Edit tour

Windows Analysis Report
securedoc_20250414T103717.html

Overview

General Information

Sample name:	securedoc_20250414T103717.html
Analysis ID:	1664742
MD5:	c4432d1b1bd231cdeb511e47d17b087c
SHA1:	9c8782462a5136458d5c505b224fa17291012ce5
SHA256:	f131edaa4a186173277acfcc58cf5507f728b36ac2dabe7fabe0a5de3e67fff3
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious Javascript

HTML file submission containing password form

Suspicious Javascript code found in HTML file

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

HTTP GET or POST without a user agent

IP address seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6668 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2312,i,14326597320850353260,6128771861761579037,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2332 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\securedoc_20250414T103717.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html

Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 0.1.pages.csv

AI detected suspicious Javascript

Source: 0.12..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/securedoc_20250414T... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. It appears to be a malicious script that collects user data and sends it to an external server. The use of a POST form, the presence of a 'payload' variable, and the interaction with a 'keyserver' domain further suggest suspicious and potentially malicious intent. Overall, this script poses a high risk and should be thoroughly investigated.

Suspicious Javascript code found in HTML file

Source: securedoc_20250414T103717.html	HTTP Parser: document.write
Source: securedoc_20250414T103717.html	HTTP Parser: location.href
Source: securedoc_20250414T103717.html	HTTP Parser: .location
Source: securedoc_20250414T103717.html	HTTP Parser: .location

Source: securedoc_20250414T103717.html	HTTP Parser: CIP Verification Elanfs Shared <cipverification@elanfs.com>
Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html	HTTP Parser: {'name':null,'msgID':'\|1__c6287a8d0000019634f29e0fffc41eff9d1b37a9@localhost','flags':3073,'rid':'ImpzY2hpcGZlckBncmVlbnZpbGxlZmVkZXJhbC5jb20iIDxqc2NoaXBmZXJAZ3JlZW52aWxsZWZlZGVyYWwuY29tPg==','algnames':{'encryption':{'data':'AES'},'keyHash':'SHA-256'},'algparams':{'encryption':{'data':{'IV':'mmiZN2nEonO4jkmkJ1FCVg=='}}},'keyserverhost':'res.cisco.com:443','securereplyhost':'res.cisco.com:443','openerhost':'res.cisco.com:443','toc':[['Body-1744645037587.txt',1,'','',13,[0,3605],'Body-1744645037587.txt','ISO-8859-1'],['GREENVILLE FEDERAL.pdf',2,'','GREENVILLE FEDERAL.pdf',5,[3605,200515],'GREENVILLE FEDERAL.pdf','ISO-8859-1'],['MessageBar.html',4,'','',1,[204120,35160],'MessageBar.html','ISO-8859-1']],'salt':'N+td2cqfmYAlGGJrBHydDzSBASA=','data':['','','']}
Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html	HTTP Parser: jsmith@contoso.com

Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html

HTTP Parser: Number of links: 1

Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html

HTTP Parser: Base64 decoded: "jschipfer@greenvillefederal.com" <jschipfer@greenvillefederal.com>

Source: securedoc_20250414T103717.html	HTTP Parser: Title: Secure Registered Envelope:New Elan Acct, Action Required Key 123 does not match URL
Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html	HTTP Parser: Title: Authentication Frame does not match URL

Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html

HTTP Parser: Has password / email / username input fields

Source: securedoc_20250414T103717.html	HTTP Parser: <input type="password" .../> found
Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html	HTTP Parser: <input type="password" .../> found

Source: securedoc_20250414T103717.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html	HTTP Parser: No favicon

Source: securedoc_20250414T103717.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 108.177.122.106:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.85:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.208.196.58:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.208.196.58:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.85:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.85:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.85:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.85:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.229.110.229:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.229.110.229:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.63:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.44.247.215:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.63:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.63:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.63:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49768 version: TLS 1.2

Source: global traffic

HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?p=0&d=%7B%27name%27%3Anull,%0D%0A%27msgID%27%3A%27%7C1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost%27,%0D%0A%27flags%27%3A3073,%0D%0A%27rid%27%3A%27ImpzY2hpcGZlckBncmVlbnZpbGxlZmVkZXJhbC5jb20iIDxqc2NoaXBmZXJAZ3JlZW52aWxsZWZlZGVyYWwuY29tPg%3D%3D%27,%0D%0A%27algnames%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%27AES%27%7D,%27keyHash%27%3A%27SHA-256%27%7D,%0D%0A%27algparams%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%7B%27IV%27%3A%27mmiZN2nEonO4jkmkJ1FCVg%3D%3D%27%7D%7D%7D,%0D%0A%27keyserverhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27securereplyhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27openerhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27toc%27%3A%5B%0D%0A%5B%27Body-1744645037587%2Etxt%27,1,%0D%0A%27%27,%0D%0A%27%27,%0D%0A13,%5B0,3605%5D,%27Body-1744645037587%2Etxt%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27GREENVILLE+FEDERAL%2Epdf%27,2,%0D%0A%27%27,%0D%0A%27GREENVILLE+FEDERAL%2Epdf%27,%0D%0A5,%5B3605,200515%5D,%27GREENVILLE+FEDERAL%2Epdf%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27MessageBar%2Ehtml%27,4,%0D%0A%27%27,%0D%0A%27%27,%0D%0A1,%5B204120,35160%5D,%27MessageBar%2Ehtml%27,%0D%0A%27ISO-8859-1%27%5D%0D%0A%5D,%0D%0A%27salt%27%3A%27N%2Btd2cqfmYAlGGJrBHydDzSBASA%3D%27,%0D%0A%27data%27%3A%5B%0D%0A%27%27,%27sXJmy2sL5VXJeN3w24DYtuOnpiLzTfRVz8TN1HVaGeQXF5%2FcS%2FbtfuXQ2VCtFRj1DFHFj4IsH6ZIOu2IG%2FqxlEoVnkvEdTjb2RGQkCJTUz2oxbjNMPXHjn1p%2FDeBCcnbpl1%2ByiylLF8BzWYPubMdwLc65wweZdoLdB10U%2BceaR0eUiAqy%2F%2FyM0AavB7Lw6XwtlNhvNpm2zTxEjfxv7LPDvW220b%2FdiIWbVjOmP0p5K2gqo8T4VDoJsYzYhhyC9FK50DA3nFEs5X8ondYMK9WSGOLbJet5deV%2B57qkS1IzvpFxJ%2Ba4lisTyu8SbbnVFItjRrweAJ1zYDygG1FzrI6cJGXSq%2BOOFaxyXNxdYXazDu4c1V15xPuXxPegjNnaGa4qbx%2F1OC7KfTIcU9BG3wk7BHWlHAyj2Fag%2FKRrB6o2NfA%2BTqPQXv%2BG4SjXPD4emCUObgIZLV4eJ2bD0%2FffT07AcWpn9YNsQNsHYf4PWFqsXrYdvQ9L9PELCTuHtK5xaltn97heDzc5L7myR91tW2JytZ1bMYOe5edtmd5vm3uwFssXdfCn2oM5C5py1AQWh8A2RVbnrLSjwls5O4qN0tLuhukfwoHJ%2FXo%2Fam3FRVakEva0QFC5FrT70NCQmf6OiVGMo9fHCrKpJS%2BDUveLAUqD2cClmpIHMSGxCzGf7bo5EHngh7sGbPWf1VAEmKk%2FHmk%2FpZZwOCyGI0ZVaNE296b121%2F1OEJTsQu9eOYh%2BdOQgTAevbbeXjdQ3fc%2F9RtEtnleyakLbJdhhSTId8NuwX0aCnXqK%2FFGcoCt65CVK60JGvMtWNiSuB%2BBfek7fyceD4xZabSisUv5QnMnfWsJ1lglsstQXhrJfeAH0YrxtnywQ2x%2Fo2EfAXWtvj%2FkaUHlZsV%2FXEe819ofjmTm5GcaR3YbizNWmiJR94Cql%2FD49xGSsPeeTStV5FGFIm2STLWRTu%2F2oolSC2ww44wfHW5VBj1SRVeuSSePxWDyuZHq4tDbX1su8NkjgdRooH2Wq%2Bob97qGtjTfOchcGoLBamyJ9x2qqK9o76WkuJULBHSNFKzo%2Fj%2FyUq4U43R3UtGyIfXFLeGfCExhRmH6frYLunNSiScdAgXjCoWyjF1kTQXreX4aqihJbExiWxBQn1NHBYg5acr6iTo7YNGuBNyVL4apesdDwZQkEkCBcNROzt3KxsH3a4OY8RkCA9gavY73bGGI%2FvUbLeo1aeEY%2FYC8vSlMx35i7CrHFVO033iPj6aMgD%2FxFUgPj9whEX8QcZXx9V86pVyGUglpz5aMwi%2BjrtKU0kcsYm77DXaDqNSVlY0DUeIxHTq8NohUINIxU6b6QRQZW1ZPCwFdEHoc%2Bokt%2BvYTpuhuJ7zbDleS70LaC3Xs0dveF%2Bj4eCSG%2BMTOgZl2aUsQHV2Dq%2FXSncsaU%2FeY%2Fyk2irEoTmJhqpitXu6NNxwWaVjBGEcQQ0g7KBd7xnH1kq9n36Yxphh4v6mn6ug1ImR22U4G8f9ibUcl0PQyyqi3xOGMW

Source: Joe Sandbox View

IP Address: 104.17.24.14 104.17.24.14

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.215.94
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.215.94
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.215.94
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.215.94
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.215.94
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.215.94
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.215.94
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.215.94
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ajax/libs/select2/4.0.12/css/select2.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/select2/4.0.12/js/select2.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /postx.css HTTP/1.1Host: static.cres-aws.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websafe/logo/ptZ7YKQ1DE0.hya1GSdimhLUGsxYGG7kkyLOcdYZhHyi05Qmaa6IqnJQCO0RFhUVevahTQ!!/branding/customer-logo.gif?f=1 HTTP/1.1Host: res.cisco.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /CRES_login_bg.jpg HTTP/1.1Host: static.cres-aws.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=7dWSXCfERGsUOtN441ttyunRy4jKOddWjLKS1RKY2oGOrkaWJbS5Qn8D09382Tv3CxBt7c377Xwq56THS86BJH+t7x1L70d6L2I7eGu/SU+Xh4mrlomHB5S2rGFP
Source: global traffic	HTTP traffic detected: GET /fonts/Inter/Inter-Regular.ttf HTTP/1.1Host: static.cres-aws.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.cres-aws.com/postx.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Inter/Inter-Light.ttf HTTP/1.1Host: static.cres-aws.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.cres-aws.com/postx.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Inter/Inter-SemiBold.ttf HTTP/1.1Host: static.cres-aws.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.cres-aws.com/postx.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Inter/Inter-Bold.ttf HTTP/1.1Host: static.cres-aws.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.cres-aws.com/postx.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=NXM8tOH5s7CMiOwYa9RSIJIYFYnryu8eybLZXoxs8CNetP9cZpogWflD5CdnbqhjVkbyEdBW6ClNARMzywTDXJmAKdj183rdvy7Uw+4PcpxkxFxqcc639WVpk6db
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=ok&lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=7dWSXCfERGsUOtN441ttyunRy4jKOddWjLKS1RKY2oGOrkaWJbS5Qn8D09382Tv3CxBt7c377Xwq56THS86BJH+t7x1L70d6L2I7eGu/SU+Xh4mrlomHB5S2rGFP
Source: global traffic	HTTP traffic detected: GET /websafe/images/loginbg.gif HTTP/1.1Host: res.cisco.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=NXM8tOH5s7CMiOwYa9RSIJIYFYnryu8eybLZXoxs8CNetP9cZpogWflD5CdnbqhjVkbyEdBW6ClNARMzywTDXJmAKdj183rdvy7Uw+4PcpxkxFxqcc639WVpk6db
Source: global traffic	HTTP traffic detected: GET /websafe/logo/ptZ7YKQ1DE0.hya1GSdimhLUGsxYGG7kkyLOcdYZhHyi05Qmaa6IqnJQCO0RFhUVevahTQ!!/branding/customer-logo.gif?f=1 HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=7dWSXCfERGsUOtN441ttyunRy4jKOddWjLKS1RKY2oGOrkaWJbS5Qn8D09382Tv3CxBt7c377Xwq56THS86BJH+t7x1L70d6L2I7eGu/SU+Xh4mrlomHB5S2rGFP
Source: global traffic	HTTP traffic detected: GET /keyserver/keyserver?su=jsmith%40contoso.com&df=&tf=&lp=en&v=2&m=%7c1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost&s=1&f=0&d=1744646946715&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36 HTTP/1.1Host: res.cisco.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=7dWSXCfERGsUOtN441ttyunRy4jKOddWjLKS1RKY2oGOrkaWJbS5Qn8D09382Tv3CxBt7c377Xwq56THS86BJH+t7x1L70d6L2I7eGu/SU+Xh4mrlomHB5S2rGFP
Source: global traffic	HTTP traffic detected: GET /CRES_login_bg.jpg HTTP/1.1Host: static.cres-aws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websafe/images/loginbg.gif HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=FB8811B028A8AB09B4CEB5D233F1EA38; AWSALB=Cq4AHSqdtXpiXp4ERhXEnPENLMg5Z3oXSNDpOx1bGEihGCHSSctHrEOVqHteBg7Xf9wqSfRdSJBYkC4/Ij6BxtfMcLzB7+hg2NF/akQWlC3dg3VINIpH4Vclb8Cl; AWSALBCORS=8irg8o+mNv+zRUFJDb2UpRsqAftBMynzHNNB42zLmjb3Ox4WKcWkY/nGtFH+0EirTAoihYSZx36974XXFUnqRwPsCAgq8+zB9ju87acNIv+MLgBIGDBzDQBfmNZl; TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5
Source: global traffic	HTTP traffic detected: GET /keyserver/keyserver?su=jsmith%40contoso.com&df=&tf=&lp=en&v=2&m=%7c1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost&s=8&f=0&d=1744646959820&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqq&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36 HTTP/1.1Host: res.cisco.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=9fwheTHwZka7iyxyXXF/HBtjRyKmq25Ee9mRtnYbY5WYolTosQN5pCqq7fujjEKQYdwR8lABTpTKr7XplOoVvTt6p2V5PMviAuy8vHvcKLrqi0/fyX8VXh4psBKu
Source: global traffic	HTTP traffic detected: GET /postx.css HTTP/1.1Host: static.cres-aws.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://res.cisco.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Inter/Inter-Regular.ttf HTTP/1.1Host: static.cres-aws.comConnection: keep-aliveOrigin: https://res.cisco.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.cres-aws.com/postx.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/Inter/Inter-Bold.ttf HTTP/1.1Host: static.cres-aws.comConnection: keep-aliveOrigin: https://res.cisco.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.cres-aws.com/postx.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websafe/images/skins/googleSignIn.png HTTP/1.1Host: res.cisco.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://res.cisco.com/websafe/custom.action?cmd=authFrameAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=vpNBqMceYJQflkC9VuYs5PkLxyD8rF0iDjG2MbxZq6M8e6jRK/53TxraVn66V6ZqZ6PR5UZkRLjg6ArchTZhYF161dqPyCZGWyLj5CecV81RktKq4tPBNmkXvt94
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=ok&lp=en&try=1 HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=0Hsxj/TOisbo+FEkP8RSg7Ptzc+VNgpmgVzmRMnN2zhl7IVoNNj2IopVRwcq38pVCaBbSMWj5Kev74DPU9IEQGSoRzufGlLVTfoCDAJ5zUNZf0Reg3nXGhfc9Haf
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en&try=1 HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=0Hsxj/TOisbo+FEkP8RSg7Ptzc+VNgpmgVzmRMnN2zhl7IVoNNj2IopVRwcq38pVCaBbSMWj5Kev74DPU9IEQGSoRzufGlLVTfoCDAJ5zUNZf0Reg3nXGhfc9Haf
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://res.cisco.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /keyserver/keyserver?su=jsmith%40contoso.com&df=&tf=&lp=en&ck=0&v=2&m=%7c1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost&s=9&f=0&d=1744646962883&action=open&prd=519&prn=1&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqp&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36 HTTP/1.1Host: res.cisco.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=B7C8D88A8969DA5C4DFF75AEEE6A7EC0; TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=khctCwmxvMegebYwBYLCFEHS1ElpbgKjDkKWeoukOyscb4trCEy7X60hikbyl5AvjQWtWVatAQO5d6CfUPB00y8cwcVfeysS3UP5GqzLQe6YDyUJVMLGeDkiomg7
Source: global traffic	HTTP traffic detected: GET /websafe/images/skins/googleSignIn.png HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: JSESSIONID=FB8811B028A8AB09B4CEB5D233F1EA38; TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALB=9fwheTHwZka7iyxyXXF/HBtjRyKmq25Ee9mRtnYbY5WYolTosQN5pCqq7fujjEKQYdwR8lABTpTKr7XplOoVvTt6p2V5PMviAuy8vHvcKLrqi0/fyX8VXh4psBKu; AWSALBCORS=khctCwmxvMegebYwBYLCFEHS1ElpbgKjDkKWeoukOyscb4trCEy7X60hikbyl5AvjQWtWVatAQO5d6CfUPB00y8cwcVfeysS3UP5GqzLQe6YDyUJVMLGeDkiomg7
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=ok&lp=en&try=1 HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALB=LJMwlQtLM9CGDtucfg9k0eokwF4eVMLSeDPIpineDOPrngqyAQWNNbmWrNI9Vp1YsB6uPCICGY9buvEppuQm9g7ywx+rEcrR2dk07OgP0zPYnqUwQ76m1RW5Pqdd; AWSALBCORS=6C82DQ7KEMFmDOjjoKrTHlXd6BAGPUcdhiP8Ek8NOmOnQRtMJn+LCcZGP69xZQHnUl8954Ee5Yu9wpEeD8D6DdQVfXdoLwNhHdo/yeo4CmfLzvo99R1mWRQUelnq
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en&try=1 HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALB=LJMwlQtLM9CGDtucfg9k0eokwF4eVMLSeDPIpineDOPrngqyAQWNNbmWrNI9Vp1YsB6uPCICGY9buvEppuQm9g7ywx+rEcrR2dk07OgP0zPYnqUwQ76m1RW5Pqdd; AWSALBCORS=di7yhffxq+jYSwNi+8EjdZN6aZ445S5fzDbqqn+GkgBWkdZHQbrMQqY6WLG3cuz8Otvf2A7DAjjHQ84JRHuemNjiG4VbFJh54g57uzxvk8lirlFYa+TAe1eg1fRV
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?p=0&d=%7B%27name%27%3Anull,%0D%0A%27msgID%27%3A%27%7C1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost%27,%0D%0A%27flags%27%3A3073,%0D%0A%27rid%27%3A%27ImpzY2hpcGZlckBncmVlbnZpbGxlZmVkZXJhbC5jb20iIDxqc2NoaXBmZXJAZ3JlZW52aWxsZWZlZGVyYWwuY29tPg%3D%3D%27,%0D%0A%27algnames%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%27AES%27%7D,%27keyHash%27%3A%27SHA-256%27%7D,%0D%0A%27algparams%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%7B%27IV%27%3A%27mmiZN2nEonO4jkmkJ1FCVg%3D%3D%27%7D%7D%7D,%0D%0A%27keyserverhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27securereplyhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27openerhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27toc%27%3A%5B%0D%0A%5B%27Body-1744645037587%2Etxt%27,1,%0D%0A%27%27,%0D%0A%27%27,%0D%0A13,%5B0,3605%5D,%27Body-1744645037587%2Etxt%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27GREENVILLE+FEDERAL%2Epdf%27,2,%0D%0A%27%27,%0D%0A%27GREENVILLE+FEDERAL%2Epdf%27,%0D%0A5,%5B3605,200515%5D,%27GREENVILLE+FEDERAL%2Epdf%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27MessageBar%2Ehtml%27,4,%0D%0A%27%27,%0D%0A%27%27,%0D%0A1,%5B204120,35160%5D,%27MessageBar%2Ehtml%27,%0D%0A%27ISO-8859-1%27%5D%0D%0A%5D,%0D%0A%27salt%27%3A%27N%2Btd2cqfmYAlGGJrBHydDzSBASA%3D%27,%0D%0A%27data%27%3A%5B%0D%0A%27%27,%27sXJmy2sL5VXJeN3w24DYtuOnpiLzTfRVz8TN1HVaGeQXF5%2FcS%2FbtfuXQ2VCtFRj1DFHFj4IsH6ZIOu2IG%2FqxlEoVnkvEdTjb2RGQkCJTUz2oxbjNMPXHjn1p%2FDeBCcnbpl1%2ByiylLF8BzWYPubMdwLc65wweZdoLdB10U%2BceaR0eUiAqy%2F%2FyM0AavB7Lw6XwtlNhvNpm2zTxEjfxv7LPDvW220b%2FdiIWbVjOmP0p5K2gqo8T4VDoJsYzYhhyC9FK50DA3nFEs5X8ondYMK9WSGOLbJet5deV%2B57qkS1IzvpFxJ%2Ba4lisTyu8SbbnVFItjRrweAJ1zYDygG1FzrI6cJGXSq%2BOOFaxyXNxdYXazDu4c1V15xPuXxPegjNnaGa4qbx%2F1OC7KfTIcU9BG3wk7BHWlHAyj2Fag%2FKRrB6o2NfA%2BTqPQXv%2BG4SjXPD4emCUObgIZLV4eJ2bD0%2FffT07AcWpn9YNsQNsHYf4PWFqsXrYdvQ9L9PELCTuHtK5xaltn97heDzc5L7myR91tW2JytZ1bMYOe5edtmd5vm3uwFssXdfCn2oM5C5py1AQWh8A2RVbnrLSjwls5O4qN0tLuhukfwoHJ%2FXo%2Fam3FRVakEva0QFC5FrT70NCQmf6OiVGMo9fHCrKpJS%2BDUveLAUqD2cClmpIHMSGxCzGf7bo5EHngh7sGbPWf1VAEmKk%2FHmk%2FpZZwOCyGI0ZVaNE296b121%2F1OEJTsQu9eOYh%2BdOQgTAevbbeXjdQ3fc%2F9RtEtnleyakLbJdhhSTId8NuwX0aCnXqK%2FFGcoCt65CVK60JGvMtWNiSuB%2BBfek7fyceD4xZabSisUv5QnMnfWsJ1lglsstQXhrJfeAH0YrxtnywQ2x%2Fo2EfAXWtvj%2FkaUHlZsV%2FXEe819ofjmTm5GcaR3YbizNWmiJR94Cql%2FD49xGSsPeeTStV5FGFIm2STLWRTu%2F2oolSC2ww44wfHW5VBj1SRVeuSSePxWDyuZHq4tDbX1su8NkjgdRooH2Wq%2Bob97qGtjTfOchcGoLBamyJ9x2qqK9o76WkuJULBHSNFKzo%2Fj%2FyUq4U43R3UtGyIfXFLeGfCExhRmH6frYLunNSiScdAgXjCoWyjF1kTQXreX4aqihJbExiWxBQn1NHBYg5acr6iTo7YNGuBNyVL4apesdDwZQkEkCBcNROzt3KxsH3a4OY8RkCA9gavY73bGGI%2FvUbLeo1aeEY%2FYC8vSlMx35i7CrHFVO033iPj6aMgD%2FxFUgPj9whEX8QcZXx9V86pVyGUglpz5aMwi%2BjrtKU0kcsYm77DXaDqNSVlY0DUeIxHTq8NohUINIxU6b6QRQZW1ZPCwFdEHoc%2Bokt%2BvYTpuhuJ7zbDleS70LaC3Xs0dveF%2Bj4eCSG%2BMTOgZl2aUsQHV2Dq%2FXSncsaU%2FeY%2Fyk2irEoTmJhqpitXu6NNxwWaVjBGEcQQ0g7KBd7xnH1kq9n36Yxphh4v6mn6ug1ImR22U4G8f9ibUcl0PQyyqi3xOGMW
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=ok&lp=en HTTP/1.1Host: res.cisco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.cres-aws.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: res.cisco.com

Source: unknown

HTTP traffic detected: POST /websafe/custom.action?cmd=authFrame HTTP/1.1Host: res.cisco.comConnection: keep-aliveContent-Length: 953Cache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Origin: nullContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=HXQuLXdAsBaQ18pYY+aSpFdW21cadp3FAR5gk7cdmyrmSosHt9m/7FY1w1XD8f9LA57AmIfeiUomyr7/9r83e4i1owiB4XZwq5126ayHuEd4OnSPDH2zOfLWyLSA

Source: securedoc_20250414T103717.html	String found in binary or memory: http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQ
Source: chromecache_71.3.dr	String found in binary or memory: http://scripts.sil.org/OFLInterLightWeightSlant
Source: chromecache_91.3.dr	String found in binary or memory: http://scripts.sil.org/OFLInterSemiBoldWeightSlant
Source: chromecache_74.3.dr, chromecache_76.3.dr	String found in binary or memory: http://scripts.sil.org/OFLWeightSlant
Source: chromecache_89.3.dr, chromecache_80.3.dr	String found in binary or memory: http://scripts.sil.org/OFLWeightSlantRegular
Source: securedoc_20250414T103717.html	String found in binary or memory: http://www.usbank.com
Source: securedoc_20250414T103717.html	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js
Source: securedoc_20250414T103717.html	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/css/select2.min.css
Source: securedoc_20250414T103717.html	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/js/select2.min.js
Source: chromecache_91.3.dr, chromecache_71.3.dr	String found in binary or memory: https://github.com/rsms/inter)Inter
Source: chromecache_89.3.dr, chromecache_80.3.dr	String found in binary or memory: https://github.com/rsms/inter)InterBold3.019;RSMS;Inter-BoldInter
Source: chromecache_74.3.dr, chromecache_76.3.dr	String found in binary or memory: https://github.com/rsms/inter)InterRegular3.019;RSMS;Inter-RegularInter
Source: chromecache_78.3.dr	String found in binary or memory: https://github.com/select2/select2/blob/master/LICENSE.md
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com/websafe/custom.action?cmd=authFrame
Source: chromecache_72.3.dr	String found in binary or memory: https://res.cisco.com/websafe/custom.action?cmd=changeExpiredPassword&id=jsmith
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com/websafe/images/loginbg.gif
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com/websafe/images/pullFeature/arrowDown.svg
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com/websafe/logo/ptZ7YKQ1DE0.hya1GSdimhLUGsxYGG7kkyLOcdYZhHyi05Qmaa6IqnJQCO0RFhUVe
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com:443
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com:443/envelopeopener/decrypt_envelope.jsp
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com:443/keyserver/Logout
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com:443/keyserver/keyserver
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com:443/websafe/help?topic=AddrNotShown
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com:443/websafe/help?topic=PPNotShown
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com:443/websafe/help?topic=RegEnvelope
Source: securedoc_20250414T103717.html	String found in binary or memory: https://res.cisco.com:443/websafe/pswdForgot.action
Source: securedoc_20250414T103717.html	String found in binary or memory: https://static.cres-aws.com/CRES_login_bg.jpg
Source: securedoc_20250414T103717.html	String found in binary or memory: https://static.cres-aws.com/postx.css

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 108.177.122.106:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.85:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.208.196.58:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.208.196.58:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.85:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.85:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.85:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.85:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.229.110.229:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.229.110.229:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.63:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.44.247.215:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.63:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.63:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.163.115.63:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.4:49768 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.winHTML@23/44@22/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2312,i,14326597320850353260,6128771861761579037,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2332 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\securedoc_20250414T103717.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2312,i,14326597320850353260,6128771861761579037,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2332 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html

HTTP Parser: file:///C:/Users/user/Desktop/securedoc_20250414T103717.html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file:///C:/Users/user/Desktop/securedoc_20250414T103717.html	0%	Avira URL Cloud	safe
http://scripts.sil.org/OFLInterSemiBoldWeightSlant	0%	Avira URL Cloud	safe
http://scripts.sil.org/OFLWeightSlant	0%	Avira URL Cloud	safe
http://scripts.sil.org/OFLInterLightWeightSlant	0%	Avira URL Cloud	safe
http://scripts.sil.org/OFLWeightSlantRegular	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
res.cisco.com	52.44.247.215	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
www.google.com	108.177.122.106	true	false	high
d2qj7djftjbj85.cloudfront.net	3.163.115.85	true	false	unknown
static.cres-aws.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://static.cres-aws.com/fonts/Inter/Inter-Light.ttf	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=ok&lp=en	false		high
http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?lp=en	false		high
https://res.cisco.com/websafe/images/loginbg.gif	false		high
https://res.cisco.com/keyserver/keyserver?su=jsmith%40contoso.com&df=&tf=&lp=en&v=2&m=%7c1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost&s=1&f=0&d=1744646946715&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36	false		high
http://c.pki.goog/r/r4.crl	false		high
https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/css/select2.min.css	false		high
https://res.cisco.com/websafe/images/skins/googleSignIn.png	false		high
http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en	false		high
https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en	false		high
https://res.cisco.com/websafe/custom.action?cmd=authFrame	false		high
https://static.cres-aws.com/fonts/Inter/Inter-Regular.ttf	false		high
https://res.cisco.com/keyserver/keyserver?su=jsmith%40contoso.com&df=&tf=&lp=en&v=2&m=%7c1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost&s=8&f=0&d=1744646959820&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqq&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36	false		high
https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=ok&lp=en&try=1	false		high
https://static.cres-aws.com/fonts/Inter/Inter-SemiBold.ttf	false		high
https://res.cisco.com/keyserver/keyserver?su=jsmith%40contoso.com&df=&tf=&lp=en&ck=0&v=2&m=%7c1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost&s=9&f=0&d=1744646962883&action=open&prd=519&prn=1&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqp&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36	false		high
http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=ok&lp=en	false		high
file:///C:/Users/user/Desktop/securedoc_20250414T103717.html	true	Avira URL Cloud: safe	unknown
https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?lp=en	false		high
https://static.cres-aws.com/postx.css	false		high
http://c.pki.goog/r/gsr1.crl	false		high
https://static.cres-aws.com/CRES_login_bg.jpg	false		high
https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.12/js/select2.min.js	false		high
https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en&try=1	false		high
https://res.cisco.com/websafe/logo/ptZ7YKQ1DE0.hya1GSdimhLUGsxYGG7kkyLOcdYZhHyi05Qmaa6IqnJQCO0RFhUVevahTQ!!/branding/customer-logo.gif?f=1	false		high
https://static.cres-aws.com/fonts/Inter/Inter-Bold.ttf	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://res.cisco.com/websafe/images/pullFeature/arrowDown.svg	securedoc_20250414T103717.html	false		high
http://www.usbank.com	securedoc_20250414T103717.html	false		high
http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQ	securedoc_20250414T103717.html	false		high
https://github.com/select2/select2/blob/master/LICENSE.md	chromecache_78.3.dr	false		high
https://res.cisco.com:443/websafe/help?topic=RegEnvelope	securedoc_20250414T103717.html	false		high
https://github.com/rsms/inter)InterBold3.019;RSMS;Inter-BoldInter	chromecache_89.3.dr, chromecache_80.3.dr	false		high
https://github.com/rsms/inter)InterRegular3.019;RSMS;Inter-RegularInter	chromecache_74.3.dr, chromecache_76.3.dr	false		high
http://scripts.sil.org/OFLWeightSlant	chromecache_74.3.dr, chromecache_76.3.dr	false	Avira URL Cloud: safe	unknown
https://res.cisco.com:443/websafe/help?topic=PPNotShown	securedoc_20250414T103717.html	false		high
http://scripts.sil.org/OFLWeightSlantRegular	chromecache_89.3.dr, chromecache_80.3.dr	false	Avira URL Cloud: safe	unknown
https://res.cisco.com:443/websafe/help?topic=AddrNotShown	securedoc_20250414T103717.html	false		high
https://res.cisco.com:443/envelopeopener/decrypt_envelope.jsp	securedoc_20250414T103717.html	false		high
https://res.cisco.com:443/websafe/pswdForgot.action	securedoc_20250414T103717.html	false		high
http://scripts.sil.org/OFLInterLightWeightSlant	chromecache_71.3.dr	false	Avira URL Cloud: safe	unknown
https://res.cisco.com:443	securedoc_20250414T103717.html	false		high
https://res.cisco.com:443/keyserver/keyserver	securedoc_20250414T103717.html	false		high
https://github.com/rsms/inter)Inter	chromecache_91.3.dr, chromecache_71.3.dr	false		high
http://scripts.sil.org/OFLInterSemiBoldWeightSlant	chromecache_91.3.dr	false	Avira URL Cloud: safe	unknown
https://res.cisco.com/websafe/logo/ptZ7YKQ1DE0.hya1GSdimhLUGsxYGG7kkyLOcdYZhHyi05Qmaa6IqnJQCO0RFhUVe	securedoc_20250414T103717.html	false		high
https://res.cisco.com:443/keyserver/Logout	securedoc_20250414T103717.html	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.44.247.215	res.cisco.com	United States	14618	AMAZON-AESUS	false
3.163.115.85	d2qj7djftjbj85.cloudfront.net	United States	16509	AMAZON-02US	false
3.163.115.63	unknown	United States	16509	AMAZON-02US	false
3.229.110.229	unknown	United States	14618	AMAZON-AESUS	false
108.177.122.106	www.google.com	United States	15169	GOOGLEUS	false
44.208.196.58	unknown	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1664742
Start date and time:	2025-04-14 18:07:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	securedoc_20250414T103717.html
Detection:	MAL
Classification:	mal60.phis.winHTML@23/44@22/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.76.34.6, 142.251.15.101, 142.251.15.113, 142.251.15.138, 142.251.15.139, 142.251.15.102, 142.251.15.100, 64.233.185.94, 108.177.122.139, 108.177.122.102, 108.177.122.113, 108.177.122.101, 108.177.122.138, 108.177.122.100, 64.233.176.84, 74.125.136.113, 74.125.136.138, 74.125.136.101, 74.125.136.102, 74.125.136.100, 74.125.136.139, 23.4.43.62, 199.232.214.172, 64.233.177.113, 64.233.177.139, 64.233.177.101, 64.233.177.102, 64.233.177.138, 64.233.177.100, 172.253.124.100, 172.253.124.102, 172.253.124.139, 172.253.124.138, 172.253.124.101, 172.253.124.113, 74.125.138.95, 74.125.138.101, 74.125.138.139, 74.125.138.113, 74.125.138.102, 74.125.138.138, 74.125.138.100, 142.250.9.138, 142.250.9.102, 142.250.9.139, 142.250.9.113, 142.250.9.100, 142.250.9.101, 172.253.124.95, 74.125.21.95, 142.250.105.95, 64.233.177.95, 74.125.136.95, 173.194.219.95, 172.217.215.95, 108.177.122.95, 142.250.9.95, 64.233.176.95, 64.233.185.95, 64.233.185.139, 64.233.185.113, 64.233.185.102, 64
Excluded domains from analysis (whitelisted): clients1.google.com, fp.msedge.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ajax.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
3.163.115.85	http://decktop.us/gORiyf	Get hash	malicious	HTMLPhisher	Browse
3.163.115.63	https://webshuaw.weebly.com/	Get hash	malicious	HTMLPhisher	Browse
	_file____C__Users_hp_Downloads_C__Users_moodyt_AppData_Local_Temp_2_RemittanceAdvice17-Apr-2024.html	Get hash	malicious	Unknown	Browse
	securedoc_20240212T082824.html	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
d2qj7djftjbj85.cloudfront.net	securedoc_20250312T094219.html	Get hash	malicious	Unknown	Browse	13.32.121.35
	https://themortgagehub.netlify.app/	Get hash	malicious	Unknown	Browse	13.32.121.35
	securedoc_20250206T160817.html	Get hash	malicious	Unknown	Browse	13.32.121.62
	securedoc_20250204T161616.html	Get hash	malicious	Unknown	Browse	13.32.121.62
	securedoc_20250130T095521.html	Get hash	malicious	Unknown	Browse	108.139.243.129
	securedoc_20250128T225648.html	Get hash	malicious	Unknown	Browse	13.32.121.110
	securedoc_20250124T095106.html	Get hash	malicious	Unknown	Browse	13.32.121.35
	securedoc_20241220T111852.html	Get hash	malicious	Unknown	Browse	13.32.121.110
	securedoc_20241220T070409.html	Get hash	malicious	Unknown	Browse	18.66.161.47
	securedoc_20241217T163143.html	Get hash	malicious	Unknown	Browse	18.66.161.47
res.cisco.com	securedoc_20250312T094219.html	Get hash	malicious	Unknown	Browse	3.216.49.201
	https://themortgagehub.netlify.app/	Get hash	malicious	Unknown	Browse	44.219.86.120
	securedoc_20250206T160817.html	Get hash	malicious	Unknown	Browse	3.209.177.19
	securedoc_20250204T161616.html	Get hash	malicious	Unknown	Browse	54.174.121.193
	securedoc_20250130T095521.html	Get hash	malicious	Unknown	Browse	35.172.198.201
	securedoc_20250128T225648.html	Get hash	malicious	Unknown	Browse	34.199.16.247
	securedoc_20250124T095106.html	Get hash	malicious	Unknown	Browse	34.200.196.108
	securedoc_20241220T111852.html	Get hash	malicious	Unknown	Browse	34.199.33.163
	securedoc_20241220T070409.html	Get hash	malicious	Unknown	Browse	52.86.107.71
	securedoc_20241217T163143.html	Get hash	malicious	Unknown	Browse	54.161.144.184
cdnjs.cloudflare.com	Waltham Payment Record.xlsx	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://www.rochesterrealestateblog.com	Get hash	malicious	Unknown	Browse	104.17.24.14
	McCullough - Ryan.svg	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://wonderful-flower-051df7210.6.azurestaticapps.net/	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	STATEMENT OF OVERDUE INVOICES ---MARCH2025.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://freegames2u.org/67c8217f5f4f4f18a19993e0	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.24.14
	QuarantineMessage.zip	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://jk.ievintwayt.com/mgRXV5X/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://drvn.vip/webapp/proposal/67ec4ff641fed	Get hash	malicious	Captcha Phish	Browse	104.17.25.14
	https://drvn.vip/webapp/proposal/67ec4ff641fed	Get hash	malicious	Captcha Phish	Browse	104.17.24.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://quotadocs-cloud.webflow.io/	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	172.67.160.199
	ps1 (3).ps1	Get hash	malicious	Unknown	Browse	104.21.72.118
	Waltham Payment Record.xlsx	Get hash	malicious	Unknown	Browse	104.18.35.212
	PO-INVOICE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	XS03-25041409-INV& PACK.com	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	js (10).js	Get hash	malicious	Unknown	Browse	104.21.48.1
	https://click.ap-mail.org/?qs=a7fe9f5ec76b9ef80d0500b704474b3baf8ed02c7081b00a80709bbe8c08cb429e83e4829d814009e88e8895002cb247ce5465664c3e4ab704ebc248ac9fcea6	Get hash	malicious	Unknown	Browse	104.26.2.116
	https://reviewcomenntsiite.com/	Get hash	malicious	AsyncRAT, DcRat	Browse	104.17.208.240
	js (10).js	Get hash	malicious	Unknown	Browse	104.21.16.1
AMAZON-02US	https://quotadocs-cloud.webflow.io/	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	3.165.184.23
	mpsl.elf	Get hash	malicious	Aquabot	Browse	34.249.145.219
	x86.elf	Get hash	malicious	Aquabot	Browse	34.249.145.219
	i686.elf	Get hash	malicious	Aquabot	Browse	54.247.62.1
	ppc.elf	Get hash	malicious	Aquabot	Browse	54.171.230.55
	sh4.elf	Get hash	malicious	Aquabot	Browse	34.243.160.129
	https://click.ap-mail.org/?qs=a7fe9f5ec76b9ef80d0500b704474b3baf8ed02c7081b00a80709bbe8c08cb429e83e4829d814009e88e8895002cb247ce5465664c3e4ab704ebc248ac9fcea6	Get hash	malicious	Unknown	Browse	18.155.1.18
	https://reviewcomenntsiite.com/	Get hash	malicious	AsyncRAT, DcRat	Browse	18.155.1.112
	linpeas.sh	Get hash	malicious	Unknown	Browse	54.247.62.1
	na.elf	Get hash	malicious	Prometei	Browse	13.214.182.154
AMAZON-02US	https://quotadocs-cloud.webflow.io/	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	3.165.184.23
	mpsl.elf	Get hash	malicious	Aquabot	Browse	34.249.145.219
	x86.elf	Get hash	malicious	Aquabot	Browse	34.249.145.219
	i686.elf	Get hash	malicious	Aquabot	Browse	54.247.62.1
	ppc.elf	Get hash	malicious	Aquabot	Browse	54.171.230.55
	sh4.elf	Get hash	malicious	Aquabot	Browse	34.243.160.129
	https://click.ap-mail.org/?qs=a7fe9f5ec76b9ef80d0500b704474b3baf8ed02c7081b00a80709bbe8c08cb429e83e4829d814009e88e8895002cb247ce5465664c3e4ab704ebc248ac9fcea6	Get hash	malicious	Unknown	Browse	18.155.1.18
	https://reviewcomenntsiite.com/	Get hash	malicious	AsyncRAT, DcRat	Browse	18.155.1.112
	linpeas.sh	Get hash	malicious	Unknown	Browse	54.247.62.1
	na.elf	Get hash	malicious	Prometei	Browse	13.214.182.154
AMAZON-AESUS	https://click.ap-mail.org/?qs=a7fe9f5ec76b9ef80d0500b704474b3baf8ed02c7081b00a80709bbe8c08cb429e83e4829d814009e88e8895002cb247ce5465664c3e4ab704ebc248ac9fcea6	Get hash	malicious	Unknown	Browse	18.207.37.15
	https://www.rochesterrealestateblog.com	Get hash	malicious	Unknown	Browse	3.5.28.217
	https://insights.sphera.com/e/272282/-24x3k8j-email-Recipient-Email/24x3mys/1733612915/h/SMbb5-i77eivzxRCGQTo5zh9LysX5uo-QExLIRrtM4I	Get hash	malicious	Unknown	Browse	34.237.219.119
	#U00d6szt#U00f6nd#U00edjprogram.msi	Get hash	malicious	AteraAgent	Browse	54.175.191.204
	Shipment Document.bat.exe	Get hash	malicious	FormBook	Browse	44.205.92.141
	http://www-kodi.com	Get hash	malicious	Unknown	Browse	34.234.106.80
	6499151747.pdf	Get hash	malicious	Unknown	Browse	54.234.96.219
	splarm5.elf	Get hash	malicious	Unknown	Browse	54.54.35.85
	splarm.elf	Get hash	malicious	Unknown	Browse	52.55.168.202
	mpsl.elf	Get hash	malicious	Unknown	Browse	54.208.42.78

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with very long lines (554)
Category:	downloaded
Size (bytes):	125394
Entropy (8bit):	5.069062799454485
Encrypted:	false
SSDEEP:	1536:ZrCMDD2MR/9fU2j2L292qgJYq1x2KLLn+mbkQ7ThzeSRwJWL0V8bK/FMGFOFlLn5:HDFfU2j2L292qgZxxv+mAQXhzeSRwzQ
MD5:	A0B4FF216E038470B000B63F5AA39816
SHA1:	319D6BB77F2115DA9F977569477AC010F87E6386
SHA-256:	7A61694ACF36F22050B90F751DBAFC330D5025471F83F5C08F663CD2633448F7
SHA-512:	A3B38E3CC9B204D809DBAEEB1417E878EFA9A2D8AAF9E311051FF6FEDD1C1F92F89901274EBD43A163F03D42567D6586063333A3ECDDC128A64773315BB1B094
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://static.cres-aws.com/postx.css
Preview:	/* Inter Font Library */..@font-face {. font-family: "Inter";. font-weight: 100;. src: url("./fonts/Inter/Inter-Thin.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 200;. src: url("./fonts/Inter/Inter-ExtraLight.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 300;. src: url("./fonts/Inter/Inter-Light.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 400;. src: url("./fonts/Inter/Inter-Regular.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 500;. src: url("./fonts/Inter/Inter-Medium.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 600;. src: url("./fonts/Inter/Inter-SemiBold.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 700;. src: url("./fonts/Inter/Inter-Bold.ttf") format("truetype");.}..@font-face {. font-family: "Inter";. font-weight: 800;. src: url("./fonts/Inter/Inter-ExtraBol

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (491), with CRLF line terminators
Entropy (8bit):	6.232035431747818
TrID:	Scalable Vector Graphics (18501/1) 24.18% HyperText Markup Language (12001/1) 15.69% HyperText Markup Language (12001/1) 15.69% HyperText Markup Language (11501/1) 15.03% HyperText Markup Language (11501/1) 15.03%
File name:	securedoc_20250414T103717.html
File size:	354'885 bytes
MD5:	c4432d1b1bd231cdeb511e47d17b087c
SHA1:	9c8782462a5136458d5c505b224fa17291012ce5
SHA256:	f131edaa4a186173277acfcc58cf5507f728b36ac2dabe7fabe0a5de3e67fff3
SHA512:	b097068fe383abd4d0f8f49577784d366fdb1441878be2b9ce9c9fc3e337225894860124f0e1377d3bcec22d7f0edf26512714d0e2cd64597561d388868b4705
SSDEEP:	6144:sWDWDeVBUwcUJIHYONivd29VTSaRHMtQQiB2pvQIa9gRG0HKL3w3L:sWDWDebUwcU490iiDID9mpw3w3L
TLSH:	D074E0893620643142F619F2B47B264A39355807094928B1FF6DC5ACBBFAD96503FFCD
File Content Preview:	saved from url=(0025)https://res.cisco.com:443 -->..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".. "http://www.w3.org/TR/html4/loose.dtd"><html..lang="en"><head><base href="http://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjEx

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 14, 2025 18:09:00.180865049 CEST	53	61876	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:00.309170008 CEST	53	59201	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:01.193519115 CEST	53	64770	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:04.116676092 CEST	57067	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:04.116871119 CEST	60942	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:04.223278999 CEST	53	57067	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:04.223438025 CEST	53	60942	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:06.469115019 CEST	53875	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:06.469297886 CEST	53520	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:06.469805002 CEST	56224	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:06.470038891 CEST	62196	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:06.470693111 CEST	65468	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:06.470863104 CEST	64145	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:06.576121092 CEST	53	60534	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:06.576683044 CEST	53	62196	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:06.576716900 CEST	53	56224	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:06.585414886 CEST	53	53875	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:06.586941957 CEST	53	64145	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:06.588212013 CEST	53	65468	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:06.603554964 CEST	53	53520	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:06.837409019 CEST	53489	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:06.837639093 CEST	53086	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:06.944886923 CEST	53	53489	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:06.946454048 CEST	53	53086	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:07.468581915 CEST	51536	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:07.469126940 CEST	63394	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:07.577379942 CEST	53	63394	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:07.578795910 CEST	53	51536	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:08.242432117 CEST	64096	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:08.242506027 CEST	51787	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:08.349466085 CEST	53	64096	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:08.375946999 CEST	53	51787	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:18.286021948 CEST	53	50355	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:21.481339931 CEST	55681	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:21.481497049 CEST	56198	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:21.589083910 CEST	53	56198	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:21.592564106 CEST	53	55681	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:22.171308994 CEST	58535	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:22.171508074 CEST	49884	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:22.281788111 CEST	53	49884	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:22.286252022 CEST	53	58535	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:23.389055967 CEST	62319	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:23.389187098 CEST	56763	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:09:23.495296001 CEST	53	50940	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:23.495740891 CEST	53	62319	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:23.495932102 CEST	53	56763	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:37.665628910 CEST	53	57132	1.1.1.1	192.168.2.4
Apr 14, 2025 18:09:51.995716095 CEST	138	138	192.168.2.4	192.168.2.255
Apr 14, 2025 18:09:59.755158901 CEST	53	62797	1.1.1.1	192.168.2.4
Apr 14, 2025 18:10:00.688682079 CEST	53	54346	1.1.1.1	192.168.2.4
Apr 14, 2025 18:10:02.609975100 CEST	53	57086	1.1.1.1	192.168.2.4
Apr 14, 2025 18:10:31.537596941 CEST	53	63549	1.1.1.1	192.168.2.4
Apr 14, 2025 18:11:08.907809019 CEST	55837	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:11:08.908102036 CEST	56052	53	192.168.2.4	1.1.1.1
Apr 14, 2025 18:11:09.019567013 CEST	53	55837	1.1.1.1	192.168.2.4
Apr 14, 2025 18:11:09.040581942 CEST	53	56052	1.1.1.1	192.168.2.4
Apr 14, 2025 18:11:17.804152966 CEST	53	51348	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Apr 14, 2025 18:09:02.334906101 CEST	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 14, 2025 18:09:02.441622019 CEST	1358	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 14 Apr 2025 15:21:43 GMT Expires: Mon, 14 Apr 2025 16:11:43 GMT Cache-Control: public, max-age=3000 Age: 2839 Last-Modified: Mon, 07 Apr 2025 13:58:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 06 c7 30 82 05 af 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 57 31 0b 30 09 06 03 55 04 06 13 02 42 45 31 19 30 17 06 03 55 04 0a 13 10 47 6c 6f 62 61 6c 53 69 67 6e 20 6e 76 2d 73 61 31 10 30 0e 06 03 55 04 0b 13 07 52 6f 6f 74 20 43 41 31 1b 30 19 06 03 55 04 03 13 12 47 6c 6f 62 61 6c 53 69 67 6e 20 52 6f 6f 74 20 43 41 17 0d 32 35 30 34 30 37 30 30 30 30 30 30 5a 17 0d 32 35 30 37 31 35 30 30 30 30 30 30 5a 30 82 04 f1 30 2a 02 0b 04 00 00 00 00 01 1e 44 a5 e4 04 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 29 45 c3 a8 0f 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 20 19 c1 8d 68 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 2c 5e 7f 1a 88 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 15 4b 5a [TRUNCATED] Data Ascii: 000H0W10UBE10UGlobalSign nv-sa10URoot CA10UGlobalSign Root CA250407000000Z250715000000Z00D141125000000Z00U0)E141125000000Z00U0 h141125000000Z00U0,^141125000000Z00U0KZ160107000000Z00U0/NIR170419000000Z00U0/NG170419000000Z00U0/N9191120000000Z00U0/N=k191204000000Z00U0*/N;X191204000000Z00U0-Ga7.u200630000000Z00U0-G
Apr 14, 2025 18:09:02.441660881 CEST	1095	IN	Data Raw: 18 9d c0 41 1c 9f 3e 54 68 41 17 0d 32 30 30 36 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2d 02 0e 47 c3 10 00 c0 4b fa 8a 26 54 b7 41 ec 2b 17 0d 32 30 30 36 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 Data Ascii: A>ThA200630000000Z00U0-GK&TA+200630000000Z00U0*6::200711160000Z00U0/vSBS%V>200728000000Z00U0/vSF-Kg>)200728000000Z00U0/vSHqe]c
Apr 14, 2025 18:09:02.601496935 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 14, 2025 18:09:02.709717035 CEST	1242	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 14 Apr 2025 16:01:53 GMT Expires: Mon, 14 Apr 2025 16:51:53 GMT Cache-Control: public, max-age=3000 Age: 429 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

Timestamp	Bytes transferred	Direction	Data
Apr 14, 2025 18:09:06.711137056 CEST	477	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 14, 2025 18:09:06.832916021 CEST	483	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Mon, 14 Apr 2025 16:09:06 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://res.cisco.com:443/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?lp=en Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>
Apr 14, 2025 18:09:07.463529110 CEST	491	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 14, 2025 18:09:07.585521936 CEST	497	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Mon, 14 Apr 2025 16:09:07 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://res.cisco.com:443/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>
Apr 14, 2025 18:09:07.587996960 CEST	487	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=ok&lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 14, 2025 18:09:07.710059881 CEST	493	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Mon, 14 Apr 2025 16:09:07 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://res.cisco.com:443/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=ok&lp=en Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>
Apr 14, 2025 18:09:52.725070000 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 14, 2025 18:10:37.850662947 CEST	6	OUT	Data Raw: 00 Data Ascii:
Apr 14, 2025 18:11:22.984565020 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Apr 14, 2025 18:09:06.711919069 CEST	13580	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?p=0&d=%7B%27name%27%3Anull,%0D%0A%27msgID%27%3A%27%7C1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost%27,%0D%0A%27flags%27%3A3073,%0D%0A%27rid%27%3A%27ImpzY2hpcGZlckBncmVlbnZpbGxlZmVkZXJhbC5jb20iIDxqc2NoaXBmZXJAZ3JlZW52aWxsZWZlZGVyYWwuY29tPg%3D%3D%27,%0D%0A%27algnames%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%27AES%27%7D,%27keyHash%27%3A%27SHA-256%27%7D,%0D%0A%27algparams%27%3A%7B%27encryption%27%3A%7B%27data%27%3A%7B%27IV%27%3A%27mmiZN2nEonO4jkmkJ1FCVg%3D%3D%27%7D%7D%7D,%0D%0A%27keyserverhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27securereplyhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27openerhost%27%3A%27res%2Ecisco%2Ecom%3A443%27,%0D%0A%27toc%27%3A%5B%0D%0A%5B%27Body-1744645037587%2Etxt%27,1,%0D%0A%27%27,%0D%0A%27%27,%0D%0A13,%5B0,3605%5D,%27Body-1744645037587%2Etxt%27,%0D%0A%27ISO-8859-1%27%5D,%0D%0A%5B%27GREENVILLE+FEDERAL%2Epdf%27,2,%0D%0A [TRUNCATED] Data Raw: Data Ascii:
Apr 14, 2025 18:09:06.833189964 CEST	13580	OUT	Data Raw: 51 50 33 37 6e 45 48 64 4d 71 41 64 52 6f 4d 75 64 36 61 69 63 4c 6f 5a 4c 6b 36 61 46 6a 47 36 7a 31 33 77 54 66 41 4c 59 32 74 54 65 58 30 71 4e 62 6a 56 64 50 74 76 4c 58 66 59 61 73 30 74 44 57 41 44 63 31 50 6f 32 31 6a 43 5a 42 6e 4c 75 47 Data Ascii: QP37nEHdMqAdRoMud6aicLoZLk6aFjG6z13wTfALY2tTeX0qNbjVdPtvLXfYas0tDWADc1Po21jCZBnLuG3O0ZDKPkHeERPq%2Fdr2%2Bcdx9WQ2Vq5kKW6tlwW7Dcwd3vb7TrKVr6zYD6LTzpUl2z3OGcVRGF%2F4qFdXBzPVTHDA7YYe6DgNtT5owqcXlsgpxc5HW0SD96bzVHpPHin5SBC3anUCWMYlxAD7IE34r6ZrL9duz
Apr 14, 2025 18:09:06.833240986 CEST	13580	OUT	Data Raw: 6f 4f 25 32 42 49 42 36 4c 64 41 48 41 49 64 6e 51 6e 55 32 76 39 6c 6b 36 79 51 43 35 66 38 52 47 57 71 6f 79 30 31 50 56 42 30 4e 58 36 62 4c 78 34 6a 33 64 32 65 77 71 52 39 41 6f 79 35 58 74 45 75 55 51 36 6a 79 42 4e 69 77 76 6f 30 34 48 6f Data Ascii: oO%2BIB6LdAHAIdnQnU2v9lk6yQC5f8RGWqoy01PVB0NX6bLx4j3d2ewqR9Aoy5XtEuUQ6jyBNiwvo04HoX24MP1JbmmkaSXcoAT%2BJC8ccaVDAvvfr7PQ82M01MZX9kYQroWC5O1ZQw5mFyGJJVr%2FGh0jqF2WFi9KIVXxs29iXzFh0sjNLK5YBn7pijqaL4OPz8SqNIbZfYX786tUaVLaZB4Vt32TBo5OFFXWVk5MpqEjbD
Apr 14, 2025 18:09:06.954226017 CEST	8148	OUT	Data Raw: 55 6a 76 61 58 37 51 44 76 38 71 32 62 6a 4c 35 7a 42 46 4d 58 6b 72 77 30 72 35 6f 72 6b 4c 41 48 64 4e 6a 56 6a 4d 6b 76 4b 44 51 74 39 41 45 39 6f 74 75 56 39 52 42 52 6b 71 51 54 70 42 32 70 77 38 72 33 74 66 67 59 47 25 32 42 39 25 32 42 75 Data Ascii: UjvaX7QDv8q2bjL5zBFMXkrw0r5orkLAHdNjVjMkvKDQt9AE9otuV9RBRkqQTpB2pw8r3tfgYG%2B9%2Bu4%2FGZ8w%2B1wbxoynEeipFE%2F%2BshBrxGPydwNhjiXA1rfXpJdoPy0E1kSqQPT2CZIo%2F5WKCmwCSnyeY5Pm4NyBzkvhXu9Do8al0fXlh2n2s1j%2Ft6Y0bQlzURsYaM4yy4bevzLCMKZHr2OlRm9AUj5SurJ
Apr 14, 2025 18:09:06.954271078 CEST	5432	OUT	Data Raw: 57 4a 30 43 4e 73 79 50 64 6e 79 34 36 6e 4d 56 74 36 55 25 32 42 41 6a 39 41 71 4e 73 31 31 6e 51 4e 76 44 66 43 37 75 42 34 6e 34 53 41 6f 37 6e 4c 41 66 33 78 57 32 6d 66 50 62 6a 49 75 45 44 73 4d 6e 25 32 46 46 6d 4e 59 75 55 77 56 25 32 46 Data Ascii: WJ0CNsyPdny46nMVt6U%2BAj9AqNs11nQNvDfC7uB4n4SAo7nLAf3xW2mfPbjIuEDsMn%2FFmNYuUwV%2FI3RcSnOZE2Dw1aNlIDFqGihB%2FEw8z1Veo661lKK3U%2Fi9d1evnzOk2BMav4CsXD9oLBtd2PR8s9LrAyA8vF7Z5U6%2FXL7xwMDXEvgrBx417x1s1EMOS34V5x4J%2B1veT%2Fg8PeDcnIh%2Bo537EUMij3ogh
Apr 14, 2025 18:09:06.954468012 CEST	16296	OUT	Data Raw: 66 74 65 41 62 53 31 74 54 48 71 37 64 58 44 50 7a 6d 39 34 78 6d 55 33 4a 71 4c 43 42 71 4e 7a 6b 59 77 59 6e 47 50 74 67 72 64 45 65 6f 74 4d 32 57 6e 34 47 54 61 62 37 74 4f 43 43 57 30 36 44 6e 25 32 46 6b 69 25 32 42 46 74 25 32 42 34 57 43 Data Ascii: fteAbS1tTHq7dXDPzm94xmU3JqLCBqNzkYwYnGPtgrdEeotM2Wn4GTab7tOCCW06Dn%2Fki%2BFt%2B4WCN6Bjqf3hnFvgBnIpaBT5W9iKsrt22O5WVXtHYaPCHmVQOZOc0uLpICD3Fk9l3k1rHBw%2FHzl2o9MvjMo9inGJg97rHI8siZd1qRPHnrYIcowV3QCUvcdELUrmKuBzqQ%2F88WCZmGnYEHEmcp5J6A1eBqkX5zhL8
Apr 14, 2025 18:09:06.954510927 CEST	5432	OUT	Data Raw: 46 51 52 58 34 43 44 42 31 47 62 67 69 62 56 4c 69 6f 56 6d 68 79 4a 52 4e 73 52 31 4c 30 68 38 25 32 46 71 64 4b 4b 35 73 54 75 5a 41 61 73 74 64 6d 32 25 32 42 39 48 65 73 52 6c 59 34 33 78 64 46 78 35 49 59 75 5a 44 6f 79 6d 63 25 32 46 45 74 Data Ascii: FQRX4CDB1GbgibVLioVmhyJRNsR1L0h8%2FqdKK5sTuZAastdm2%2B9HesRlY43xdFx5IYuZDoymc%2FEt1gOsJiVQhfvOCCYx0zQLyGjfe8yP7LkxXVcYYm%2BDHfg4zGh8%2FmVWzlVY1izJsR3r5onKoKf484H%2BsNNaxvTgegvIMtuQK8vQjDbaWac06rBg0Du0a%2FaBdR0NaUys3ryEHPt69RwQ28sDfKbQmAW5M5TcT
Apr 14, 2025 18:09:06.954544067 CEST	5432	OUT	Data Raw: 6a 4b 75 62 32 71 56 66 72 39 64 32 66 31 31 56 76 4f 71 50 46 52 51 35 48 58 63 52 56 71 30 63 46 59 67 76 53 45 52 6c 41 73 41 59 6c 46 53 66 4b 66 48 6b 72 7a 41 4f 63 47 61 33 25 32 42 30 64 35 77 47 70 77 71 4f 46 6b 63 31 53 31 59 72 47 4e Data Ascii: jKub2qVfr9d2f11VvOqPFRQ5HXcRVq0cFYgvSERlAsAYlFSfKfHkrzAOcGa3%2B0d5wGpwqOFkc1S1YrGNxN9J2z3FQhBHhqrVfY0bjDvFDJw76cgaZZ4B8cCWTQ%2BcqrilYuw8ShU%2Bo8QszQHHQ2FY1b8uqAW%2BImeNho7SdDB%2BLEX%2FNCOZ7KxWpVjlFTSDySXxYTIj7OPRU5yGmlU%2BKbLVDRyRFjsCjd%2FLKTi
Apr 14, 2025 18:09:06.954667091 CEST	10864	OUT	Data Raw: 39 79 70 6b 52 25 32 46 4b 73 6e 6c 58 41 6e 56 53 4d 25 32 46 66 4a 37 79 57 68 55 72 67 35 4b 62 74 55 54 79 67 6a 4a 50 31 33 59 41 72 6d 63 67 4a 72 57 51 4c 41 76 74 63 7a 49 32 37 63 6a 53 4c 50 73 39 48 69 74 6c 77 30 44 63 4a 33 52 48 44 Data Ascii: 9ypkR%2FKsnlXAnVSM%2FfJ7yWhUrg5KbtUTygjJP13YArmcgJrWQLAvtczI27cjSLPs9Hitlw0DcJ3RHDyeQOjBLAD7dhaYM0t%2BTv7bbMUBFWP30vWI8i2te%2BQWPP%2BSRD%2FOAd8J%2BD8YnqWYtnbqyYx4yh6HOn%2BzDQGkl1vnx7kX4Dr4xhFzMpfWUsbeMv92bcbDv4JKJcZ3ZWhBVl4d2FOhkJ9QhVuMjNwrZjI
Apr 14, 2025 18:09:06.954674006 CEST	302	IN	HTTP/1.1 414 Request-URI Too Large Server: awselb/2.0 Date: Mon, 14 Apr 2025 16:09:06 GMT Content-Type: text/html Content-Length: 142 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 34 20 52 65 71 75 65 73 74 2d 55 52 49 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 34 20 52 65 71 75 65 73 74 2d 55 52 49 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>414 Request-URI Too Large</title></head><body><center><h1>414 Request-URI Too Large</h1></center></body></html>
Apr 14, 2025 18:09:06.954835892 CEST	2716	OUT	Data Raw: 47 67 54 44 4c 66 58 45 75 6b 50 49 64 54 43 74 67 57 48 52 39 66 4f 4a 37 4c 63 68 30 42 52 6e 59 53 36 42 47 51 37 5a 55 73 76 34 70 37 77 7a 57 30 59 6a 6a 55 62 75 6a 37 79 4e 7a 47 59 58 57 35 57 33 46 65 33 41 53 45 76 73 47 37 7a 6c 42 74 Data Ascii: GgTDLfXEukPIdTCtgWHR9fOJ7Lch0BRnYS6BGQ7ZUsv4p7wzW0YjjUbuj7yNzGYXW5W3Fe3ASEvsG7zlBtadyz%2BZnAdinFMO5RiSWSsj6vCPvlXQXCr9SY5A6bne7x2KbRNfYHwZePAzJR8MOyfCBys38iSsqQEqXvzC4XxBwCszrkJgmELrzn2FVn7DplM8y%2B23%2FanCRMgVLPAUn112Iu2QQr7gZI4gZRwQ0YFRuk1wz
Apr 14, 2025 18:09:07.075666904 CEST	13580	OUT	Data Raw: 38 34 50 33 64 35 39 70 50 66 72 58 79 49 34 68 42 46 43 6e 49 63 4d 5a 75 6f 6b 63 64 71 67 47 71 51 68 59 78 6e 49 31 41 75 6e 32 45 75 41 5a 78 73 61 69 68 4f 25 32 42 32 53 68 66 48 25 32 42 50 57 7a 42 37 67 5a 65 77 52 52 6c 79 59 72 6c 4d Data Ascii: 84P3d59pPfrXyI4hBFCnIcMZuokcdqgGqQhYxnI1Aun2EuAZxsaihO%2B2ShfH%2BPWzB7gZewRRlyYrlMRy8MJ6WOe1WdwcZ7jAMd5Ld0tN%2B2M687tb5I3sqyHENScvjNkdykfmudON7XWeFqtV9%2FFfvfVEpU4PrCNYt%2BU7tjXILSmNIAxwMhh87A3a5nKL4aoxYnkluI3zn2Ilhq7u1AdRlNS17xBrvelgW4na9kLEL

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:06 UTC	583	OUT	GET /ajax/libs/select2/4.0.12/css/select2.min.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 16:09:07 UTC	948	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:09:07 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fcb-3a76" Last-Modified: Mon, 04 May 2020 16:16:11 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 416466 Expires: Sat, 04 Apr 2026 16:09:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VAzBj5eLm3whtknBO%2BMmczissK1PiOuhvwc34GFWYOZiRbBv6qESn%2BiiiF5HA57lHMJgEVMcfV1Y2M2%2FdUZBJ6%2BmWfI%2FQLZH1VqqiT5HaQQ5wQ9ybqGWTYWLyoPT8HiPXqj2KIND"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 9304773abc35d1b5-ATL alt-svc: h3=":443"; ma=86400
2025-04-14 16:09:07 UTC	421	IN	Data Raw: 33 61 37 36 0d 0a 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 32 38 70 78 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 Data Ascii: 3a76.select2-container{box-sizing:border-box;display:inline-block;margin:0;position:relative;vertical-align:middle}.select2-container .select2-selection--single{box-sizing:border-box;cursor:pointer;display:block;height:28px;user-select:none;-webkit-user
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 77 3a 65 6c 6c 69 70 73 69 73 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 5f 5f 63 6c 65 61 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 5b 64 69 72 3d 22 72 74 6c 22 5d 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 5f 5f 72 65 6e 64 65 72 65 64 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 38 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 30 70 78 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 Data Ascii: w:ellipsis;white-space:nowrap}.select2-container .select2-selection--single .select2-selection__clear{position:relative}.select2-container[dir="rtl"] .select2-selection--single .select2-selection__rendered{padding-right:8px;padding-left:20px}.select2-cont
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 2d 64 72 6f 70 64 6f 77 6e 2d 2d 61 62 6f 76 65 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 30 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 6f 70 65 6e 20 2e 73 65 6c 65 63 74 32 2d 64 72 6f 70 64 6f 77 6e 2d 2d 62 65 6c 6f 77 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 30 7d 2e 73 65 6c 65 63 74 32 2d 73 65 61 72 63 68 2d 2d 64 72 6f 70 64 6f 77 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 Data Ascii: -dropdown--above{border-bottom:none;border-bottom-left-radius:0;border-bottom-right-radius:0}.select2-container--open .select2-dropdown--below{border-top:none;border-top-left-radius:0;border-top-right-radius:0}.select2-search--dropdown{display:block;paddi
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 5f 5f 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 23 39 39 39 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 5f 5f 61 72 72 6f 77 7b 68 65 69 67 68 74 3a 32 36 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 31 70 78 3b 72 69 67 68 74 3a 31 70 78 3b 77 69 64 74 68 3a 32 30 70 78 7d 2e 73 65 Data Ascii: t-weight:bold}.select2-container--default .select2-selection--single .select2-selection__placeholder{color:#999}.select2-container--default .select2-selection--single .select2-selection__arrow{height:26px;position:absolute;top:1px;right:1px;width:20px}.se
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 69 6f 6e 5f 5f 72 65 6e 64 65 72 65 64 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 6d 75 6c 74 69 70 6c 65 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 5f 5f 72 65 6e 64 65 72 65 64 20 6c 69 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 6d 75 6c 74 69 70 6c 65 20 2e 73 65 6c 65 63 74 Data Ascii: ion__rendered{box-sizing:border-box;list-style:none;margin:0;padding:0 5px;width:100%}.select2-container--default .select2-selection--multiple .select2-selection__rendered li{list-style:none}.select2-container--default .select2-selection--multiple .select
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 6e 74 61 69 6e 65 72 2d 2d 66 6f 63 75 73 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 6d 75 6c 74 69 70 6c 65 7b 62 6f 72 64 65 72 3a 73 6f 6c 69 64 20 62 6c 61 63 6b 20 31 70 78 3b 6f 75 74 6c 69 6e 65 3a 30 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 69 73 61 62 6c 65 64 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 6d 75 6c 74 69 70 6c 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 69 73 61 62 6c 65 64 20 Data Ascii: ntainer--focus .select2-selection--multiple{border:solid black 1px;outline:0}.select2-container--default.select2-container--disabled .select2-selection--multiple{background-color:#eee;cursor:default}.select2-container--default.select2-container--disabled
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 5b 61 72 69 61 2d 73 65 6c 65 63 74 65 64 3d 74 72 75 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 64 64 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 65 6d 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f Data Ascii: ntainer--default .select2-results__option[aria-selected=true]{background-color:#ddd}.select2-container--default .select2-results__option .select2-results__option{padding-left:1em}.select2-container--default .select2-results__option .select2-results__optio
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 64 65 66 61 75 6c 74 20 2e 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 67 72 6f 75 70 7b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 3a 36 70 78 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 63 6c 61 73 73 69 63 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 6f 6e 2d 2d 73 69 6e 67 6c 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 37 66 37 66 37 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 6f 75 74 6c 69 6e 65 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 2d 77 65 62 6b 69 74 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 20 23 66 66 66 20 35 Data Ascii: default .select2-results__group{cursor:default;display:block;padding:6px}.select2-container--classic .select2-selection--single{background-color:#f7f7f7;border:1px solid #aaa;border-radius:4px;outline:0;background-image:-webkit-linear-gradient(top, #fff 5
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 23 65 65 65 20 35 30 25 2c 20 23 63 63 63 20 31 30 30 25 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 72 65 70 65 61 74 2d 78 3b 66 69 6c 74 65 72 3a 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 67 72 61 64 69 65 6e 74 28 73 74 61 72 74 43 6f 6c 6f 72 73 74 72 3d 27 23 46 46 45 45 45 45 45 45 27 2c 20 65 6e 64 43 6f 6c 6f 72 73 74 72 3d 27 23 46 46 43 43 43 43 43 43 27 2c 20 47 72 61 64 69 65 6e 74 54 79 70 65 3d 30 29 7d 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 63 6c 61 73 73 69 63 20 2e 73 65 6c 65 63 74 32 2d 73 65 6c 65 63 74 69 Data Ascii: ;background-image:linear-gradient(to bottom, #eee 50%, #ccc 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#FFEEEEEE', endColorstr='#FFCCCCCC', GradientType=0)}.select2-container--classic .select2-selecti
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 2d 77 65 62 6b 69 74 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 20 23 66 66 66 20 30 25 2c 20 23 65 65 65 20 35 30 25 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 2d 6f 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 20 23 66 66 66 20 30 25 2c 20 23 65 65 65 20 35 30 25 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 23 66 66 66 20 30 25 2c 20 23 65 65 65 20 35 30 25 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 72 65 70 65 61 74 2d 78 Data Ascii: -left-radius:0;border-top-right-radius:0;background-image:-webkit-linear-gradient(top, #fff 0%, #eee 50%);background-image:-o-linear-gradient(top, #fff 0%, #eee 50%);background-image:linear-gradient(to bottom, #fff 0%, #eee 50%);background-repeat:repeat-x

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:06 UTC	567	OUT	GET /ajax/libs/select2/4.0.12/js/select2.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 16:09:07 UTC	959	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:09:07 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fcb-112d5" Last-Modified: Mon, 04 May 2020 16:16:11 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 339430 Expires: Sat, 04 Apr 2026 16:09:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UKgtMIQIxghMaWg6wxTVXZzm53m69rag8cTNXS83P3q9hgF%2BHUGuPGxkitqDmPEAKz5dVoFIXapWXd2vSeCi2%2FIToh80uIH4dOacx7oll355qywZ8CKJGn7g1YGu1%2BPYWzmCLSNd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 9304773acff47bab-ATL alt-svc: h3=":443"; ma=86400
2025-04-14 16:09:07 UTC	410	IN	Data Raw: 37 62 66 30 0d 0a 2f 2a 21 20 53 65 6c 65 63 74 32 20 34 2e 30 2e 31 32 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 73 65 6c 65 63 74 32 2f 73 65 6c 65 63 74 32 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 2e 6d 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 6e 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 22 75 6e 64 Data Ascii: 7bf0/! Select2 4.0.12 \| https://github.com/select2/select2/blob/master/LICENSE.md /!function(n){"function"==typeof define&&define.amd?define(["jquery"],n):"object"==typeof module&&module.exports?module.exports=function(e,t){return void 0===t&&(t="und
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 61 72 20 65 3d 75 2e 66 6e 2e 73 65 6c 65 63 74 32 2e 61 6d 64 3b 76 61 72 20 74 2c 6e 2c 72 2c 68 2c 6f 2c 73 2c 66 2c 67 2c 6d 2c 76 2c 79 2c 5f 2c 69 2c 61 2c 77 3b 66 75 6e 63 74 69 6f 6e 20 62 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 69 2e 63 61 6c 6c 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 2c 73 2c 61 2c 6c 2c 63 2c 75 2c 64 2c 70 2c 68 3d 74 26 26 74 2e 73 70 6c 69 74 28 22 2f 22 29 2c 66 3d 79 2e 6d 61 70 2c 67 3d 66 26 26 66 5b 22 2a 22 5d 7c 7c 7b 7d 3b 69 66 28 65 29 7b 66 6f 72 28 73 3d 28 65 3d 65 2e 73 70 6c 69 74 28 22 2f 22 29 29 2e 6c 65 6e 67 74 68 2d 31 2c 79 2e 6e 6f 64 65 49 64 43 6f 6d 70 61 74 26 26 77 2e 74 65 73 74 28 65 5b 73 5d 29 26 26 28 65 5b 73 5d 3d 65 5b 73 5d 2e 72 Data Ascii: ar e=u.fn.select2.amd;var t,n,r,h,o,s,f,g,m,v,y,_,i,a,w;function b(e,t){return i.call(e,t)}function l(e,t){var n,r,i,o,s,a,l,c,u,d,p,h=t&&t.split("/"),f=y.map,g=f&&f["*"]\|\|{};if(e){for(s=(e=e.split("/")).length-1,y.nodeIdCompat&&w.test(e[s])&&(e[s]=e[s].r
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 72 6e 20 65 3d 72 5b 31 5d 2c 69 26 26 28 6e 3d 44 28 69 3d 6c 28 69 2c 6f 29 29 29 2c 69 3f 65 3d 6e 26 26 6e 2e 6e 6f 72 6d 61 6c 69 7a 65 3f 6e 2e 6e 6f 72 6d 61 6c 69 7a 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6c 28 65 2c 74 29 7d 7d 28 6f 29 29 3a 6c 28 65 2c 6f 29 3a 28 69 3d 28 72 3d 63 28 65 3d 6c 28 65 2c 6f 29 29 29 5b 30 5d 2c 65 3d 72 5b 31 5d 2c 69 26 26 28 6e 3d 44 28 69 29 29 29 2c 7b 66 3a 69 3f 69 2b 22 21 22 2b 65 3a 65 2c 6e 3a 65 2c 70 72 3a 69 2c 70 3a 6e 7d 7d 2c 67 3d 7b 72 65 71 75 69 72 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 41 28 65 29 7d 2c 65 78 70 6f 72 74 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 6d Data Ascii: rn e=r[1],i&&(n=D(i=l(i,o))),i?e=n&&n.normalize?n.normalize(e,function(t){return function(e){return l(e,t)}}(o)):l(e,o):(i=(r=c(e=l(e,o)))[0],e=r[1],i&&(n=D(i))),{f:i?i+"!"+e:e,n:e,pr:i,p:n}},g={require:function(e){return A(e)},exports:function(e){var t=m
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 28 22 53 65 65 20 61 6c 6d 6f 6e 64 20 52 45 41 44 4d 45 3a 20 69 6e 63 6f 72 72 65 63 74 20 6d 6f 64 75 6c 65 20 62 75 69 6c 64 2c 20 6e 6f 20 6d 6f 64 75 6c 65 20 6e 61 6d 65 22 29 3b 74 2e 73 70 6c 69 63 65 7c 7c 28 6e 3d 74 2c 74 3d 5b 5d 29 2c 62 28 6d 2c 65 29 7c 7c 62 28 76 2c 65 29 7c 7c 28 76 5b 65 5d 3d 5b 65 2c 74 2c 6e 5d 29 7d 29 2e 61 6d 64 3d 7b 6a 51 75 65 72 79 3a 21 30 7d 2c 65 2e 72 65 71 75 69 72 65 6a 73 3d 74 2c 65 2e 72 65 71 75 69 72 65 3d 6e 2c 65 2e 64 65 66 69 6e 65 3d 72 29 2c 65 2e 64 65 66 69 6e 65 28 22 61 6c 6d 6f 6e 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 65 2e 64 65 66 69 6e 65 28 22 6a 71 75 65 72 79 22 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 75 7c 7c 24 3b 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: ("See almond README: incorrect module build, no module name");t.splice\|\|(n=t,t=[]),b(m,e)\|\|b(v,e)\|\|(v[e]=[e,t,n])}).amd={jQuery:!0},e.requirejs=t,e.require=n,e.define=r),e.define("almond",function(){}),e.define("jquery",[],function(){var e=u\|\|$;return nul
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 2c 6e 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 66 6f 72 28 76 61 72 20 6c 3d 30 3b 6c 3c 65 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 7b 76 61 72 20 63 3d 65 5b 6c 5d 3b 6f 2e 70 72 6f 74 6f 74 79 70 65 5b 63 5d 3d 61 28 63 29 7d 72 65 74 75 72 6e 20 6f 7d 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 7b 7d 7d 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 7c 7c 7b 7d 2c 65 20 69 6e 20 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3f 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 5b 65 5d 2e 70 75 73 68 28 74 29 3a 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 5b 65 5d 3d 5b 74 Data Ascii: ,n.apply(this,arguments)}}for(var l=0;l<e.length;l++){var c=e[l];o.prototype[c]=a(c)}return o};function e(){this.listeners={}}e.prototype.on=function(e,t){this.listeners=this.listeners\|\|{},e in this.listeners?this.listeners[e].push(t):this.listeners[e]=[t
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 26 67 74 3b 22 2c 27 22 27 3a 22 26 71 75 6f 74 3b 22 2c 22 27 22 3a 22 26 23 33 39 3b 22 2c 22 2f 22 3a 22 26 23 34 37 3b 22 7d 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 3f 65 3a 53 74 72 69 6e 67 28 65 29 2e 72 65 70 6c 61 63 65 28 2f 5b 26 3c 3e 22 27 5c 2f 5c 5c 5d 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 5b 65 5d 7d 29 7d 2c 69 2e 61 70 70 65 6e 64 4d 61 6e 79 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 31 2e 37 22 3d 3d 3d 6f 2e 66 6e 2e 6a 71 75 65 72 79 2e 73 75 62 73 74 72 28 30 2c 33 29 29 7b 76 61 72 20 6e 3d 6f 28 29 3b 6f 2e 6d 61 70 28 74 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 6e 2e 61 64 64 28 65 29 7d 29 2c 74 3d 6e 7d 65 2e 61 70 70 65 6e 64 28 74 29 7d 2c 69 Data Ascii: >",'"':""","'":"'","/":"/"};return"string"!=typeof e?e:String(e).replace(/[&<>"'\/\\]/g,function(e){return t[e]})},i.appendMany=function(e,t){if("1.7"===o.fn.jquery.substr(0,3)){var n=o();o.map(t,function(e){n=n.add(e)}),t=n}e.append(t)},i
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 70 65 4d 61 72 6b 75 70 22 29 3b 74 68 69 73 2e 63 6c 65 61 72 28 29 2c 74 68 69 73 2e 68 69 64 65 4c 6f 61 64 69 6e 67 28 29 3b 76 61 72 20 6e 3d 68 28 27 3c 6c 69 20 72 6f 6c 65 3d 22 61 6c 65 72 74 22 20 61 72 69 61 2d 6c 69 76 65 3d 22 61 73 73 65 72 74 69 76 65 22 20 63 6c 61 73 73 3d 22 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6f 70 74 69 6f 6e 22 3e 3c 2f 6c 69 3e 27 29 2c 72 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 67 65 74 28 22 74 72 61 6e 73 6c 61 74 69 6f 6e 73 22 29 2e 67 65 74 28 65 2e 6d 65 73 73 61 67 65 29 3b 6e 2e 61 70 70 65 6e 64 28 74 28 72 28 65 2e 61 72 67 73 29 29 29 2c 6e 5b 30 5d 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 73 65 6c 65 63 74 32 2d 72 65 73 75 6c 74 73 5f 5f 6d 65 73 73 61 67 65 22 2c 74 68 69 73 2e 24 72 Data Ascii: peMarkup");this.clear(),this.hideLoading();var n=h('<li role="alert" aria-live="assertive" class="select2-results__option"></li>'),r=this.options.get("translations").get(e.message);n.append(t(r(e.args))),n[0].className+=" select2-results__message",this.$r
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 2e 73 65 6c 65 63 74 65 64 7c 7c 6e 75 6c 6c 3d 3d 74 2e 65 6c 65 6d 65 6e 74 26 26 2d 31 3c 68 2e 69 6e 41 72 72 61 79 28 6e 2c 72 29 3f 65 2e 61 74 74 72 28 22 61 72 69 61 2d 73 65 6c 65 63 74 65 64 22 2c 22 74 72 75 65 22 29 3a 65 2e 61 74 74 72 28 22 61 72 69 61 2d 73 65 6c 65 63 74 65 64 22 2c 22 66 61 6c 73 65 22 29 7d 29 7d 29 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 73 68 6f 77 4c 6f 61 64 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 68 69 64 65 4c 6f 61 64 69 6e 67 28 29 3b 76 61 72 20 74 3d 7b 64 69 73 61 62 6c 65 64 3a 21 30 2c 6c 6f 61 64 69 6e 67 3a 21 30 2c 74 65 78 74 3a 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 67 65 74 28 22 74 72 61 6e 73 6c 61 74 69 6f 6e 73 22 29 2e 67 65 74 28 22 73 65 61 72 63 68 69 6e 67 22 29 28 65 Data Ascii: .selected\|\|null==t.element&&-1<h.inArray(n,r)?e.attr("aria-selected","true"):e.attr("aria-selected","false")})})},r.prototype.showLoading=function(e){this.hideLoading();var t={disabled:!0,loading:!0,text:this.options.get("translations").get("searching")(e
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 70 70 65 6e 64 28 61 29 2c 73 2e 61 70 70 65 6e 64 28 70 29 7d 65 6c 73 65 20 74 68 69 73 2e 74 65 6d 70 6c 61 74 65 28 65 2c 74 29 3b 72 65 74 75 72 6e 20 66 2e 53 74 6f 72 65 44 61 74 61 28 74 2c 22 64 61 74 61 22 2c 65 29 2c 74 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6c 3d 74 68 69 73 2c 6e 3d 74 2e 69 64 2b 22 2d 72 65 73 75 6c 74 73 22 3b 74 68 69 73 2e 24 72 65 73 75 6c 74 73 2e 61 74 74 72 28 22 69 64 22 2c 6e 29 2c 74 2e 6f 6e 28 22 72 65 73 75 6c 74 73 3a 61 6c 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 2e 63 6c 65 61 72 28 29 2c 6c 2e 61 70 70 65 6e 64 28 65 2e 64 61 74 61 29 2c 74 2e 69 73 4f 70 65 6e 28 29 26 26 28 6c 2e 73 65 74 43 6c 61 73 73 65 73 28 29 2c 6c 2e 68 Data Ascii: ppend(a),s.append(p)}else this.template(e,t);return f.StoreData(t,"data",e),t},r.prototype.bind=function(t,e){var l=this,n=t.id+"-results";this.$results.attr("id",n),t.on("results:all",function(e){l.clear(),l.append(e.data),t.isOpen()&&(l.setClasses(),l.h
2025-04-14 16:09:07 UTC	1369	IN	Data Raw: 28 6e 3c 3d 30 29 29 7b 76 61 72 20 72 3d 6e 2d 31 3b 30 3d 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 28 72 3d 30 29 3b 76 61 72 20 69 3d 74 2e 65 71 28 72 29 3b 69 2e 74 72 69 67 67 65 72 28 22 6d 6f 75 73 65 65 6e 74 65 72 22 29 3b 76 61 72 20 6f 3d 6c 2e 24 72 65 73 75 6c 74 73 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2c 73 3d 69 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2c 61 3d 6c 2e 24 72 65 73 75 6c 74 73 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 2b 28 73 2d 6f 29 3b 30 3d 3d 3d 72 3f 6c 2e 24 72 65 73 75 6c 74 73 2e 73 63 72 6f 6c 6c 54 6f 70 28 30 29 3a 73 2d 6f 3c 30 26 26 6c 2e 24 72 65 73 75 6c 74 73 2e 73 63 72 6f 6c 6c 54 6f 70 28 61 29 7d 7d 29 2c 74 2e 6f 6e 28 22 72 65 73 75 6c 74 73 3a 6e 65 78 74 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d Data Ascii: (n<=0)){var r=n-1;0===e.length&&(r=0);var i=t.eq(r);i.trigger("mouseenter");var o=l.$results.offset().top,s=i.offset().top,a=l.$results.scrollTop()+(s-o);0===r?l.$results.scrollTop(0):s-o<0&&l.$results.scrollTop(a)}}),t.on("results:next",function(){var e=

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:06 UTC	547	OUT	GET /postx.css HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 16:09:07 UTC	714	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 125394 Connection: close Date: Mon, 14 Apr 2025 16:09:08 GMT Last-Modified: Sat, 08 Jun 2024 05:00:10 GMT ETag: "a0b4ff216e038470b000b63f5aa39816" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 03c76f41c7551fa29cffd38a109c9dc2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P9 X-Amz-Cf-Id: 4K6ziudKNGIv2gh4XdzG5uwk7EzcCSzoF-KTOOkAbLmhkgBnWMJpaw== X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Vary: Origin
2025-04-14 16:09:07 UTC	8192	IN	Data Raw: 2f 2a 20 49 6e 74 65 72 20 46 6f 6e 74 20 4c 69 62 72 61 72 79 20 2a 2f 0a 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 49 6e 74 65 72 22 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 31 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 22 2e 2f 66 6f 6e 74 73 2f 49 6e 74 65 72 2f 49 6e 74 65 72 2d 54 68 69 6e 2e 74 74 66 22 29 20 66 6f 72 6d 61 74 28 22 74 72 75 65 74 79 70 65 22 29 3b 0a 7d 0a 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 49 6e 74 65 72 22 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 32 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 22 2e 2f 66 6f 6e 74 73 2f 49 6e 74 65 72 2f 49 6e 74 65 72 2d 45 78 74 72 61 4c 69 67 68 74 2e 74 74 66 22 29 20 Data Ascii: /* Inter Font Library */@font-face { font-family: "Inter"; font-weight: 100; src: url("./fonts/Inter/Inter-Thin.ttf") format("truetype");}@font-face { font-family: "Inter"; font-weight: 200; src: url("./fonts/Inter/Inter-ExtraLight.ttf")
2025-04-14 16:09:07 UTC	8796	IN	Data Raw: 61 72 67 69 6e 3a 20 30 25 20 31 25 20 30 25 20 30 2e 35 35 25 3b 20 2a 2f 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 33 33 63 63 3b 0a 20 20 77 69 64 74 68 3a 20 35 30 30 70 78 3b 0a 20 20 68 65 69 67 68 74 3a 20 33 30 70 78 3b 0a 20 20 2f 2a 20 68 65 69 67 68 74 20 73 61 6d 65 20 61 73 20 6c 6f 67 20 6d 61 78 20 68 65 69 67 68 74 20 2a 2f 0a 7d 0a 0a 2e 68 6f 72 42 61 72 20 7b 0a 20 20 63 6c 65 61 72 3a 20 62 6f 74 68 3b 0a 20 20 2f 2a 0a 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 2d 31 70 78 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 Data Ascii: argin: 0% 1% 0% 0.55%; / font-size: 10px; text-align: left; font-weight: bold; color: #0033cc; width: 500px; height: 30px; / height same as log max height /}.horBar { clear: both; / margin-bottom: -1px; background-image: u
2025-04-14 16:09:07 UTC	16384	IN	Data Raw: 2c 0a 2e 66 6f 72 6d 49 6e 70 75 74 44 65 73 63 43 65 6c 6c 2c 0a 2e 66 6f 72 6d 49 6e 70 75 74 45 72 72 6f 72 43 65 6c 6c 2c 0a 2e 66 6f 72 6d 52 65 71 75 69 72 65 64 49 6e 70 75 74 4c 61 62 65 6c 43 65 6c 6c 2c 0a 2e 61 74 74 46 6f 72 6d 49 6e 70 75 74 4c 61 62 65 6c 43 65 6c 6c 2c 0a 2e 61 74 74 46 6f 72 6d 49 6e 70 75 74 44 65 73 63 43 65 6c 6c 2c 0a 2e 66 6f 72 6d 4c 61 62 65 6c 43 65 6c 6c 20 7b 0a 20 20 70 61 64 64 69 6e 67 3a 20 39 70 78 20 39 70 78 20 39 70 78 20 35 70 78 3b 0a 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 35 35 35 35 35 35 3b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f Data Ascii: ,.formInputDescCell,.formInputErrorCell,.formRequiredInputLabelCell,.attFormInputLabelCell,.attFormInputDescCell,.formLabelCell { padding: 9px 9px 9px 5px; vertical-align: middle; color: #555555; text-align: left; font-weight: normal; fo
2025-04-14 16:09:07 UTC	16384	IN	Data Raw: 6f 6c 73 2e 0a 49 45 20 68 61 6e 64 6c 65 73 20 74 68 65 20 72 65 73 74 20 6f 66 20 74 68 65 20 70 61 67 65 2c 20 73 6f 20 69 74 20 6d 61 79 20 73 68 6f 77 20 75 70 20 63 6f 72 72 65 63 74 6c 79 20 28 62 65 63 61 75 73 65 20 49 45 20 74 72 69 65 73 0a 74 6f 20 70 69 63 6b 20 74 68 65 20 62 65 73 74 20 66 6f 6e 74 20 74 6f 20 64 69 73 70 6c 61 79 20 74 68 65 20 74 65 78 74 29 2c 20 62 75 74 20 74 68 65 20 64 72 6f 70 2d 64 6f 77 6e 73 20 73 68 6f 77 20 75 70 20 77 69 74 68 0a 62 6f 78 65 73 20 69 6e 73 74 65 61 64 20 6f 66 20 63 68 61 72 61 63 74 65 72 73 2c 20 62 65 63 61 75 73 65 20 57 69 6e 64 6f 77 73 20 64 6f 65 73 6e 27 74 20 74 72 79 20 74 6f 20 70 69 63 6b 20 74 68 65 20 6d 6f 73 74 0a 61 70 70 72 6f 70 72 69 61 74 65 20 66 6f 6e 74 2e 20 20 53 6f Data Ascii: ols.IE handles the rest of the page, so it may show up correctly (because IE triesto pick the best font to display the text), but the drop-downs show up withboxes instead of characters, because Windows doesn't try to pick the mostappropriate font. So
2025-04-14 16:09:07 UTC	1024	IN	Data Raw: 78 20 31 37 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 0a 2e 65 78 70 69 72 79 4c 6f 63 6b 50 61 67 65 44 69 76 69 64 65 72 20 7b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 36 70 78 3b 0a 7d 0a 0a 0a 2e 65 78 70 69 72 65 4c 6f 63 6b 54 61 62 6c 65 20 74 72 20 7b 0a 20 20 68 65 69 67 68 74 3a 20 34 30 70 78 3b 0a 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 0a 7d 0a 0a 2e 65 78 70 69 72 65 4c 6f 63 6b 54 61 62 6c 65 20 7b 0a 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 0a 7d 0a 0a 0a 0a 2e 65 78 70 69 72 65 4c 6f 63 6b 54 61 62 6c 65 68 65 61 64 65 72 54 78 74 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 37 66 37 66 38 36 3b 0a 20 20 66 6f 6e 74 2d 66 61 Data Ascii: x 17px !important;}.expiryLockPageDivider { font-size: 26px;}.expireLockTable tr { height: 40px; border-bottom: 1px solid #dfdfdf;}.expireLockTable { border: 1px solid #dfdfdf;}.expireLockTableheaderTxt { color: #7f7f86; font-fa
2025-04-14 16:09:07 UTC	16384	IN	Data Raw: 3b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 49 6e 74 65 72 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 39 70 78 3b 0a 20 20 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 6e 6f 6e 65 3b 0a 7d 0a 0a 2e 65 78 70 69 72 65 4c 6f 63 6b 54 61 62 6c 65 20 74 72 20 74 64 3a 66 69 72 73 74 2d 63 68 69 6c 64 20 7b 0a 20 20 62 6f 72 64 65 72 2d 6c 65 66 74 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 34 39 34 61 34 63 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 49 6e 74 65 72 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f Data Ascii: ; font-family: Inter; font-size: 14px; line-height: 19px; border-right: none;}.expireLockTable tr td:first-child { border-left: 1px solid #dfdfdf; color: #494a4c; font-size: 13px; font-family: Inter; font-weight: 300; text-decoratio
2025-04-14 16:09:07 UTC	2048	IN	Data Raw: 65 6e 2d 32 3a 20 72 67 62 61 28 32 30 39 2c 20 32 34 35 2c 20 31 39 31 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 67 72 65 65 6e 2d 31 3a 20 72 67 62 61 28 32 33 34 2c 20 32 34 37 2c 20 32 32 38 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 62 6c 75 65 2d 31 30 3a 20 72 67 62 61 28 32 32 2c 20 38 30 2c 20 31 38 31 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 62 6c 75 65 2d 39 3a 20 72 67 62 61 28 33 35 2c 20 39 34 2c 20 31 39 36 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 62 6c 75 65 2d 38 3a 20 72 67 62 61 28 35 30 2c 20 31 30 38 2c 20 32 30 39 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 62 6c 75 65 2d 37 3a 20 72 67 62 61 28 36 39 2c 20 31 32 38 2c 20 32 32 39 2c 20 31 29 3b 0a 20 20 2d 2d 63 6f 6c 6f 72 2d 62 6c 75 65 2d 36 3a 20 72 Data Ascii: en-2: rgba(209, 245, 191, 1); --color-green-1: rgba(234, 247, 228, 1); --color-blue-10: rgba(22, 80, 181, 1); --color-blue-9: rgba(35, 94, 196, 1); --color-blue-8: rgba(50, 108, 209, 1); --color-blue-7: rgba(69, 128, 229, 1); --color-blue-6: r
2025-04-14 16:09:07 UTC	16384	IN	Data Raw: 70 61 64 64 69 6e 67 2d 6c 67 3a 20 76 61 72 28 2d 2d 73 69 7a 65 2d 6c 67 29 3b 0a 20 20 2d 2d 73 69 7a 65 2d 63 6f 6e 74 61 69 6e 2d 70 61 64 64 69 6e 67 2d 78 6c 3a 20 76 61 72 28 2d 2d 73 69 7a 65 2d 78 6c 29 3b 0a 20 20 2d 2d 73 69 7a 65 2d 63 6f 6e 74 61 69 6e 2d 70 61 64 64 69 6e 67 2d 32 78 6c 3a 20 76 61 72 28 2d 2d 73 69 7a 65 2d 32 78 6c 29 3b 0a 20 20 2d 2d 73 69 7a 65 2d 63 6f 6e 74 61 69 6e 2d 62 6f 72 64 65 72 2d 73 74 72 6f 6b 65 3a 20 76 61 72 28 2d 2d 73 69 7a 65 2d 73 74 72 6f 6b 65 2d 73 74 72 6f 6e 67 29 3b 0a 20 20 2d 2d 73 69 7a 65 2d 73 74 72 6f 6b 65 2d 6c 69 67 68 74 3a 20 76 61 72 28 2d 2d 73 69 7a 65 2d 6e 6f 6e 65 29 3b 0a 20 20 2d 2d 73 69 7a 65 2d 72 61 64 69 75 73 2d 62 6f 72 64 65 72 2d 6c 67 3a 20 76 61 72 28 2d 2d 73 69 Data Ascii: padding-lg: var(--size-lg); --size-contain-padding-xl: var(--size-xl); --size-contain-padding-2xl: var(--size-2xl); --size-contain-border-stroke: var(--size-stroke-strong); --size-stroke-light: var(--size-none); --size-radius-border-lg: var(--si
2025-04-14 16:09:07 UTC	15990	IN	Data Raw: 65 72 2d 68 6f 76 65 72 3a 20 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 69 6e 74 65 72 61 63 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 6c 69 67 68 74 2d 68 6f 76 65 72 29 3b 0a 20 20 2d 2d 6d 64 73 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 2d 62 6f 72 64 65 72 2d 64 69 73 61 62 6c 65 64 3a 20 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 69 6e 74 65 72 61 63 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 6c 69 67 68 74 29 3b 0a 20 20 2d 2d 6d 64 73 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 2d 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 69 6e 74 65 72 61 63 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 6c 69 67 68 74 29 3b 0a 20 20 2d 2d 6d 64 73 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 68 6f 76 65 72 3a 20 76 61 72 28 2d 2d 63 6f 6c Data Ascii: er-hover: var(--color-interact-background-light-hover); --mds-button-color-border-disabled: var(--color-interact-background-light); --mds-button-color-background: var(--color-interact-background-light); --mds-button-color-background-hover: var(--col
2025-04-14 16:09:07 UTC	16384	IN	Data Raw: 20 20 74 6f 20 7b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 0a 20 20 7d 0a 7d 0a 0a 2e 6d 64 73 2d 73 77 69 74 63 68 20 7b 0a 20 20 2d 2d 6d 64 73 2d 73 77 69 74 63 68 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 74 65 78 74 2d 73 74 72 6f 6e 67 29 3b 0a 20 20 2d 2d 6d 64 73 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 30 3b 0a 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 67 61 70 3a 20 76 61 72 28 2d 2d 73 69 7a 65 2d 78 73 29 3b 0a 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 66 6f 6e 74 2d 73 69 Data Ascii: to { transform: rotate(360deg); }}.mds-switch { --mds-switch-text-color: var(--color-text-strong); --mds-switch-icon-border-radius: 0; cursor: pointer; display: flex; gap: var(--size-xs); align-items: center; padding: 0; font-si

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:07 UTC	694	OUT	GET /websafe/logo/ptZ7YKQ1DE0.hya1GSdimhLUGsxYGG7kkyLOcdYZhHyi05Qmaa6IqnJQCO0RFhUVevahTQ!!/branding/customer-logo.gif?f=1 HTTP/1.1 Host: res.cisco.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 16:09:07 UTC	969	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:09:07 GMT Content-Type: image/gif Content-Length: 2878 Connection: close Set-Cookie: AWSALB=7dWSXCfERGsUOtN441ttyunRy4jKOddWjLKS1RKY2oGOrkaWJbS5Qn8D09382Tv3CxBt7c377Xwq56THS86BJH+t7x1L70d6L2I7eGu/SU+Xh4mrlomHB5S2rGFP; Expires=Mon, 21 Apr 2025 16:09:07 GMT; Path=/ Set-Cookie: AWSALBCORS=7dWSXCfERGsUOtN441ttyunRy4jKOddWjLKS1RKY2oGOrkaWJbS5Qn8D09382Tv3CxBt7c377Xwq56THS86BJH+t7x1L70d6L2I7eGu/SU+Xh4mrlomHB5S2rGFP; Expires=Mon, 21 Apr 2025 16:09:07 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" X-Frame-Options: DENY Cache-Control: must-revalidate,max-age=1 Pragma: no-cache Set-Cookie: JSESSIONID=EAF3C0677BF93450595DD2440E88B1C8; Path=/websafe; Secure; HttpOnly Last-Modified: Tue, 03 May 2011 00:00:01 GMT ETag: "12fb3277c00-b3e" Server: unknown
2025-04-14 16:09:07 UTC	2878	IN	Data Raw: 47 49 46 38 39 61 f5 00 5a 00 f7 00 00 00 00 00 80 00 00 00 80 00 80 80 00 00 00 80 80 00 80 00 80 80 80 80 80 c0 c0 c0 ff 00 00 00 ff 00 ff ff 00 00 00 ff ff 00 ff 00 ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 00 00 66 00 00 99 00 00 cc 00 00 ff 00 33 00 00 33 33 00 33 66 00 33 99 00 33 cc 00 33 ff 00 66 00 00 66 33 00 66 66 00 66 99 00 66 cc 00 66 ff 00 99 00 00 99 33 00 99 66 00 99 99 00 99 cc 00 99 ff 00 cc 00 00 cc 33 00 cc 66 00 cc 99 00 cc cc 00 cc ff 00 ff 00 00 ff 33 00 ff 66 00 ff 99 00 ff cc 00 ff ff 33 00 00 33 00 33 33 00 66 33 00 99 33 00 Data Ascii: GIF89aZ3f3333f333ff3fffff3f3f3f3333f33

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:07 UTC	601	OUT	GET /CRES_login_bg.jpg HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 16:09:07 UTC	726	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 155249 Connection: close Last-Modified: Wed, 20 Sep 2023 11:59:56 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 14 Apr 2025 15:11:45 GMT ETag: "c3598f2d3bf6694df3378aafc792bfee" X-Cache: Hit from cloudfront Via: 1.1 03c76f41c7551fa29cffd38a109c9dc2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P9 X-Amz-Cf-Id: pC-nz87_JmgsdlmpDuGSTLnIiYNEOagw_J6SEBFZWZj-AYocZPhMvg== Age: 3443 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Vary: Origin
2025-04-14 16:09:07 UTC	16384	IN	Data Raw: ff d8 ff e1 00 4a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 98 82 02 00 26 00 00 00 1a 00 00 00 00 00 00 00 73 61 6e 64 72 61 20 63 69 66 6f 2e 20 77 77 77 2e 63 69 66 6f 67 72 61 70 68 79 2e 63 6f 6d 2e 20 32 30 31 36 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 00 00 00 ff e1 04 13 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 Data Ascii: JExifII*&sandra cifo. www.cifography.com. 2016Duckyhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 78 36 85 56 3b d6 72 82 22 ba 6e 66 0e d2 6f ca e1 2a a3 1d 93 a8 1c bc bc 0a ca d1 fb 8e 5f a2 d5 d7 6a d4 eb 6d a4 df 76 56 e5 30 fa 11 5e 55 25 2a 57 ae f3 b2 9e ee d4 56 6f d4 95 a3 ec ce 8f a5 57 b5 eb 0c e3 e5 f6 ed 27 1d 6c 07 a3 3c 5c d3 57 ac 64 c1 fb 5b f0 e7 85 e3 ad 5e 4e 2e 46 eb f5 1f 91 d1 c7 ee ad c6 d5 5e 52 ac c0 1b f1 fb c7 58 5c 89 f1 bf be bf c8 df 93 87 8b 9d 4b c3 7f b9 09 72 71 73 a4 ad ad b3 0f f8 98 bf 69 6e 2c f0 da 3c 3a 30 30 e5 f6 7c 9c 59 5e aa f7 5f c0 e6 4c f4 29 ef 1d 1c 72 27 47 df f6 ff 00 23 6b f1 71 73 e5 e2 cf f7 54 a3 cd 57 36 ad c5 cb ed 39 38 b3 f3 d7 ba fe 07 3a b1 11 e8 57 90 d9 5a 4f 35 5c da b7 0a ef 91 9c d5 e4 36 56 03 43 0e 6e 1d cb 06 c9 8c 0f 26 b6 b5 1e d6 69 bd 9e 8b a2 b6 a8 36 57 b0 1c f4 dc d4 9b 56 Data Ascii: x6V;r"nfo_jmvV0^U%WVoW'l<\Wd[^N.F^RX\Krqsin,<:00\|Y^_L)r'G#kqsTW698:WZO5\6VCn&i6WV
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 79 36 c8 9a 9d 50 04 ee d0 4b 1a a2 6b 87 06 a0 63 6f 4b dc 8d 53 95 20 d2 7a 98 d5 b4 f6 c8 1b 80 b2 82 40 62 c8 e5 06 40 9a b9 d4 6d 48 c2 10 13 ae 19 35 71 86 53 95 9f bc 2c b7 20 2b 53 1b f1 f5 45 56 dd 0d 00 c3 8e c6 cd f4 30 ba da e4 da af 72 90 2b c0 4d aa a9 61 6b 2a a3 04 9d 9c b0 2d 27 67 2f 43 62 5b 04 e4 06 08 48 6d b0 09 0c 89 c8 24 00 9c 8d 28 04 a3 41 80 09 8c 00 00 00 0c ec 49 56 24 0a a9 44 54 d4 09 60 36 20 00 01 00 c0 50 00 30 10 c0 04 dc 0c cf 95 c2 01 3b f7 31 7c b0 2f a7 7b 67 44 55 78 eb 5d 7d 4c 88 85 bb 93 44 5a e1 4b 36 66 de a7 e0 83 6a 41 52 b1 8a a1 ed 7a d9 c9 40 04 ac 74 1e e6 12 4b b8 0e 43 79 2d e2 4c f7 76 08 d5 d9 90 df 72 72 c7 b4 07 5c bc 03 99 2e b7 49 60 89 c8 57 47 1a 8a 9a 19 f1 fc a6 85 00 00 00 10 cb 25 81 9b 34 Data Ascii: y6PKkcoKS z@b@mH5qS, +SEV0r+Mak*-'g/Cb[Hm$(AIV$DT`6 P0;1\|/{gDUx]}LDZK6fjARz@tKCy-Lvrr\.I`WG%4
2025-04-14 16:09:08 UTC	14808	IN	Data Raw: 19 a5 79 18 1c dc c9 c6 03 db 52 ea d3 6e c6 bc af 49 2d 2b 51 3b 3d 20 0f 3b dc 5f d4 ce 3b b3 ab 95 27 99 39 dd 24 cb 6c ea 82 d5 34 88 1e d7 d0 2b 0d 06 94 9b fd 32 be 93 e8 11 c9 10 f2 68 96 0d 1f 1b d0 4a 85 0e b5 92 df 00 d6 0e 9e 37 24 1c dc 74 9c 1d 75 a4 23 55 45 a9 69 40 46 6e 98 0a a6 99 a3 ce 0a aa 2a 3a d1 42 43 34 c8 b6 87 98 ea f7 b7 0c f4 ed a1 c5 3c d3 fb 63 c8 95 a9 5a ac 50 f3 5f 3a 4d c9 e9 4b 55 7d cc 2a ee eb 2e aa 4c d8 b2 bc db 73 d5 19 f1 d9 3b 4f 63 d5 dd c8 bf 65 41 f2 59 7f fa 69 fc 42 69 52 eb e8 95 cc f4 f3 46 95 b4 d6 5d 23 c0 ab 67 3b 64 d4 47 04 ad cb 41 ca f0 0b 72 56 73 c5 6f c0 d2 ab 8e fa 51 af 81 8c 6f 60 70 ea 67 c0 e7 92 3c 18 ee f8 eb 09 ab 7d c5 d1 f1 37 89 4e 3b 1a 9d 31 5d 54 f9 99 e0 fb ea b9 6f c4 f6 f8 12 4d Data Ascii: yRnI-+Q;= ;_;'9$l4+2hJ7$tu#UEi@Fn:BC4<cZP_:MKU}.Ls;OceAYiBiRF]#g;dGArVsoQo`pg<}7N;1]ToM
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: e7 93 f0 4b 2d 9c 0b 85 f3 f2 56 79 2b 65 3f 2f 81 d9 6e 1b 3e 5b 5e 57 a6 9b 57 9b 2e 2d ae 5b fb d4 ec de d9 4b c7 b1 ce bd e5 1e b5 7f 78 f9 7d af 25 6b a6 5f 88 70 fb 2b cc de 2a bc 58 c8 dd ad eb cf 5a 2d fb 5c bd 13 66 95 f7 2e d9 75 fc 49 7e da 72 ed 5f bc 9b fb 6e 46 a2 ae b1 e6 5c 8c d5 5b df d1 38 87 f0 1d 79 b8 ed fb a3 fd 48 e3 7e d3 96 ba d7 06 76 4e b8 69 fd c4 be 65 1e a2 da fe 57 5b 1b 71 70 c3 dc d4 3e 87 95 ed f8 3e b5 bb 55 66 cf f4 f8 9e da b2 aa dd d1 68 73 b3 9f ac 34 da 54 50 b5 67 37 d0 dc f5 c9 0f 96 c9 cb 6f c8 d3 ea da 57 1b d5 ad d7 7f d3 5e 8b cd 9b cb 3a 5e 7c 86 b6 fa ab a5 7e 55 e3 d6 df c0 c5 70 3b bc e1 7e e7 d7 cb e2 6a f9 d3 69 46 5e 2a 91 d0 9d 5f a5 68 9f de ff 00 90 b6 c4 dc e3 e5 93 aa d6 c9 42 c2 5d 97 db 53 cf 85 Data Ascii: K-Vy+e?/n>[^WW.-[Kx}%k_p+XZ-\f.uI~r_nF\[8yH~vNieW[qp>>Ufhs4TPg7oW^:^\|~Up;~jiF^_hB]S
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: b6 e3 b7 1f 25 5f 89 ea 4e 6c a3 b3 3c 8e 3f 77 c8 ee a5 a4 a5 68 8f 4b 95 37 7b a9 d6 9f 93 2e 5f cb 36 f2 d1 d1 3c 99 c2 a6 ad 24 79 5c ee 12 c8 f8 fd c5 96 22 51 7e b0 af 45 de 9d e6 3b 22 f8 6e b9 13 aa 58 d7 d4 63 49 b7 ed 67 5f 17 16 d6 dc 74 2e 48 c5 35 48 af a5 27 3a f4 17 1f 1e d9 75 4a 7f 2f 89 a3 a6 ef 9a 0d 52 85 01 18 d3 86 b5 72 b5 1b e2 5a a5 93 5d 08 6e 48 61 7d 34 f2 f5 7e 64 72 71 ee 78 34 4c 6a 16 81 71 16 e3 5d 5b c7 c0 d2 a9 25 83 1e 4e 45 5d 7a e0 de ba 15 0c c3 9b 9a bc 4a 5e bd 12 d5 93 cd ee 3e 9e 16 6f db f8 9c 4a ad bd d6 7b ac fa 81 2d db 95 ee bf c1 74 5f cf c4 d6 a8 69 14 44 52 70 2d e2 6c ca cf 12 06 17 ad 79 2c d2 f4 ba f4 e9 e6 89 74 dd 86 43 7f ef a7 d2 f4 15 9d f4 9d 1f 60 35 75 9c 1c 1c aa 2c d1 d8 ed 68 89 fc 0e 2b b7 Data Ascii: %_Nl<?whK7{._6<$y\"Q~E;"nXcIg_t.H5H':uJ/RrZ]nHa}4~drqx4Ljq][%NE]zJ^>oJ{-t_iDRp-ly,tC`5u,h+
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: fe a1 b5 a8 63 09 01 55 e5 8e b8 ec 5c a7 a2 4c c1 b9 14 94 76 d6 16 89 d5 f7 ab 82 df 25 ff 00 ab 77 fa 91 c4 af 64 56 fb 76 20 e8 7c dd eb f1 ab 1a e6 4f 4b 47 fa 91 cd 87 aa 35 af 1d 2d d4 0e 9a f2 d9 65 65 78 1d 75 f7 5b b0 d1 c9 c1 ec e9 c9 f3 5b 6e 61 74 e9 2c ea 5e cd 63 e8 f2 66 dd 1f ab 4f b6 80 6b b5 6d 93 9b 93 89 34 97 63 4d bc d5 6e b6 49 aa f5 5e 99 fb f0 45 fd c5 53 74 bc d5 f9 15 1c 57 a7 ab 24 fd 3c 4a 3a de db 3c 35 20 f8 e1 e7 42 2b ce 55 68 ee f6 de ee dc 58 79 44 a7 4a fc c4 5f 92 8f e5 4e 40 f6 d5 ab ca a5 10 9f 4e a7 8b 4f 77 7e 37 83 d5 e2 e6 5c f5 dc b5 2a 3b f8 b9 7f 6d b5 ef dc e9 3c 5e 5e 64 ac a8 bb e7 c0 f6 80 60 00 14 00 00 08 86 cb 00 32 b5 9f 44 2a 2e e6 c0 d8 00 18 de d0 8c 65 b0 3b 06 73 d6 4d 90 0c 06 20 00 18 80 00 00 Data Ascii: cU\Lv%wdVv \|OKG5-eexu[[nat,^cfOkm4cMnI^EStW$<J:<5 B+UhXyDJ_N@NOw~7\;m<^^d`2D.e;sM
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: c7 4b 57 49 4d e7 2f 30 b4 9d 5a 5d 93 02 3e 92 95 57 3e ac b8 e8 97 ec 1f 25 d5 ed 09 43 d1 ae c9 7e de d1 e3 d0 b4 e6 bb 2d de 62 67 d5 d5 bf f2 af bd b2 ab 5b 52 af d2 94 25 96 f2 d6 bb 9e ba f6 60 4a 73 78 fc b3 a2 cf 8a 4b f1 15 92 e4 9a ad aa 5a 8e ba 7e eb 47 d9 09 df e9 e5 ad 7e 67 ff 00 d8 df 97 cc c5 44 de 89 3f a8 9e dc 46 27 f5 fd 00 ba bd cd 67 fd 36 8f bd f9 76 5f 12 6d 5a ba b4 93 d9 5d 3f d5 e3 e7 a7 e0 55 da 9f a7 59 77 ba f5 3c 74 fc 92 8f e2 14 b2 a2 85 36 c4 6d fe 1d fb b0 1f 1d 13 97 76 ed 19 7d 9b 5d db d3 c1 76 45 5f fd eb 62 27 0f e0 b5 9f 0f ba 4c 9c 55 3a 53 d5 d5 b7 dd f5 6b c3 a7 6d 4d 6b 84 fa 55 5b d2 eb d5 c6 6d 66 fa 78 bf 80 17 cc b7 ba cb 7b ba 77 49 e9 11 f9 98 d5 3a e1 e7 5f 4a 7a 3e 9d 74 4b 36 f1 0b fa a6 2d 2a d8 5b Data Ascii: KWIM/0Z]>W>%C~-bg[R%`JsxKZ~G~gD?F'g6v_mZ]?UYw<t6mv}]vE_b'LU:SkmMkU[mfx{wI:_Jz>tK6-*[
2025-04-14 16:09:08 UTC	712	IN	Data Raw: 73 bb c1 7c bf 19 50 ba 19 da af 96 df 4d b8 dc ed 0d f5 6b d5 98 32 bd 1e d4 ac b6 c3 da d7 eb fa 9b 36 ad 31 a2 5f 75 9b cf c1 c4 01 13 bd 27 1e a5 f7 6c 78 d0 da c9 5e 15 77 38 e9 6e 8a bf c7 f8 19 73 35 c7 c8 dc e5 59 34 b5 c3 59 9f d1 05 38 ee ec f7 4c e2 6b a2 6f 54 bc ba 80 d5 6f c9 36 78 5c 99 fb b3 fe 33 aa 22 cd 71 de 6a dc 7a 67 ae 30 e5 78 76 fb 8a a7 13 ad a5 e6 95 b2 c2 ff 00 37 e8 16 bd 9a 6d e1 25 b7 c1 c6 00 dd 37 c8 ac a6 15 a1 a7 e6 f2 a3 b1 ce a1 3c ac bb 4e 14 4a cc fc 0d 54 d9 52 cb f6 da 2d e2 bc 7c 97 e0 5d 9b e4 c3 51 5c be cf 0f 0b ed a8 07 1b e4 dd 37 4b a4 c3 ed fb bf 29 26 de 96 f8 ec f6 ef b4 b4 b5 73 a2 ed e5 e0 d1 cd 59 b4 d9 af 56 e8 7e 1e 3f a4 1d 74 da 96 f5 9c a9 9f ba 25 f8 e9 e4 06 16 6e d4 76 e4 5f 2b c7 f5 3e 91 e3 Data Ascii: s\|PMk261_u'lx^w8ns5Y4Y8LkoTo6x\3"qjzg0xv7m%7<NJTR-\|]Q\7K)&sYV~?t%nv_+>
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: c0 8b 37 76 d3 8f ab 0d 37 3d 7f fe 65 aa f8 95 5b b5 6a ed 4f 59 f1 86 b3 55 f1 58 f0 02 ed 79 9a fc ad 3c 38 ea ff 00 fc bf 9a c9 2b 72 da 93 97 69 c2 9f 86 7f 35 f8 86 cf 52 aa f4 ae 48 b2 b7 5f bf c3 f6 af 83 15 95 2d 74 9e 16 d6 f2 e1 fc d9 f0 fb 78 04 3a a7 c8 94 62 9b 61 bb 29 db de 7c d9 a7 35 a5 3c 4b ab 53 f7 67 3f 73 c1 8f 37 ad bb 2b 4a ab 8b 26 f1 0f f7 63 a7 7f f3 02 e4 75 ab 55 5b a1 e2 7f 74 65 a8 c3 ff 00 4f c4 29 ad d5 70 d2 73 33 b7 a3 75 f5 5b e3 5f 83 79 41 5d b0 b8 ee 96 d4 b7 5d a7 89 6b d3 e3 16 fc 0b 4e 9c 35 76 ab 79 87 1a ca fe 94 fe 3e 68 ca f2 96 ea b5 b6 36 e9 86 ad a5 63 b2 e9 e2 a0 02 9b b9 15 53 58 97 3b 5c 26 97 5f 3a f7 d5 97 6e 49 ab ad 62 f0 9c c7 9f e5 1e ac 7c af 24 5a 9b d2 e3 ec f3 d2 25 4e 7b 43 eb ac 61 83 e4 fa Data Ascii: 7v7=e[jOYUXy<8+ri5RH_-tx:ba)\|5<KSg?s7+J&cuU[teO)ps3u[_yA]]kN5vy>h6cSX;\&_:nIb\|$Z%N{Ca

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:07 UTC	756	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=7dWSXCfERGsUOtN441ttyunRy4jKOddWjLKS1RKY2oGOrkaWJbS5Qn8D09382Tv3CxBt7c377Xwq56THS86BJH+t7x1L70d6L2I7eGu/SU+Xh4mrlomHB5S2rGFP
2025-04-14 16:09:23 UTC	805	IN	HTTP/1.1 302 Moved Temporarily Date: Mon, 14 Apr 2025 16:09:22 GMT Content-Length: 0 Connection: close Set-Cookie: AWSALB=0Hsxj/TOisbo+FEkP8RSg7Ptzc+VNgpmgVzmRMnN2zhl7IVoNNj2IopVRwcq38pVCaBbSMWj5Kev74DPU9IEQGSoRzufGlLVTfoCDAJ5zUNZf0Reg3nXGhfc9Haf; Expires=Mon, 21 Apr 2025 16:09:07 GMT; Path=/ Set-Cookie: AWSALBCORS=0Hsxj/TOisbo+FEkP8RSg7Ptzc+VNgpmgVzmRMnN2zhl7IVoNNj2IopVRwcq38pVCaBbSMWj5Kev74DPU9IEQGSoRzufGlLVTfoCDAJ5zUNZf0Reg3nXGhfc9Haf; Expires=Mon, 21 Apr 2025 16:09:07 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains Location: https://res.cisco.com/envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=google&lp=en&try=1 Server: unknown

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:07 UTC	576	OUT	GET /fonts/Inter/Inter-Regular.ttf HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://static.cres-aws.com/postx.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 16:09:08 UTC	766	IN	HTTP/1.1 200 OK Content-Type: font/ttf Content-Length: 303504 Connection: close Date: Mon, 14 Apr 2025 16:09:09 GMT Last-Modified: Fri, 22 Sep 2023 08:10:20 GMT ETag: "a4a7379505cd554ea9523594b7c28b2a" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 7d2e8c2396efd943b9c80d028e8585f6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P9 X-Amz-Cf-Id: BtDEPSMrtO9ypX-C7dHxWcsxVlnm7gxQsNTvyjKpyvRsdKHZ3YypGA== X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2025-04-14 16:09:08 UTC	15618	IN	Data Raw: 00 01 00 00 00 10 01 00 00 04 00 00 47 44 45 46 31 cb 31 1c 00 03 3b 00 00 00 04 12 47 50 4f 53 bc af 92 58 00 03 3f 14 00 01 1f 80 47 53 55 42 be 7f 66 78 00 04 5e 94 00 00 42 b4 4f 53 2f 32 22 97 6e 62 00 02 6e 4c 00 00 00 60 53 54 41 54 f1 71 d9 45 00 04 a1 48 00 00 00 48 63 6d 61 70 2f 2e e9 9d 00 02 6e ac 00 00 65 8a 67 61 73 70 00 00 00 10 00 03 3a f8 00 00 00 08 67 6c 79 66 8b bf 4f 34 00 00 01 0c 00 02 1d 26 68 65 61 64 2d c3 61 46 00 02 46 24 00 00 00 36 68 68 65 61 1e f5 19 bf 00 02 6e 28 00 00 00 24 68 6d 74 78 fd c3 4c d4 00 02 46 5c 00 00 27 ca 6c 6f 63 61 09 5d 06 34 00 02 1e 54 00 00 27 d0 6d 61 78 70 0a 0c 01 06 00 02 1e 34 00 00 00 20 6e 61 6d 65 30 24 51 40 00 02 d4 40 00 00 02 16 70 6f 73 74 a7 a8 35 72 00 02 d6 58 00 00 64 9e 70 72 65 Data Ascii: GDEF11;GPOSX?GSUBfx^BOS/2"nbnL`STATqEHHcmap/.negasp:glyfO4&head-aFF$6hhean($hmtxLF\'loca]4T'maxp4 name0$Q@@post5rXdpre
2025-04-14 16:09:08 UTC	766	IN	Data Raw: 88 08 00 02 26 01 99 00 00 00 07 08 62 06 c8 00 00 ff ff 00 88 fd d0 06 88 08 00 02 26 01 99 00 00 00 07 06 89 06 a8 00 00 00 01 00 88 00 00 06 f8 08 00 00 10 00 00 01 15 21 11 23 11 21 22 06 06 15 15 23 35 34 36 33 06 f8 fd 7c f8 fe a4 46 50 22 e0 db bd 08 00 dc f8 dc 07 24 42 68 3a 4c 78 b4 e0 00 02 00 88 fd c0 06 88 08 00 00 0d 00 15 00 00 21 15 14 16 33 33 15 23 22 2e 02 35 35 01 35 21 15 21 11 23 11 04 04 90 60 4c 88 54 9a 78 46 fd 7c 06 00 fd 7c f8 a4 78 48 dc 35 68 98 63 a8 07 24 dc dc f8 dc 07 24 00 02 00 88 fe fc 06 88 09 04 00 03 00 0b 00 00 01 01 33 01 01 35 21 15 21 11 23 11 01 68 03 90 e4 fc 70 fe 3c 06 00 fd 7c f8 fe fc 0a 08 f5 f8 08 28 dc dc f8 dc 07 24 ff ff 00 88 00 00 06 88 08 00 02 06 01 99 00 00 00 01 00 f8 ff dc 07 30 08 00 00 15 00 Data Ascii: &b&!#!"#5463\|FP"$Bh:Lx!33#".555!!#`LTxF\|\|xH5hc$$35!!#hp<\|($0
2025-04-14 16:09:08 UTC	584	IN	Data Raw: 07 30 0a f8 02 26 01 a5 00 00 00 07 08 0c 07 3c 02 38 ff ff 00 f8 ff dc 07 30 0a a0 02 26 01 a5 00 00 00 07 06 7b 06 9c 02 00 ff ff 00 f8 ff dc 07 30 0a 74 02 26 01 a5 00 00 00 07 06 7f 07 66 02 a0 ff ff 00 f8 fd e8 07 30 08 00 02 26 01 a5 00 00 00 07 06 8d 07 c0 ff e4 ff ff 00 f8 fd e8 07 30 08 00 02 26 01 a5 00 00 00 07 06 90 07 74 ff e4 ff ff 00 f8 fd b4 07 30 08 00 02 26 01 a5 00 00 00 07 06 89 07 34 ff e4 ff ff 00 f8 ff dc 07 30 0b a0 02 26 01 a5 00 00 00 07 08 bd 06 00 00 00 ff ff 00 f8 ff dc 07 30 0b 80 02 26 01 a5 00 00 00 07 08 5d 07 3c 02 8c ff ff 00 f8 fd e8 07 30 08 00 02 26 01 a5 00 00 00 07 06 8b 07 54 ff e4 ff ff 00 f8 ff dc 07 30 0b 0c 02 26 01 a5 00 00 00 07 06 80 07 44 02 24 ff ff 00 f8 ff dc 08 fc 0a a0 02 26 01 a6 00 00 00 07 06 64 01 Data Ascii: 0&<80&{0t&f0&0&t0&40&0&]<0&T0&D$&d
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 01 ac fc fd d0 ff 00 fe 3c 10 fe 3c 08 00 f9 7c 06 84 f9 7c 06 84 f8 00 06 60 f9 a0 ff ff 00 3c 00 00 0a 34 0a 68 02 26 01 c8 00 00 00 07 06 6a 02 b8 02 00 ff ff 00 3c 00 00 0a 34 0a a0 02 26 01 c8 00 00 00 07 06 66 01 e4 02 00 ff ff 00 3c 00 00 0a 34 0a a0 02 26 01 c8 00 00 00 07 06 64 02 9c 02 00 ff ff 00 3c 00 00 0a 34 0a 40 02 26 01 c8 00 00 00 07 06 69 01 f8 00 18 ff ff 00 3c 00 00 0a 34 0a 40 02 26 01 c8 00 00 00 07 06 70 03 e8 02 00 ff ff 00 3c fe 14 0a 34 08 00 02 26 01 c8 00 00 00 07 06 8b 08 78 00 10 00 01 00 4c 00 00 06 c4 08 00 00 0d 00 00 01 01 33 01 21 01 01 21 01 23 01 21 01 01 01 70 02 10 10 02 10 01 24 fd 7c 02 84 fe dc fd f0 10 fd f0 fe dc 02 94 fd 6c 08 00 fc ac 03 54 fc 00 fc 00 03 44 fc bc 04 00 04 00 ff ff 00 4c 00 00 06 c4 0a 40 02 Data Ascii: <<\|\|`<4h&j<4&f<4&d<4@&i<4@&p<4&xL3!!#!p$\|lTDL@
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 00 00 07 09 8f 01 38 00 b0 ff ff 00 90 ff e0 06 00 08 b0 02 26 03 07 00 00 00 07 09 96 00 fc 00 b0 ff ff 00 90 ff e0 06 00 08 94 02 26 03 07 00 00 00 07 09 9d 01 5c 00 94 00 03 00 90 ff e0 06 00 06 14 00 03 00 13 00 23 00 00 01 15 21 35 01 22 24 02 35 34 12 24 33 32 04 12 15 14 02 04 27 32 36 12 35 34 02 26 23 22 06 02 15 14 12 16 05 62 fb cc 02 1a d0 fe c7 af af 01 39 d0 d0 01 39 af af fe c7 d0 9e cc 62 62 cc 9e 9e cc 62 62 cc 03 66 cc cc fc 7a c6 01 64 ee f0 01 66 c6 c6 fe 9a f0 ee fe 9c c6 d4 a2 01 08 9a 9a 01 0a a4 a4 fe f6 9a 9a fe f8 a2 ff ff 00 90 ff e0 06 00 06 14 02 06 03 35 00 00 ff ff 00 90 ff e0 06 00 06 14 02 06 03 07 00 00 ff ff 00 90 ff e0 06 00 08 40 02 06 03 08 00 00 ff ff 00 90 ff e0 0a 5c 06 14 00 26 03 07 00 00 00 07 02 64 04 84 00 00 Data Ascii: 8&&\#!5"$54$32'2654&#"b99bbbbfzdf5@\&d
2025-04-14 16:09:08 UTC	2048	IN	Data Raw: 05 7c 08 b0 02 26 04 44 00 00 00 07 09 94 00 58 00 b0 ff ff 00 90 ff e4 05 7c 08 b0 02 26 04 44 00 00 00 07 09 8f 00 f4 00 b0 ff ff 00 90 ff e4 05 7c 08 b0 02 26 04 44 00 00 00 07 09 96 00 b8 00 b0 ff ff 00 90 ff e4 05 7c 08 94 02 26 04 44 00 00 00 07 09 9d 01 18 00 94 00 02 00 88 fd f0 05 20 08 00 00 21 00 25 00 00 01 33 15 01 0e 02 15 14 16 17 17 16 16 15 14 06 07 27 36 36 35 34 26 27 27 26 02 35 34 3e 02 37 01 21 15 21 04 a8 78 fe 2c 70 a1 57 76 66 b8 aa c2 87 71 90 3c 44 6f 61 7c c4 e0 36 65 92 5b fe 14 04 44 fb bc 08 00 b0 fd 9c 92 d4 d8 9a 67 96 1f 38 34 a5 5f 60 d9 5f 7c 44 82 2e 26 4e 1c 24 39 01 0f b4 7f d8 c6 c4 6b 02 a4 dc 00 01 00 d8 fd c0 05 98 06 14 00 16 00 00 01 11 23 11 33 15 33 36 36 33 32 16 12 15 11 23 11 34 26 23 22 06 06 01 c4 ec e4 Data Ascii: \|&DX\|&D\|&D\|&D !%3'6654&''&54>7!!x,pWvfq<Doa\|6e[Dg84_`_\|D.&N$9k#336632#4&#"
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: ff ff ff 84 fd c4 05 b8 06 14 02 26 04 81 00 00 00 07 07 fe fe c4 fb 20 00 01 00 90 fd fc 05 64 06 14 00 27 00 00 01 32 04 12 15 21 34 26 23 22 06 06 15 15 14 16 16 17 1e 02 15 14 06 07 27 36 36 35 34 26 27 26 24 02 35 35 34 12 24 03 24 ad 01 03 90 fe fc b1 8f 7f bb 66 75 e3 a4 a0 a9 3f 93 65 90 52 32 57 7d de fe d7 95 a1 01 29 06 14 8c fe fc b4 ab bd 91 fe a5 38 75 c6 93 2a 29 54 63 40 79 eb 54 7c 5d 63 32 44 36 1c 33 c0 01 1d bc 38 ea 01 61 c5 00 03 00 a4 ff e4 06 4c 05 d0 00 15 00 27 00 2b 00 00 13 35 34 12 24 33 1e 02 17 1e 02 15 15 14 02 04 23 22 24 02 25 15 14 16 16 33 32 36 36 35 35 34 26 26 23 22 06 06 01 15 21 35 a4 9f 01 29 d0 2c 4a 5a 44 7a b0 5e 9d fe d7 d2 d2 fe d5 9f 01 14 51 ad 8a 88 ab 51 51 ad 8a 88 ab 51 04 94 fc f0 02 d8 20 ce 01 4a c0 Data Ascii: & d'2!4&#"'6654&'&$554$$fu?eR2W})8u*)Tc@yT\|]c2D638aL'+54$3#"$%3266554&&#"!5),JZDz^QQQQ J
2025-04-14 16:09:08 UTC	1024	IN	Data Raw: 00 c4 04 f0 03 78 08 00 00 26 05 79 00 00 00 07 05 79 01 9c 00 00 00 01 00 bc fe 0c 02 38 01 18 00 0b 00 00 01 07 06 02 06 07 23 36 36 12 37 37 02 38 10 11 45 4a 18 b4 0d 2a 2b 0e 0c 01 18 6c 72 fe fc e6 44 40 d2 01 03 87 70 00 01 00 d0 ff f0 02 38 01 58 00 0c 00 00 05 22 26 35 34 36 33 32 16 15 14 06 06 01 84 4a 6a 6a 4a 4a 6a 31 51 10 6a 4a 4a 6a 6a 4a 31 52 31 ff ff 00 d0 ff f0 08 38 01 58 00 26 05 7c 00 00 00 27 05 7c 03 00 00 00 00 07 05 7c 06 00 00 00 ff ff 00 d0 ff f0 05 38 01 58 00 26 05 7c 00 00 00 07 05 7c 03 00 00 00 00 02 00 d0 ff f0 02 38 05 cc 00 0c 00 19 00 00 05 22 26 35 34 36 33 32 16 15 14 06 06 03 22 26 35 34 36 33 32 16 15 14 06 06 01 84 4a 6a 6a 4a 4a 6a 31 51 32 4a 6a 6a 4a 4a 6a 31 51 10 6a 4a 4a 6a 6a 4a 31 52 31 04 74 6a 4a 4a 6a Data Ascii: x&yy8#66778EJ*+lrD@p8X"&54632JjjJJj1QjJJjjJ1R18X&\|'\|\|8X&\|\|8"&54632"&54632JjjJJj1Q2JjjJJj1QjJJjjJ1R1tjJJj
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 9c d8 d8 fd b0 d8 d8 00 02 01 0c 00 8c 06 34 05 b4 00 03 00 07 00 00 25 11 33 11 01 35 21 15 03 30 e0 fc fc 05 28 8c 05 28 fa d8 02 24 e0 e0 00 01 01 20 02 b0 06 20 03 90 00 03 00 00 01 15 21 35 06 20 fb 00 03 90 e0 e0 00 02 01 20 00 a0 06 20 05 a0 00 03 00 07 00 00 25 01 37 01 05 27 01 17 05 88 fb 98 98 04 68 fb 98 98 04 68 98 a0 04 68 98 fb 98 98 98 04 68 98 00 03 01 20 00 68 06 20 05 d8 00 03 00 0f 00 1c 00 00 01 15 21 35 01 22 26 35 34 36 33 32 16 15 14 06 03 22 26 26 35 34 36 33 32 16 15 14 06 06 20 fb 00 02 80 4b 69 69 4b 48 68 68 48 32 52 30 69 4b 48 68 68 03 90 e0 e0 fc d8 69 4b 48 68 68 48 4b 69 04 0c 30 52 32 48 68 68 48 4b 69 00 03 01 1c 00 60 06 24 06 00 00 03 00 07 00 0b 00 00 25 35 21 15 01 35 21 15 01 11 33 11 01 1c 05 08 fa f8 05 08 fd 0c Data Ascii: 4%35!0(($ !5 %7'hhhh h !5"&54632"&&54632 KiiKHhhH2R0iKHhhiKHhhHKi0R2HhhHKi`$%5!5!3
2025-04-14 16:09:08 UTC	1024	IN	Data Raw: 9a fd 1a fd 18 01 8c dc dc 01 dc dc dc 00 01 01 be 00 00 08 c0 08 0c 00 08 00 00 21 11 01 27 01 01 07 01 11 04 d2 fd 88 9c 03 82 03 80 98 fd 86 06 6c fd 86 9a 03 80 fc 80 9a 02 7a f9 94 00 01 01 c0 ff f4 08 c2 08 00 00 08 00 00 01 11 01 17 01 01 37 01 11 05 ae 02 78 9c fc 7e fc 80 98 02 7a 08 00 f9 94 02 7a 9a fc 80 03 80 9a fd 86 06 6c 00 01 01 c0 fd 9c 08 c0 09 40 00 0d 00 00 01 01 37 01 11 01 27 01 01 07 01 11 01 17 05 40 fc 80 9a 02 78 fd 88 9a 03 80 03 80 98 fd 86 02 7a 98 fd 9c 03 80 9a fd 86 08 64 fd 86 9a 03 80 fc 80 9a 02 7a f7 9c 02 7a 9a 00 02 01 16 00 00 0b 84 08 40 00 16 00 1c 00 00 01 35 21 32 36 36 35 34 26 26 23 23 35 33 32 04 12 15 14 0e 02 23 09 02 17 01 01 02 00 06 ee 7a c9 77 78 c8 7a 66 66 b7 01 2c b3 67 b6 f0 89 fb a8 fc 80 03 80 99 Data Ascii: !'lz7x~zzl@7'@xzdzz@5!26654&&##532#zwxzff,g

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:07 UTC	574	OUT	GET /fonts/Inter/Inter-Light.ttf HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://static.cres-aws.com/postx.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 16:09:08 UTC	766	IN	HTTP/1.1 200 OK Content-Type: font/ttf Content-Length: 304092 Connection: close Date: Mon, 14 Apr 2025 16:09:09 GMT Last-Modified: Fri, 22 Sep 2023 08:10:20 GMT ETag: "60c8f64064078554b6469eeda25944eb" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 4b14054a85dbd772fa74b3629899476c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P9 X-Amz-Cf-Id: R6AeQh6TOFP9xhBqoCiF9L7PD8BVXNT0LmVwnfuQqPYOmKyn8d978Q== X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 00 01 00 00 00 10 01 00 00 04 00 00 47 44 45 46 31 cb 31 1c 00 03 3b 6c 00 00 04 12 47 50 4f 53 44 54 7b 36 00 03 3f 80 00 01 21 64 47 53 55 42 be 7f 66 78 00 04 60 e4 00 00 42 b4 4f 53 2f 32 22 33 6e 62 00 02 6e 98 00 00 00 60 53 54 41 54 ee 4d d9 3f 00 04 a3 98 00 00 00 44 63 6d 61 70 2f 2e e9 9d 00 02 6e f8 00 00 65 8a 67 61 73 70 00 00 00 10 00 03 3b 64 00 00 00 08 67 6c 79 66 97 e6 ea 0c 00 00 01 0c 00 02 1d 71 68 65 61 64 2d c3 61 46 00 02 46 70 00 00 00 36 68 68 65 61 1e f5 19 bf 00 02 6e 74 00 00 00 24 68 6d 74 78 e5 18 e6 d0 00 02 46 a8 00 00 27 ca 6c 6f 63 61 09 5d 8d 80 00 02 1e a0 00 00 27 d0 6d 61 78 70 0a 0c 01 06 00 02 1e 80 00 00 00 20 6e 61 6d 65 35 9c 5c a6 00 02 d4 8c 00 00 02 38 70 6f 73 74 a7 a8 35 72 00 02 d6 c4 00 00 64 9e 70 72 65 Data Ascii: GDEF11;lGPOSDT{6?!dGSUBfx`BOS/2"3nbn`STATM?Dcmap/.negasp;dglyfqhead-aFFp6hheant$hmtxF'loca]'maxp name5\8post5rdpre
2025-04-14 16:09:08 UTC	572	IN	Data Raw: dd 07 20 0a d4 02 26 01 a5 00 00 00 07 08 0c 07 23 02 38 ff ff 01 10 ff dd 07 20 0a 9b 02 26 01 a5 00 00 00 07 06 7b 06 c8 02 00 ff ff 01 10 ff dd 07 20 0a 67 02 26 01 a5 00 00 00 07 06 7f 07 61 02 95 ff ff 01 10 fd f8 07 20 08 00 02 26 01 a5 00 00 00 07 06 8d 07 94 ff e3 ff ff 01 10 fe 11 07 20 08 00 02 26 01 a5 00 00 00 07 06 90 07 37 ff e3 ff ff 01 10 fd b8 07 20 08 00 02 26 01 a5 00 00 00 07 06 89 07 18 ff e3 ff ff 01 10 ff dd 07 20 0b 60 02 26 01 a5 00 00 00 07 08 bd 06 0b 00 00 ff ff 01 10 ff dd 07 20 0b 43 02 26 01 a5 00 00 00 07 08 5d 07 23 02 af ff ff 01 10 fd f8 07 20 08 00 02 26 01 a5 00 00 00 07 06 8b 07 43 ff e3 ff ff 01 10 ff dd 07 20 0b 0d 02 26 01 a5 00 00 00 07 06 80 07 1c 02 2c ff ff 01 10 ff dd 08 c2 0a 9b 02 26 01 a6 00 00 00 07 06 64 Data Ascii: &#8 &{ g&a & &7 & `& C&]# &C &,&d
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 74 fd cf be 01 d0 10 01 d0 d8 01 d0 10 01 d0 bf fd cf c8 fe 25 0d fe 25 08 00 f9 1f 06 e1 f9 1f 06 e1 f8 00 06 c9 f9 37 ff ff 00 43 00 00 09 f8 0a 50 02 26 01 c8 00 00 00 07 06 6a 02 ad 02 00 ff ff 00 43 00 00 09 f8 0a 9b 02 26 01 c8 00 00 00 07 06 66 01 d0 02 00 ff ff 00 43 00 00 09 f8 0a 9b 02 26 01 c8 00 00 00 07 06 64 02 78 02 00 ff ff 00 43 00 00 09 f8 0a 08 02 26 01 c8 00 00 00 07 06 69 01 bd 00 25 ff ff 00 43 00 00 09 f8 0a 08 02 26 01 c8 00 00 00 07 06 70 03 e8 02 00 ff ff 00 43 fe 25 09 f8 08 00 02 26 01 c8 00 00 00 07 06 8b 08 48 00 10 00 01 00 53 00 00 06 88 08 00 00 0d 00 00 01 01 33 01 33 01 01 23 01 23 01 23 01 01 01 30 02 37 0d 02 37 dd fd 6d 02 93 dd fd c9 0d fd c9 dd 02 9d fd 63 08 00 fc 87 03 79 fc 00 fc 00 03 6f fc 91 04 00 04 00 ff ff Data Ascii: t%%7CP&jC&fC&dxC&i%C&pC%&HS33###077mcyo
2025-04-14 16:09:08 UTC	15990	IN	Data Raw: 9c ff e0 05 e4 08 b3 02 26 03 07 00 00 00 07 09 8f 01 72 00 b0 ff ff 00 9c ff e0 05 e4 08 b3 02 26 03 07 00 00 00 07 09 96 01 27 00 b0 ff ff 00 9c ff e0 05 e4 08 93 02 26 03 07 00 00 00 07 09 9d 01 75 00 90 00 03 00 9c ff e0 05 e4 06 15 00 03 00 13 00 23 00 00 01 15 21 35 01 22 24 02 35 34 12 24 33 32 04 12 15 14 02 04 27 32 36 12 35 34 02 26 23 22 06 02 15 14 12 16 05 6f fb a4 02 2d c7 fe cf ac ac 01 31 c7 c7 01 30 ad ac fe cf c7 a0 de 73 73 de a0 9f df 73 73 de 03 4f 9e 9e fc 91 ca 01 65 ea ec 01 67 c9 ca fe 9a ec ea fe 9b ca a3 ac 01 1e ac ac 01 20 ae ae fe e0 ac ac fe e2 ac ff ff 00 9c ff e0 05 e4 06 15 02 06 03 35 00 00 ff ff 00 9c ff e0 05 e4 06 15 02 06 03 07 00 00 ff ff 00 9c ff e0 05 e4 08 08 02 06 03 08 00 00 ff ff 00 9b ff e0 0a 5c 06 15 00 26 Data Ascii: &r&'&u#!5"$54$32'2654&#"o-10ssssOeg 5\&
2025-04-14 16:09:08 UTC	10568	IN	Data Raw: 06 04 03 23 35 33 32 36 35 26 26 23 22 06 02 15 23 34 12 36 36 33 32 04 15 14 0e 02 03 0e a2 f5 a6 54 b3 ed f1 b8 e0 01 5f ac 73 ae af a1 db 82 39 98 fe f3 92 af ae b1 b5 01 cb a9 a5 d9 6c b3 55 a6 f8 a2 fc 01 36 32 79 d0 1c 6c d2 01 2e c1 fe ca fe ae 99 7d 54 87 4f 60 46 73 8f 49 83 c4 6d 03 05 7d 86 73 7c 96 8e fe f1 c4 b7 01 1f c6 68 eb cd 47 86 69 3e 00 03 00 9d ff e4 07 49 06 14 00 11 00 2d 00 47 00 00 01 35 25 1e 02 33 16 36 37 17 06 06 23 2e 02 27 01 32 1e 02 15 14 06 04 23 22 2e 02 27 33 16 16 33 32 36 35 36 26 26 23 23 35 15 35 33 32 36 27 34 26 23 22 06 07 23 3e 02 33 32 16 16 15 14 0e 02 27 04 d3 01 2c 10 30 54 44 21 26 0e 1d 23 4e 2b 61 7b 46 10 fd ac 9f da 83 3b 97 fe f4 b0 85 da a0 60 0f ba 21 ce bd bd e3 01 62 ac 71 ad ad b1 b6 01 cf ad a3 Data Ascii: #53265&&#"#46632T_s9lU62yl.}TO`FsIm}s\|hGi>I-G5%367#.'2#".'332656&&##55326'4&#"#>32',0TD!&#N+a{F;`!bq
2025-04-14 16:09:08 UTC	2604	IN	Data Raw: 01 23 01 23 01 09 d5 f6 6a 09 96 f6 6a ae 01 d0 10 01 d0 d8 01 d0 10 01 d0 bf fd cf c8 fe 25 0d fe 25 c8 fd cf 05 2c a8 a8 fe 21 a8 a8 04 b3 f9 1f 06 e1 f9 1f 06 e1 f8 00 06 c9 f9 37 08 00 00 04 00 c0 00 00 06 20 08 1c 00 03 00 1e 00 22 00 26 00 00 21 21 35 21 01 13 16 06 07 27 3e 02 27 03 26 12 24 33 32 16 16 07 27 36 26 26 23 22 06 06 01 15 21 35 01 15 21 35 06 20 fa a5 05 5b fc 38 1f 03 3e 5f b2 37 42 1d 02 1c 06 9b 01 10 ab ab fa 82 09 b8 08 6b b2 64 68 b4 6d 02 11 fc 58 03 a8 fc 58 ad 05 1f fc 2f 8b de 2b 46 08 6b 94 47 03 d1 b6 01 0a 90 88 ee 97 05 6f 9a 4f 64 ba fe 4f 8d 8d fe 8b 8d 8d 00 03 00 4f 00 00 06 e9 08 00 00 03 00 07 00 0f 00 00 13 35 21 15 01 35 21 15 01 23 01 33 01 23 01 23 68 06 68 f9 98 06 68 fa 43 c4 02 e9 c8 02 e9 c4 fd 7e 0e 04 0b Data Ascii: ##jj%%,!7 "&!!5!'>'&$32'6&&#"!5!5 [8>_7BkdhmXX/+FkGoOdOO5!5!#3##hhhC~
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: a0 49 6d be 77 7e bd 68 b3 9d 01 11 ad ab 01 0a 98 4f c0 aa fe 04 03 f5 89 02 f0 94 d2 b2 60 75 af 62 6c bc 7a aa 01 07 96 93 fc 9c 71 d4 fe fc bc fd c9 0d a8 ff ff 00 e4 00 00 06 1b 08 1c 02 26 05 10 00 00 00 07 07 fe 02 0f 00 35 00 01 00 e3 ff e4 06 15 08 1c 00 33 00 00 05 22 24 26 27 33 1e 02 33 32 36 36 35 34 26 26 23 23 35 33 32 36 36 35 34 26 26 23 22 06 06 07 23 36 36 24 33 32 04 16 15 14 06 07 15 16 12 15 14 02 04 03 7d bd fe d6 ae 05 bd 05 80 d4 82 8e d9 7b 7e eb a3 78 78 85 cd 76 66 b9 7b 77 c6 79 04 b5 04 a9 01 19 ab b5 01 08 91 be a1 c4 e1 ac fe d5 1c 89 f4 9f 70 a7 5d 6a b9 75 7c be 6a a8 61 b0 77 71 ac 62 5c a8 73 a0 f3 89 94 f5 93 af f9 30 0d 27 fe f3 c3 a4 fe fb 97 00 02 00 b3 00 00 06 31 08 00 00 09 00 0f 00 00 13 35 01 33 15 23 01 15 21 Data Ascii: Imw~hO`ublzq&53"$&'3326654&&##5326654&&#"#66$32}{~xxvf{wyp]ju\|jawqb\s0'153#!
2025-04-14 16:09:08 UTC	1024	IN	Data Raw: 00 05 22 26 26 27 33 16 16 33 32 36 35 34 26 23 22 06 07 27 13 21 15 21 03 33 36 36 33 32 16 16 15 14 06 06 02 08 71 b0 66 01 9c 03 86 63 72 93 9b 6e 3b 6f 22 9c 40 02 95 fd f3 2f 06 28 82 4c 68 ab 67 6c bc 10 51 8f 5d 56 68 88 68 6d 83 30 28 1e 02 2b 83 fe a3 2d 36 59 9e 68 6b a9 60 00 02 00 69 ff f0 03 b5 04 53 00 1e 00 2b 00 00 05 22 2e 02 35 34 12 36 33 32 16 17 23 26 26 23 22 06 15 33 36 36 33 32 16 16 15 14 06 06 27 32 36 35 34 26 23 22 06 06 17 16 16 02 1d 58 9d 79 46 61 c5 98 a0 cf 0e a0 0b 73 5f 8e 91 08 21 b1 66 67 a6 60 66 b8 7c 6c 91 95 6b 49 78 41 09 0e 87 10 3d 80 c8 8b a4 01 0e a1 b4 87 4d 62 ec d3 4e 5f 5a 9d 62 65 a5 62 7f 88 62 62 86 41 6d 3f 68 7d 00 01 00 50 00 00 03 6b 04 40 00 07 00 00 33 01 35 21 35 21 15 01 a4 02 1d fd 8f 03 1b fd Data Ascii: "&&'332654&#"'!!36632qfcrn;o"@/(LhglQ]Vhhm0(+-6Yhk`iS+".54632#&&#"36632'2654&#"XyFas_!fg`f\|lkIxA=MbN_ZbebbbAm?h}Pk@35!5!
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: bf 03 f0 52 8f 5c 50 66 6e 50 54 68 76 64 51 4c 67 67 50 5b 8c 51 4e 86 55 5d 80 13 07 14 8d 64 5a 8f 52 ff ff 00 65 04 00 03 db 08 40 02 07 06 23 00 00 04 00 00 01 00 80 03 f0 03 ab 08 40 00 22 00 00 01 22 26 26 27 33 16 16 33 32 36 35 34 26 23 22 06 07 27 13 21 15 21 03 33 36 36 33 32 16 16 15 14 06 06 02 08 71 b0 66 01 9c 03 86 63 72 93 9b 6e 3b 6f 22 9c 40 02 95 fd f3 2f 06 28 82 4c 68 ab 67 6c bc 03 f0 51 8f 5d 56 68 88 68 6d 83 30 28 1e 02 2b 83 fe a3 2d 36 59 9e 68 6b a9 60 ff ff 00 69 03 f0 03 b5 08 53 02 07 06 25 00 00 04 00 00 01 00 50 04 00 03 6b 08 40 00 07 00 00 13 01 35 21 35 21 15 01 a4 02 1d fd 8f 03 1b fd e4 04 00 03 b5 08 83 84 fc 44 ff ff 00 65 03 f0 03 cc 08 50 02 07 06 27 00 00 04 00 ff ff 00 6c 03 ee 03 b8 08 51 02 07 06 28 00 00 03 Data Ascii: R\PfnPThvdQLggP[QNU]dZRe@#@""&&'332654&#"'!!36632qfcrn;o"@/(LhglQ]Vhhm0(+-6Yhk`iS%Pk@5!5!DeP'lQ(
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 23 11 01 15 21 35 01 15 21 35 01 22 24 02 35 35 34 12 24 33 32 1e 02 17 15 2e 02 23 22 06 02 15 15 14 12 16 33 32 36 36 37 15 0e 03 09 13 fc 7e 2f cd 03 a9 fc f5 03 82 fc 7e fe 15 d2 fe cf a6 a4 01 30 d2 35 67 70 7e 4a 61 95 8a 51 9c d4 6b 6d d4 9c 4a 8d 9a 5c 43 7b 73 6b a5 a5 a5 05 2b fa 30 05 d0 fd 79 a8 a8 02 87 a5 a5 fa 13 c7 01 59 da 18 d9 01 58 c7 07 0b 09 03 a5 04 0d 0a a0 fe f4 a4 18 a6 fe f2 9e 0a 0e 03 a5 03 09 0b 07 00 03 00 b4 fd c0 08 1a 08 1c 00 15 00 2c 00 33 00 00 01 11 0e 02 23 22 24 26 02 35 35 37 15 14 12 04 33 32 36 37 11 13 11 23 11 26 26 23 22 06 06 02 15 15 23 35 34 12 12 24 33 32 16 16 25 11 23 11 05 35 25 06 79 3b c3 f6 89 be fe cb de 77 d3 9b 01 1f c7 82 e3 42 ca ca 40 e1 85 96 ee a6 58 d3 78 e1 01 3b c4 83 ee c1 01 dc cd fe c9 Data Ascii: #!5!5"$554$32.#"32667~/~05gp~JaQkmJ\C{sk+0yYX,3#"$&5573267#&&#"#54$32%#5%y;wB@Xx;

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:07 UTC	577	OUT	GET /fonts/Inter/Inter-SemiBold.ttf HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://static.cres-aws.com/postx.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 16:09:08 UTC	766	IN	HTTP/1.1 200 OK Content-Type: font/ttf Content-Length: 309432 Connection: close Date: Mon, 14 Apr 2025 16:09:09 GMT Last-Modified: Fri, 22 Sep 2023 08:10:20 GMT ETag: "1753a05196abeef95c32f10246bd6473" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 ba1e517a4f7e2b0408d16a73e8b5ca62.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P9 X-Amz-Cf-Id: T7kmAi8Q-92e5YhkjsgHaTOsXtKKajqEK6XPBdT457aALP-VNhFmEg== X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2025-04-14 16:09:08 UTC	14588	IN	Data Raw: 00 01 00 00 00 10 01 00 00 04 00 00 47 44 45 46 31 cb 31 1c 00 03 44 98 00 00 04 12 47 50 4f 53 9b af 91 74 00 03 48 ac 00 01 2d 14 47 53 55 42 be 7f 66 78 00 04 75 c0 00 00 42 b4 4f 53 2f 32 23 5f 6e 62 00 02 77 ac 00 00 00 60 53 54 41 54 ef 79 d9 45 00 04 b8 74 00 00 00 44 63 6d 61 70 2f 2e e9 9d 00 02 78 0c 00 00 65 8a 67 61 73 70 00 00 00 10 00 03 44 90 00 00 00 08 67 6c 79 66 6a 1b 9d 97 00 00 01 0c 00 02 26 86 68 65 61 64 2d c3 61 46 00 02 4f 84 00 00 00 36 68 68 65 61 1e f5 19 bf 00 02 77 88 00 00 00 24 68 6d 74 78 24 35 88 39 00 02 4f bc 00 00 27 ca 6c 6f 63 61 09 84 29 ed 00 02 27 b4 00 00 27 d0 6d 61 78 70 0a 0c 01 06 00 02 27 94 00 00 00 20 6e 61 6d 65 37 5c 60 0e 00 02 dd a0 00 00 02 50 70 6f 73 74 a7 a8 35 72 00 02 df f0 00 00 64 9e 70 72 65 Data Ascii: GDEF11DGPOStH-GSUBfxuBOS/2#_nbw`STATyEtDcmap/.xegaspDglyfj&head-aFO6hheaw$hmtx$59O'loca)''maxp' name7\`Ppost5rdpre
2025-04-14 16:09:08 UTC	2400	IN	Data Raw: 1c 00 20 00 00 13 21 32 04 12 15 14 06 06 07 07 21 03 21 32 36 36 35 34 26 26 23 21 11 21 21 01 21 01 21 21 01 21 ca 02 f2 f7 01 43 9e 73 cf 8a 57 fd 52 01 01 ec 83 a5 4f 47 9e 84 fe 81 fe 8d 05 82 fd 69 01 51 02 a0 fd 48 fe d5 02 9f 01 22 08 00 a1 fe e1 ba a4 f1 a2 2c 1f 01 39 4d 91 64 5b 96 59 f9 37 03 96 fc 6a 03 96 00 03 00 1a 00 00 07 0e 08 00 00 03 00 1b 00 1f 00 00 01 21 11 21 03 11 21 32 04 12 15 14 02 04 23 21 11 21 32 36 36 35 34 26 26 23 21 11 01 01 21 01 01 c9 fe 51 01 af d9 03 01 eb 01 42 a4 a6 fe bc ed fd dd 01 f2 89 b0 55 55 b1 8b fe ac 02 af 01 fc fe 61 fe 0f 03 02 01 23 fb db 08 00 a4 fe d9 c4 c5 fe df 9d 01 34 4d 95 6d 6d 9b 51 f9 36 03 a0 fc 60 03 a0 00 01 00 80 ff e1 06 a4 08 1c 00 33 00 00 01 26 26 23 22 06 06 07 14 1e 02 17 17 1e 03 Data Ascii: !2!!26654&&#!!!!!!!CsWROGiQH",9Md[Y7j!!!2#!!26654&&#!!QBUUa#4MmmQ6`3&&#"
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: f8 00 08 00 ff ff 00 45 00 00 07 b2 0a 47 02 26 01 c5 00 00 00 07 06 6b 01 3b 02 00 ff ff 00 45 fd d7 07 b2 08 00 02 26 01 c5 00 00 00 07 06 8b 07 15 00 00 00 01 00 37 00 00 0a dc 08 00 00 0f 00 00 21 01 21 01 33 01 21 01 33 01 21 01 21 01 23 01 02 79 fd be 01 8f 01 71 13 01 8a 01 6b 01 8b 12 01 71 01 8f fd be fe 92 fe 66 10 fe 65 08 00 fa 1f 05 e1 fa 1e 05 e2 f8 00 05 9d fa 63 ff ff 00 37 00 00 0a dc 0a 76 02 26 01 c8 00 00 00 07 06 6a 02 a6 02 00 ff ff 00 37 00 00 0a dc 0a 93 02 26 01 c8 00 00 00 07 06 66 02 37 02 00 ff ff 00 37 00 00 0a dc 0a 93 02 26 01 c8 00 00 00 07 06 64 02 e1 02 00 ff ff 00 37 00 00 0a dc 0a 5b 02 26 01 c8 00 00 00 07 06 69 02 7e 00 20 ff ff 00 37 00 00 0a dc 0a 63 02 26 01 c8 00 00 00 07 06 70 04 08 02 00 ff ff 00 37 fd e1 0a dc Data Ascii: EG&k;E&7!!3!3!!#yqkqfec7v&j7&f77&d7[&i~ 7c&p7
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 38 08 76 02 26 03 07 00 00 00 26 06 6a 75 00 00 07 06 8b 06 72 00 00 ff ff 00 78 ff e2 06 d4 08 93 02 26 03 0b 00 00 00 07 06 64 00 af 00 00 ff ff 00 78 ff e2 06 d4 08 93 02 26 03 0b 00 00 00 06 06 66 06 00 ff ff 00 78 ff e2 06 d4 09 09 02 26 03 0b 00 00 00 07 06 80 06 d8 00 12 ff ff 00 78 ff e2 06 d4 08 47 02 26 03 0b 00 00 00 07 06 6b 00 98 00 00 ff ff 00 78 fd d7 06 d4 06 62 02 26 03 0b 00 00 00 07 06 8b 06 72 00 00 ff ff 00 78 ff a2 06 38 08 92 02 26 03 0a 00 00 00 07 06 64 00 af ff fe ff ff 00 78 ff e2 06 38 06 14 02 06 03 07 00 00 ff ff 00 78 ff e2 06 38 08 98 02 26 03 07 00 00 00 07 08 cd 01 d5 00 0b ff ff 00 78 ff e2 06 38 08 b0 02 26 03 07 00 00 00 07 09 88 02 36 00 a8 ff ff 00 78 ff e2 06 38 08 b0 02 26 03 07 00 00 00 07 09 a1 01 a5 00 b0 ff ff Data Ascii: 8v&&jurx&dx&fx&xG&kxb&rx8&dx8x8&x8&6x8&
2025-04-14 16:09:08 UTC	2048	IN	Data Raw: 9a d2 7f 38 01 9f 01 1c bc 9c 01 03 bc 66 fe a4 01 5f ab 72 7e 83 01 01 81 86 74 1c 6d c9 88 4a 8a 6d 40 8e 34 5f 41 53 70 01 0d 01 0a ca fe ce cd 68 03 02 40 6a 83 43 8e c7 69 61 c0 fe e0 be ad d7 65 6e 50 4e 61 ab ff ff 00 78 ff e4 05 be 06 14 02 06 04 44 00 00 00 02 00 72 ff e4 05 b7 06 14 00 1b 00 35 00 00 01 32 1e 02 15 14 06 04 23 22 2e 02 27 21 16 16 33 32 36 37 2e 02 23 23 35 15 35 33 32 36 37 26 26 23 22 06 07 21 36 36 24 33 32 04 16 17 0e 03 23 03 64 a5 e5 8a 3f b4 fe ca c2 85 ec b5 6c 07 01 61 12 9a 97 96 a9 01 01 53 8d 56 ce ce 8a 93 01 01 96 8a 7e a0 0f fe 9b 0c aa 01 1b b3 bf 01 28 a7 01 01 3c 86 d8 9e 03 23 40 6d 8a 4a 88 c9 6d 3e 79 b1 71 60 61 72 53 42 5d 32 91 3d ae 5e 4e 50 6e 5a 56 8f cb 6c 69 c7 8e 43 83 6a 40 00 02 00 76 ff e4 05 cb Data Ascii: 8f_r~tmJm@4_ASph@jCiaenPNaxDr52#".'!3267.##553267&&#"!66$32#d?laSV~(<#@mJm>yq`arSB]2=^NPnZVliCj@v
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: d4 ff ee 03 46 09 c7 02 26 04 6c 00 00 00 07 09 98 ff 53 00 a8 ff ff 00 29 ff ee 03 46 08 94 02 26 04 6c 00 00 00 07 09 9d ff 75 00 9c ff ff ff a8 ff ee 03 4f 08 10 02 26 04 6c 00 00 00 07 06 6e fe e3 00 00 ff ff ff 9a ff ee 03 5b 08 00 02 26 04 6c 00 00 00 07 06 6d fe 96 00 00 ff ff ff 70 ff ee 03 84 09 7d 02 26 04 6c 00 00 00 07 09 9b fe e2 00 a8 ff ff ff 7a ff ee 03 7b 08 ef 02 26 04 6c 00 00 00 07 09 8b fe e3 00 00 ff ff ff 76 ff ee 03 8a 0a 08 02 26 04 6c 00 00 00 07 09 8c fe e8 00 a8 00 02 00 4e ff e8 06 4b 08 1c 00 1b 00 20 00 00 05 22 26 27 01 03 27 2e 02 07 03 36 36 33 32 04 17 01 16 16 33 32 36 37 13 06 06 25 01 13 23 01 05 b5 83 c4 34 fe d8 88 3a 25 4f 75 5d 54 29 69 3f b7 01 01 44 01 e7 1c 33 39 0b 1b 09 2a 1c 55 fa 74 02 5f d1 5c fe a6 18 8b Data Ascii: F&lS)F&luO&ln[&lmp}&lz{&lv&lNK "&''.66323267%#4:%Ou]T)i?D39*Ut_\
2025-04-14 16:09:08 UTC	1730	IN	Data Raw: 11 07 60 f8 a0 03 ea fe d6 01 2a 00 01 00 00 02 c0 0b 00 03 ea 00 03 00 00 01 11 21 11 0b 00 f5 00 03 ea fe d6 01 2a ff ff 00 00 02 c0 0b 00 03 ea 02 06 05 55 00 00 00 01 01 03 01 78 04 73 04 e8 00 0f 00 00 01 22 26 26 35 34 36 36 33 32 16 16 15 14 06 06 02 bb 79 c8 77 77 c8 79 7a c7 77 77 c7 01 78 77 c8 79 7a c7 77 77 c7 7a 79 c8 77 00 02 01 03 01 78 04 73 04 e8 00 0f 00 1b 00 00 01 22 26 26 35 34 36 36 33 32 16 16 15 14 06 06 27 32 36 35 34 26 23 22 06 15 14 16 02 bb 79 c8 77 77 c8 79 7a c7 77 77 c7 7a 60 87 87 60 5f 87 87 01 78 77 c8 79 7a c7 77 77 c7 7a 79 c8 77 d2 87 5f 60 86 86 60 5f 87 00 01 01 38 02 9b 04 3e 03 c5 00 03 00 00 01 11 21 11 04 3e fc fa 03 c5 fe d6 01 2a 00 01 01 7d 01 70 04 61 04 f0 00 02 00 00 01 11 01 01 7d 02 e4 01 70 03 80 fe 40 Data Ascii: `!Uxs"&&546632ywwyzwwxwyzwwzywxs"&&546632'2654&#"ywwyzwwz``_xwyzwwzyw_``_8>!>*}pa}p@
2025-04-14 16:09:08 UTC	1024	IN	Data Raw: 05 7c 00 00 04 74 ff ff 00 ac fe 0c 02 9e 05 e9 00 06 05 82 05 00 00 02 00 ac 00 dc 03 86 05 a8 00 04 00 09 00 00 25 21 01 35 21 01 01 21 35 01 03 86 fe ba fe 6c 01 5a 01 80 fe 80 fe a6 01 94 dc 02 58 14 02 60 fd 94 14 02 58 00 02 00 9e 00 dc 03 78 05 a8 00 04 00 09 00 00 37 01 21 15 01 01 21 01 15 21 9e 01 80 01 5a fe 6c fe ba 01 46 01 94 fe a6 dc 02 6c 14 fd a8 04 cc fd a8 14 ff ff 00 ac 00 dc 05 e8 05 a8 00 26 05 8a 00 00 00 07 05 8a 02 62 00 00 ff ff 00 9e 00 dc 05 e0 05 a8 00 26 05 8b 00 00 00 07 05 8b 02 68 00 00 00 01 01 07 00 25 06 5f 06 35 00 09 00 00 01 11 01 11 01 37 15 27 01 11 01 07 05 58 fc 34 0b 0b 03 cc 02 9d 01 20 02 78 fe 9d fe 5f 13 2e 13 fe 5f fe 9d 00 01 01 07 00 25 06 5f 06 35 00 09 00 00 01 01 11 01 07 35 17 01 11 01 06 5f fa a8 03 Data Ascii: \|t%!5!!5lZX`Xx7!!!ZlFl&b&h%_57'X4 x_._%_55_
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 34 49 61 02 02 3b b6 f2 79 51 61 36 36 75 77 b5 f2 79 54 5d 3a 32 6d 7f 00 01 01 07 00 e5 06 5f 06 f5 00 09 00 00 01 11 01 11 01 37 15 27 01 11 01 07 05 58 fc 34 0b 0b 03 cc 03 5d 01 20 02 78 fe 9d fe 5f 13 2e 13 fe 5f fe 9d 00 01 01 07 00 e5 06 5f 06 f5 00 09 00 00 01 01 11 01 07 35 17 01 11 01 06 5f fa a8 03 cc 0b 0b fc 34 05 58 03 5d fd 88 01 63 01 a1 13 2e 13 01 a1 01 63 fd 88 ff ff 01 07 01 05 06 5f 06 fa 02 07 05 90 00 00 00 b2 ff ff 01 07 01 05 06 5f 06 fa 02 07 05 91 00 00 00 b2 00 02 01 1a 02 26 06 4d 05 da 00 03 00 07 00 00 01 11 21 11 01 11 21 11 01 1a 05 33 fa cd 05 33 04 a6 01 34 fe cc fd 80 01 34 fe cc ff ff 01 1a 01 13 06 4d 06 ed 02 07 05 93 00 00 00 d3 00 02 00 ff 01 48 06 67 06 b0 00 03 00 07 00 00 01 11 21 11 01 11 21 11 03 16 01 3a fc Data Ascii: 4Ia;yQa66uwyT]:2m_7'X4] x_.__5_4X]c.c__&M!!3344MHg!!:
2025-04-14 16:09:08 UTC	15990	IN	Data Raw: 15 14 0e 02 23 09 02 17 01 01 02 40 06 ba 6a ae 68 69 ad 6a 7a 7a bd 01 35 b8 6a bc f7 8d fb b6 fc 66 03 9a cd fd 32 02 ce 02 eb 01 2a 68 af 6a 6a ad 69 01 2a b8 fe cb bd 8d f8 bc 6a fc fb 03 9a 03 9a cd fd 33 fd 33 00 02 01 0e ff e6 0b 9c 08 40 00 16 00 1c 00 00 01 22 24 02 35 34 3e 02 33 33 11 23 22 06 06 15 14 16 16 33 21 11 01 27 01 01 37 01 03 b8 bc fe ca b8 6a bc f7 8d 7a 7a 69 ae 69 68 ae 6a 06 ba fd 90 cc 02 cd fd 33 cc 03 9a 02 eb b9 01 36 bc 8d f7 bc 6a fe d6 69 ad 6a 6a af 68 fe d6 fc fb ce 02 cc 02 ce cc fc 66 00 01 01 16 00 36 09 20 07 ca 00 08 00 00 25 01 01 17 01 21 11 21 01 04 e0 fc 36 03 ca ce fd 97 05 db fa 25 02 69 36 03 ca 03 ca cc fd 97 fe d6 fd 98 ff ff 01 16 00 36 0d 60 07 ca 02 07 06 a9 00 00 00 80 ff ff 01 16 00 36 1c 20 07 ca 02 Data Ascii: #@jhijzz5jf2hjjij33@"$54>33#"3!'7jzziihj36jijjhf6 %!!6%i66`6

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:07 UTC	573	OUT	GET /fonts/Inter/Inter-Bold.ttf HTTP/1.1 Host: static.cres-aws.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://static.cres-aws.com/postx.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 16:09:08 UTC	766	IN	HTTP/1.1 200 OK Content-Type: font/ttf Content-Length: 309772 Connection: close Date: Mon, 14 Apr 2025 16:09:09 GMT Last-Modified: Fri, 22 Sep 2023 08:10:20 GMT ETag: "d17c0274915408cee0308d5476df9f45" x-amz-server-side-encryption: AES256 x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 4b14054a85dbd772fa74b3629899476c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P9 X-Amz-Cf-Id: iLORo0OUxcDzBuUZUC68yMIL6oPV_2b9VciYdfmySZ32lSuzW-JMJg== X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2025-04-14 16:09:08 UTC	8192	IN	Data Raw: 00 01 00 00 00 10 01 00 00 04 00 00 47 44 45 46 31 cb 31 1c 00 03 46 04 00 00 04 12 47 50 4f 53 ab ef 32 2f 00 03 4a 18 00 01 2c fc 47 53 55 42 be 7f 66 78 00 04 77 14 00 00 42 b4 4f 53 2f 32 23 c3 6e 42 00 02 79 50 00 00 00 60 53 54 41 54 ef dd d9 47 00 04 b9 c8 00 00 00 44 63 6d 61 70 2f 2e e9 9d 00 02 79 b0 00 00 65 8a 67 61 73 70 00 00 00 10 00 03 45 fc 00 00 00 08 67 6c 79 66 05 f3 35 d8 00 00 01 0c 00 02 28 2b 68 65 61 64 2d c4 61 46 00 02 51 28 00 00 00 36 68 68 65 61 1e f5 19 bf 00 02 79 2c 00 00 00 24 68 6d 74 78 37 f0 22 d7 00 02 51 60 00 00 27 ca 6c 6f 63 61 09 88 86 18 00 02 29 58 00 00 27 d0 6d 61 78 70 0a 0c 01 06 00 02 29 38 00 00 00 20 6e 61 6d 65 30 30 54 df 00 02 df 44 00 00 02 18 70 6f 73 74 a7 a8 35 72 00 02 e1 5c 00 00 64 9e 70 72 65 Data Ascii: GDEF11FGPOS2/J,GSUBfxwBOS/2#nByP`STATGDcmap/.yegaspEglyf5(+head-aFQ(6hheay,$hmtx7"Q`'loca)X'maxp)8 name00TDpost5r\dpre
2025-04-14 16:09:08 UTC	8796	IN	Data Raw: 02 00 ff ff 00 b2 00 00 03 51 0a 8d 02 26 00 c5 00 00 00 07 06 64 fe dd 02 00 ff ff ff 58 00 00 03 c0 0a 7e 02 26 00 c5 00 00 00 07 06 6a fe 77 02 00 ff ff 00 6e 00 00 04 85 0a 51 00 27 00 c5 00 ee 00 00 00 07 06 6b ff ba 02 00 ff ff ff a5 00 00 03 73 0a 00 02 26 00 c5 00 00 00 07 06 6d fe 71 02 00 ff ff ff 9e 00 00 03 7b 0a 18 02 26 00 c5 00 00 00 07 06 6e fe e5 02 00 ff ff 00 42 fd c2 02 85 08 00 02 26 00 c5 00 00 00 06 06 76 ca 00 ff ff 00 a6 00 00 02 72 0a 75 02 26 00 c5 00 00 00 07 06 70 ff f2 02 00 ff ff ff 58 00 00 03 c0 0a 7e 02 26 00 c5 00 00 00 07 06 73 fe 77 02 00 ff ff fe d4 00 00 03 21 0a 8d 02 26 00 c5 00 00 00 07 06 7b 04 86 02 00 ff ff ff 9a 00 00 03 7a 0a 96 02 26 00 c5 00 00 00 07 06 7f 04 f2 02 c2 ff ff 00 b2 00 00 02 ff 0b 07 02 26 00 Data Ascii: Q&dX~&jwnQ'ks&mq{&nB&vru&pX~&sw!&{z&&
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 08 00 ff ff 00 43 00 00 07 f6 0a 51 02 26 01 c5 00 00 00 07 06 6b 01 5d 02 00 ff ff 00 43 fd c1 07 f6 08 00 02 26 01 c5 00 00 00 07 06 8b 07 23 00 00 00 01 00 35 00 00 0b 30 08 00 00 0f 00 00 21 01 21 01 33 01 21 01 33 01 21 01 21 01 23 01 02 7f fd b6 01 d9 01 53 11 01 76 01 95 01 75 12 01 53 01 d9 fd b6 fe 5a fe 7a 10 fe 7b 08 00 fa 71 05 8f fa 6e 05 92 f8 00 05 3b fa c5 ff ff 00 35 00 00 0b 30 0a 7e 02 26 01 c8 00 00 00 07 06 6a 02 9e 02 00 ff ff 00 35 00 00 0b 30 0a 8d 02 26 01 c8 00 00 00 07 06 66 02 61 02 00 ff ff 00 35 00 00 0b 30 0a 8d 02 26 01 c8 00 00 00 07 06 64 03 03 02 00 ff ff 00 35 00 00 0b 30 0a 69 02 26 01 c8 00 00 00 07 06 69 02 c2 00 24 ff ff 00 35 00 00 0b 30 0a 75 02 26 01 c8 00 00 00 07 06 70 04 18 02 00 ff ff 00 35 fd c7 0b 30 08 00 Data Ascii: CQ&k]C&#50!!3!3!!#SvuSZz{qn;50~&j50&fa50&d50i&i$50u&p50
2025-04-14 16:09:08 UTC	1024	IN	Data Raw: 07 07 f1 ff 52 ff e0 ff ff 00 6c ff e2 06 70 09 1c 02 26 03 07 00 00 00 07 07 f2 00 b7 ff d7 ff ff 00 6c ff e2 06 54 09 20 02 26 03 07 00 00 00 06 07 f3 28 d3 ff ff 00 6c fd c1 06 54 08 7e 02 26 03 07 00 00 00 26 06 6a 4b 00 00 07 06 8b 06 66 00 00 ff ff 00 6c ff e2 06 f4 08 8d 02 26 03 0b 00 00 00 07 06 64 00 b1 00 00 ff ff 00 6c ff e2 06 f4 08 8d 02 26 03 0b 00 00 00 06 06 66 0e 00 ff ff 00 6c ff e2 06 f4 09 07 02 26 03 0b 00 00 00 07 06 80 07 08 00 0a ff ff 00 6c ff e2 06 f4 08 51 02 26 03 0b 00 00 00 07 06 6b 00 a0 00 00 ff ff 00 6c fd c1 06 f4 06 5a 02 26 03 0b 00 00 00 07 06 8b 06 66 00 00 ff ff 00 6c ff 9e 06 54 08 8a 02 26 03 0a 00 00 00 07 06 64 00 b1 ff fe ff ff 00 6c ff e2 06 54 06 14 02 06 03 07 00 00 ff ff 00 6c ff e2 06 54 08 a4 02 26 03 07 Data Ascii: Rlp&lT &(lT~&&jKfl&dl&fl&lQ&klZ&flT&dlTlT&
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: af 7c ad 6e 1d 0d 09 4c 90 67 68 90 4b 4a 90 69 68 8f 4c 06 00 d8 bf 10 08 fe e4 05 0e 01 01 3b f7 83 08 40 fe fe 3e 81 57 af fe a1 fe f8 fe ff fe 9f b5 52 7d 40 fc ca 05 40 89 cc 71 73 cd 86 85 ca 72 6e ca ff ff 00 aa fd c0 06 84 08 8d 02 26 03 3b 00 00 00 07 06 64 01 12 00 00 ff ff 00 aa fd c0 06 84 08 75 02 26 03 3b 00 00 00 07 06 70 02 27 00 00 ff ff 00 aa fd c0 06 84 06 14 02 06 03 3b 00 00 00 02 00 71 fd c0 06 4a 06 14 00 16 00 26 00 00 01 11 23 0e 02 23 22 24 02 11 10 12 24 33 32 16 16 17 33 11 21 11 01 32 36 36 35 34 26 26 23 22 06 06 15 14 16 16 04 a1 0d 1e 6d ad 7c af fe e5 a5 aa 01 1b a9 81 ad 6b 1c 12 01 a4 fd 1d 67 8f 4d 4c 90 67 69 90 4a 4b 8f fd c0 03 36 40 7d 52 b5 01 61 01 01 01 08 01 5f af 57 81 3e 01 02 f7 c0 03 7a 71 cc 89 89 ca 6e 72 Data Ascii: \|nLghKJihL;@>WR}@@qsrn&;du&;p';qJ&##"$$323!26654&&#"m\|kgMLgiJK6@}Ra_W>zqnr
2025-04-14 16:09:08 UTC	11754	IN	Data Raw: 56 90 81 55 84 4a 03 78 fc 88 06 00 fe f1 87 9c 8c fe fe b4 f9 ee 05 c6 8d 9f 4a 8d ff ff 00 aa fd c0 06 32 08 a4 02 26 04 53 00 00 00 07 08 cd 01 c0 00 11 ff ff 00 aa fd c0 06 32 08 b0 02 26 04 53 00 00 00 07 09 88 02 5e 00 a8 ff ff 00 aa fd c0 06 32 08 b0 02 26 04 53 00 00 00 07 09 a1 01 9c 00 b0 ff ff 00 aa fd c0 06 32 08 b0 02 26 04 53 00 00 00 07 09 8d 00 b4 00 a8 ff ff 00 aa fd c0 06 32 08 ae 02 26 04 53 00 00 00 07 09 94 00 f1 00 ae ff ff 00 aa fd c0 06 32 08 b0 02 26 04 53 00 00 00 07 09 8f 01 1a 00 b0 ff ff 00 aa fd c0 06 32 08 ae 02 26 04 53 00 00 00 07 09 96 01 06 00 ae ff ff 00 aa fd c0 06 32 09 cd 02 26 04 53 00 00 00 07 09 91 01 81 00 a8 ff ff 00 aa fd c0 06 32 09 cd 02 26 04 53 00 00 00 07 09 98 01 34 00 a8 ff ff 00 aa fd c0 06 32 08 94 02 Data Ascii: VUJxJ2&S2&S^2&S2&S2&S2&S2&S2&S2&S42
2025-04-14 16:09:08 UTC	9000	IN	Data Raw: 4a 73 bb 6f 22 70 cc 82 75 c2 72 fa b5 00 02 00 a8 ff 54 09 2a 06 e0 00 03 00 2d 00 00 01 01 21 01 13 11 21 11 34 26 23 22 06 06 15 11 21 11 21 15 33 3e 02 33 32 16 17 33 3e 02 33 32 16 12 15 11 21 11 34 26 26 23 22 06 06 9e fc e4 fe d0 03 20 48 fe 63 83 63 3e 69 3e fe 56 01 a0 0e 28 76 9d 61 95 c1 31 10 27 83 af 68 84 db 81 fe 57 3b 64 3e 74 76 06 e0 f8 74 07 8c fc da fc 46 03 c8 81 74 35 70 59 fc 41 06 00 b2 37 5a 35 7a 65 3f 65 3b 72 fe fe d8 fc 38 03 c9 57 6c 31 86 00 02 00 c6 00 00 09 72 06 00 00 0d 00 1b 00 00 13 21 20 00 17 11 21 11 26 26 23 21 11 21 21 11 21 11 21 32 36 35 11 21 11 14 00 21 c6 04 31 01 1a 01 07 01 fe 60 01 4e 68 fd a4 fe 60 02 59 01 a0 02 5d 5f 57 01 a0 fe f8 fe e7 06 00 fe f1 f1 fe 01 01 ff 5b 56 fb 4f 03 ff fd 50 4f 62 03 ee fc Data Ascii: Jso"purT*-!!4&#"!!3>323>32!4&&#" Hcc>i>V(va1'hW;d>tvtFt5pYA7Z5ze?e;r8Wl1r! !&&#!!!!!265!!1`Nh`Y]_W[VOPOb
2025-04-14 16:09:08 UTC	8408	IN	Data Raw: c8 00 02 00 e5 02 04 05 82 04 54 00 03 00 07 00 00 01 15 21 35 05 11 21 11 05 82 fb 63 04 9d fe e5 04 54 ec ec 6c fe 1c 01 e4 00 01 ff fe fe bd 05 3f 00 00 00 03 00 00 21 11 21 11 05 3f fa bf fe bd 01 43 00 02 00 86 00 00 05 fe 08 00 00 03 00 07 00 00 01 11 21 11 01 11 21 11 04 08 fe 65 03 91 fa 88 08 00 f8 00 08 00 fe 00 fe a5 01 5b 00 03 00 6d fd c4 05 e6 07 d4 00 03 00 07 00 0b 00 00 01 11 21 11 01 11 21 11 01 11 21 11 03 f9 fe 5b 03 92 fa 87 05 79 fa 87 07 d4 f5 f0 0a 10 fd fc fe b1 01 4f fb 82 fe ae 01 52 00 02 00 5d 04 60 05 00 07 d3 00 03 00 0b 00 00 01 33 15 23 01 01 21 01 21 01 33 01 02 8a 48 48 fd d3 01 a5 01 58 01 a6 fe be fe e7 13 fe e9 07 22 6d fd ab 03 73 fc 8d 02 7d fd 83 00 01 00 e4 03 80 05 52 08 00 00 11 00 00 01 13 05 27 25 25 37 05 03 Data Ascii: T!5!cTl?!!?C!!e[m!!![yOR]`3#!!3HHX"ms}R'%%7
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: a0 00 02 00 aa ff 50 04 42 01 fb 00 03 00 07 00 00 37 35 21 15 01 35 21 15 aa 03 98 fc 68 03 98 ff fc fc fe 51 fc fc 00 02 00 50 ff e8 04 43 04 50 00 0b 00 17 00 00 05 22 00 11 10 00 33 32 00 11 10 00 27 32 36 35 34 26 23 22 06 15 14 16 02 4a ed fe f3 01 0e ec eb 01 0e fe f2 eb 64 78 78 64 65 7a 78 18 01 29 01 0f 01 0c 01 24 fe dc fe f4 fe f0 fe d8 e6 a5 ad a6 a4 a3 a7 ac a6 00 01 00 54 00 00 02 75 04 40 00 07 00 00 21 11 23 05 35 25 21 11 01 62 08 fe fa 01 1d 01 04 03 38 a4 f9 b3 fb c0 00 01 00 57 00 00 03 db 04 50 00 1a 00 00 33 35 01 36 36 35 34 26 23 22 06 15 21 34 36 33 32 16 15 14 06 06 07 07 15 21 15 6d 01 ba 47 5c 6a 4e 4f 63 fe f7 fd c5 c8 ef 42 89 6b 9d 01 de c8 01 57 38 5d 3b 40 43 4a 48 ab c5 ca 93 4f 86 80 44 6c 0a e4 00 01 00 52 ff f0 04 12 Data Ascii: PB75!5!hQPCP"32'2654&#"Jdxxdezx)$Tu@!#5%!b8WP356654&#"!4632!mG\jNOcBkW8];@CJHODlR
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 17 57 76 90 52 91 e1 80 80 e1 91 50 8d 75 56 17 01 a7 27 a0 e3 fe e7 a3 fe f4 fe 5c f2 f2 01 a4 01 0c 9e 01 18 e7 a3 f7 f1 fe 4f 04 a4 fe ae 01 52 da 38 56 7e 56 2a 8c fe d8 e8 e9 fe db 8a 28 52 7c 54 37 9b f5 ab 5a f9 01 d5 01 4c 01 4b 01 d8 fb 58 ac f9 01 e1 f8 00 08 00 ff ff 00 43 fd b6 08 a6 08 00 02 26 04 06 00 00 00 07 08 02 06 43 ff 9c 00 02 00 9e ff e4 06 c2 08 1c 00 1a 00 34 00 00 01 21 22 24 26 35 34 12 24 33 32 04 12 15 21 26 26 23 22 06 06 15 14 16 16 33 33 05 21 15 23 22 06 06 15 14 16 16 33 32 36 37 21 06 02 04 23 22 24 02 35 10 00 04 a7 fe c7 c8 fe c9 b1 be 01 58 e7 d8 01 50 c0 fe 4d 01 9f 96 6e 91 47 40 8b 6e fa fe c7 01 39 fa 76 98 4a 55 9a 66 b0 b1 01 01 b6 01 ce fe a0 dc ed fe 9a c6 01 7c 03 d4 80 e7 9b b7 01 04 8b 90 ff 00 a9 67 72 3c Data Ascii: WvRPuV'\OR8V~V*(R\|T7ZLKXC&C4!"$&54$32!&&#"33!#"3267!#"$5XPMnG@n9vJUf\|gr<

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:07 UTC	749	OUT	GET /websafe/images/loginbg.gif HTTP/1.1 Host: res.cisco.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=NXM8tOH5s7CMiOwYa9RSIJIYFYnryu8eybLZXoxs8CNetP9cZpogWflD5CdnbqhjVkbyEdBW6ClNARMzywTDXJmAKdj183rdvy7Uw+4PcpxkxFxqcc639WVpk6db
2025-04-14 16:09:08 UTC	971	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:09:08 GMT Content-Type: image/gif Content-Length: 51646 Connection: close Set-Cookie: AWSALB=D6zu9BfCQjcmMk/WMiEDxp4fgVshINKLO+089392nx3j4MHNaIxiYtHZ6Q02hEj7GD3qdPx2gxJvzfe7AvuPwXYQeqpMNCt6WxhhOqjecBoGCEvCjvcc6jR1+bP5; Expires=Mon, 21 Apr 2025 16:09:08 GMT; Path=/ Set-Cookie: AWSALBCORS=D6zu9BfCQjcmMk/WMiEDxp4fgVshINKLO+089392nx3j4MHNaIxiYtHZ6Q02hEj7GD3qdPx2gxJvzfe7AvuPwXYQeqpMNCt6WxhhOqjecBoGCEvCjvcc6jR1+bP5; Expires=Mon, 21 Apr 2025 16:09:08 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" X-Frame-Options: DENY Cache-Control: must-revalidate,max-age=1 Pragma: no-cache Set-Cookie: JSESSIONID=AD639A5E577671C5C4D0BAC026AA3590; Path=/websafe; Secure; HttpOnly Last-Modified: Wed, 05 Mar 2025 12:11:59 GMT ETag: "195663842b0-c9be" Server: unknown
2025-04-14 16:09:08 UTC	8459	IN	Data Raw: ff d8 ff e1 00 4a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 98 82 02 00 26 00 00 00 1a 00 00 00 00 00 00 00 73 61 6e 64 72 61 20 63 69 66 6f 2e 20 77 77 77 2e 63 69 66 6f 67 72 61 70 68 79 2e 63 6f 6d 2e 20 32 30 31 36 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 00 00 00 ff e1 04 13 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 Data Ascii: JExifII*&sandra cifo. www.cifography.com. 2016Duckyhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79
2025-04-14 16:09:08 UTC	16384	IN	Data Raw: 01 0e 16 47 a6 50 d8 27 b0 02 c8 c5 a0 ac c0 16 72 1c ba 10 b2 5e 40 34 0d 47 03 01 43 04 86 4a 7b 01 40 20 01 8a 46 00 20 18 01 31 92 89 97 3e 43 01 88 02 00 94 c7 28 4a a3 e0 80 25 11 39 2f 82 25 55 4c 01 52 82 50 70 42 e0 80 a6 10 27 91 e4 00 03 21 20 4b f2 2b 22 4f 23 80 09 1c 88 00 60 20 c8 04 48 40 48 48 0b 23 91 80 0b 52 62 3d 0a 8e 82 ca 00 84 d0 93 d8 3c d0 9d b7 02 86 00 02 6c 13 08 28 04 86 28 00 33 78 66 89 c9 36 4d 8a ac 0b 80 81 80 0b 21 23 10 00 68 c2 04 d0 14 04 a6 54 80 08 60 02 80 18 00 a4 60 20 07 e4 45 9c a2 f5 22 ce 00 a9 84 2d 75 23 52 b8 01 72 80 49 40 e0 05 12 09 40 e3 cc 20 02 46 2e 21 00 30 25 a1 a0 08 01 88 00 91 88 0a 43 12 18 00 00 00 99 05 b2 40 43 89 d4 45 20 18 00 00 04 0a ce 06 9c 80 c0 52 39 00 00 92 64 0a 14 8a 49 6c 06 Data Ascii: GP'r^@4GCJ{@ F 1>C(J%9/%ULRPpB'! K+"O#` H@HH#Rb=<l((3xf6M!#hT`` E"-u#RrI@@ F.!0%C@CE R9dIl
2025-04-14 16:09:08 UTC	1616	IN	Data Raw: 90 61 58 fc 88 eb 30 e4 b9 a4 9b f3 37 28 68 cf d0 d1 12 dd 7a b0 22 76 2e a8 c5 77 93 b4 25 8e a6 c9 cc 90 51 87 79 4f d4 bf b4 dc 9f a7 39 28 cb b9 5e 55 f3 17 6e ad 34 b6 2a aa 26 0a ed d9 b6 11 a5 84 3b 08 29 14 9c 12 34 41 4f 0b 04 e5 e8 90 4e c1 5c a0 1f d5 d0 26 dd 09 e3 d5 b1 42 ea 03 72 f6 13 af 92 08 5d 45 1e 60 69 59 d0 a6 8c 92 5d 58 71 5a cb 28 ab 55 35 0f 70 a5 6d 55 1a a2 78 4e 8d 8b f1 cf dc d9 05 5b b5 57 d0 55 a4 35 d1 15 15 dc 2b 58 d1 81 a0 98 d0 32 88 67 9f de fb 99 e8 34 73 3e cd 6c e6 48 30 b7 fb 17 b1 b7 fa 8b 0d cf 90 bf eb d7 a9 5d 9e d7 16 d3 ca 7a 01 b7 35 2a ae 18 ad 4a 3d e1 9c 77 4f 9c 3d 8e 8e 2a d6 86 01 dc 5c 17 d5 94 f7 37 a3 c2 33 b7 69 5f 7c 9b 29 9d 70 51 40 00 00 4b 28 96 04 5b 46 73 6c 74 db 46 73 d6 bc b0 88 3a 69 Data Ascii: aX07(hz"v.w%QyO9(^Un4&;)4AON\&Br]E`iY]XqZ(U5pmUxN[WU5+X2g4s>lH0]z5J=wO=*\73i_\|)pQ@K([FsltFs:i
2025-04-14 16:09:08 UTC	9000	IN	Data Raw: f2 01 48 60 c6 d6 bd 37 27 f3 37 ac 01 b3 d4 9e 52 cc ab 6e 5a 9b 2a ad d0 0e ae 59 d3 db d4 e7 4a a8 df b5 69 61 17 74 71 d2 ce 62 4e db 9c 54 fb 98 56 bc 98 f9 04 02 41 0f 90 73 14 09 a0 38 21 b0 86 77 f6 ad 54 da ae 3c ca 7d d4 ba b2 ab 83 8b 6a 4e da e9 1e 41 f4 5d c3 5f 11 b7 5c c6 80 70 e7 a2 1a e5 5d 0d 9f 65 ce 16 0d 2b d8 ea 80 8a ff 00 b0 eb ae 4e 8a f7 d5 b5 33 fc 75 ae b0 1c e9 5d c8 8e 95 0f 46 37 9d 72 70 be ea 5a 17 4f f6 36 60 6f c1 2c a7 ec 29 fd 2b cc 1c eb b9 93 ab 6e 59 5a 91 2a 9c 9c e7 db 05 70 aa cb 26 d2 be d4 62 eb 67 a8 69 ad bb 89 a8 5a 7a 93 5a f2 71 fa 93 c1 f4 3a 3b 5d be 2a 5e ac 83 58 8c 04 72 f4 17 2a a7 1b 99 df b8 9d 67 39 fd 45 f8 87 7e ea aa 9a ef a1 85 bb 9b 67 de 3b 70 e4 ab 2f e9 c1 0f 83 7f 71 56 60 e7 3d 7e 07 45 Data Ascii: H`7'7RnZYJiatqbNTVAs8!wT<}jNA]_\p]e+N3u]F7rpZO6`o,)+nYZp&bgiZzZq:;]^Xrg9E~g;p/qV`=~E
2025-04-14 16:09:08 UTC	16187	IN	Data Raw: c6 2d 04 03 32 ee 5a 32 5d ec aa b2 71 da ce ce 59 54 36 ec 35 66 88 45 20 36 4c de a7 3d 4e 9a e9 82 0d 96 80 4d ae a8 a6 c4 7e 6a ae a5 1a c0 ab ae 4a 90 c0 43 81 40 c1 39 d3 20 15 97 ec 2f 8f 99 09 b4 5a b0 52 6a 37 27 89 69 6e 34 04 f1 6f 71 f1 7d 4a 18 11 0c 72 ca 10 0a 7c 85 cb c9 94 00 4f 21 c8 c0 05 23 00 80 09 26 41 c1 36 f2 00 4e 59 72 42 a8 43 5a 01 72 27 64 43 ab 29 24 02 96 c6 aa 8a 80 80 18 0a 03 8a 01 81 3c 50 f8 a0 18 0a 10 68 00 4a d4 a8 22 32 05 68 38 08 12 01 f1 42 e2 54 04 00 a1 86 42 06 04 cb e8 3e 48 60 02 94 31 71 42 e0 80 a1 0b 88 43 40 25 82 c8 72 09 b0 2c 09 9e a1 c8 0a 01 48 48 0c 09 90 90 28 09 e4 c2 58 14 04 cb 1c b0 1b 44 c8 e5 89 c8 14 04 4b 45 4b 02 80 9c 86 40 a0 24 60 04 5c b8 22 c0 43 d0 8f f5 f4 65 b7 82 3f d7 78 64 1b Data Ascii: -2Z2]qYT65fE 6L=NM~jJC@9 /ZRj7'in4oq}Jr\|O!#&A6NYrBCZr'dC)$<PhJ"2h8BTB>H`1qBC@%r,HH(XDKEK@$`\"Ce?xd

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:08 UTC	1242	OUT	GET /keyserver/keyserver?su=jsmith%40contoso.com&df=&tf=&lp=en&v=2&m=%7c1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost&s=1&f=0&d=1744646946715&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqr&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36 HTTP/1.1 Host: res.cisco.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=7dWSXCfERGsUOtN441ttyunRy4jKOddWjLKS1RKY2oGOrkaWJbS5Qn8D09382Tv3CxBt7c377Xwq56THS86BJH+t7x1L70d6L2I7eGu/SU+Xh4mrlomHB5S2rGFP
2025-04-14 16:09:08 UTC	941	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:09:08 GMT Content-Type: text/javascript;charset=ISO-8859-1 Content-Length: 159 Connection: close Set-Cookie: AWSALB=8irg8o+mNv+zRUFJDb2UpRsqAftBMynzHNNB42zLmjb3Ox4WKcWkY/nGtFH+0EirTAoihYSZx36974XXFUnqRwPsCAgq8+zB9ju87acNIv+MLgBIGDBzDQBfmNZl; Expires=Mon, 21 Apr 2025 16:09:08 GMT; Path=/ Set-Cookie: AWSALBCORS=8irg8o+mNv+zRUFJDb2UpRsqAftBMynzHNNB42zLmjb3Ox4WKcWkY/nGtFH+0EirTAoihYSZx36974XXFUnqRwPsCAgq8+zB9ju87acNIv+MLgBIGDBzDQBfmNZl; Expires=Mon, 21 Apr 2025 16:09:08 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" Set-Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; path=/; SameSite=None; Secure; HttpOnly Set-Cookie: JSESSIONID=5D93DFCA1FD162D0E0B7B2AE90C4A1AB; Path=/keyserver; Secure; HttpOnly Server: unknown
2025-04-14 16:09:08 UTC	159	IN	Data Raw: 69 66 28 6c 5f 29 0d 0a 6c 5f 28 7b 0d 0a 22 52 50 43 52 65 66 22 3a 70 61 79 6c 6f 61 64 2e 72 70 63 2c 0a 22 63 61 6c 6c 62 61 63 6b 22 3a 71 72 0d 0a 2c 27 73 74 61 74 75 73 27 3a 32 31 0d 0a 2c 27 6d 65 73 73 61 67 65 27 3a 27 43 61 6e 6e 6f 74 20 69 64 65 6e 74 69 66 79 20 72 65 63 69 70 69 65 6e 74 2e 27 0d 0a 2c 27 61 63 74 69 6f 6e 27 3a 27 6f 70 65 6e 27 0d 0a 2c 27 73 75 63 63 65 73 73 27 3a 66 61 6c 73 65 0d 0a 2c 27 73 74 61 74 65 27 3a 31 0d 0a 7d 29 3b 0d 0a Data Ascii: if(l_)l_({"RPCRef":payload.rpc,"callback":qr,'status':21,'message':'Cannot identify recipient.','action':'open','success':false,'state':1});

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:21 UTC	1289	OUT	GET /keyserver/keyserver?su=jsmith%40contoso.com&df=&tf=&lp=en&v=2&m=%7c1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost&s=8&f=0&d=1744646959820&action=open&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqq&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36 HTTP/1.1 Host: res.cisco.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=9fwheTHwZka7iyxyXXF/HBtjRyKmq25Ee9mRtnYbY5WYolTosQN5pCqq7fujjEKQYdwR8lABTpTKr7XplOoVvTt6p2V5PMviAuy8vHvcKLrqi0/fyX8VXh4psBKu
2025-04-14 16:09:21 UTC	899	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:09:21 GMT Content-Type: text/javascript;charset=ISO-8859-1 Content-Length: 794 Connection: close Set-Cookie: AWSALB=HXQuLXdAsBaQ18pYY+aSpFdW21cadp3FAR5gk7cdmyrmSosHt9m/7FY1w1XD8f9LA57AmIfeiUomyr7/9r83e4i1owiB4XZwq5126ayHuEd4OnSPDH2zOfLWyLSA; Expires=Mon, 21 Apr 2025 16:09:21 GMT; Path=/ Set-Cookie: AWSALBCORS=HXQuLXdAsBaQ18pYY+aSpFdW21cadp3FAR5gk7cdmyrmSosHt9m/7FY1w1XD8f9LA57AmIfeiUomyr7/9r83e4i1owiB4XZwq5126ayHuEd4OnSPDH2zOfLWyLSA; Expires=Mon, 21 Apr 2025 16:09:21 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" Set-Cookie: JSESSIONID=B7C8D88A8969DA5C4DFF75AEEE6A7EC0; path=/keyserver; SameSite=None; Secure; HttpOnly Cache-Control: no-cache Pragma: no-cache Server: unknown
2025-04-14 16:09:21 UTC	794	IN	Data Raw: 69 66 28 6c 5f 29 0d 0a 6c 5f 28 7b 0d 0a 22 52 50 43 52 65 66 22 3a 70 61 79 6c 6f 61 64 2e 72 70 63 2c 0a 22 63 61 6c 6c 62 61 63 6b 22 3a 71 71 0d 0a 2c 27 61 63 74 69 6f 6e 27 3a 27 6f 70 65 6e 27 0d 0a 2c 27 73 74 61 74 75 73 27 3a 31 36 0d 0a 2c 27 6d 65 73 73 61 67 65 27 3a 27 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 2e 27 0d 0a 2c 27 73 74 61 74 65 27 3a 38 0d 0a 2c 27 72 65 71 54 69 6d 65 27 3a 31 37 34 34 36 34 36 39 35 39 38 32 30 0d 0a 2c 27 72 65 71 4e 75 6d 62 65 72 27 3a 31 0d 0a 2c 27 72 65 63 69 70 69 65 6e 74 49 64 65 6e 74 69 66 69 65 64 27 3a 66 61 6c 73 65 0d 0a 2c 27 73 75 63 63 65 73 73 27 3a 74 72 75 65 0d 0a 2c 27 63 6f 6f 6b 69 65 73 45 6e 61 62 6c 65 64 27 3a 74 72 75 65 0d 0a 2c 27 68 61 64 52 65 6d Data Ascii: if(l_)l_({"RPCRef":payload.rpc,"callback":qq,'action':'open','status':16,'message':'Authentication required.','state':8,'reqTime':1744646959820,'reqNumber':1,'recipientIdentified':false,'success':true,'cookiesEnabled':true,'hadRem

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:21 UTC	1039	OUT	POST /websafe/custom.action?cmd=authFrame HTTP/1.1 Host: res.cisco.com Connection: keep-alive Content-Length: 953 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: null Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=HXQuLXdAsBaQ18pYY+aSpFdW21cadp3FAR5gk7cdmyrmSosHt9m/7FY1w1XD8f9LA57AmIfeiUomyr7/9r83e4i1owiB4XZwq5126ayHuEd4OnSPDH2zOfLWyLSA
2025-04-14 16:09:21 UTC	953	OUT	Data Raw: 65 72 3d 25 32 34 52 65 76 69 73 69 6f 6e 25 33 41 2b 31 2e 32 37 36 2b 25 32 34 26 73 75 3d 6a 73 6d 69 74 68 25 34 30 63 6f 6e 74 6f 73 6f 2e 63 6f 6d 26 68 65 69 67 68 74 3d 32 33 33 26 77 69 64 74 68 3d 30 26 68 63 5f 68 65 69 67 68 74 3d 32 31 30 26 63 74 5f 77 69 64 74 68 3d 30 26 76 3d 32 26 6b 73 3d 25 35 45 26 6b 73 6b 68 3d 53 48 41 31 26 6b 63 69 3d 30 26 6d 3d 25 37 43 31 5f 5f 63 36 32 38 37 61 38 64 30 30 30 30 30 31 39 36 33 34 66 32 39 65 30 66 66 66 63 34 31 65 66 66 39 64 31 62 33 37 61 39 25 34 30 6c 6f 63 61 6c 68 6f 73 74 26 66 72 3d 43 49 50 2b 56 65 72 69 66 69 63 61 74 69 6f 6e 2b 45 6c 61 6e 66 73 2b 53 68 61 72 65 64 2b 25 33 43 63 69 70 76 65 72 69 66 69 63 61 74 69 6f 6e 25 34 30 65 6c 61 6e 66 73 2e 63 6f 6d 25 33 45 26 73 75 Data Ascii: er=%24Revision%3A+1.276+%24&su=jsmith%40contoso.com&height=233&width=0&hc_height=210&ct_width=0&v=2&ks=%5E&kskh=SHA1&kci=0&m=%7C1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost&fr=CIP+Verification+Elanfs+Shared+%3Ccipverification%40elanfs.com%3E&su
2025-04-14 16:09:22 UTC	1197	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:09:22 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 62589 Connection: close Set-Cookie: AWSALB=vpNBqMceYJQflkC9VuYs5PkLxyD8rF0iDjG2MbxZq6M8e6jRK/53TxraVn66V6ZqZ6PR5UZkRLjg6ArchTZhYF161dqPyCZGWyLj5CecV81RktKq4tPBNmkXvt94; Expires=Mon, 21 Apr 2025 16:09:22 GMT; Path=/ Set-Cookie: AWSALBCORS=vpNBqMceYJQflkC9VuYs5PkLxyD8rF0iDjG2MbxZq6M8e6jRK/53TxraVn66V6ZqZ6PR5UZkRLjg6ArchTZhYF161dqPyCZGWyLj5CecV81RktKq4tPBNmkXvt94; Expires=Mon, 21 Apr 2025 16:09:22 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" Cache-Control: no-cache, no-store, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: JSESSIONID=FD02956CDD86B70773DF69AB9C5E797E; Path=/websafe; Secure; HttpOnly Set-Cookie: WebSafe.current-locale=en; Version=1; Expires=Sat, 02 May 2093 19:23:29 GMT; Secure; HttpOnly Set-Cookie: WebSafe.current-locale-changed=true; Version=1; Expires=Sat, 02 May 2093 19:23:29 GMT; Secure; HttpOnly Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Language: en Server: unknown
2025-04-14 16:09:22 UTC	8233	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0a 20 20 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 46 72 61 6d 65 3c 2f 74 69 74 6c 65 3e 0d 0a 0a 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 20 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en"> <head> <title>Authentication Frame</title> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
2025-04-14 16:09:22 UTC	16384	IN	Data Raw: 74 68 69 73 0a 20 2e 65 6e 63 6f 64 65 54 6f 41 72 72 61 79 3d 66 75 6e 63 74 69 6f 6e 28 63 56 2c 63 53 29 7b 76 61 72 20 63 54 3d 63 56 2e 6c 65 6e 67 74 68 2c 63 55 3d 74 68 69 73 2e 67 65 74 45 6e 63 6f 64 65 41 72 72 61 79 28 29 2c 5f 2c 0a 62 2c 63 57 2c 69 3b 5f 3d 4d 61 74 68 2e 63 65 69 6c 28 63 54 2f 33 29 2a 34 3b 62 3d 4d 61 74 68 2e 63 65 69 6c 28 63 54 2f 33 2a 34 29 3b 63 57 3d 5f 2d 62 3b 69 66 28 21 63 53 29 63 53 3d 6e 65 77 20 41 72 72 61 79 28 5f 29 0a 3b 5f 3d 62 3d 30 3b 77 68 69 6c 65 28 5f 3c 63 54 29 7b 69 3d 63 56 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 2b 2b 29 3c 3c 31 36 3b 69 66 28 5f 3c 63 54 29 69 7c 3d 63 56 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 2b 2b 29 3c 3c 38 0a 3b 69 66 28 5f 3c 63 54 29 69 7c 3d 63 56 2e 63 68 61 72 Data Ascii: this .encodeToArray=function(cV,cS){var cT=cV.length,cU=this.getEncodeArray(),_,b,cW,i;_=Math.ceil(cT/3)4;b=Math.ceil(cT/34);cW=_-b;if(!cS)cS=new Array(_);_=b=0;while(_<cT){i=cV.charCodeAt(_++)<<16;if(_<cT)i\|=cV.charCodeAt(_++)<<8;if(_<cT)i\|=cV.char
2025-04-14 16:09:22 UTC	1616	IN	Data Raw: 6c 65 6d 65 6e 74 42 79 49 64 28 66 69 29 2c 65 4f 3d 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 4a 29 3b 69 66 28 0a 65 30 26 26 65 4f 29 65 4f 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 30 2c 65 4f 29 7d 66 75 6e 63 74 69 6f 6e 20 66 70 28 65 50 2c 65 4a 29 7b 76 61 72 20 63 3b 69 66 28 63 3d 0a 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 50 29 29 7b 65 77 28 63 2e 63 65 6c 6c 73 5b 30 5d 2c 27 27 29 3b 65 77 28 63 2e 63 65 6c 6c 73 5b 31 5d 2c 27 27 29 3b 69 66 28 65 4a 29 69 6e 73 65 72 74 52 6f 77 28 65 50 2c 0a 65 4a 29 3b 65 6c 73 65 7b 65 56 5b 65 50 5d 3d 63 3b 69 66 28 63 2e 70 61 72 65 6e 74 4e 6f 64 65 29 63 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 63 29 7d 7d 7d 66 75 Data Ascii: lementById(fi),eO=getElementById(eJ);if(e0&&eO)eO.parentNode.insertBefore(e0,eO)}function fp(eP,eJ){var c;if(c=getElementById(eP)){ew(c.cells[0],'');ew(c.cells[1],'');if(eJ)insertRow(eP,eJ);else{eV[eP]=c;if(c.parentNode)c.parentNode.removeChild(c)}}}fu
2025-04-14 16:09:22 UTC	16384	IN	Data Raw: 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 0a 70 61 74 68 6e 61 6d 65 29 63 3d 61 5f 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 3b 6c 6f 63 61 74 69 6f 6e 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 0a 3b 69 66 28 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 29 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 66 61 6c 73 65 29 3b 65 6c 73 65 20 69 66 28 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 29 6c 6f 63 61 74 69 6f 6e 0a 20 2e 72 65 70 6c 61 63 65 28 63 29 3b 65 6c 73 65 20 69 66 28 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 63 7d 64 69 73 70 6c 61 79 45 72 72 6f 72 3d 66 61 3b 0a 64 69 73 70 6c 61 79 4d 65 73 73 61 67 65 3d 65 74 Data Ascii: indow.location.pathname)c=a_(window.location.pathname);else return;location=window.location;if(location.reload)location.reload(false);else if(location.replace)location .replace(c);else if(location.href)location.href=c}displayError=fa;displayMessage=et
2025-04-14 16:09:22 UTC	16384	IN	Data Raw: 6d 73 6f 66 73 65 72 76 69 63 65 2e 6e 61 6d 65 27 3a 27 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 27 2c 27 64 6f 77 6e 6c 6f 61 64 4d 6f 62 69 6c 65 41 70 70 42 6f 6c 64 54 65 78 74 27 3a 27 55 73 65 20 6f 6e 20 6d 6f 62 69 6c 65 3a 27 2c 27 52 50 43 47 6f 6f 67 6c 65 57 72 6f 6e 67 55 73 65 72 53 65 6c 65 63 74 65 64 27 3a 27 54 68 65 20 72 65 63 69 70 69 65 6e 74 20 74 68 61 74 20 79 6f 75 20 73 65 6c 65 63 74 65 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 2e 20 53 65 6c 65 63 74 20 79 6f 75 72 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 20 6f 6e 20 74 68 65 20 52 65 67 69 73 74 65 72 65 64 20 45 6e 76 65 6c 6f 70 65 2e 27 2c 27 72 65 66 65 72 65 6e 63 65 2e 70 72 69 76 61 63 79 70 6f 6c 69 63 79 2e 74 6f 6f 6c 74 69 70 27 3a 27 56 69 65 77 20 74 68 Data Ascii: msofservice.name':'Terms of Service','downloadMobileAppBoldText':'Use on mobile:','RPCGoogleWrongUserSelected':'The recipient that you selected is incorrect. Select your email address on the Registered Envelope.','reference.privacypolicy.tooltip':'View th
2025-04-14 16:09:22 UTC	3588	IN	Data Raw: 6e 6b 3e 4a 61 76 61 26 61 6d 70 3b 74 72 61 64 65 3b 3c 2f 61 3e 2e 22 20 6e 61 6d 65 3d 22 69 6e 73 74 61 6c 6c 4a 61 76 61 22 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 3e 3c 69 6e 70 75 74 20 76 61 6c 75 65 3d 22 31 22 20 6e 61 6d 65 3d 22 70 61 73 73 77 6f 72 64 52 65 71 75 69 72 65 64 22 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 3e 3c 69 6e 70 75 74 20 76 61 6c 75 65 3d 22 43 6f 6e 74 61 63 74 69 6e 67 20 73 65 72 76 65 72 2e 20 50 6c 65 61 73 65 20 77 61 69 74 2e 22 20 6e 61 6d 65 3d 22 72 70 63 57 61 69 74 69 6e 67 4d 65 73 73 61 67 65 22 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 3e 3c 69 6e 70 75 74 20 76 61 6c 75 65 3d 22 22 20 6e 61 6d 65 3d 22 73 61 76 65 42 75 74 74 6f 6e 4c 61 62 65 6c 49 44 22 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 3e 3c Data Ascii: nk>Java&trade;</a>." name="installJava" type="hidden"><input value="1" name="passwordRequired" type="hidden"><input value="Contacting server. Please wait." name="rpcWaitingMessage" type="hidden"><input value="" name="saveButtonLabelID" type="hidden"><

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:23 UTC	876	OUT	GET /websafe/images/skins/googleSignIn.png HTTP/1.1 Host: res.cisco.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://res.cisco.com/websafe/custom.action?cmd=authFrame Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=vpNBqMceYJQflkC9VuYs5PkLxyD8rF0iDjG2MbxZq6M8e6jRK/53TxraVn66V6ZqZ6PR5UZkRLjg6ArchTZhYF161dqPyCZGWyLj5CecV81RktKq4tPBNmkXvt94
2025-04-14 16:09:23 UTC	971	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:09:23 GMT Content-Type: image/png Content-Length: 62336 Connection: close Set-Cookie: AWSALB=khctCwmxvMegebYwBYLCFEHS1ElpbgKjDkKWeoukOyscb4trCEy7X60hikbyl5AvjQWtWVatAQO5d6CfUPB00y8cwcVfeysS3UP5GqzLQe6YDyUJVMLGeDkiomg7; Expires=Mon, 21 Apr 2025 16:09:23 GMT; Path=/ Set-Cookie: AWSALBCORS=khctCwmxvMegebYwBYLCFEHS1ElpbgKjDkKWeoukOyscb4trCEy7X60hikbyl5AvjQWtWVatAQO5d6CfUPB00y8cwcVfeysS3UP5GqzLQe6YDyUJVMLGeDkiomg7; Expires=Mon, 21 Apr 2025 16:09:23 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" X-Frame-Options: DENY Cache-Control: must-revalidate,max-age=1 Pragma: no-cache Set-Cookie: JSESSIONID=BA88B6A1D46D67CA0F6030E888A6177D; Path=/websafe; Secure; HttpOnly Last-Modified: Wed, 05 Mar 2025 12:12:00 GMT ETag: "19566384698-f380" Server: unknown
2025-04-14 16:09:23 UTC	15413	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 9a 00 00 01 9a 08 06 00 00 00 36 06 85 63 00 00 0c 15 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 52 08 09 2d 10 01 29 a1 f7 2e 5d 20 10 aa 20 20 1d 6c 84 24 40 28 11 12 82 8a 1d 5d 54 70 ed 22 82 a2 a2 2b 22 b6 b5 00 b2 a8 88 5d 59 04 7b 7f 28 a2 b2 b2 2e 16 6c a8 bc 49 01 5d 5f fb de f9 be b9 f3 e7 cc 39 67 fe 33 f7 dc c9 0c 00 aa 8e 9c bc bc 1c 54 0d 80 5c 61 81 28 26 24 80 99 94 9c c2 24 f5 00 14 10 01 05 a8 01 94 c3 15 e7 f9 47 47 47 00 28 23 fd df e5 dd 4d 80 48 fb 6b 76 d2 58 ff 3a fe 5f 45 9d c7 17 73 01 40 a2 21 4e e3 89 b9 b9 10 1f 01 00 d7 e6 e6 89 0a 00 20 b4 43 bd c9 cc 82 3c 29 1e 80 58 53 04 09 02 40 c4 a5 38 43 8e b5 a5 38 4d 8e 6d 65 36 71 31 Data Ascii: PNGIHDR6ciCCPICC ProfileHWXS[R-).] l$@(]Tp"+"]Y{(.lI]_9g3T\a(&$$GGG(#MHkvX:_Es@!N C<)XS@8C8Mme6q1
2025-04-14 16:09:23 UTC	16384	IN	Data Raw: b8 87 e3 b4 5b 82 33 9e 20 24 71 79 e8 2e e8 11 37 c3 ef 54 2e 0e 3b 50 20 63 24 45 2c c4 d7 f4 18 41 2f 26 31 13 96 c9 0e 11 32 c3 38 2a f5 70 42 21 cc f4 63 a8 e0 b8 40 9f f4 f5 41 cd 06 75 1b 00 27 04 f8 14 5e 7a 51 f2 3b b6 89 07 29 c8 c7 2a b1 94 8c f8 69 6a e4 00 9a 8d a4 5d f2 aa 59 b4 53 aa 11 a8 41 b3 22 16 29 cb 5c 08 eb 32 b8 95 a1 ab ff 88 20 c3 36 af 74 66 b9 ab cc ab e7 7c 8e 80 6f 61 6a 29 30 03 80 86 ad f3 b0 26 cd 4b f8 95 b9 c1 b8 8c 40 d5 d0 75 db 0f 64 f0 fe fb 24 18 e8 51 0a 52 91 92 3e 47 93 66 1d fc e5 62 47 7a d7 2a 9a 92 a1 46 36 69 09 a7 fb 34 5b c3 99 65 88 f1 0f 96 b7 07 35 57 00 e9 44 20 b5 34 ac 5e 03 57 22 e7 40 82 39 49 82 f6 76 09 9a 9a 20 d5 40 f5 85 81 7d 96 b9 03 17 d7 af d5 72 27 33 67 e2 78 91 aa 99 70 a0 40 c3 17 23 Data Ascii: [3 $qy.7T.;P c$E,A/&128pB!c@Au'^zQ;)ij]YSA")\2 6tf\|oaj)0&K@ud$QR>GfbGz*F6i4[e5WD 4^W"@9Iv @}r'3gxp@#
2025-04-14 16:09:23 UTC	430	IN	Data Raw: d3 77 a0 91 4b 80 05 eb a2 99 27 9f 03 11 06 d9 f7 fe 01 f9 9d 0f 50 50 7a a0 e9 4b 05 86 51 ae 0b 85 18 a2 33 6e 40 62 e1 57 10 a9 98 11 00 4d 5f 9e e0 af 19 6d 0a 78 a0 19 ed 1a f0 ef 1f 09 0a 14 f2 1c a3 a1 49 3f 92 eb c0 7f fb ec 04 9c 3b 27 4e a0 09 c6 66 06 a0 d4 f4 09 68 0c bf f8 25 af 33 4b f4 48 40 6e 3f 32 3b be 87 fc b6 9f d2 98 26 4d 87 e7 f9 37 50 d5 ca 1e 30 86 bf 44 3a a7 cf 48 a3 89 22 3a e5 0a 4e da fc 1a 50 bd 90 34 93 e9 2c 24 ee 18 26 c2 18 28 9a 07 9a 31 50 89 be 08 a7 a4 40 91 91 01 b4 4c 40 8c cb 04 fc f9 e7 26 63 f9 ac 28 81 26 6a 4e 61 a6 d5 f4 53 5c f5 09 68 42 11 69 40 42 43 59 b1 48 a0 61 68 82 ec ae 1f 21 bb f9 9f 69 f8 a1 86 c3 e4 81 e6 94 f5 67 70 52 10 62 37 9d cd 30 34 5f b3 78 67 91 48 65 bf bd 38 4e fd 26 7f c5 70 50 c0 Data Ascii: wK'PPzKQ3n@bWM_mxI?;'Nfh%3KH@n?2;&M7P0D:H":NP4,$&(1P@L@&c(&jNaS\hBi@BCYHah!igpRb704_xgHe8N&pP
2025-04-14 16:09:24 UTC	16384	IN	Data Raw: c7 3d d0 94 60 a5 f8 2c 0d 39 05 64 3a 8b 27 68 e2 4f 09 68 e6 62 ce 84 a2 d3 68 28 c7 06 22 e7 fb 66 3a a3 80 ec 8e 0a c0 17 15 38 61 33 c2 e5 9c 0b 07 1e 75 40 43 3b 9e 07 9a 53 d4 b5 9b f1 6a 51 14 d8 59 40 91 73 69 92 67 fc 1a a2 d3 3e 49 15 95 93 36 2d 82 f3 29 9e e1 4f 8f 3a 05 3c d0 8c 7a 15 f8 0c 0c 33 05 cc 62 c5 71 f8 04 dd cc aa 8b 2d f8 ab af cc c2 ac 46 86 a4 91 e9 6c 44 80 86 43 33 45 86 21 d0 64 9e 68 31 85 e2 c1 a7 69 3a fb 6b 44 d2 07 58 74 af d1 9c b2 fe 55 49 ec 29 c8 fc 58 88 72 02 d4 dc 5b e9 e6 fc 59 44 92 d3 ec d8 40 7a 0a a7 7c a7 bf 60 48 29 e0 81 66 48 c9 e9 1f 56 82 14 30 a0 e1 38 7c 8c 9d e3 29 d5 69 fc d9 e7 a6 62 5a bd 80 86 71 61 6c d2 66 ff 23 99 f4 4d a3 21 31 cc e0 63 9a 8d 33 fd 44 0a 5d 28 36 bf 80 ec 86 6f a0 d8 fe 3e Data Ascii: =`,9d:'hOhbh("f:8a3u@C;SjQY@sig>I6-)O:<z3bq-FlDC3E!dh1i:kDXtUI)Xr[YD@z\|`H)fHV08\|)ibZqalf#M!1c3D](6o>
2025-04-14 16:09:24 UTC	13725	IN	Data Raw: e2 ec 69 8b 71 e6 84 05 a8 af a8 41 25 57 fd 94 69 4d 9a 90 55 a4 f5 c0 75 9f ab 7f 83 38 fd e4 49 89 5a 35 44 93 59 bd 32 d2 3b 5f 3a dc 93 b7 50 68 ba 8b 9d 60 e5 fd e1 bd da 06 37 33 9b 27 4e ca 4b 78 a1 ae 0b 07 23 82 3b c2 7b 8f 7d 84 1e ee 34 38 3d 41 1a 86 fd f1 b0 3d 86 5f a6 a1 88 cf 79 8c af b1 e3 7a ac 62 8f e5 f9 27 73 97 80 23 c5 89 cd 5a 1a 5d 83 fa 1b f7 6e c1 6b 07 df 65 54 e5 1d a6 85 c4 92 5c 95 31 cc 1f ef 3d b9 36 a1 3c 1d 3f a7 7a af 3b 73 fc 6b 5c 0d f4 5c 61 19 d6 3d 5c 69 33 92 99 45 ed 66 35 62 5d 4b 11 97 d3 00 8f c9 89 c0 40 89 e5 93 f0 94 16 24 0b 85 74 b1 d0 eb 4a 6f 2c 76 77 3a 94 83 b1 9b 44 55 a3 6c 5e 13 63 b5 9f c1 62 3a 00 7c e1 8a 46 2c 9b 95 44 82 9d 33 b7 1e 14 4f 9a ec 0b 69 61 77 85 3f 46 7d 5b 3e 40 73 14 a9 d4 ff Data Ascii: iqA%WiMUu8IZ5DY2;_:Ph`73'NKx#;{}48=A=_yzb's#Z]nkeT\1=6<?z;sk\\a=\i3Ef5b]K@$tJo,vw:DUl^cb:\|F,D3Oiaw?F}[>@s

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report securedoc_20250414T103717.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Static File Info

General

Network Behavior

Network Port Distribution

Windows Analysis Report
securedoc_20250414T103717.html

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:23 UTC	805	OUT	GET /envelopeopener/pf/ZGJAVG9rZW4xNzA3OjExOTMy/JNND13cQOyS7S8lq1uMZc.RwvwtNPuSTjTFQE5WzSNhnzgvVB.-Eh9XrD4-xj10DC5Fjdx71EuIEkP6Ram9u4Qv-0nZIxrzd6A!!/?button=ok&lp=en&try=1 HTTP/1.1 Host: res.cisco.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=0Hsxj/TOisbo+FEkP8RSg7Ptzc+VNgpmgVzmRMnN2zhl7IVoNNj2IopVRwcq38pVCaBbSMWj5Kev74DPU9IEQGSoRzufGlLVTfoCDAJ5zUNZf0Reg3nXGhfc9Haf
2025-04-14 16:11:08 UTC	750	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:11:08 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close Set-Cookie: AWSALB=6C82DQ7KEMFmDOjjoKrTHlXd6BAGPUcdhiP8Ek8NOmOnQRtMJn+LCcZGP69xZQHnUl8954Ee5Yu9wpEeD8D6DdQVfXdoLwNhHdo/yeo4CmfLzvo99R1mWRQUelnq; Expires=Mon, 21 Apr 2025 16:09:23 GMT; Path=/ Set-Cookie: AWSALBCORS=6C82DQ7KEMFmDOjjoKrTHlXd6BAGPUcdhiP8Ek8NOmOnQRtMJn+LCcZGP69xZQHnUl8954Ee5Yu9wpEeD8D6DdQVfXdoLwNhHdo/yeo4CmfLzvo99R1mWRQUelnq; Expires=Mon, 21 Apr 2025 16:09:23 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store, private Server: unknown
2025-04-14 16:11:08 UTC	205	IN	Data Raw: 63 37 0d 0a 47 49 46 38 39 61 82 00 1e 00 f0 00 00 00 81 bf ff ff ff 2c 00 00 00 00 82 00 1e 00 40 08 a6 00 01 08 1c 48 b0 a0 c1 83 08 13 2a 5c c8 b0 a1 c3 87 10 23 4a 9c 48 b1 a2 c5 8b 18 17 06 08 50 70 e3 40 8f 02 41 8a e4 98 b1 a4 c9 93 28 53 aa 5c c9 b2 a5 cb 95 20 3f 72 9c 39 33 e4 46 92 00 3c e2 7c c9 b3 a7 cf 9f 40 83 0a 1d 4a b4 a8 d1 a3 48 2f de bc 99 b4 a9 d2 a5 36 65 4a cd 49 32 a6 d3 a3 4b 75 e2 b4 0a 35 ea d5 af 60 c3 8a 1d 4b b6 ac d9 b3 68 d3 aa 5d cb b6 ed 50 ab 6e c1 c2 65 4a b5 aa 5d 9b 3b e3 9e 9c bb b5 af 57 b8 7a 4d f2 9d 4a f5 6f de c0 88 13 2b 5e cc b8 b1 e3 c7 90 cf 06 04 00 3b 0d 0a Data Ascii: c7GIF89a,@H*\#JHPp@A(S\ ?r93F<\|@JH/6eJI2Ku5`Kh]PneJ];WzMJo+^;
2025-04-14 16:11:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:23 UTC	600	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://res.cisco.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-14 16:09:23 UTC	960	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:09:23 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 412747 Expires: Sat, 04 Apr 2026 16:09:23 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3v1cw3juBCFKvUti%2FtqUWUj3p7YKeRlWusaa19rxke9qmvhNxvu708tEylg4kWqjZxJRC%2BKnYMnWkwsRcOlIueTqSl3CMp3AZ2L5dU%2FSwdfPwR9r2EFIDNhKcPmXf%2F6Bbz4Pt2S0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 930477a48cd3bd52-ATL alt-svc: h3=":443"; ma=86400
2025-04-14 16:09:23 UTC	409	IN	Data Raw: 37 62 66 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bf0!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-04-14 16:09:23 UTC	1369	IN	Data Raw: 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 Data Ascii: of globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.cr
2025-04-14 16:09:23 UTC	1369	IN	Data Raw: 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 Data Ascii: .call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomByte
2025-04-14 16:09:23 UTC	1369	IN	Data Raw: 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c Data Ascii: ypeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<
2025-04-14 16:09:23 UTC	1369	IN	Data Raw: 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e Data Ascii: (var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>
2025-04-14 16:09:23 UTC	1369	IN	Data Raw: 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b Data Ascii: ;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[
2025-04-14 16:09:23 UTC	1369	IN	Data Raw: 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a Data Ascii: er,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:
2025-04-14 16:09:23 UTC	1369	IN	Data Raw: 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f Data Ascii: charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNO
2025-04-14 16:09:23 UTC	1369	IN	Data Raw: 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 Data Ascii: (a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=th
2025-04-14 16:09:23 UTC	1369	IN	Data Raw: 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c Data Ascii: ]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,

Timestamp	Bytes transferred	Direction	Data
2025-04-14 16:09:24 UTC	1353	OUT	GET /keyserver/keyserver?su=jsmith%40contoso.com&df=&tf=&lp=en&ck=0&v=2&m=%7c1__c6287a8d0000019634f29e0fffc41eff9d1b37a9%40localhost&s=9&f=0&d=1744646962883&action=open&prd=519&prn=1&j=1&jc=l_&jca=%22RPCRef%22%3apayload.rpc%2c%0a%22callback%22%3aqp&src=1&na=Netscape&nj=0&njs=1&nl=en-US&np=Win32&nu=Mozilla%2f5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36&nv=5.0%20%28Windows%20NT%2010.0%3b%20Win64%3b%20x64%29%20AppleWebKit%2f537.36%20%28KHTML%2c%20like%20Gecko%29%20Chrome%2f134.0.0.0%20Safari%2f537.36 HTTP/1.1 Host: res.cisco.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: JSESSIONID=B7C8D88A8969DA5C4DFF75AEEE6A7EC0; TRACE-ID=d6aaa1d2-fc06-45f6-a143-9b9239e4e0c5; AWSALBCORS=khctCwmxvMegebYwBYLCFEHS1ElpbgKjDkKWeoukOyscb4trCEy7X60hikbyl5AvjQWtWVatAQO5d6CfUPB00y8cwcVfeysS3UP5GqzLQe6YDyUJVMLGeDkiomg7
2025-04-14 16:10:14 UTC	792	IN	HTTP/1.1 200 OK Date: Mon, 14 Apr 2025 16:10:14 GMT Content-Type: text/javascript;charset=ISO-8859-1 Content-Length: 405 Connection: close Set-Cookie: AWSALB=EK8O4EfLKgfU8aHZzzOje5ym9x8BsWphauf+qUeMcPn49JNrr+zV6nSAIdVZKMw7Rp14EvLARs4YYaoBNM4uHMq6FPkYc6I5Wj7A6jfu4rf4mwIXONukh6XSf08t; Expires=Mon, 21 Apr 2025 16:09:24 GMT; Path=/ Set-Cookie: AWSALBCORS=EK8O4EfLKgfU8aHZzzOje5ym9x8BsWphauf+qUeMcPn49JNrr+zV6nSAIdVZKMw7Rp14EvLARs4YYaoBNM4uHMq6FPkYc6I5Wj7A6jfu4rf4mwIXONukh6XSf08t; Expires=Mon, 21 Apr 2025 16:09:24 GMT; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: policyref=https://res.cisco.com/websafe/p3p/p3p.xml, CP="ALL CURa ADMa TAIa OUR BUS ONL UNI COM NAV INT" Cache-Control: no-cache Pragma: no-cache Server: unknown
2025-04-14 16:10:14 UTC	405	IN	Data Raw: 69 66 28 6c 5f 29 0d 0a 6c 5f 28 7b 0d 0a 22 52 50 43 52 65 66 22 3a 70 61 79 6c 6f 61 64 2e 72 70 63 2c 0a 22 63 61 6c 6c 62 61 63 6b 22 3a 71 70 0d 0a 2c 27 61 63 74 69 6f 6e 27 3a 27 6f 70 65 6e 27 0d 0a 2c 27 73 74 61 74 75 73 27 3a 32 33 0d 0a 2c 27 6d 65 73 73 61 67 65 27 3a 27 27 0d 0a 2c 27 73 74 61 74 65 27 3a 39 0d 0a 2c 27 6c 6f 63 61 6c 65 27 3a 27 65 6e 27 0d 0a 2c 27 72 65 71 54 69 6d 65 27 3a 31 37 34 34 36 34 36 39 36 32 38 38 33 0d 0a 2c 27 72 65 71 4e 75 6d 62 65 72 27 3a 32 0d 0a 2c 27 73 75 63 63 65 73 73 27 3a 74 72 75 65 0d 0a 2c 27 73 65 73 73 69 6f 6e 49 64 27 3a 27 42 37 43 38 44 38 38 41 38 39 36 39 44 41 35 43 34 44 46 46 37 35 41 45 45 45 36 41 37 45 43 30 27 0d 0a 2c 27 72 65 63 69 70 69 65 6e 74 27 3a 27 27 0d 0a 2c 27 63 61 Data Ascii: if(l_)l_({"RPCRef":payload.rpc,"callback":qp,'action':'open','status':23,'message':'','state':9,'locale':'en','reqTime':1744646962883,'reqNumber':2,'success':true,'sessionId':'B7C8D88A8969DA5C4DFF75AEEE6A7EC0','recipient':'','ca

Target ID:	2
Start time:	12:08:53
Start date:	14/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	12:08:58
Start date:	14/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2312,i,14326597320850353260,6128771861761579037,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2332 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	15
Start time:	12:09:04
Start date:	14/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\securedoc_20250414T103717.html"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre