Edit tour

Windows Analysis Report
https://email.baystatedigital.com/

Overview

General Information

Sample URL:	https://email.baystatedigital.com/
Analysis ID:	1522148
Tags:	urlscan
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

Found iframes

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6288 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1900,i,1157449053875135814,2097530389074965015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.baystatedigital.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /csp/collect HTTP/1.1Host: g.sst.gpl.secureserver.netConnection: keep-aliveContent-Length: 2809sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: */*sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://sso.secureserver.netSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pathway=2be96445-b34a-4514-ab40-0a78dd9da835; visitor=vid=2be96445-b34a-4514-ab40-0a78dd9da835; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; market=en-US; _gid=GA1.2.634316938.1727608137; _gat_gtag_UA_115508484_1=1; currency=USD; fb_sessiontraffic=S_TOUCH=&pathway=2be96445-b34a-4514-ab40-0a78dd9da835&V_DATE=&pc=5&C_TOUCH=2024-09-29T11:09:48.273Z; _ga_11GY9GPGDG=GS1.1.1727608190.1.0.1727608190.0.0.1886395659; _ga=GA1.1.1390147669.1727608137

Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: Number of links: 1
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass	HTTP Parser: Number of links: 0
Source: https://sso.secureserver.net/login?app=email&realm=pass#main	HTTP Parser: Number of links: 0
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass#main	HTTP Parser: Number of links: 0

Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://sso.secureserver.net/login?app=email&realm=pass#main	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: Title: Sign In does not match URL
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass	HTTP Parser: Title: Reset my password does not match URL
Source: https://sso.secureserver.net/login?app=email&realm=pass#main	HTTP Parser: Title: Sign In does not match URL
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass#main	HTTP Parser: Title: Reset my password does not match URL

Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No favicon
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No favicon
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No favicon
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No favicon
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No favicon
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No favicon
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass	HTTP Parser: No favicon
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass	HTTP Parser: No favicon
Source: https://sso.secureserver.net/login?app=email&realm=pass#main	HTTP Parser: No favicon
Source: https://sso.secureserver.net/login?app=email&realm=pass#main	HTTP Parser: No favicon
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass#main	HTTP Parser: No favicon
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass#main	HTTP Parser: No favicon

Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No <meta name="author".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No <meta name="author".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No <meta name="author".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No <meta name="author".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No <meta name="author".. found
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass	HTTP Parser: No <meta name="author".. found
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass	HTTP Parser: No <meta name="author".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass#main	HTTP Parser: No <meta name="author".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass#main	HTTP Parser: No <meta name="author".. found
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass#main	HTTP Parser: No <meta name="author".. found
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass#main	HTTP Parser: No <meta name="author".. found

Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No <meta name="copyright".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No <meta name="copyright".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No <meta name="copyright".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No <meta name="copyright".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass	HTTP Parser: No <meta name="copyright".. found
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass	HTTP Parser: No <meta name="copyright".. found
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass	HTTP Parser: No <meta name="copyright".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass#main	HTTP Parser: No <meta name="copyright".. found
Source: https://sso.secureserver.net/login?app=email&realm=pass#main	HTTP Parser: No <meta name="copyright".. found
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass#main	HTTP Parser: No <meta name="copyright".. found
Source: https://sso.secureserver.net/account/reset?app=email&realm=pass#main	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49727 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: email.baystatedigital.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /auth HTTP/1.1Host: email.secureserver.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /@elastic/apm-rum@5.16.1/dist/bundles/elastic-apm-rum.umd.min.js HTTP/1.1Host: unpkg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /@elastic/apm-rum@5.16.1/dist/bundles/elastic-apm-rum.umd.min.js HTTP/1.1Host: unpkg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=G-11GY9GPGDG&l=_sGtmDataLayer HTTP/1.1Host: g.sst.gpl.secureserver.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pathway=2be96445-b34a-4514-ab40-0a78dd9da835; visitor=vid=2be96445-b34a-4514-ab40-0a78dd9da835; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; fb_sessiontraffic=S_TOUCH=&pathway=2be96445-b34a-4514-ab40-0a78dd9da835&V_DATE=&pc=1&C_TOUCH=2024-09-29T11:08:49.841Z; market=en-US
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=G-11GY9GPGDG&l=_sGtmDataLayer HTTP/1.1Host: g.sst.gpl.secureserver.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pathway=2be96445-b34a-4514-ab40-0a78dd9da835; visitor=vid=2be96445-b34a-4514-ab40-0a78dd9da835; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; market=en-US; _ga=GA1.2.1390147669.1727608137; _gid=GA1.2.634316938.1727608137; _gat_gtag_UA_115508484_1=1; currency=USD; fb_sessiontraffic=S_TOUCH=&pathway=2be96445-b34a-4514-ab40-0a78dd9da835&V_DATE=&pc=2&C_TOUCH=2024-09-29T11:09:05.916Z
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=G-11GY9GPGDG&l=_sGtmDataLayer HTTP/1.1Host: g.sst.gpl.secureserver.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pathway=2be96445-b34a-4514-ab40-0a78dd9da835; visitor=vid=2be96445-b34a-4514-ab40-0a78dd9da835; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; market=en-US; _ga=GA1.2.1390147669.1727608137; _gid=GA1.2.634316938.1727608137; _gat_gtag_UA_115508484_1=1; currency=USD; fb_sessiontraffic=S_TOUCH=&pathway=2be96445-b34a-4514-ab40-0a78dd9da835&V_DATE=&pc=3&C_TOUCH=2024-09-29T11:09:10.227Z
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=G-11GY9GPGDG&l=_sGtmDataLayer HTTP/1.1Host: g.sst.gpl.secureserver.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pathway=2be96445-b34a-4514-ab40-0a78dd9da835; visitor=vid=2be96445-b34a-4514-ab40-0a78dd9da835; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; market=en-US; _ga=GA1.2.1390147669.1727608137; _gid=GA1.2.634316938.1727608137; _gat_gtag_UA_115508484_1=1; currency=USD; fb_sessiontraffic=S_TOUCH=&pathway=2be96445-b34a-4514-ab40-0a78dd9da835&V_DATE=&pc=4&C_TOUCH=2024-09-29T11:09:22.891Z
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=G-11GY9GPGDG&l=_sGtmDataLayer HTTP/1.1Host: g.sst.gpl.secureserver.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pathway=2be96445-b34a-4514-ab40-0a78dd9da835; visitor=vid=2be96445-b34a-4514-ab40-0a78dd9da835; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; market=en-US; _ga=GA1.2.1390147669.1727608137; _gid=GA1.2.634316938.1727608137; _gat_gtag_UA_115508484_1=1; currency=USD; fb_sessiontraffic=S_TOUCH=&pathway=2be96445-b34a-4514-ab40-0a78dd9da835&V_DATE=&pc=5&C_TOUCH=2024-09-29T11:09:48.273Z
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=G-11GY9GPGDG&l=_sGtmDataLayer HTTP/1.1Host: g.sst.gpl.secureserver.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pathway=2be96445-b34a-4514-ab40-0a78dd9da835; visitor=vid=2be96445-b34a-4514-ab40-0a78dd9da835; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; market=en-US; _ga=GA1.2.1390147669.1727608137; _gid=GA1.2.634316938.1727608137; _gat_gtag_UA_115508484_1=1; currency=USD; fb_sessiontraffic=S_TOUCH=&pathway=2be96445-b34a-4514-ab40-0a78dd9da835&V_DATE=&pc=5&C_TOUCH=2024-09-29T11:09:48.273Z
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-11GY9GPGDG&gtm=45he49p0v9186435885za200&_p=1727608188749&gcs=G111&gcd=13t3t3t3t5l1&npa=0&dma=0&tag_exp=101671035~101686685~101747727&cid=1390147669.1727608137&ecid=1886395659&ul=en-us&sr=1280x1024&_fplc=0&ur=US&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&sst.rnd=1788108591.1727608190&sst.tft=1727608188749&sst.sp=1&sst.em_event=1&sst.ude=0&_s=1&sid=1727608190&sct=1&seg=0&dl=https%3A%2F%2Fsso.secureserver.net%2Flogin%3Fapp%3Demail%26realm%3Dpass&dt=Sign%20In&en=scroll&_fv=1&_ss=1&ep.anonymize_ip=true&epn.percent_scrolled=90&tfd=3430&richsstsse HTTP/1.1Host: g.sst.gpl.secureserver.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://sso.secureserver.netSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAttribution-Reporting-Eligible: trigger;event-source;navigation-sourceAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pathway=2be96445-b34a-4514-ab40-0a78dd9da835; visitor=vid=2be96445-b34a-4514-ab40-0a78dd9da835; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; market=en-US; _gid=GA1.2.634316938.1727608137; _gat_gtag_UA_115508484_1=1; currency=USD; fb_sessiontraffic=S_TOUCH=&pathway=2be96445-b34a-4514-ab40-0a78dd9da835&V_DATE=&pc=5&C_TOUCH=2024-09-29T11:09:48.273Z; _ga_11GY9GPGDG=GS1.1.1727608190.1.0.1727608190.0.0.1886395659; _ga=GA1.1.1390147669.1727608137
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-11GY9GPGDG&gtm=45he49p0v9186435885za200&_p=1727608188749&gcs=G111&gcd=13t3t3t3t5l1&npa=0&dma=0&tag_exp=101671035~101686685~101747727&cid=1390147669.1727608137&ecid=1886395659&ul=en-us&sr=1280x1024&_fplc=0&ur=US&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&sst.rnd=1788108591.1727608190&sst.tft=1727608188749&sst.sp=1&sst.em_event=1&sst.ude=0&_s=1&sid=1727608190&sct=1&seg=0&dl=https%3A%2F%2Fsso.secureserver.net%2Flogin%3Fapp%3Demail%26realm%3Dpass&dt=Sign%20In&en=scroll&_fv=1&_ss=1&ep.anonymize_ip=true&epn.percent_scrolled=90&tfd=3430&richsstsse HTTP/1.1Host: g.sst.gpl.secureserver.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pathway=2be96445-b34a-4514-ab40-0a78dd9da835; visitor=vid=2be96445-b34a-4514-ab40-0a78dd9da835; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; market=en-US; _gid=GA1.2.634316938.1727608137; _gat_gtag_UA_115508484_1=1; currency=USD; fb_sessiontraffic=S_TOUCH=&pathway=2be96445-b34a-4514-ab40-0a78dd9da835&V_DATE=&pc=5&C_TOUCH=2024-09-29T11:09:48.273Z; _ga_11GY9GPGDG=GS1.1.1727608190.1.0.1727608190.0.0.1886395659; _ga=GA1.1.1390147669.1727608137

Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Yj:function(){e=zb()},nd:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),FC=["www.youtube.com","www.youtube-nocookie.com"],GC,HC=!1; equals www.youtube.com (Youtube)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=lA(a,c,e);N(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return N(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},oA=function(){var a=[],b=function(c){return ob(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={eh:e,ah:f,bh:g,Ph:k,Qh:m,Ge:n,Bb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(QC(w,"iframe_api")\|\|QC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!HC&&OC(x[A],p.Ge))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_176.2.dr, chromecache_199.2.dr	String found in binary or memory: return b}DC.H="internal.enableAutoEventOnTimer";var gc=ja(["data-gtm-yt-inspected-"]),FC=["www.youtube.com","www.youtube-nocookie.com"],GC,HC=!1; equals www.youtube.com (Youtube)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: var SB=function(a,b,c,d,e){var f=Jz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Jz("fsl","nv.ids",[]):Jz("fsl","ids",[]);if(!g.length)return!0;var k=Oz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);N(121);if(m==="https://www.facebook.com/tr/")return N(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!wy(k,yy(b, equals www.facebook.com (Facebook)

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1900,i,1157449053875135814,2097530389074965015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.baystatedigital.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1900,i,1157449053875135814,2097530389074965015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source: global traffic	DNS traffic detected: DNS query: email.baystatedigital.com
Source: global traffic	DNS traffic detected: DNS query: email.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: sso.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: img6.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: unpkg.com
Source: global traffic	DNS traffic detected: DNS query: gui.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: reporting.cdndex.io
Source: global traffic	DNS traffic detected: DNS query: g.sst.gpl.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: events.api.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: csp.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io
Source: global traffic	DNS traffic detected: DNS query: _9243._https.cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io

Source: chromecache_126.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_185.2.dr, chromecache_170.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_132.2.dr, chromecache_126.2.dr, chromecache_176.2.dr, chromecache_199.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_161.2.dr, chromecache_142.2.dr	String found in binary or memory: https://feross.org
Source: chromecache_126.2.dr, chromecache_176.2.dr, chromecache_199.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_132.2.dr, chromecache_126.2.dr, chromecache_176.2.dr, chromecache_199.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_130.2.dr, chromecache_221.2.dr, chromecache_191.2.dr, chromecache_186.2.dr	String found in binary or memory: https://sso.secureserver.net/v1/account/reset?app=email&realm=pass
Source: chromecache_130.2.dr, chromecache_221.2.dr, chromecache_191.2.dr, chromecache_186.2.dr	String found in binary or memory: https://sso.secureserver.net/v1/account/retrieve?app=email&realm=pass
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_170.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_185.2.dr, chromecache_170.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_132.2.dr, chromecache_126.2.dr, chromecache_176.2.dr, chromecache_199.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_176.2.dr, chromecache_199.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_185.2.dr, chromecache_170.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_185.2.dr, chromecache_170.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_185.2.dr, chromecache_170.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_126.2.dr, chromecache_176.2.dr, chromecache_199.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_185.2.dr, chromecache_170.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_132.2.dr, chromecache_126.2.dr, chromecache_176.2.dr, chromecache_199.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_199.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_185.2.dr, chromecache_170.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source	Detection	Scanner	Label
https://feross.org	0%	URL Reputation	safe
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://www.merchant-center-analytics.goog	0%	URL Reputation	safe
https://tagassistant.google.com/	0%	URL Reputation	safe
https://stats.g.doubleclick.net/j/collect	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
g.sst.gpl.secureserver.net	75.2.72.163	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
proxy-nlb-prod-us-west-2-v5-ac4e52c97755301b.elb.us-west-2.amazonaws.com	54.212.23.110	true	false	unknown
www.google.com	172.217.18.100	true	false	unknown
reporting.cdndex.io	13.32.99.103	true	false	unknown
unpkg.com	104.17.248.203	true	false	unknown
email.secureserver.net	15.197.155.180	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
img1.wsimg.com	unknown	unknown	false	unknown
events.api.secureserver.net	unknown	unknown	false	unknown
cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io	unknown	unknown	false	unknown
email.baystatedigital.com	unknown	unknown	false	unknown
img6.wsimg.com	unknown	unknown	false	unknown
_9243._https.cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io	unknown	unknown	false	unknown
csp.secureserver.net	unknown	unknown	false	unknown
gui.secureserver.net	unknown	unknown	false	unknown
sso.secureserver.net	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://unpkg.com/@elastic/apm-rum@5.16.1/dist/bundles/elastic-apm-rum.umd.min.js	false	unknown
https://email.baystatedigital.com/	false	unknown
https://sso.secureserver.net/account/reset?app=email&realm=pass	false	unknown
https://sso.secureserver.net/account/reset?app=email&realm=pass#main	false	unknown
https://g.sst.gpl.secureserver.net/csp/collect	false	unknown
https://email.secureserver.net/auth	false	unknown
https://sso.secureserver.net/login?app=email&realm=pass	false	unknown
https://sso.secureserver.net/login?app=email&realm=pass#main	false	unknown
https://g.sst.gpl.secureserver.net/gtag/js?id=G-11GY9GPGDG&l=_sGtmDataLayer	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	chromecache_126.2.dr, chromecache_176.2.dr, chromecache_199.2.dr	false		unknown
https://www.youtube.com/iframe_api	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://feross.org	chromecache_161.2.dr, chromecache_142.2.dr	false	URL Reputation: safe	unknown
https://stats.g.doubleclick.net/g/collect	chromecache_132.2.dr, chromecache_126.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/ads/ga-audiences	chromecache_185.2.dr, chromecache_170.2.dr	false		unknown
https://www.google.%/ads/ga-audiences	chromecache_185.2.dr, chromecache_170.2.dr	false		unknown
https://td.doubleclick.net	chromecache_132.2.dr, chromecache_126.2.dr, chromecache_176.2.dr, chromecache_199.2.dr	false		unknown
https://www.merchant-center-analytics.goog	chromecache_132.2.dr, chromecache_126.2.dr	false	URL Reputation: safe	unknown
https://tagassistant.google.com/	chromecache_185.2.dr, chromecache_170.2.dr	false	URL Reputation: safe	unknown
https://stats.g.doubleclick.net/j/collect	chromecache_170.2.dr	false	URL Reputation: safe	unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_185.2.dr, chromecache_170.2.dr	false	URL Reputation: safe	unknown
https://sso.secureserver.net/v1/account/reset?app=email&realm=pass	chromecache_130.2.dr, chromecache_221.2.dr, chromecache_191.2.dr, chromecache_186.2.dr	false		unknown
https://cct.google/taggy/agent.js	chromecache_132.2.dr, chromecache_126.2.dr, chromecache_176.2.dr, chromecache_199.2.dr	false	URL Reputation: safe	unknown
https://sso.secureserver.net/v1/account/retrieve?app=email&realm=pass	chromecache_130.2.dr, chromecache_221.2.dr, chromecache_191.2.dr, chromecache_186.2.dr	false		unknown
https://adservice.google.com/pagead/regclk?	chromecache_126.2.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
54.212.23.110	proxy-nlb-prod-us-west-2-v5-ac4e52c97755301b.elb.us-west-2.amazonaws.com	United States	16509	AMAZON-02US	false
104.17.248.203	unpkg.com	United States	13335	CLOUDFLARENETUS	false
75.2.72.163	g.sst.gpl.secureserver.net	United States	16509	AMAZON-02US	false
15.197.155.180	email.secureserver.net	United States	7430	TANDEMUS	false
13.32.99.103	reporting.cdndex.io	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.100	unknown	United States	15169	GOOGLEUS	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522148
Start date and time:	2024-09-29 13:07:37 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://email.baystatedigital.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.win@20/157@50/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://sso.secureserver.net/v1/account/reset?app=email&realm=pass Browse: https://sso.secureserver.net/login?app=email&realm=pass#main Browse: https://sso.secureserver.net/account/reset?app=email&realm=pass#main

Input	Output
URL: https://sso.secureserver.net/login?app=email&realm=pass Model: jbxai

URL: https://sso.secureserver.net/login?app=email&realm=pass Model: jbxai

URL: https://sso.secureserver.net/account/reset?app=email&realm=pass Model: jbxai

URL: https://sso.secureserver.net/login?app=email&realm=pass#main Model: jbxai

URL: https://sso.secureserver.net/login?app=email&realm=pass#main Model: jbxai

URL: https://sso.secureserver.net/account/reset?app=email&realm=pass#main Model: jbxai

URL: https://sso.secureserver.net/login?app=email&realm=pass Model: jbxai

URL: https://sso.secureserver.net/login?app=email&realm=pass Model: jbxai

URL: https://sso.secureserver.net/account/reset?app=email&realm=pass Model: jbxai

URL: https://sso.secureserver.net/login?app=email&realm=pass#main Model: jbxai

URL: https://sso.secureserver.net/login?app=email&realm=pass#main Model: jbxai

URL: https://sso.secureserver.net/account/reset?app=email&realm=pass#main Model: jbxai

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://email.baystatedigital.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Windows Analysis Report
https://email.baystatedigital.com/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Sep 29 10:08:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9764533934914863
Encrypted:	false
SSDEEP:	48:85t0dATkg3HZidAKZdA1oehwiZUklqehAy+3:8nffq/y
MD5:	9A30023792AAF8FDF6A1E194AC5C25B7
SHA1:	2FA4F581BE752E3ED3D487D8EADDBB4094FBA5FB
SHA-256:	C70737719B88DEED2E33D2CE0A0C822FF45C718B404813263FCB08BE6460B557
SHA-512:	7275AC93228145E02CC4BE329DB19040B7B710599F3230D660788C115F93C14C7E31265C690A16CDADBB43441FB6465F554983DED67B03A6CC4FBB791368BF3A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Q..._...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I=Y.Y....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V=Y.Y....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V=Y.Y....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V=Y.Y..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V=Y.Y...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............=.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 13:08:42.738126993 CEST	53	55426	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:42.778810978 CEST	53	64427	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:43.780519009 CEST	53	58437	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:43.839298010 CEST	58613	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:43.839534044 CEST	51125	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:43.854371071 CEST	53	58613	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:43.877602100 CEST	53	51125	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:44.776539087 CEST	65068	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:44.776716948 CEST	51940	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:44.786885977 CEST	53	51940	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:44.787599087 CEST	53	65068	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:45.682200909 CEST	62226	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:45.682728052 CEST	55804	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:47.134038925 CEST	57150	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:47.134628057 CEST	50666	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:47.140820026 CEST	53	57150	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:47.141704082 CEST	53	50666	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:47.303529978 CEST	51145	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:47.303845882 CEST	54429	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:50.250333071 CEST	55254	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:50.251205921 CEST	59107	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:50.257107973 CEST	53	55254	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:50.257878065 CEST	53	59107	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:50.828325033 CEST	59749	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:50.828592062 CEST	59273	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:50.861143112 CEST	53811	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:50.861655951 CEST	55165	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:50.865827084 CEST	52992	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:50.866250038 CEST	58212	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:51.152211905 CEST	61480	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:51.152586937 CEST	52567	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:51.159149885 CEST	53	61480	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:51.159535885 CEST	53	52567	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:52.393671989 CEST	58208	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:52.394479990 CEST	64863	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:53.022500992 CEST	53	59726	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:54.810641050 CEST	65114	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:54.810928106 CEST	53250	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:54.818183899 CEST	53	53250	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:54.818432093 CEST	53	65114	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:54.850898027 CEST	52954	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:54.851023912 CEST	56437	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:54.851259947 CEST	58461	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:54.851613998 CEST	54820	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:54.857388973 CEST	53	57874	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:54.860035896 CEST	53	52954	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:54.861459017 CEST	53	56437	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:54.907140970 CEST	54534	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:54.907411098 CEST	54292	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:55.094074011 CEST	63229	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:55.094285011 CEST	61151	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:55.975884914 CEST	53191	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:55.976183891 CEST	52598	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:56.254883051 CEST	56389	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:56.255378962 CEST	51499	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:56.260477066 CEST	53	50832	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:56.280643940 CEST	53	60865	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:57.785370111 CEST	53	63807	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:58.820673943 CEST	62636	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:58.821451902 CEST	56110	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:08:58.834686995 CEST	53	56110	1.1.1.1	192.168.2.8
Sep 29, 2024 13:08:58.842058897 CEST	53	62636	1.1.1.1	192.168.2.8
Sep 29, 2024 13:09:01.960436106 CEST	53	51225	1.1.1.1	192.168.2.8
Sep 29, 2024 13:09:19.953058004 CEST	138	138	192.168.2.8	192.168.2.255
Sep 29, 2024 13:09:20.676518917 CEST	53	57551	1.1.1.1	192.168.2.8
Sep 29, 2024 13:09:42.549596071 CEST	53	52073	1.1.1.1	192.168.2.8
Sep 29, 2024 13:09:44.025808096 CEST	53	53474	1.1.1.1	192.168.2.8
Sep 29, 2024 13:09:47.166500092 CEST	64881	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:47.166790962 CEST	61566	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:47.174299955 CEST	53	61566	1.1.1.1	192.168.2.8
Sep 29, 2024 13:09:47.174316883 CEST	53	64881	1.1.1.1	192.168.2.8
Sep 29, 2024 13:09:47.455533981 CEST	61852	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:47.455725908 CEST	54914	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:47.479351044 CEST	64688	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:47.479516029 CEST	65507	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:50.858004093 CEST	64930	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:50.858004093 CEST	54182	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:50.868067980 CEST	53	54182	1.1.1.1	192.168.2.8
Sep 29, 2024 13:09:50.870315075 CEST	53	64930	1.1.1.1	192.168.2.8
Sep 29, 2024 13:09:55.602211952 CEST	49897	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:55.602381945 CEST	63452	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:58.606286049 CEST	60795	53	192.168.2.8	1.1.1.1
Sep 29, 2024 13:09:58.606286049 CEST	60970	53	192.168.2.8	1.1.1.1

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 29, 2024 13:08:43.877711058 CEST	192.168.2.8	1.1.1.1	c24a	(Port unreachable)	Destination Unreachable
Sep 29, 2024 13:08:50.857853889 CEST	192.168.2.8	1.1.1.1	c282	(Port unreachable)	Destination Unreachable
Sep 29, 2024 13:09:47.495779037 CEST	192.168.2.8	1.1.1.1	c280	(Port unreachable)	Destination Unreachable
Sep 29, 2024 13:09:55.638624907 CEST	192.168.2.8	1.1.1.1	c27a	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-09-29 11:08:44 UTC	668	OUT	GET / HTTP/1.1 Host: email.baystatedigital.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 11:08:44 UTC	207	IN	HTTP/1.1 302 Moved Temporarily Server: awselb/2.0 Date: Sun, 29 Sep 2024 11:08:44 GMT Content-Type: text/html Content-Length: 110 Connection: close Location: https://email.secureserver.net:443/auth
2024-09-29 11:08:44 UTC	110	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center></body></html>

Timestamp	Bytes transferred	Direction	Data
2024-09-29 11:08:45 UTC	669	OUT	GET /auth HTTP/1.1 Host: email.secureserver.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 11:08:45 UTC	227	IN	HTTP/1.1 302 Moved Temporarily Server: awselb/2.0 Date: Sun, 29 Sep 2024 11:08:45 GMT Content-Type: text/html Content-Length: 110 Connection: close Location: https://sso.secureserver.net:443/login?app=email&realm=pass
2024-09-29 11:08:45 UTC	110	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center></body></html>

Timestamp	Bytes transferred	Direction	Data
2024-09-29 11:08:48 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-29 11:08:48 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=106574 Date: Sun, 29 Sep 2024 11:08:48 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-09-29 11:08:49 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-29 11:08:50 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=106602 Date: Sun, 29 Sep 2024 11:08:50 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-29 11:08:50 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-09-29 11:08:50 UTC	536	OUT	GET /@elastic/apm-rum@5.16.1/dist/bundles/elastic-apm-rum.umd.min.js HTTP/1.1 Host: unpkg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 11:08:50 UTC	576	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 11:08:50 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 1985 08:15:00 GMT etag: W/"fa4c-Dh0zfbIfKGc/m5YAqu9Jaas4HiY" via: 1.1 fly.io fly-request-id: 01J1DAZ9ZTSWCD6NGS61Q97Q51-lga CF-Cache-Status: HIT Age: 8099750 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8cab8481fa277c87-EWR
2024-09-29 11:08:50 UTC	793	IN	Data Raw: 37 64 36 31 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 7b 38 31 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 61 3b 21 66 75 6e 63 74 69 6f 6e 28 6f 2c 73 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 3d 5b 6e 28 31 37 30 29 5d 2c 76 6f 69 64 20 30 3d 3d 3d 28 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 2f 28 5e 7c 40 29 5c 53 2b 5c 3a 5c 64 2b 2f 2c 6e 3d 2f 5e 5c 73 2a 61 74 20 2e 2a 28 5c 53 2b 5c 3a 5c 64 2b 7c 5c 28 6e 61 74 69 76 65 5c 29 29 2f 6d 2c 72 3d 2f 5e 28 65 76 61 6c 40 29 3f 28 5c 5b 6e 61 74 69 76 65 20 63 6f 64 65 5c 5d 29 3f 24 2f 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 2c 6e 29 7b 69 66 28 22 66 75 6e Data Ascii: 7d61!function(){var t={816:function(t,e,n){var r,i,a;!function(o,s){"use strict";i=[n(170)],void 0===(a="function"==typeof(r=function(t){var e=/(^\|@)\S+\:\d+/,n=/^\sat .(\S+\:\d+\|\(native\))/m,r=/^(eval@)?(\[native code\])?$/;function i(t,e,n){if("fun
2024-09-29 11:08:50 UTC	1369	IN	Data Raw: 22 29 7d 2c 65 78 74 72 61 63 74 4c 6f 63 61 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 2d 31 3d 3d 3d 74 2e 69 6e 64 65 78 4f 66 28 22 3a 22 29 29 72 65 74 75 72 6e 5b 74 5d 3b 76 61 72 20 65 3d 2f 28 2e 2b 3f 29 28 3f 3a 5c 3a 28 5c 64 2b 29 29 3f 28 3f 3a 5c 3a 28 5c 64 2b 29 29 3f 24 2f 2e 65 78 65 63 28 74 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 28 5c 29 5d 2f 67 2c 22 22 29 29 3b 72 65 74 75 72 6e 5b 65 5b 31 5d 2c 65 5b 32 5d 7c 7c 76 6f 69 64 20 30 2c 65 5b 33 5d 7c 7c 76 6f 69 64 20 30 5d 7d 2c 70 61 72 73 65 56 38 4f 72 49 45 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 69 28 61 28 65 2e 73 74 61 63 6b 2e 73 70 6c 69 74 28 22 5c 6e 22 29 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 21 21 74 2e 6d 61 74 Data Ascii: ")},extractLocation:function(t){if(-1===t.indexOf(":"))return[t];var e=/(.+?)(?:\:(\d+))?(?:\:(\d+))?$/.exec(t.replace(/[\(\)]/g,""));return[e[1],e[2]\|\|void 0,e[3]\|\|void 0]},parseV8OrIE:function(e){return i(a(e.stack.split("\n"),(function(t){return!!t.mat
2024-09-29 11:08:50 UTC	1369	IN	Data Raw: 72 28 76 61 72 20 6e 3d 2f 4c 69 6e 65 20 28 5c 64 2b 29 2e 2a 73 63 72 69 70 74 20 28 3f 3a 69 6e 20 29 3f 28 5c 53 2b 29 2f 69 2c 72 3d 65 2e 6d 65 73 73 61 67 65 2e 73 70 6c 69 74 28 22 5c 6e 22 29 2c 69 3d 5b 5d 2c 61 3d 32 2c 6f 3d 72 2e 6c 65 6e 67 74 68 3b 61 3c 6f 3b 61 2b 3d 32 29 7b 76 61 72 20 73 3d 6e 2e 65 78 65 63 28 72 5b 61 5d 29 3b 73 26 26 69 2e 70 75 73 68 28 6e 65 77 20 74 28 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 73 5b 32 5d 2c 73 5b 31 5d 2c 76 6f 69 64 20 30 2c 72 5b 61 5d 29 29 7d 72 65 74 75 72 6e 20 69 7d 2c 70 61 72 73 65 4f 70 65 72 61 31 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 2f 4c 69 6e 65 20 28 5c 64 2b 29 2e 2a 73 63 72 69 70 74 20 28 3f 3a 69 6e 20 29 3f 28 5c 53 2b 29 28 3f 3a 3a 20 49 Data Ascii: r(var n=/Line (\d+).script (?:in )?(\S+)/i,r=e.message.split("\n"),i=[],a=2,o=r.length;a<o;a+=2){var s=n.exec(r[a]);s&&i.push(new t(void 0,void 0,s[2],s[1],void 0,r[a]))}return i},parseOpera10:function(e){for(var n=/Line (\d+).script (?:in )?(\S+)(?:: I
2024-09-29 11:08:50 UTC	1369	IN	Data Raw: 6e 20 74 68 69 73 2e 66 75 6e 63 74 69 6f 6e 4e 61 6d 65 7d 2c 73 65 74 46 75 6e 63 74 69 6f 6e 4e 61 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 68 69 73 2e 66 75 6e 63 74 69 6f 6e 4e 61 6d 65 3d 53 74 72 69 6e 67 28 74 29 7d 2c 67 65 74 41 72 67 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 72 67 73 7d 2c 73 65 74 41 72 67 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 41 72 67 73 20 6d 75 73 74 20 62 65 20 61 6e 20 41 72 72 61 79 22 29 3b 74 68 69 73 2e 61 72 67 73 3d 74 7d 2c 67 65 74 46 69 6c Data Ascii: n this.functionName},setFunctionName:function(t){this.functionName=String(t)},getArgs:function(){return this.args},setArgs:function(t){if("[object Array]"!==Object.prototype.toString.call(t))throw new TypeError("Args must be an Array");this.args=t},getFil
2024-09-29 11:08:50 UTC	1369	IN	Data Raw: 74 2c 72 29 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 72 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 65 5b 72 5d 7d 29 7d 2c 6e 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 65 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 2e 72 65 73 6f 6c 76 65 28 74 28 29 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 Data Ascii: t,r)&&Object.defineProperty(t,r,{enumerable:!0,get:e[r]})},n.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},function(){"use strict";var t=function(t){var e=this.constructor;return this.then((function(n){return e.resolve(t()).then((funct
2024-09-29 11:08:50 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 75 28 74 29 7b 32 3d 3d 3d 74 2e 5f 73 74 61 74 65 26 26 30 3d 3d 3d 74 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 26 26 61 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 5f 68 61 6e 64 6c 65 64 7c 7c 61 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 46 6e 28 74 2e 5f 76 61 6c 75 65 29 7d 29 29 3b 66 6f 72 28 76 61 72 20 65 3d 30 2c 6e 3d 74 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 3b 65 3c 6e 3b 65 2b 2b 29 6f 28 74 2c 74 2e 5f 64 65 66 65 72 72 65 64 73 5b 65 5d 29 3b 74 2e 5f 64 65 66 65 72 72 65 64 73 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 66 28 74 2c 65 2c 6e 29 7b 74 68 69 73 2e 6f 6e 46 75 6c 66 69 6c 6c 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 Data Ascii: tion u(t){2===t._state&&0===t._deferreds.length&&a._immediateFn((function(){t._handled\|\|a._unhandledRejectionFn(t._value)}));for(var e=0,n=t._deferreds.length;e<n;e++)o(t,t._deferreds[e]);t._deferreds=null}function f(t,e,n){this.onFulfilled="function"==ty
2024-09-29 11:08:50 UTC	1369	IN	Data Raw: 6e 28 65 2c 6e 29 7d 29 29 7d 2c 61 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 26 26 66 75 6e 63 74 69 6f 6e 28 74 29 7b 73 65 74 49 6d 6d 65 64 69 61 74 65 28 74 29 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 65 28 74 2c 30 29 7d 2c 61 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 46 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 50 6f 73 73 69 62 6c 65 20 55 6e 68 61 6e 64 6c 65 64 20 50 72 6f 6d 69 73 65 20 52 65 6a 65 63 74 69 6f 6e 3a 22 2c 74 29 7d 3b 76 61 72 20 6c 3d 61 2c 70 3d 7b 7d 3b 67 3f Data Ascii: n(e,n)}))},a._immediateFn="function"==typeof setImmediate&&function(t){setImmediate(t)}\|\|function(t){e(t,0)},a._unhandledRejectionFn=function(t){"undefined"!=typeof console&&console&&console.warn("Possible Unhandled Promise Rejection:",t)};var l=a,p={};g?
2024-09-29 11:08:50 UTC	1369	IN	Data Raw: 22 21 3d 3d 69 26 26 22 6e 75 6d 62 65 72 22 21 3d 3d 69 26 26 28 65 3d 53 74 72 69 6e 67 28 65 29 29 2c 6e 5b 72 5d 3d 65 2c 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 6b 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 74 2e 73 70 6c 69 74 28 22 3f 22 29 5b 30 5d 7d 66 75 6e 63 74 69 6f 6e 20 49 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 2b 2b 72 29 7b 76 61 72 20 61 3d 65 5b 72 5d 3b 69 66 28 49 28 61 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 61 29 66 6f 72 28 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 61 29 2c 73 3d 30 2c Data Ascii: "!==i&&"number"!==i&&(e=String(e)),n[r]=e,n}}function k(t){return t&&t.split("?")[0]}function I(t){return null!==t&&"object"==typeof t}function C(t,e,n){for(var r=0,i=e.length;r<i;++r){var a=e[r];if(I(a)\|\|"function"==typeof a)for(var o=Object.keys(a),s=0,
2024-09-29 11:08:50 UTC	1369	IN	Data Raw: 6f 6e 20 42 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 72 65 64 69 72 65 63 74 53 74 61 72 74 3e 30 7d 76 61 72 20 56 3d 7b 66 65 74 63 68 49 6e 50 72 6f 67 72 65 73 73 3a 21 31 7d 3b 66 75 6e 63 74 69 6f 6e 20 24 28 74 29 7b 72 65 74 75 72 6e 22 5f 5f 61 70 6d 5f 73 79 6d 62 6f 6c 5f 5f 22 2b 74 7d 66 75 6e 63 74 69 6f 6e 20 4a 28 74 2c 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 3d 74 3b 72 26 26 21 72 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 29 3b 29 72 3d 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 72 29 3b 21 72 26 26 74 5b 65 5d 26 26 28 72 3d 74 29 3b 76 61 72 20 69 2c 61 2c 6f 2c 73 2c 63 3d 24 28 65 29 3b 69 66 28 72 26 26 21 28 69 3d 72 5b 63 5d 29 29 7b 69 3d 72 5b 63 5d 3d 72 5b 65 5d 3b 76 61 72 20 75 3d 72 26 26 4f Data Ascii: on B(t){return t.redirectStart>0}var V={fetchInProgress:!1};function $(t){return"__apm_symbol__"+t}function J(t,e,n){for(var r=t;r&&!r.hasOwnProperty(e);)r=Object.getPrototypeOf(r);!r&&t[e]&&(r=t);var i,a,o,s,c=$(e);if(r&&!(i=r[c])){i=r[c]=r[e];var u=r&&O
2024-09-29 11:08:50 UTC	1369	IN	Data Raw: 61 74 75 73 26 26 69 28 65 2c 22 73 75 63 63 65 73 73 22 29 3a 69 28 65 2c 22 6c 6f 61 64 22 3d 3d 3d 72 3f 22 73 75 63 63 65 73 73 22 3a 72 29 7d 29 29 7d 7d 28 61 29 2c 72 2e 61 70 70 6c 79 28 65 2c 6e 29 7d 63 61 74 63 68 28 74 29 7b 74 68 72 6f 77 20 69 28 61 2c 22 65 72 72 6f 72 22 29 2c 74 7d 7d 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 6e 29 7b 65 2e 73 74 61 74 65 21 3d 3d 51 26 26 28 65 2e 73 74 61 74 65 3d 51 2c 65 2e 64 61 74 61 2e 73 74 61 74 75 73 3d 6e 2c 74 28 51 2c 65 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 74 29 7b 72 65 74 75 72 6e 21 28 30 3d 3d 3d 74 7c 7c 74 3e 33 39 39 26 26 74 3c 36 30 30 29 7d 66 75 6e 63 74 69 6f 6e 20 72 74 28 29 7b 72 65 74 75 72 6e 28 72 74 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 Data Ascii: atus&&i(e,"success"):i(e,"load"===r?"success":r)}))}}(a),r.apply(e,n)}catch(t){throw i(a,"error"),t}}}));function i(e,n){e.state!==Q&&(e.state=Q,e.data.status=n,t(Q,e))}}function nt(t){return!(0===t\|\|t>399&&t<600)}function rt(){return(rt=Object.assign\|\|fu

Timestamp	Bytes transferred	Direction	Data
2024-09-29 11:08:51 UTC	396	OUT	GET /@elastic/apm-rum@5.16.1/dist/bundles/elastic-apm-rum.umd.min.js HTTP/1.1 Host: unpkg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 11:08:51 UTC	576	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 11:08:51 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 1985 08:15:00 GMT etag: W/"fa4c-Dh0zfbIfKGc/m5YAqu9Jaas4HiY" via: 1.1 fly.io fly-request-id: 01J1DAZ9ZTSWCD6NGS61Q97Q51-lga CF-Cache-Status: HIT Age: 8099751 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8cab84887c0a5e6e-EWR
2024-09-29 11:08:51 UTC	793	IN	Data Raw: 37 64 36 31 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 7b 38 31 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 61 3b 21 66 75 6e 63 74 69 6f 6e 28 6f 2c 73 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 3d 5b 6e 28 31 37 30 29 5d 2c 76 6f 69 64 20 30 3d 3d 3d 28 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 2f 28 5e 7c 40 29 5c 53 2b 5c 3a 5c 64 2b 2f 2c 6e 3d 2f 5e 5c 73 2a 61 74 20 2e 2a 28 5c 53 2b 5c 3a 5c 64 2b 7c 5c 28 6e 61 74 69 76 65 5c 29 29 2f 6d 2c 72 3d 2f 5e 28 65 76 61 6c 40 29 3f 28 5c 5b 6e 61 74 69 76 65 20 63 6f 64 65 5c 5d 29 3f 24 2f 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 2c 6e 29 7b 69 66 28 22 66 75 6e Data Ascii: 7d61!function(){var t={816:function(t,e,n){var r,i,a;!function(o,s){"use strict";i=[n(170)],void 0===(a="function"==typeof(r=function(t){var e=/(^\|@)\S+\:\d+/,n=/^\sat .(\S+\:\d+\|\(native\))/m,r=/^(eval@)?(\[native code\])?$/;function i(t,e,n){if("fun
2024-09-29 11:08:51 UTC	1369	IN	Data Raw: 22 29 7d 2c 65 78 74 72 61 63 74 4c 6f 63 61 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 2d 31 3d 3d 3d 74 2e 69 6e 64 65 78 4f 66 28 22 3a 22 29 29 72 65 74 75 72 6e 5b 74 5d 3b 76 61 72 20 65 3d 2f 28 2e 2b 3f 29 28 3f 3a 5c 3a 28 5c 64 2b 29 29 3f 28 3f 3a 5c 3a 28 5c 64 2b 29 29 3f 24 2f 2e 65 78 65 63 28 74 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 28 5c 29 5d 2f 67 2c 22 22 29 29 3b 72 65 74 75 72 6e 5b 65 5b 31 5d 2c 65 5b 32 5d 7c 7c 76 6f 69 64 20 30 2c 65 5b 33 5d 7c 7c 76 6f 69 64 20 30 5d 7d 2c 70 61 72 73 65 56 38 4f 72 49 45 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 69 28 61 28 65 2e 73 74 61 63 6b 2e 73 70 6c 69 74 28 22 5c 6e 22 29 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 21 21 74 2e 6d 61 74 Data Ascii: ")},extractLocation:function(t){if(-1===t.indexOf(":"))return[t];var e=/(.+?)(?:\:(\d+))?(?:\:(\d+))?$/.exec(t.replace(/[\(\)]/g,""));return[e[1],e[2]\|\|void 0,e[3]\|\|void 0]},parseV8OrIE:function(e){return i(a(e.stack.split("\n"),(function(t){return!!t.mat
2024-09-29 11:08:51 UTC	1369	IN	Data Raw: 72 28 76 61 72 20 6e 3d 2f 4c 69 6e 65 20 28 5c 64 2b 29 2e 2a 73 63 72 69 70 74 20 28 3f 3a 69 6e 20 29 3f 28 5c 53 2b 29 2f 69 2c 72 3d 65 2e 6d 65 73 73 61 67 65 2e 73 70 6c 69 74 28 22 5c 6e 22 29 2c 69 3d 5b 5d 2c 61 3d 32 2c 6f 3d 72 2e 6c 65 6e 67 74 68 3b 61 3c 6f 3b 61 2b 3d 32 29 7b 76 61 72 20 73 3d 6e 2e 65 78 65 63 28 72 5b 61 5d 29 3b 73 26 26 69 2e 70 75 73 68 28 6e 65 77 20 74 28 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 73 5b 32 5d 2c 73 5b 31 5d 2c 76 6f 69 64 20 30 2c 72 5b 61 5d 29 29 7d 72 65 74 75 72 6e 20 69 7d 2c 70 61 72 73 65 4f 70 65 72 61 31 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 2f 4c 69 6e 65 20 28 5c 64 2b 29 2e 2a 73 63 72 69 70 74 20 28 3f 3a 69 6e 20 29 3f 28 5c 53 2b 29 28 3f 3a 3a 20 49 Data Ascii: r(var n=/Line (\d+).script (?:in )?(\S+)/i,r=e.message.split("\n"),i=[],a=2,o=r.length;a<o;a+=2){var s=n.exec(r[a]);s&&i.push(new t(void 0,void 0,s[2],s[1],void 0,r[a]))}return i},parseOpera10:function(e){for(var n=/Line (\d+).script (?:in )?(\S+)(?:: I
2024-09-29 11:08:51 UTC	1369	IN	Data Raw: 6e 20 74 68 69 73 2e 66 75 6e 63 74 69 6f 6e 4e 61 6d 65 7d 2c 73 65 74 46 75 6e 63 74 69 6f 6e 4e 61 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 68 69 73 2e 66 75 6e 63 74 69 6f 6e 4e 61 6d 65 3d 53 74 72 69 6e 67 28 74 29 7d 2c 67 65 74 41 72 67 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 72 67 73 7d 2c 73 65 74 41 72 67 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 41 72 67 73 20 6d 75 73 74 20 62 65 20 61 6e 20 41 72 72 61 79 22 29 3b 74 68 69 73 2e 61 72 67 73 3d 74 7d 2c 67 65 74 46 69 6c Data Ascii: n this.functionName},setFunctionName:function(t){this.functionName=String(t)},getArgs:function(){return this.args},setArgs:function(t){if("[object Array]"!==Object.prototype.toString.call(t))throw new TypeError("Args must be an Array");this.args=t},getFil
2024-09-29 11:08:51 UTC	1369	IN	Data Raw: 74 2c 72 29 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 72 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 65 5b 72 5d 7d 29 7d 2c 6e 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 65 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 2e 72 65 73 6f 6c 76 65 28 74 28 29 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 Data Ascii: t,r)&&Object.defineProperty(t,r,{enumerable:!0,get:e[r]})},n.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},function(){"use strict";var t=function(t){var e=this.constructor;return this.then((function(n){return e.resolve(t()).then((funct
2024-09-29 11:08:51 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 75 28 74 29 7b 32 3d 3d 3d 74 2e 5f 73 74 61 74 65 26 26 30 3d 3d 3d 74 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 26 26 61 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 5f 68 61 6e 64 6c 65 64 7c 7c 61 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 46 6e 28 74 2e 5f 76 61 6c 75 65 29 7d 29 29 3b 66 6f 72 28 76 61 72 20 65 3d 30 2c 6e 3d 74 2e 5f 64 65 66 65 72 72 65 64 73 2e 6c 65 6e 67 74 68 3b 65 3c 6e 3b 65 2b 2b 29 6f 28 74 2c 74 2e 5f 64 65 66 65 72 72 65 64 73 5b 65 5d 29 3b 74 2e 5f 64 65 66 65 72 72 65 64 73 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 66 28 74 2c 65 2c 6e 29 7b 74 68 69 73 2e 6f 6e 46 75 6c 66 69 6c 6c 65 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 Data Ascii: tion u(t){2===t._state&&0===t._deferreds.length&&a._immediateFn((function(){t._handled\|\|a._unhandledRejectionFn(t._value)}));for(var e=0,n=t._deferreds.length;e<n;e++)o(t,t._deferreds[e]);t._deferreds=null}function f(t,e,n){this.onFulfilled="function"==ty
2024-09-29 11:08:51 UTC	1369	IN	Data Raw: 6e 28 65 2c 6e 29 7d 29 29 7d 2c 61 2e 5f 69 6d 6d 65 64 69 61 74 65 46 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 73 65 74 49 6d 6d 65 64 69 61 74 65 26 26 66 75 6e 63 74 69 6f 6e 28 74 29 7b 73 65 74 49 6d 6d 65 64 69 61 74 65 28 74 29 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 65 28 74 2c 30 29 7d 2c 61 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 46 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 50 6f 73 73 69 62 6c 65 20 55 6e 68 61 6e 64 6c 65 64 20 50 72 6f 6d 69 73 65 20 52 65 6a 65 63 74 69 6f 6e 3a 22 2c 74 29 7d 3b 76 61 72 20 6c 3d 61 2c 70 3d 7b 7d 3b 67 3f Data Ascii: n(e,n)}))},a._immediateFn="function"==typeof setImmediate&&function(t){setImmediate(t)}\|\|function(t){e(t,0)},a._unhandledRejectionFn=function(t){"undefined"!=typeof console&&console&&console.warn("Possible Unhandled Promise Rejection:",t)};var l=a,p={};g?
2024-09-29 11:08:51 UTC	1369	IN	Data Raw: 22 21 3d 3d 69 26 26 22 6e 75 6d 62 65 72 22 21 3d 3d 69 26 26 28 65 3d 53 74 72 69 6e 67 28 65 29 29 2c 6e 5b 72 5d 3d 65 2c 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 6b 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 74 2e 73 70 6c 69 74 28 22 3f 22 29 5b 30 5d 7d 66 75 6e 63 74 69 6f 6e 20 49 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 2b 2b 72 29 7b 76 61 72 20 61 3d 65 5b 72 5d 3b 69 66 28 49 28 61 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 61 29 66 6f 72 28 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 61 29 2c 73 3d 30 2c Data Ascii: "!==i&&"number"!==i&&(e=String(e)),n[r]=e,n}}function k(t){return t&&t.split("?")[0]}function I(t){return null!==t&&"object"==typeof t}function C(t,e,n){for(var r=0,i=e.length;r<i;++r){var a=e[r];if(I(a)\|\|"function"==typeof a)for(var o=Object.keys(a),s=0,
2024-09-29 11:08:51 UTC	1369	IN	Data Raw: 6f 6e 20 42 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 72 65 64 69 72 65 63 74 53 74 61 72 74 3e 30 7d 76 61 72 20 56 3d 7b 66 65 74 63 68 49 6e 50 72 6f 67 72 65 73 73 3a 21 31 7d 3b 66 75 6e 63 74 69 6f 6e 20 24 28 74 29 7b 72 65 74 75 72 6e 22 5f 5f 61 70 6d 5f 73 79 6d 62 6f 6c 5f 5f 22 2b 74 7d 66 75 6e 63 74 69 6f 6e 20 4a 28 74 2c 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 3d 74 3b 72 26 26 21 72 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 29 3b 29 72 3d 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 72 29 3b 21 72 26 26 74 5b 65 5d 26 26 28 72 3d 74 29 3b 76 61 72 20 69 2c 61 2c 6f 2c 73 2c 63 3d 24 28 65 29 3b 69 66 28 72 26 26 21 28 69 3d 72 5b 63 5d 29 29 7b 69 3d 72 5b 63 5d 3d 72 5b 65 5d 3b 76 61 72 20 75 3d 72 26 26 4f Data Ascii: on B(t){return t.redirectStart>0}var V={fetchInProgress:!1};function $(t){return"__apm_symbol__"+t}function J(t,e,n){for(var r=t;r&&!r.hasOwnProperty(e);)r=Object.getPrototypeOf(r);!r&&t[e]&&(r=t);var i,a,o,s,c=$(e);if(r&&!(i=r[c])){i=r[c]=r[e];var u=r&&O
2024-09-29 11:08:51 UTC	1369	IN	Data Raw: 61 74 75 73 26 26 69 28 65 2c 22 73 75 63 63 65 73 73 22 29 3a 69 28 65 2c 22 6c 6f 61 64 22 3d 3d 3d 72 3f 22 73 75 63 63 65 73 73 22 3a 72 29 7d 29 29 7d 7d 28 61 29 2c 72 2e 61 70 70 6c 79 28 65 2c 6e 29 7d 63 61 74 63 68 28 74 29 7b 74 68 72 6f 77 20 69 28 61 2c 22 65 72 72 6f 72 22 29 2c 74 7d 7d 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 6e 29 7b 65 2e 73 74 61 74 65 21 3d 3d 51 26 26 28 65 2e 73 74 61 74 65 3d 51 2c 65 2e 64 61 74 61 2e 73 74 61 74 75 73 3d 6e 2c 74 28 51 2c 65 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 74 29 7b 72 65 74 75 72 6e 21 28 30 3d 3d 3d 74 7c 7c 74 3e 33 39 39 26 26 74 3c 36 30 30 29 7d 66 75 6e 63 74 69 6f 6e 20 72 74 28 29 7b 72 65 74 75 72 6e 28 72 74 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 Data Ascii: atus&&i(e,"success"):i(e,"load"===r?"success":r)}))}}(a),r.apply(e,n)}catch(t){throw i(a,"error"),t}}}));function i(e,n){e.state!==Q&&(e.state=Q,e.data.status=n,t(Q,e))}}function nt(t){return!(0===t\|\|t>399&&t<600)}function rt(){return(rt=Object.assign\|\|fu

Timestamp	Bytes transferred	Direction	Data
2024-09-29 11:08:55 UTC	847	OUT	GET /gtag/js?id=G-11GY9GPGDG&l=_sGtmDataLayer HTTP/1.1 Host: g.sst.gpl.secureserver.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pathway=2be96445-b34a-4514-ab40-0a78dd9da835; visitor=vid=2be96445-b34a-4514-ab40-0a78dd9da835; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; fb_sessiontraffic=S_TOUCH=&pathway=2be96445-b34a-4514-ab40-0a78dd9da835&V_DATE=&pc=1&C_TOUCH=2024-09-29T11:08:49.841Z; market=en-US
2024-09-29 11:08:55 UTC	229	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 11:08:55 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 318302 Connection: close cache-control: private, max-age=900 expires: Sun, 29 Sep 2024 11:23:42 GMT
2024-09-29 11:08:55 UTC	16155	IN	Data Raw: 0a 2f 2f 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 32 20 47 6f 6f 67 6c 65 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 0a 76 61 72 20 64 61 74 61 20 3d 20 7b 0a 22 72 65 73 6f 75 72 63 65 22 3a 20 7b 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 22 31 22 2c 0a 20 20 0a 20 20 22 6d 61 63 72 6f 73 22 3a 5b 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 65 22 7d 2c 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 63 22 2c 22 76 74 70 5f 76 61 6c 75 65 22 3a 22 22 7d 2c 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 63 22 2c 22 76 74 70 5f 76 61 6c 75 65 22 3a 30 7d 5d 2c 0a 20 20 22 74 61 67 73 22 3a 5b 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 6f 67 74 5f 31 70 5f 64 61 74 61 5f 76 32 22 Data Ascii: // Copyright 2012 Google Inc. All rights reserved. (function(){var data = {"resource": { "version":"1", "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}], "tags":[{"function":"__ogt_1p_data_v2"
2024-09-29 11:08:55 UTC	16356	IN	Data Raw: 2e 69 6e 74 65 72 61 63 74 65 64 46 6f 72 6d 46 69 65 6c 64 54 79 70 65 22 5d 2c 22 66 69 72 73 74 5f 66 69 65 6c 64 5f 70 6f 73 69 74 69 6f 6e 22 2c 5b 31 36 2c 5b 31 35 2c 22 62 61 22 5d 2c 22 67 74 6d 2e 69 6e 74 65 72 61 63 74 65 64 46 6f 72 6d 46 69 65 6c 64 50 6f 73 69 74 69 6f 6e 22 5d 5d 5d 2c 5b 35 32 2c 22 62 65 22 2c 5b 38 2c 22 65 76 65 6e 74 49 64 22 2c 5b 31 37 2c 5b 31 35 2c 22 61 22 5d 2c 22 67 74 6d 45 76 65 6e 74 49 64 22 5d 5d 5d 2c 5b 22 74 22 2c 5b 31 35 2c 22 62 65 22 5d 5d 2c 5b 22 75 22 2c 5b 31 35 2c 22 62 65 22 5d 2c 5b 31 35 2c 22 62 61 22 5d 5d 2c 5b 22 76 22 2c 5b 31 35 2c 22 69 22 5d 2c 5b 31 35 2c 22 62 64 22 5d 2c 5b 31 35 2c 22 62 65 22 5d 5d 5d 5d 2c 5b 35 32 2c 22 79 22 2c 5b 31 36 2c 5b 31 35 2c 22 62 22 5d 2c 22 75 73 Data Ascii: .interactedFormFieldType"],"first_field_position",[16,[15,"ba"],"gtm.interactedFormFieldPosition"]]],[52,"be",[8,"eventId",[17,[15,"a"],"gtmEventId"]]],["t",[15,"be"]],["u",[15,"be"],[15,"ba"]],["v",[15,"i"],[15,"bd"],[15,"be"]]]],[52,"y",[16,[15,"b"],"us
2024-09-29 11:08:55 UTC	16384	IN	Data Raw: 35 2c 22 6a 22 5d 5d 2c 5b 34 36 2c 5b 32 2c 5b 31 35 2c 22 6b 22 5d 2c 22 73 65 74 48 69 74 44 61 74 61 22 2c 5b 37 2c 22 6c 69 6e 6b 5f 69 64 22 2c 5b 34 34 5d 5d 5d 2c 5b 32 2c 5b 31 35 2c 22 6b 22 5d 2c 22 73 65 74 48 69 74 44 61 74 61 22 2c 5b 37 2c 22 6c 69 6e 6b 5f 75 72 6c 22 2c 5b 34 34 5d 5d 5d 2c 5b 32 2c 5b 31 35 2c 22 6b 22 5d 2c 22 73 65 74 48 69 74 44 61 74 61 22 2c 5b 37 2c 22 6c 69 6e 6b 5f 74 65 78 74 22 2c 5b 34 34 5d 5d 5d 2c 5b 32 2c 5b 31 35 2c 22 6b 22 5d 2c 22 73 65 74 48 69 74 44 61 74 61 22 2c 5b 37 2c 22 66 69 6c 65 5f 6e 61 6d 65 22 2c 5b 34 34 5d 5d 5d 2c 5b 32 2c 5b 31 35 2c 22 6b 22 5d 2c 22 73 65 74 48 69 74 44 61 74 61 22 2c 5b 37 2c 22 66 69 6c 65 5f 65 78 74 65 6e 73 69 6f 6e 22 2c 5b 34 34 5d 5d 5d 5d 5d 5d 5d 5d 2c 5b Data Ascii: 5,"j"]],[46,[2,[15,"k"],"setHitData",[7,"link_id",[44]]],[2,[15,"k"],"setHitData",[7,"link_url",[44]]],[2,[15,"k"],"setHitData",[7,"link_text",[44]]],[2,[15,"k"],"setHitData",[7,"file_name",[44]]],[2,[15,"k"],"setHitData",[7,"file_extension",[44]]]]]]]],[
2024-09-29 11:08:55 UTC	16384	IN	Data Raw: 61 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 21 21 74 68 69 73 2e 76 61 6c 75 65 73 2e 68 61 73 28 61 29 7c 7c 21 28 21 74 68 69 73 2e 70 61 72 65 6e 74 7c 7c 21 74 68 69 73 2e 70 61 72 65 6e 74 2e 68 61 73 28 61 29 29 7d 3b 76 61 72 20 46 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 6e 65 77 20 43 61 28 61 2e 50 2c 61 29 3b 61 2e 43 26 26 28 62 2e 43 3d 61 2e 43 29 3b 62 2e 46 3d 61 2e 46 3b 62 2e 6a 3d 61 2e 6a 3b 72 65 74 75 72 6e 20 62 7d 3b 43 61 2e 70 72 6f 74 6f 74 79 70 65 2e 72 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 50 7d 3b 43 61 2e 70 72 6f 74 6f 74 79 70 65 2e 4a 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 4b 3d 21 30 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 61 28 61 2c Data Ascii: as=function(a){return!!this.values.has(a)\|\|!(!this.parent\|\|!this.parent.has(a))};var Fa=function(a){var b=new Ca(a.P,a);a.C&&(b.C=a.C);b.F=a.F;b.j=a.j;return b};Ca.prototype.rd=function(){return this.P};Ca.prototype.Ja=function(){this.K=!0};function Ga(a,
2024-09-29 11:08:55 UTC	16384	IN	Data Raw: 2e 6b 65 79 73 2e 70 75 73 68 28 61 29 3b 74 68 69 73 2e 76 61 6c 75 65 73 2e 70 75 73 68 28 62 29 7d 3b 59 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 74 68 69 73 2e 6b 65 79 73 2e 69 6e 64 65 78 4f 66 28 61 29 3b 69 66 28 62 3e 2d 31 29 72 65 74 75 72 6e 20 74 68 69 73 2e 76 61 6c 75 65 73 5b 62 5d 7d 3b 66 75 6e 63 74 69 6f 6e 20 5a 63 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 4d 61 70 3f 6e 65 77 20 58 63 3a 6e 65 77 20 59 63 7d 63 61 74 63 68 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 59 63 7d 7d 3b 76 61 72 20 24 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 24 63 29 72 65 74 75 72 6e 20 61 3b 69 66 28 52 61 28 61 29 29 74 68 72 6f 77 20 45 72 72 Data Ascii: .keys.push(a);this.values.push(b)};Yc.prototype.get=function(a){var b=this.keys.indexOf(a);if(b>-1)return this.values[b]};function Zc(){try{return Map?new Xc:new Yc}catch(a){return new Yc}};var $c=function(a){if(a instanceof $c)return a;if(Ra(a))throw Err
2024-09-29 11:08:55 UTC	7570	IN	Data Raw: 28 35 39 2c 74 65 29 3b 62 28 36 30 2c 70 65 29 3b 62 28 36 31 2c 71 65 29 3b 62 28 36 32 2c 73 65 29 3b 62 28 35 33 2c 6e 64 29 3b 62 28 34 2c 6f 64 29 3b 62 28 35 2c 70 64 29 3b 62 28 35 32 2c 71 64 29 3b 62 28 36 2c 72 64 29 3b 62 28 34 39 2c 75 64 29 3b 62 28 37 2c 55 64 29 3b 62 28 38 2c 56 64 29 3b 62 28 39 2c 70 64 29 3b 62 28 35 30 2c 76 64 29 3b 62 28 31 30 2c 77 64 29 3b 62 28 31 32 2c 78 64 29 3b 62 28 31 33 2c 79 64 29 3b 62 28 35 31 2c 4a 64 29 3b 62 28 34 37 2c 42 64 29 3b 62 28 35 34 2c 43 64 29 3b 62 28 35 35 2c 44 64 29 3b 62 28 36 33 2c 49 64 29 3b 62 28 36 34 2c 45 64 29 3b 62 28 36 35 2c 47 64 29 3b 62 28 36 36 2c 48 64 29 3b 62 28 31 35 2c 4b 64 29 3b 62 28 31 36 2c 4d 64 29 3b 62 28 31 37 2c 4d 64 29 3b 62 28 31 38 2c 4e 64 29 3b 62 Data Ascii: (59,te);b(60,pe);b(61,qe);b(62,se);b(53,nd);b(4,od);b(5,pd);b(52,qd);b(6,rd);b(49,ud);b(7,Ud);b(8,Vd);b(9,pd);b(50,vd);b(10,wd);b(12,xd);b(13,yd);b(51,Jd);b(47,Bd);b(54,Cd);b(55,Dd);b(63,Id);b(64,Ed);b(65,Gd);b(66,Hd);b(15,Kd);b(16,Md);b(17,Md);b(18,Nd);b
2024-09-29 11:08:55 UTC	16384	IN	Data Raw: 26 26 28 65 5b 70 5d 3d 72 2e 46 6a 29 7d 29 3b 0a 63 2e 43 5b 67 5d 3d 66 75 6e 63 74 69 6f 6e 28 70 2c 71 29 7b 76 61 72 20 72 3d 6e 5b 70 5d 3b 69 66 28 21 72 29 74 68 72 6f 77 20 4f 66 28 70 2c 7b 7d 2c 22 54 68 65 20 72 65 71 75 65 73 74 65 64 20 70 65 72 6d 69 73 73 69 6f 6e 20 22 2b 70 2b 22 20 69 73 20 6e 6f 74 20 63 6f 6e 66 69 67 75 72 65 64 2e 22 29 3b 76 61 72 20 74 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 30 29 3b 72 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 74 29 3b 66 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 74 29 3b 76 61 72 20 75 3d 65 5b 70 5d 3b 75 26 26 75 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 5b 6d 5d 2e 63 6f 6e 63 61 74 28 6d 61 28 74 2e 73 6c 69 63 65 28 31 29 Data Ascii: &&(e[p]=r.Fj)});c.C[g]=function(p,q){var r=n[p];if(!r)throw Of(p,{},"The requested permission "+p+" is not configured.");var t=Array.prototype.slice.call(arguments,0);r.apply(void 0,t);f.apply(void 0,t);var u=e[p];u&&u.apply(null,[m].concat(ma(t.slice(1)
2024-09-29 11:08:55 UTC	16384	IN	Data Raw: 2f 5e 5c 53 2b 40 5c 53 2b 5c 2e 5c 53 2b 24 2f 2c 4b 68 3d 2f 5e 5c 2b 5c 64 7b 31 30 2c 31 35 7d 24 2f 2c 49 68 3d 2f 5b 2e 7e 5d 2f 67 2c 74 68 3d 2f 5e 5b 30 2d 39 41 2d 5a 61 2d 7a 5f 2d 5d 7b 34 33 7d 24 2f 2c 4d 68 3d 7b 7d 2c 72 68 3d 28 4d 68 2e 65 6d 61 69 6c 3d 22 65 6d 22 2c 4d 68 2e 70 68 6f 6e 65 5f 6e 75 6d 62 65 72 3d 22 70 6e 22 2c 4d 68 2e 66 69 72 73 74 5f 6e 61 6d 65 3d 22 66 6e 22 2c 0a 4d 68 2e 6c 61 73 74 5f 6e 61 6d 65 3d 22 6c 6e 22 2c 4d 68 2e 73 74 72 65 65 74 3d 22 73 61 22 2c 4d 68 2e 63 69 74 79 3d 22 63 74 22 2c 4d 68 2e 72 65 67 69 6f 6e 3d 22 72 67 22 2c 4d 68 2e 63 6f 75 6e 74 72 79 3d 22 63 6f 22 2c 4d 68 2e 70 6f 73 74 61 6c 5f 63 6f 64 65 3d 22 70 63 22 2c 4d 68 2e 65 72 72 6f 72 5f 63 6f 64 65 3d 22 65 63 22 2c 4d 68 Data Ascii: /^\S+@\S+\.\S+$/,Kh=/^\+\d{10,15}$/,Ih=/[.~]/g,th=/^[0-9A-Za-z_-]{43}$/,Mh={},rh=(Mh.email="em",Mh.phone_number="pn",Mh.first_name="fn",Mh.last_name="ln",Mh.street="sa",Mh.city="ct",Mh.region="rg",Mh.country="co",Mh.postal_code="pc",Mh.error_code="ec",Mh
2024-09-29 11:08:55 UTC	16384	IN	Data Raw: 6a 3a 22 47 2d 31 31 47 59 39 47 50 47 44 47 7c 47 54 2d 4e 4e 58 4a 37 35 42 33 22 2c 53 6a 3a 22 47 2d 31 31 47 59 39 47 50 47 44 47 22 7d 3b 79 6a 2e 6f 65 3d 76 62 28 22 22 29 3b 66 75 6e 63 74 69 6f 6e 20 41 6a 28 29 7b 76 61 72 20 61 3d 42 6a 28 29 3b 72 65 74 75 72 6e 20 7a 6a 3f 61 2e 6d 61 70 28 43 6a 29 3a 61 7d 66 75 6e 63 74 69 6f 6e 20 44 6a 28 29 7b 76 61 72 20 61 3d 45 6a 28 29 3b 72 65 74 75 72 6e 20 7a 6a 3f 61 2e 6d 61 70 28 43 6a 29 3a 61 7d 66 75 6e 63 74 69 6f 6e 20 46 6a 28 29 7b 72 65 74 75 72 6e 20 47 6a 28 4e 66 2e 63 74 69 64 29 7d 66 75 6e 63 74 69 6f 6e 20 48 6a 28 29 7b 72 65 74 75 72 6e 20 47 6a 28 4e 66 2e 63 61 6e 6f 6e 69 63 61 6c 43 6f 6e 74 61 69 6e 65 72 49 64 7c 7c 22 5f 22 2b 4e 66 2e 63 74 69 64 29 7d 66 75 6e 63 74 Data Ascii: j:"G-11GY9GPGDG\|GT-NNXJ75B3",Sj:"G-11GY9GPGDG"};yj.oe=vb("");function Aj(){var a=Bj();return zj?a.map(Cj):a}function Dj(){var a=Ej();return zj?a.map(Cj):a}function Fj(){return Gj(Nf.ctid)}function Hj(){return Gj(Nf.canonicalContainerId\|\|"_"+Nf.ctid)}funct
2024-09-29 11:08:55 UTC	16384	IN	Data Raw: 69 6a 28 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 22 29 2c 22 2f 61 22 2c 55 6c 5d 2c 65 3d 6c 28 53 6c 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 21 66 2e 64 6f 6e 65 3b 66 3d 65 2e 6e 65 78 74 28 29 29 66 6f 72 28 76 61 72 20 67 3d 66 2e 76 61 6c 75 65 2c 6b 3d 67 28 7b 65 76 65 6e 74 49 64 3a 63 2c 69 63 3a 21 21 61 7d 29 2c 6d 3d 6c 28 6b 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e 65 78 74 28 29 29 7b 76 61 72 20 70 3d 6c 28 6e 2e 76 61 6c 75 65 29 2c 71 3d 70 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 2c 72 3d 70 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 3b 64 2e 70 75 73 68 28 22 26 22 2b 71 2b 22 3d 22 2b 72 29 7d 64 2e 70 75 73 68 28 22 26 7a 3d 30 22 29 3b 72 65 74 Data Ascii: ij("https://www.googletagmanager.com"),"/a",Ul],e=l(Sl),f=e.next();!f.done;f=e.next())for(var g=f.value,k=g({eventId:c,ic:!!a}),m=l(k),n=m.next();!n.done;n=m.next()){var p=l(n.value),q=p.next().value,r=p.next().value;d.push("&"+q+"="+r)}d.push("&z=0");ret