa0ZNCWFBH1EYGKkMWvyjKNTjqCL67Vfc33FOvgrMxucLZ3JKksW9HH-mYOPw7d4FQLwfFjqjeWDxLE2mi6NnrVC8C1haV9pCPSnM4xuZHpn4ClMTkYgBJi3skodd6XjdjYD79pX9pyYN4i0lwt34zY7oq0lwVpsGn2ggwvbB7stQROP91JB6B7DX-FH8V700EWkgst_DvyU7MqWETbn1wI_AtCQofFogz-9Ng5BvYcGuz_ZHLA1oejotWLaVwG6VXUMFDErhRFHPkXjkfXF6VdaNQyzFgclxOWGwaA.Jxy9xzFgiE1nZEawEmi6tQ?tkn=rsm HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rsm.login-us.mimecast.com/u/login/?gta=secure&tkn=3.qxMK6fC9rAYoFkdpfynDqerNL8qBxYpXwpMaObhHnx-vL124IKn5QyalirIpobai3mz5HLl9SqEKlq6E748Mfu7s-sVvL4sJ0pZSDnXcKPncuo3FaOI4LjFLVrABwXbi.wSqoeHG0Rj1VtU7l7nvspA Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:09 UTC	381	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:09 GMT Content-Type: image/x-icon;charset=utf-8 Content-Length: 318 Connection: close Cache-Control: max-age=1209600 Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Encoding: UTF-8
2025-03-27 18:44:09 UTC	318	IN	Data Raw: 00 00 01 00 01 00 10 10 10 00 01 00 04 00 28 01 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 6a 66 63 00 ff ff ff 00 3f 9c 35 00 de 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 00 Data Ascii: (( jfc?5"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:09 UTC	1644	OUT	GET /data/ptm.gif/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?v=2.269.1_prod&ct=1743101048724&jzb=eJztU02PozgU_C-stKcQPhOgpdEqSScdGsgn-erVChkwAQI22IaEjPq_j9O9M9rLznUu4xOvilc8nqv-_iqwroLCk1BCBoSeEBJ8pZAELCs5qhi6psiKrJuGbPaENqMZwyTIYt4QrKaL52XgBxY5jde-5d03BhdoSMHJlLGKPkkSoWW_wOcMiQ3tl1wzApT1I1xKjfSBS3-dGfhCYdQQ-Ce7oC9av755zjCZWGR0wrNLXCUdeq4hWbhmPb6dquO18sAyTOfoJrauouq2gwbrDhQZsSscgkwr74O5W1jbeuoU9XBq6KaXNAYV6b51dfoqV2_bZ3SMnBWKGqzNwNLW3Xzm7slofD2GWf-6rTGcv8ibXNmznVEYqKXV6A8pSgE6Q7EClF4xiSV7j-v6dbia-kf3NvBcy8d5flv4gejUk312QuUJJEoQW8symJkotu1uAucQyKMk3HlmOn5F4lEBC6ed3-BVjrZwH69fVkEmOifkvFwu0ztWHVfcT7O3U-7v7HVxn5eXzsnbXF42YT6OX_C6s-vJuqYZdc_TlRXjO8L3NNm6CVx0mjtIzbT2rU27hKai7GR1sMFOELuVeMfus7dvWTZa7Ci9hTczr3ULHqByPL-Zfr4Sh5PXQ9iuOTken-z5eua1l05fis4kH6gHOeO3XRFcUeHp63drPB5_5o6Cb7AB54fhIAp2W-G9J4Aowg1ivJUXFSAQsdF_oRiwx_uqIcmapPI_4DotJDTD6AH31aHVVwI-SfxQ-xTwQWjzMVBTFD2BfRbC0XWbLfOtBYQ-PQw3XCchoIQfJBlDT0-bTB6dV91xeeAkhfTxkQ9avePDcDqa785ySgeJ_kHXDUQRn03muekY5IswNeu99yNTBQbxzzKlaL8z9TtT_5uph33-NY0uG0pftb4f09R_kdWVH1Y3NP39n2_I_ [TRUNCATED] Host: app.pendo.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://rsm.login-us.mimecast.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:09 UTC	450	IN	HTTP/1.1 200 OK access-control-allow-credentials: false access-control-allow-headers: * access-control-allow-methods: GET,POST access-control-allow-origin: * access-control-max-age: 600 cache-control: no-store content-type: image/gif x-content-type-options: nosniff date: Thu, 27 Mar 2025 18:44:09 GMT Content-Length: 42 Via: 1.1 google Strict-Transport-Security: max-age=63072000; includeSubDomains Alt-Svc: clear Connection: close
2025-03-27 18:44:09 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:09 UTC	1371	OUT	GET /data/guide.js/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?id=17&jzb=eJx9Uk2PokAQ_S9ssqdBPvyCSSYbUVSkEVFkZC6kgVYboRtoQGAz_32YPWz2tLeq915Vpareb67BDFe0NGLulQsO-n5lB26glr7muKrVH-fcC1eX6UDeqypnr4JQsmyU0hsmfM1GGc5QBFk1imgm1MIfXPh1q-AbQ1Fdop_Vg7yNR0VrmbPrUi0XPl0_4vzakVWByj1QCq3188szt6Ad3rek5RsgyRPDJFOngykujZyGEI-zfroFqXoqdDMtZvp8oljXes545jVgwnZi_nFakUtkHkhU0_Ea2sYEJGvglQvteQnx6HkqKNpuxGMiedV5ns5Jw_LFDyG6Q3JDfA4Ze9IyFgyPFsVudtDdC2inFlBdmiTt3g14s1h62CeZD69SEKt2FqwVEhtGt0RbBMXFNTxbyl3bEf4iwb3ZbFv0FKMT8mJncwgwb_rE3Dweek9lE_Cejj_8xD0bTtpvs0dnJk0i2nWYaPGGOp1RLJ2CYQZu-kGNaU9of7-ewBXtuzGY3pV74arHxkaKJJ1FeXqkZhCDnO8pWFleU-HF_sxYG7ZKUkxU9I6ky-1DcZMDP1vu3sPGGUhN842ts7aaRzexeXOZTOV3EQ_fzlAFY1hB7vWvOb5D_B-DpMMRa3hDgwKR4HziPl84GEW0JtVQOiQ5LBGpFv9Cw4hvvTwXxLEgD0sMfRpUMkzJNzySZ-pICvKSxtzn5xe5-ORX&v=2.269.1_prod&ct=1743101048727 HTTP/1.1 Host: app.pendo.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://rsm.login-us.mimecast.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:09 UTC	471	IN	HTTP/1.1 200 OK access-control-allow-credentials: false access-control-allow-headers: * access-control-allow-methods: GET,POST access-control-allow-origin: * access-control-max-age: 600 cache-control: no-store content-type: application/javascript x-content-type-options: nosniff date: Thu, 27 Mar 2025 18:44:09 GMT Via: 1.1 google Strict-Transport-Security: max-age=63072000; includeSubDomains Alt-Svc: clear Connection: close Transfer-Encoding: chunked
2025-03-27 18:44:09 UTC	526	IN	Data Raw: 39 38 32 0d 0a 70 65 6e 64 6f 2e 67 75 69 64 65 73 50 61 79 6c 6f 61 64 28 7b 22 67 75 69 64 65 73 22 3a 5b 7b 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 57 6f 72 6b 73 70 61 63 65 20 6c 61 75 6e 63 68 20 67 75 69 64 65 20 66 72 6f 6d 20 74 6f 70 2d 6e 61 76 20 62 61 72 22 2c 22 63 72 65 61 74 65 64 42 79 55 73 65 72 22 3a 7b 22 69 64 22 3a 22 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 66 69 72 73 74 22 3a 22 22 2c 22 6c 61 73 74 22 3a 22 22 2c 22 72 6f 6c 65 22 3a 30 2c 22 75 73 65 72 54 79 70 65 22 3a 22 22 2c 22 68 61 73 4c 6f 67 67 65 64 49 6e 22 3a 66 61 6c 73 65 7d 2c 22 63 72 65 61 74 65 64 41 74 22 3a 31 37 34 31 36 34 33 39 35 32 30 33 34 2c 22 6c 61 73 74 55 70 64 61 74 65 64 42 79 55 73 65 72 22 3a 7b 22 69 64 22 3a 22 22 2c 22 75 73 Data Ascii: 982pendo.guidesPayload({"guides":[{"description":"Workspace launch guide from top-nav bar","createdByUser":{"id":"","username":"","first":"","last":"","role":0,"userType":"","hasLoggedIn":false},"createdAt":1741643952034,"lastUpdatedByUser":{"id":"","us
2025-03-27 18:44:09 UTC	997	IN	Data Raw: 6e 67 22 3a 66 61 6c 73 65 2c 22 61 74 74 72 69 62 75 74 65 73 22 3a 7b 22 64 61 74 65 73 22 3a 7b 22 65 6e 2d 55 53 22 3a 22 4d 61 72 20 31 31 2c 20 32 30 32 35 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 74 79 70 65 22 3a 22 64 65 73 6b 74 6f 70 22 7d 2c 22 6f 76 65 72 72 69 64 65 41 75 74 6f 54 68 72 6f 74 74 6c 69 6e 67 22 3a 74 72 75 65 2c 22 70 72 69 6f 72 69 74 79 22 3a 31 37 32 38 2c 22 73 68 61 72 65 64 53 65 72 76 69 63 65 56 65 72 73 69 6f 6e 22 3a 22 34 2e 32 37 2e 32 33 22 2c 22 74 79 70 65 22 3a 22 62 75 69 6c 64 69 6e 67 2d 62 6c 6f 63 6b 22 7d 2c 22 61 75 64 69 65 6e 63 65 22 3a 5b 7b 22 73 6f 75 72 63 65 22 3a 7b 22 76 69 73 69 74 6f 72 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 65 76 61 6c 22 3a 7b 22 61 63 63 6f 75 6e 74 49 64 22 3a 22 6d 65 74 Data Ascii: ng":false,"attributes":{"dates":{"en-US":"Mar 11, 2025"},"device":{"type":"desktop"},"overrideAutoThrottling":true,"priority":1728,"sharedServiceVersion":"4.27.23","type":"building-block"},"audience":[{"source":{"visitors":null}},{"eval":{"accountId":"met
2025-03-27 18:44:09 UTC	918	IN	Data Raw: 22 3a 22 62 75 69 6c 64 69 6e 67 2d 62 6c 6f 63 6b 22 2c 22 65 6c 65 6d 65 6e 74 50 61 74 68 52 75 6c 65 22 3a 22 5b 64 61 74 61 2d 69 63 6f 6e 3d 5c 22 73 75 69 74 63 61 73 65 5c 22 5d 22 2c 22 74 72 69 67 67 65 72 45 6c 65 6d 65 6e 74 50 61 74 68 52 75 6c 65 22 3a 22 22 2c 22 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 45 6c 65 6d 65 6e 74 50 61 74 68 52 75 6c 65 22 3a 22 22 2c 22 63 6f 6e 74 65 6e 74 54 79 70 65 22 3a 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2c 22 62 75 69 6c 64 69 6e 67 42 6c 6f 63 6b 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 65 6e 64 6f 2d 73 74 61 74 69 63 2d 35 37 30 37 37 39 37 34 32 37 39 31 32 37 30 34 2e 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 67 75 69 64 65 2d 63 Data Ascii: ":"building-block","elementPathRule":"[data-icon=\"suitcase\"]","triggerElementPathRule":"","confirmationElementPathRule":"","contentType":"text/html; charset=utf-8","buildingBlocksUrl":"https://pendo-static-5707797427912704.storage.googleapis.com/guide-c
2025-03-27 18:44:09 UTC	997	IN	Data Raw: 36 66 32 35 0d 0a 6d 65 6e 74 73 22 3a 22 22 2c 22 65 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 70 61 64 64 69 6e 67 22 3a 7b 22 62 6f 74 74 6f 6d 22 3a 30 2c 22 6c 65 66 74 22 3a 30 2c 22 72 69 67 68 74 22 3a 30 2c 22 74 6f 70 22 3a 30 7d 7d 2c 22 65 6c 65 6d 65 6e 74 53 65 6c 65 63 74 69 6f 6e 54 79 70 65 22 3a 22 63 75 73 74 6f 6d 22 2c 22 69 73 41 75 74 6f 46 6f 63 75 73 22 3a 74 72 75 65 2c 22 6c 61 79 6f 75 74 44 69 72 22 3a 22 62 6f 74 74 6f 6d 22 2c 22 74 68 65 6d 65 49 64 22 3a 22 6e 79 52 4e 49 30 62 64 51 64 54 5f 37 53 71 6c 4b 77 2d 68 59 51 72 4e 43 49 30 22 7d 2c 22 6c 61 73 74 55 70 64 61 74 65 64 41 74 22 3a 31 37 34 32 33 32 37 37 33 32 30 33 32 2c 22 72 65 73 65 74 41 74 22 3a 31 37 34 31 36 39 36 32 38 38 33 35 34 2c 22 68 69 64 65 Data Ascii: 6f25ments":"","enabled":false,"padding":{"bottom":0,"left":0,"right":0,"top":0}},"elementSelectionType":"custom","isAutoFocus":true,"layoutDir":"bottom","themeId":"nyRNI0bdQdT_7SqlKw-hYQrNCI0"},"lastUpdatedAt":1742327732032,"resetAt":1741696288354,"hide
2025-03-27 18:44:09 UTC	997	IN	Data Raw: 22 69 73 4f 6e 6c 79 53 68 6f 77 4f 6e 63 65 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 47 75 69 64 65 4f 6e 6c 79 4f 6e 45 6c 65 6d 65 6e 74 43 6c 69 63 6b 22 3a 74 72 75 65 7d 2c 22 65 6c 65 6d 65 6e 74 53 65 6c 65 63 74 69 6f 6e 54 79 70 65 22 3a 22 73 74 65 70 31 22 2c 22 70 72 69 6f 72 69 74 79 22 3a 38 39 31 2c 22 73 68 61 72 65 64 53 65 72 76 69 63 65 56 65 72 73 69 6f 6e 22 3a 22 33 2e 31 2e 34 36 22 2c 22 74 79 70 65 22 3a 22 62 75 69 6c 64 69 6e 67 2d 62 6c 6f 63 6b 22 7d 2c 22 61 75 64 69 65 6e 63 65 22 3a 5b 7b 22 73 6f 75 72 63 65 22 3a 7b 22 76 69 73 69 74 6f 72 73 22 3a 6e 75 6c 6c 7d 7d 2c 7b 22 65 76 61 6c 22 3a 7b 22 61 63 63 6f 75 6e 74 49 64 22 3a 22 6d 65 74 61 64 61 74 61 2e 61 75 74 6f 2e 61 63 63 6f 75 6e 74 69 64 73 22 7d 7d 2c 7b 22 Data Ascii: "isOnlyShowOnce":false,"showGuideOnlyOnElementClick":true},"elementSelectionType":"step1","priority":891,"sharedServiceVersion":"3.1.46","type":"building-block"},"audience":[{"source":{"visitors":null}},{"eval":{"accountId":"metadata.auto.accountids"}},{"
2025-03-27 18:44:09 UTC	997	IN	Data Raw: 70 65 22 3a 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2c 22 62 75 69 6c 64 69 6e 67 42 6c 6f 63 6b 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 65 6e 64 6f 2d 73 74 61 74 69 63 2d 35 37 30 37 37 39 37 34 32 37 39 31 32 37 30 34 2e 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 67 75 69 64 65 2d 63 6f 6e 74 65 6e 74 2f 46 6f 55 79 30 48 5a 5a 62 42 73 6f 37 49 6b 6c 47 43 69 72 4b 62 66 4c 48 77 67 2f 77 65 65 4b 5f 58 78 38 79 50 4f 78 37 7a 4c 70 38 7a 52 51 5f 66 61 53 5f 41 34 2f 49 58 32 6a 6d 2d 32 32 46 75 33 68 6d 52 6d 76 50 44 34 70 36 2d 61 69 53 74 73 2e 62 75 69 6c 64 69 6e 67 42 6c 6f 63 6b 73 2e 6a 73 6f 6e 22 2c 22 64 6f 6d 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 65 6e 64 6f Data Ascii: pe":"text/html; charset=utf-8","buildingBlocksUrl":"https://pendo-static-5707797427912704.storage.googleapis.com/guide-content/FoUy0HZZbBso7IklGCirKbfLHwg/weeK_Xx8yPOx7zLp8zRQ_faS_A4/IX2jm-22Fu3hmRmvPD4p6-aiSts.buildingBlocks.json","domUrl":"https://pendo
2025-03-27 18:44:09 UTC	997	IN	Data Raw: 64 65 44 69 73 6d 69 73 73 43 6f 75 6e 74 22 3a 30 7d 2c 7b 22 63 72 65 61 74 65 64 42 79 55 73 65 72 22 3a 7b 22 69 64 22 3a 22 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 66 69 72 73 74 22 3a 22 22 2c 22 6c 61 73 74 22 3a 22 22 2c 22 72 6f 6c 65 22 3a 30 2c 22 75 73 65 72 54 79 70 65 22 3a 22 22 2c 22 68 61 73 4c 6f 67 67 65 64 49 6e 22 3a 66 61 6c 73 65 7d 2c 22 63 72 65 61 74 65 64 41 74 22 3a 31 36 33 32 34 39 35 30 33 36 36 38 32 2c 22 6c 61 73 74 55 70 64 61 74 65 64 42 79 55 73 65 72 22 3a 7b 22 69 64 22 3a 22 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 66 69 72 73 74 22 3a 22 22 2c 22 6c 61 73 74 22 3a 22 22 2c 22 72 6f 6c 65 22 3a 30 2c 22 75 73 65 72 54 79 70 65 22 3a 22 22 2c 22 68 61 73 4c 6f 67 67 65 64 49 6e 22 3a 66 61 6c 73 Data Ascii: deDismissCount":0},{"createdByUser":{"id":"","username":"","first":"","last":"","role":0,"userType":"","hasLoggedIn":false},"createdAt":1632495036682,"lastUpdatedByUser":{"id":"","username":"","first":"","last":"","role":0,"userType":"","hasLoggedIn":fals
2025-03-27 18:44:09 UTC	997	IN	Data Raw: 41 74 22 3a 30 2c 22 70 75 62 6c 69 73 68 65 64 41 74 22 3a 31 36 33 32 37 34 30 36 33 33 32 34 31 2c 22 70 75 62 6c 69 73 68 65 64 45 76 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 74 46 69 72 73 74 45 6c 69 67 69 62 6c 65 54 6f 42 65 53 65 65 6e 41 74 22 3a 31 36 33 37 31 36 38 37 31 34 35 33 33 2c 22 69 73 54 6f 70 4c 65 76 65 6c 22 3a 66 61 6c 73 65 2c 22 69 73 4d 6f 64 75 6c 65 22 3a 66 61 6c 73 65 2c 22 65 64 69 74 6f 72 54 79 70 65 22 3a 22 65 6e 67 61 67 65 55 49 22 2c 22 64 65 70 65 6e 64 65 6e 74 4d 65 74 61 64 61 74 61 22 3a 5b 5d 2c 22 61 75 74 6f 43 72 65 61 74 65 46 65 65 64 62 61 63 6b 22 3a 66 61 6c 73 65 2c 22 6c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 73 74 65 70 73 22 3a 5b 7b 22 69 64 22 3a 22 56 65 33 56 47 64 72 Data Ascii: At":0,"publishedAt":1632740633241,"publishedEver":false,"currentFirstEligibleToBeSeenAt":1637168714533,"isTopLevel":false,"isModule":false,"editorType":"engageUI","dependentMetadata":[],"autoCreateFeedback":false,"language":"en-US","steps":[{"id":"Ve3VGdr
2025-03-27 18:44:09 UTC	997	IN	Data Raw: 65 61 70 69 73 2e 63 6f 6d 2f 67 75 69 64 65 2d 63 6f 6e 74 65 6e 74 2f 4f 50 6b 71 4c 4d 79 33 46 61 65 70 64 57 50 72 78 50 58 43 63 64 6b 4d 38 59 41 2f 56 65 33 56 47 64 72 59 6d 50 6f 63 7a 6c 73 4b 36 5f 32 6f 61 69 56 53 4f 30 63 2f 2d 6b 4d 73 4e 57 38 45 35 79 43 32 58 66 5f 6a 53 39 39 4a 33 4a 4c 33 6c 4c 41 2e 64 6f 6d 2e 6a 73 6f 6e 70 3f 73 68 61 32 35 36 3d 59 74 6b 32 77 73 74 4f 42 4d 7a 52 54 7a 6b 37 50 45 62 47 62 5f 55 70 54 4e 63 67 76 31 66 76 41 56 62 53 44 47 6f 77 6c 4c 34 22 2c 22 72 61 6e 6b 22 3a 31 30 30 30 30 30 30 30 2c 22 61 64 76 61 6e 63 65 4d 65 74 68 6f 64 22 3a 22 62 75 74 74 6f 6e 22 2c 22 61 74 74 72 69 62 75 74 65 73 22 3a 7b 22 74 68 65 6d 65 49 64 22 3a 22 75 6e 74 68 65 6d 65 64 22 7d 2c 22 6c 61 73 74 55 70 64 Data Ascii: eapis.com/guide-content/OPkqLMy3FaepdWPrxPXCcdkM8YA/Ve3VGdrYmPoczlsK6_2oaiVSO0c/-kMsNW8E5yC2Xf_jS99J3JL3lLA.dom.jsonp?sha256=Ytk2wstOBMzRTzk7PEbGb_UpTNcgv1fvAVbSDGowlL4","rank":10000000,"advanceMethod":"button","attributes":{"themeId":"unthemed"},"lastUpd
2025-03-27 18:44:09 UTC	997	IN	Data Raw: 72 6f 74 74 6c 69 6e 67 22 3a 74 72 75 65 2c 22 70 72 69 6f 72 69 74 79 22 3a 31 34 30 37 2c 22 73 68 61 72 65 64 53 65 72 76 69 63 65 56 65 72 73 69 6f 6e 22 3a 22 34 2e 32 32 2e 32 22 2c 22 74 79 70 65 22 3a 22 62 75 69 6c 64 69 6e 67 2d 62 6c 6f 63 6b 22 7d 2c 22 61 75 64 69 65 6e 63 65 55 69 48 69 6e 74 22 3a 7b 22 66 69 6c 74 65 72 73 22 3a 5b 5d 7d 2c 22 61 75 74 68 6f 72 65 64 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 72 65 63 75 72 72 65 6e 63 65 22 3a 30 2c 22 72 65 63 75 72 72 65 6e 63 65 45 6c 69 67 69 62 69 6c 69 74 79 57 69 6e 64 6f 77 22 3a 30 2c 22 72 65 73 65 74 41 74 22 3a 31 37 30 36 36 32 31 39 37 34 39 31 31 2c 22 70 75 62 6c 69 73 68 65 64 41 74 22 3a 31 37 30 36 36 32 31 39 38 30 38 34 31 2c 22 70 75 62 6c 69 73 68 65 Data Ascii: rottling":true,"priority":1407,"sharedServiceVersion":"4.22.2","type":"building-block"},"audienceUiHint":{"filters":[]},"authoredLanguage":"en-US","recurrence":0,"recurrenceEligibilityWindow":0,"resetAt":1706621974911,"publishedAt":1706621980841,"publishe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:09 UTC	738	OUT	GET /data/guide.gif/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1743101048728&v=2.269.1_prod HTTP/1.1 Host: app.pendo.io Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://rsm.login-us.mimecast.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:09 UTC	450	IN	HTTP/1.1 200 OK access-control-allow-credentials: false access-control-allow-headers: * access-control-allow-methods: GET,POST access-control-allow-origin: * access-control-max-age: 600 cache-control: no-store content-type: image/gif x-content-type-options: nosniff date: Thu, 27 Mar 2025 18:44:09 GMT Content-Length: 42 Via: 1.1 google Strict-Transport-Security: max-age=63072000; includeSubDomains Alt-Svc: clear Connection: close
2025-03-27 18:44:09 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:09 UTC	425	OUT	GET /u/proxy/api/login/get-password-rules HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:10 UTC	351	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 27 Mar 2025 18:44:09 GMT Content-Length: 0 Connection: close Cache-Control: private, max-age=0, no-cache, no-store Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:10 UTC	1213	OUT	GET /u/rest/branding/get-branding-item/m-NHsBWUn2FkP75AbBfvJgeyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJjIjo2NTUzNiwicDJzIjoiUGdiWUxmb1dKX3IzekpaMyJ9.SRrXMDqzliuYRzcQnlBLYHuRjaCRsNpp.GK8LKFYWHnmCG6F-.FA9MnLU1ka3gMv_Jxa6IrCuLjY7rmhVZhrROtJPkOloN3fWPhI7Dc8jcvoyeBdmbJ_rQVUZCRFLkTXQkPfVz0a17CsNBe2DB3KH_XObdaRQ72jdTKtX-XrznQG2uE_vuk3HdR9i4MdaLvlwwK5v3homKCSoQL8TPogsKZCJ5Ukd174trpoNI4V0mThlRMpa567sN6F_bPa_OjcuumLjEHFGbxbmSUIg54D_pnFU0SVgm2TdQiBKtNl3IEPDaYpwfVNYihJClZIJwd1zamfb3GWqCcwcTa0ZNCWFBH1EYGKkMWvyjKNTjqCL67Vfc33FOvgrMxucLZ3JKksW9HH-mYOPw7d4FQLwfFjqjeWDxLE2mi6NnrVC8C1haV9pCPSnM4xuZHpn4ClMTkYgBJi3skodd6XjdjYD79pX9pyYN4i0lwt34zY7oq0lwVpsGn2ggwvbB7stQROP91JB6B7DX-FH8V700EWkgst_DvyU7MqWETbn1wI_AtCQofFogz-9Ng5BvYcGuz_ZHLA1oejotWLaVwG6VXUMFDErhRFHPkXjkfXF6VdaNQyzFgclxOWGwaA.Jxy9xzFgiE1nZEawEmi6tQ?tkn=rsm HTTP/1.1 Host: rsm.login-us.mimecast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:10 UTC	381	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 18:44:10 GMT Content-Type: image/x-icon;charset=utf-8 Content-Length: 318 Connection: close Cache-Control: max-age=1209600 Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Encoding: UTF-8
2025-03-27 18:44:10 UTC	318	IN	Data Raw: 00 00 01 00 01 00 10 10 10 00 01 00 04 00 28 01 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 6a 66 63 00 ff ff ff 00 3f 9c 35 00 de 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 01 22 21 33 33 33 33 33 00 Data Ascii: (( jfc?5"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333"!33333

Timestamp	Bytes transferred	Direction	Data
2025-03-27 18:44:10 UTC	1398	OUT	GET /data/ptm.gif/0600cd7b-e6b2-4ba9-4249-ab1342c3631b?v=2.269.1_prod&ct=1743101048724&jzb=eJztU02PozgU_C-stKcQPhOgpdEqSScdGsgn-erVChkwAQI22IaEjPq_j9O9M9rLznUu4xOvilc8nqv-_iqwroLCk1BCBoSeEBJ8pZAELCs5qhi6psiKrJuGbPaENqMZwyTIYt4QrKaL52XgBxY5jde-5d03BhdoSMHJlLGKPkkSoWW_wOcMiQ3tl1wzApT1I1xKjfSBS3-dGfhCYdQQ-Ce7oC9av755zjCZWGR0wrNLXCUdeq4hWbhmPb6dquO18sAyTOfoJrauouq2gwbrDhQZsSscgkwr74O5W1jbeuoU9XBq6KaXNAYV6b51dfoqV2_bZ3SMnBWKGqzNwNLW3Xzm7slofD2GWf-6rTGcv8ibXNmznVEYqKXV6A8pSgE6Q7EClF4xiSV7j-v6dbia-kf3NvBcy8d5flv4gejUk312QuUJJEoQW8symJkotu1uAucQyKMk3HlmOn5F4lEBC6ed3-BVjrZwH69fVkEmOifkvFwu0ztWHVfcT7O3U-7v7HVxn5eXzsnbXF42YT6OX_C6s-vJuqYZdc_TlRXjO8L3NNm6CVx0mjtIzbT2rU27hKai7GR1sMFOELuVeMfus7dvWTZa7Ci9hTczr3ULHqByPL-Zfr4Sh5PXQ9iuOTken-z5eua1l05fis4kH6gHOeO3XRFcUeHp63drPB5_5o6Cb7AB54fhIAp2W-G9J4Aowg1ivJUXFSAQsdF_oRiwx_uqIcmapPI_4DotJDTD6AH31aHVVwI-SfxQ-xTwQWjzMVBTFD2BfRbC0XWbLfOtBYQ-PQw3XCchoIQfJBlDT0-bTB6dV91xeeAkhfTxkQ9avePDcDqa785ySgeJ_kHXDUQRn03muekY5IswNeu99yNTBQbxzzKlaL8z9TtT_5uph33-NY0uG0pftb4f09R_kdWVH1Y3NP39n2_I_ [TRUNCATED] Host: app.pendo.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 18:44:10 UTC	450	IN	HTTP/1.1 200 OK access-control-allow-credentials: false access-control-allow-headers: * access-control-allow-methods: GET,POST access-control-allow-origin: * access-control-max-age: 600 cache-control: no-store content-type: image/gif x-content-type-options: nosniff date: Thu, 27 Mar 2025 18:44:10 GMT Content-Length: 42 Via: 1.1 google Strict-Transport-Security: max-age=63072000; includeSubDomains Alt-Svc: clear Connection: close
2025-03-27 18:44:10 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Target ID:	0
Start time:	14:43:55
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6884f0000
File size:	3'384'928 bytes
MD5 hash:	DBE43C1D0092437B88CFF7BD9ABC336C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	14:43:57
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,9676452063610803519,10853376293006389434,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250316-180048.776000 --mojo-platform-channel-handle=2104 /prefetch:11
Imagebase:	0x7ff6884f0000
File size:	3'384'928 bytes
MD5 hash:	DBE43C1D0092437B88CFF7BD9ABC336C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	6
Start time:	14:44:03
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://protect-us.mimecast.com/s/146LCmZky3h5z20p7FBi1URTA8h"
Imagebase:	0x7ff6884f0000
File size:	3'384'928 bytes
MD5 hash:	DBE43C1D0092437B88CFF7BD9ABC336C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true