Edit tour

Windows Analysis Report
http://click.pstmrk.it

Overview

General Information

Sample URL:	http://click.pstmrk.it
Analysis ID:	1523385
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML page contains obfuscated javascript

Found iframes

HTML body with high number of embedded SVGs detected

HTML page contains hidden javascript code

Javascript checks online IP of machine

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2360,i,2018478157920290478,6616231166358940807,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://click.pstmrk.it" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /rest/v1/delivery?client=activecampaign&sessionId=92d650f80f434dbcb265966e6fa64906&version=2.10.0 HTTP/1.1Host: activecampaign.tt.omtrdc.netConnection: keep-aliveContent-Length: 1148sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plainAccept: */*Origin: https://www.activecampaign.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_itAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NQ88L9R
Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1041526640?random=1727787552985&cv=11&fst=1727787552985&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49u0v9137167425z876440134za201&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685~101747727&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.activecampaign.com%2F%3Futm_source%3Dpostmark%26utm_medium%3Dreferral%26utm_campaign%3Dpstmrk_it&hn=www.googleadservices.com&frm=0&tiba=Marketing%20automation%20for%20any%20business%20%7C%20ActiveCampaign&npa=0&pscdl=noapi&auid=10142707.1727787551&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=conversion_language%3Den%3Bconversion_format%3D3%3Bconversion_color%3Dffffff%3Bremarketing_only%3Dtrue
Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1041526640?random=1727787553068&cv=11&fst=1727787553068&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49u0v9137167425z876440134za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685~101747727&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.activecampaign.com%2F%3Futm_source%3Dpostmark%26utm_medium%3Dreferral%26utm_campaign%3Dpstmrk_it&hn=www.googleadservices.com&frm=0&tiba=Marketing%20automation%20for%20any%20business%20%7C%20ActiveCampaign&npa=0&pscdl=noapi&auid=10142707.1727787551&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-E6ECC8RCG8&gacid=412970438.1727787553&gtm=45je49u0v884833549z876440134za200zb76440134&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101671035~101686685~101747727&z=1999434406
Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: Iframe src: https://activecampaign.demdex.net/dest5.html?d_nsid=0#https%3A%2F%2Fwww.activecampaign.com
Source: https://www.activecampaign.com/pricing	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NQ88L9R
Source: https://www.activecampaign.com/pricing	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1041526640?random=1727787608797&cv=11&fst=1727787608797&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49u0v9137167425z876440134za201&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685~101747727&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.activecampaign.com%2Fpricing&hn=www.googleadservices.com&frm=0&tiba=Platform%20Pricing%20%26%20Features%20%7C%20ActiveCampaign&npa=0&pscdl=noapi&auid=10142707.1727787551&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=conversion_language%3Den%3Bconversion_format%3D3%3Bconversion_color%3Dffffff%3Bremarketing_only%3Dtrue
Source: https://www.activecampaign.com/pricing	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1041526640?random=1727787609107&cv=11&fst=1727787609107&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be49u0v9137167425z876440134za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101686685~101747727&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.activecampaign.com%2Fpricing&hn=www.googleadservices.com&frm=0&tiba=Platform%20Pricing%20%26%20Features%20%7C%20ActiveCampaign&npa=0&pscdl=noapi&auid=10142707.1727787551&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config

Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: Total embedded SVG size: 264701
Source: https://www.activecampaign.com/pricing	HTTP Parser: Total embedded SVG size: 365926

Source: https://s3-us-west-2.amazonaws.com/b2bjsstore/b/DNXY8HK85XO0/reb2b.js.gz	HTTP Parser: function b2bretention(){this[_0x46032c(-0x121,-0xf1)]=![],this[_0x46032c(-0xea,-0xf0)]=![],this['valid_domain']=![],this[_0x46032c(-0x11c,-0xef)]=![],this[_0x46032c(-0xe3,-0xee)]=!![],this[_0x46032c(-0xd4,-0xed)]=![],this[_0x46032c(-0xee,-0xec)]=![],this[_0x46032c(-0xb5,-0xeb)]='',this[_0x46032c(-0xd3,-0xea)]=![],this[_0x46032c(-0xbc,-0xe9)]=![],this['has_console']=window[_0x46032c(-0x112,-0xe8)]&&console[_0x46032c(-0xa4,-0xe7)],this[_0x46032c(-0xc5,-0xe6)]=document['currentscript'][_0x46032c(-0xfa,-0xe5)],this['label']=_0x46032c(-0xf8,-0xe4),this[_0x46032c(-0xd4,-0xe3)]=null,this[_0x46032c(-0x12c,-0xe2)]=1;function _0x46032c(_0x24feb8,_0xbf2828){return _0x3497(_0xbf2828- -0xf1,_0x24feb8);}this['domains']=['activecampaign.com'],this[_0x46032c(-0x11c,-0xe1)]=false,this[_0x46032c(-0x106,-0xe0)]=true,this[_0x46032c(-0xb6,-0xdf)]=false,this[_0x46032c(-0xd6,-0xde)]='9xgnrndqve';}function _0x3497(_0xdacc47,_0x34978c){const _0x14fc96=_0xdacc();return _0x3497=function(_0x2a8d57,_0x71965f){_0x2a8d57=_0x2a8d57-0x0;let ...
Source: https://cdn.vector.co/pixel.js	HTTP Parser: /! for license information please see pixel.js.license.txt /(()=>{var t={851:(t,e,r)=>{function n(t){return n="function"==typeof symbol&&"symbol"==typeof symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof symbol&&t.constructor===symbol&&t!==symbol.prototype?"symbol":typeof t},n(t)}function o(){"use strict";o=function(){return e};var t,e={},r=object.prototype,i=r.hasownproperty,a=object.defineproperty\|\|function(t,e,r){t[e]=r.value},c="function"==typeof symbol?symbol:{},u=c.iterator\|\|"@@iterator",s=c.asynciterator\|\|"@@asynciterator",l=c.tostringtag\|\|"@@tostringtag";function f(t,e,r){return object.defineproperty(t,e,{value:r,enumerable:!0,configurable:!0,writable:!0}),t[e]}try{f({},"")}catch(t){f=function(t,e,r){return t[e]=r}}function h(t,e,r,n){var o=e&&e.prototype instanceof w?e:w,i=object.create(o.prototype),c=new n(n\|\|[]);return a(i,"_invoke",{value:s(t,r,c)}),i}function p(t,e,r){try{return{type:"normal",arg:t.call(e,r)}}catch(t){return{type:"throw",arg:t}}}e.wrap=h;var...

Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: No favicon
Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: No favicon
Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: No favicon
Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: No favicon
Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: No favicon
Source: https://postmarkapp.com/support/article/1059-what-is-pstmrk-it	HTTP Parser: No favicon
Source: https://postmarkapp.com/	HTTP Parser: No favicon
Source: https://postmarkapp.com/	HTTP Parser: No favicon
Source: https://www.activecampaign.com/pricing	HTTP Parser: No favicon
Source: https://www.activecampaign.com/pricing	HTTP Parser: No favicon

Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: No <meta name="author".. found
Source: https://www.activecampaign.com/pricing	HTTP Parser: No <meta name="author".. found

Source: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it	HTTP Parser: No <meta name="copyright".. found
Source: https://www.activecampaign.com/pricing	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50144 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 3.212.39.155
Source: unknown	TCP traffic detected without corresponding DNS query: 3.212.39.155
Source: unknown	TCP traffic detected without corresponding DNS query: 3.212.39.155
Source: unknown	TCP traffic detected without corresponding DNS query: 3.212.39.155
Source: unknown	TCP traffic detected without corresponding DNS query: 3.212.39.155
Source: unknown	TCP traffic detected without corresponding DNS query: 3.212.39.155
Source: unknown	TCP traffic detected without corresponding DNS query: 3.212.39.155
Source: unknown	TCP traffic detected without corresponding DNS query: 3.212.39.155
Source: unknown	TCP traffic detected without corresponding DNS query: 3.212.39.155

Source: chromecache_699.2.dr	String found in binary or memory: experiences.","image":{"@type":"ImageObject","height":"180","url":"https://active-campaign.transforms.svdcdn.com/production/general/favicon-180x180.png?w=180&h=180&auto=compress%2Cformat&fit=crop&dm=1711378072&s=e47ca48b5de91500e10d322a0a1e3fc2","width":"180"},"inLanguage":"en","name":"ActiveCampaign","sameAs":["https://twitter.com/ActiveCampaign","https://www.facebook.com/activecampaign","https://www.linkedin.com/company/activecampaign","https://www.instagram.com/activecampaign"],"url":"https://www.activecampaign.com"},{"@id":"#creator","@type":"Organization"},{"@type":"BreadcrumbList","description":"Breadcrumbs list","itemListElement":[{"@type":"ListItem","item":"https://www.activecampaign.com","name":"Homepage","position":1},{"@type":"ListItem","item":"https://www.activecampaign.com/pricing","name":"Pricing","position":2}],"name":"Breadcrumbs"}]}</script> equals www.facebook.com (Facebook)
Source: chromecache_699.2.dr	String found in binary or memory: experiences.","image":{"@type":"ImageObject","height":"180","url":"https://active-campaign.transforms.svdcdn.com/production/general/favicon-180x180.png?w=180&h=180&auto=compress%2Cformat&fit=crop&dm=1711378072&s=e47ca48b5de91500e10d322a0a1e3fc2","width":"180"},"inLanguage":"en","name":"ActiveCampaign","sameAs":["https://twitter.com/ActiveCampaign","https://www.facebook.com/activecampaign","https://www.linkedin.com/company/activecampaign","https://www.instagram.com/activecampaign"],"url":"https://www.activecampaign.com"},{"@id":"#creator","@type":"Organization"},{"@type":"BreadcrumbList","description":"Breadcrumbs list","itemListElement":[{"@type":"ListItem","item":"https://www.activecampaign.com","name":"Homepage","position":1},{"@type":"ListItem","item":"https://www.activecampaign.com/pricing","name":"Pricing","position":2}],"name":"Breadcrumbs"}]}</script> equals www.linkedin.com (Linkedin)
Source: chromecache_699.2.dr	String found in binary or memory: experiences.","image":{"@type":"ImageObject","height":"180","url":"https://active-campaign.transforms.svdcdn.com/production/general/favicon-180x180.png?w=180&h=180&auto=compress%2Cformat&fit=crop&dm=1711378072&s=e47ca48b5de91500e10d322a0a1e3fc2","width":"180"},"inLanguage":"en","name":"ActiveCampaign","sameAs":["https://twitter.com/ActiveCampaign","https://www.facebook.com/activecampaign","https://www.linkedin.com/company/activecampaign","https://www.instagram.com/activecampaign"],"url":"https://www.activecampaign.com"},{"@id":"#creator","@type":"Organization"},{"@type":"BreadcrumbList","description":"Breadcrumbs list","itemListElement":[{"@type":"ListItem","item":"https://www.activecampaign.com","name":"Homepage","position":1},{"@type":"ListItem","item":"https://www.activecampaign.com/pricing","name":"Pricing","position":2}],"name":"Breadcrumbs"}]}</script> equals www.twitter.com (Twitter)
Source: chromecache_715.2.dr	String found in binary or memory: experiences.","image":{"@type":"ImageObject","height":"180","url":"https://active-campaign.transforms.svdcdn.com/production/general/favicon-180x180.png?w=180&h=180&auto=compress%2Cformat&fit=crop&dm=1711378072&s=e47ca48b5de91500e10d322a0a1e3fc2","width":"180"},"inLanguage":"en","name":"ActiveCampaign","sameAs":["https://twitter.com/ActiveCampaign","https://www.facebook.com/activecampaign","https://www.linkedin.com/company/activecampaign","https://www.instagram.com/activecampaign"],"url":"https://www.activecampaign.com"},{"@id":"#creator","@type":"Organization"},{"@type":"BreadcrumbList","description":"Breadcrumbs list","itemListElement":[{"@type":"ListItem","item":"https://www.activecampaign.com","name":"Homepage","position":1}],"name":"Breadcrumbs"}]}</script> equals www.facebook.com (Facebook)
Source: chromecache_715.2.dr	String found in binary or memory: experiences.","image":{"@type":"ImageObject","height":"180","url":"https://active-campaign.transforms.svdcdn.com/production/general/favicon-180x180.png?w=180&h=180&auto=compress%2Cformat&fit=crop&dm=1711378072&s=e47ca48b5de91500e10d322a0a1e3fc2","width":"180"},"inLanguage":"en","name":"ActiveCampaign","sameAs":["https://twitter.com/ActiveCampaign","https://www.facebook.com/activecampaign","https://www.linkedin.com/company/activecampaign","https://www.instagram.com/activecampaign"],"url":"https://www.activecampaign.com"},{"@id":"#creator","@type":"Organization"},{"@type":"BreadcrumbList","description":"Breadcrumbs list","itemListElement":[{"@type":"ListItem","item":"https://www.activecampaign.com","name":"Homepage","position":1}],"name":"Breadcrumbs"}]}</script> equals www.linkedin.com (Linkedin)
Source: chromecache_715.2.dr	String found in binary or memory: experiences.","image":{"@type":"ImageObject","height":"180","url":"https://active-campaign.transforms.svdcdn.com/production/general/favicon-180x180.png?w=180&h=180&auto=compress%2Cformat&fit=crop&dm=1711378072&s=e47ca48b5de91500e10d322a0a1e3fc2","width":"180"},"inLanguage":"en","name":"ActiveCampaign","sameAs":["https://twitter.com/ActiveCampaign","https://www.facebook.com/activecampaign","https://www.linkedin.com/company/activecampaign","https://www.instagram.com/activecampaign"],"url":"https://www.activecampaign.com"},{"@id":"#creator","@type":"Organization"},{"@type":"BreadcrumbList","description":"Breadcrumbs list","itemListElement":[{"@type":"ListItem","item":"https://www.activecampaign.com","name":"Homepage","position":1}],"name":"Breadcrumbs"}]}</script> equals www.twitter.com (Twitter)
Source: chromecache_699.2.dr, chromecache_715.2.dr	String found in binary or memory: <meta content="https://www.facebook.com/activecampaign" property="og:see_also"> equals www.facebook.com (Facebook)
Source: chromecache_699.2.dr, chromecache_715.2.dr	String found in binary or memory: <meta content="https://www.linkedin.com/company/activecampaign" property="og:see_also"> equals www.linkedin.com (Linkedin)
Source: chromecache_366.2.dr, chromecache_447.2.dr, chromecache_582.2.dr, chromecache_423.2.dr, chromecache_418.2.dr, chromecache_548.2.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},dk:function(){e=zb()},od:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),KC=["www.youtube.com","www.youtube-nocookie.com"],LC,MC=!1; equals www.youtube.com (Youtube)
Source: chromecache_337.2.dr, chromecache_631.2.dr, chromecache_607.2.dr, chromecache_410.2.dr, chromecache_551.2.dr, chromecache_556.2.dr, chromecache_582.2.dr, chromecache_418.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=qA(a,c,e);Q(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return Q(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},tA=function(){var a=[],b=function(c){return ob(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	String found in binary or memory: class="block w-md h-md text-theme-color" href="https://www.facebook.com/activecampaign" title="Facebook" rel="noopener noreferrer" target="_blank" aria-label="Visit ActiveCampaign on Facebook"> equals www.facebook.com (Facebook)
Source: chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	String found in binary or memory: class="block w-md h-md text-theme-color" href="https://www.linkedin.com/company/activecampaign" title="LinkedIn" rel="noopener noreferrer" target="_blank" aria-label="Visit ActiveCampaign on LinkedIn"> equals www.linkedin.com (Linkedin)
Source: chromecache_366.2.dr, chromecache_447.2.dr, chromecache_582.2.dr, chromecache_423.2.dr, chromecache_418.2.dr, chromecache_548.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={ih:e,gh:f,hh:g,Sh:k,Th:m,Ie:n,Bb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(VC(w,"iframe_api")\|\|VC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!MC&&TC(x[A],p.Ie))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_534.2.dr, chromecache_337.2.dr, chromecache_631.2.dr, chromecache_331.2.dr, chromecache_607.2.dr, chromecache_410.2.dr, chromecache_633.2.dr, chromecache_551.2.dr, chromecache_629.2.dr, chromecache_671.2.dr, chromecache_556.2.dr, chromecache_417.2.dr	String found in binary or memory: return b}IC.F="internal.enableAutoEventOnTimer";var gc=ja(["data-gtm-yt-inspected-"]),KC=["www.youtube.com","www.youtube-nocookie.com"],LC,MC=!1; equals www.youtube.com (Youtube)
Source: chromecache_446.2.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_446.2.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_446.2.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/",TOPICS_API_ENDPOINT:"https://www.facebook.com/privacy_sandbox/topics/registration/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_534.2.dr, chromecache_337.2.dr, chromecache_631.2.dr, chromecache_607.2.dr, chromecache_410.2.dr, chromecache_633.2.dr, chromecache_551.2.dr, chromecache_556.2.dr, chromecache_582.2.dr, chromecache_727.2.dr, chromecache_418.2.dr, chromecache_482.2.dr	String found in binary or memory: var XB=function(a,b,c,d,e){var f=Oz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Oz("fsl","nv.ids",[]):Oz("fsl","ids",[]);if(!g.length)return!0;var k=Tz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);Q(121);if(m==="https://www.facebook.com/tr/")return Q(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!By(k,Dy(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: click.pstmrk.it
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: pstmrk.it
Source: global traffic	DNS traffic detected: DNS query: www.activecampaign.com
Source: global traffic	DNS traffic detected: DNS query: active-campaign.transforms.svdcdn.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: js.sentry-cdn.com
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: j.6sc.co
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: www.redditstatic.com
Source: global traffic	DNS traffic detected: DNS query: activecampaign.tt.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: activecampaign.demdex.net
Source: global traffic	DNS traffic detected: DNS query: static.ads-twitter.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: a.quora.com
Source: global traffic	DNS traffic detected: DNS query: diffuser-cdn.app-us1.com
Source: global traffic	DNS traffic detected: DNS query: tracking.g2crowd.com
Source: global traffic	DNS traffic detected: DNS query: dx.mountain.com
Source: global traffic	DNS traffic detected: DNS query: client.prod.mplat-ppcprotect.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: a.usbrowserspeed.com
Source: global traffic	DNS traffic detected: DNS query: assets.apollo.io
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: pixel-config.reddit.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: cm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: aplo-evnt.com
Source: global traffic	DNS traffic detected: DNS query: script.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: alb.reddit.com
Source: global traffic	DNS traffic detected: DNS query: pclick.prod.mplat-ppcprotect.com
Source: global traffic	DNS traffic detected: DNS query: prism.app-us1.com
Source: global traffic	DNS traffic detected: DNS query: active-campaign.files.svdcdn.com
Source: global traffic	DNS traffic detected: DNS query: www.hockeystack.com
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: a.omappapi.com
Source: global traffic	DNS traffic detected: DNS query: c.6sc.co
Source: global traffic	DNS traffic detected: DNS query: ipv6.6sc.co
Source: global traffic	DNS traffic detected: DNS query: eps.6sc.co
Source: global traffic	DNS traffic detected: DNS query: static.zdassets.com
Source: global traffic	DNS traffic detected: DNS query: b.6sc.co
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api.omappapi.com
Source: global traffic	DNS traffic detected: DNS query: ekr.zdassets.com
Source: global traffic	DNS traffic detected: DNS query: px.mountain.com
Source: global traffic	DNS traffic detected: DNS query: a.trstplse.com
Source: global traffic	DNS traffic detected: DNS query: solve-widget.forethought.ai
Source: global traffic	DNS traffic detected: DNS query: gs.mountain.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: api.trstplse.com
Source: global traffic	DNS traffic detected: DNS query: solve-api.forethought.ai
Source: global traffic	DNS traffic detected: DNS query: cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: prodhostedtest.zendesk.com
Source: global traffic	DNS traffic detected: DNS query: o185886.ingest.sentry.io
Source: global traffic	DNS traffic detected: DNS query: d3tnn7lar6ozas.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: postmarkapp.com
Source: global traffic	DNS traffic detected: DNS query: www.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: assets-useast2.postmarkapp.com
Source: global traffic	DNS traffic detected: DNS query: rwd.postmarkapp.com
Source: global traffic	DNS traffic detected: DNS query: sp.postmarkapp.com
Source: global traffic	DNS traffic detected: DNS query: t.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: c.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: craft-assets.postmarkapp.com
Source: global traffic	DNS traffic detected: DNS query: sessions.bugsnag.com
Source: global traffic	DNS traffic detected: DNS query: tag.clearbitscripts.com
Source: global traffic	DNS traffic detected: DNS query: x.clearbitjs.com
Source: global traffic	DNS traffic detected: DNS query: ws.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: content.hotjar.io
Source: global traffic	DNS traffic detected: DNS query: app.clearbit.com
Source: global traffic	DNS traffic detected: DNS query: s3-us-west-2.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: pro.ip-api.com
Source: global traffic	DNS traffic detected: DNS query: click.prod.mplat-ppcprotect.com
Source: global traffic	DNS traffic detected: DNS query: cdn.vector.co
Source: global traffic	DNS traffic detected: DNS query: alocdn.com
Source: global traffic	DNS traffic detected: DNS query: billing-product-catalog.cluster.app-us1.com
Source: global traffic	DNS traffic detected: DNS query: api.vector.co
Source: global traffic	DNS traffic detected: DNS query: w3-reporting-nel.reddit.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: b-code.liadm.com
Source: global traffic	DNS traffic detected: DNS query: trackcmp.net
Source: global traffic	DNS traffic detected: DNS query: vc.hotjar.io
Source: global traffic	DNS traffic detected: DNS query: idx.liadm.com
Source: global traffic	DNS traffic detected: DNS query: rp.liadm.com
Source: global traffic	DNS traffic detected: DNS query: d-code.liadm.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/javascript;charset=utf-8Content-Length: 82Connection: closecache-control: private, max-age=600vary: Accept-Encodingdate: Tue, 01 Oct 2024 12:59:50 GMTx-envoy-response-flags: -server: Clearbitstrict-transport-security: max-age=63072000; includeSubDomains; preloadx-content-type-options: nosniffX-Cache: Error from cloudfrontVia: 1.1 08144b62d8ba59c510ae7682981f36c0.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P9X-Amz-Cf-Id: 1rdZrRIcmhFAxEfw7WJYM53ECoPspI3fTBD4nUtmj3xtHAXJEILj5w==
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencache-control: private, max-age=600content-type: application/jsonvary: Accept-Encodingcontent-length: 28date: Tue, 01 Oct 2024 12:59:51 GMTx-envoy-response-flags: -server: Clearbitstrict-transport-security: max-age=63072000; includeSubDomains; preloadx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencache-control: private, max-age=600content-type: application/jsonvary: Accept-Encodingcontent-length: 28date: Tue, 01 Oct 2024 12:59:51 GMTx-envoy-response-flags: -server: Clearbitstrict-transport-security: max-age=63072000; includeSubDomains; preloadx-content-type-options: nosniffconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 01 Oct 2024 13:00:19 GMTContent-Type: application/json; charset=utf-8Content-Length: 34Connection: closex-powered-by: Expressaccess-control-allow-origin: *etag: W/"22-MnP2DXh+JV9+bkb84v6/bs6Ql8A"x-do-app-origin: 5284eb6e-18fd-4ef7-b770-2d956bd47506Cache-Control: privatex-do-orig-status: 404CF-Cache-Status: MISSServer: cloudflareCF-RAY: 8cbca28bdf5ac40e-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 01 Oct 2024 13:00:19 GMTContent-Type: application/json; charset=utf-8Content-Length: 34Connection: closex-powered-by: Expressaccess-control-allow-origin: *etag: W/"22-MnP2DXh+JV9+bkb84v6/bs6Ql8A"x-do-app-origin: 5284eb6e-18fd-4ef7-b770-2d956bd47506Cache-Control: privatex-do-orig-status: 404CF-Cache-Status: MISSServer: cloudflareCF-RAY: 8cbca28faee4c440-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 01 Oct 2024 13:00:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 8cbca2686a0343bd-EWRCF-Cache-Status: DYNAMICCache-Control: max-age=31536000Set-Cookie: SERVD_LOGGED_IN_STATUS=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/; HttpOnly; SameSite=LaxStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadaccess-control-allow-headers: access-control-allow-methods: access-control-expose-headers: *x-content-type-options: nosniffx-xss-protection: 1; mode=blockServer: cloudflare
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 01 Oct 2024 13:00:21 GMTContent-Type: application/json; charset=utf-8Content-Length: 34Connection: closex-powered-by: Expressaccess-control-allow-origin: *etag: W/"22-MnP2DXh+JV9+bkb84v6/bs6Ql8A"x-do-app-origin: 5284eb6e-18fd-4ef7-b770-2d956bd47506Cache-Control: privatex-do-orig-status: 404CF-Cache-Status: MISSServer: cloudflareCF-RAY: 8cbca29778f84381-EWR

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2360,i,2018478157920290478,6616231166358940807,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://click.pstmrk.it"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2360,i,2018478157920290478,6616231166358940807,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: agree

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://w3-reporting-nel.reddit.com/reports	0%	URL Reputation	safe
https://px.ads.linkedin.com/collect?	0%	URL Reputation	safe
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	0%	URL Reputation	safe
https://cdn.cookielaw.org/vendorlist/googleData.json	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.1.229	true	false	unknown
pacman-content-live.live.eks.hotjar.com	54.73.193.221	true	false	unknown
pclick.prod.mplat-ppcprotect.com	18.244.18.79	true	false	unknown
active-campaign.transforms.svdcdn.com	169.150.247.40	true	false	unknown
platform.twitter.map.fastly.net	199.232.188.157	true	false	unknown
vector-static-assets.nyc3.cdn.digitaloceanspaces.com	104.18.42.227	true	false	unknown
omapp.b-cdn.net	169.150.236.104	true	false	unknown
stats.g.doubleclick.net	66.102.1.157	true	false	unknown
billing-product-catalog.cluster.app-us1.com	54.204.8.154	true	false	unknown
js.sentry-cdn.com	151.101.2.217	true	false	unknown
static.zdassets.com	104.18.70.113	true	false	unknown
t.co	172.66.0.227	true	false	unknown
livepixel-production.bln.liveintent.com	52.207.180.96	true	false	unknown
solve-api.forethought.ai	104.17.255.3	true	false	unknown
ekr.zdassets.com	104.18.70.113	true	false	unknown
www.google.com	142.250.186.132	true	false	unknown
tracking.g2crowd.com	104.18.31.176	true	false	unknown
aplo-evnt.com	34.107.133.146	true	false	unknown
app.clearbit.com	18.158.205.16	true	false	unknown
px.mountain.com	52.89.99.220	true	false	unknown
static-cdn.hotjar.com	18.66.102.51	true	false	unknown
star-mini.c10r.facebook.com	157.240.251.35	true	false	unknown
google.com	142.250.181.238	true	false	unknown
prism.app-us1.com	104.17.31.174	true	false	unknown
s.twitter.com	104.244.42.67	true	false	unknown
pstmrk.it	18.218.148.238	true	false	unknown
sessions.bugsnag.com	35.190.88.7	true	false	unknown
dx.mountain.com	44.209.137.118	true	false	unknown
detgh1asa1dg4.cloudfront.net	18.244.18.49	true	false	unknown
gs.mountain.com	52.12.117.226	true	false	unknown
www.activecampaign.com	104.20.0.15	true	false	unknown
api.omappapi.com	172.66.42.248	true	false	unknown
api.trstplse.com	172.66.43.175	true	false	unknown
dualstack.reddit.map.fastly.net	151.101.129.140	true	false	unknown
analytics-alv.google.com	216.239.32.181	true	false	unknown
reddit.map.fastly.net	151.101.65.140	true	false	unknown
googleads.g.doubleclick.net	216.58.206.66	true	false	unknown
d26da0dx1ebj70.cloudfront.net	143.204.98.115	true	false	unknown
diffuser-cdn.app-us1.com	104.17.31.174	true	false	unknown
assets.apollo.io	104.20.40.213	true	false	unknown
pro.ip-api.com	208.95.112.2	true	false	unknown
td.doubleclick.net	216.58.206.34	true	false	unknown
goldfish-app-jqrqw.ondigitalocean.app	172.66.0.96	true	false	unknown
trustpulse.b-cdn.net	169.150.247.36	true	false	unknown
alocdn.com	50.112.215.28	true	false	unknown
cdn.cookielaw.org	104.18.86.42	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
wsky-live.live.eks.hotjar.com	52.17.61.231	true	false	unknown
prodhostedtest.zendesk.com	216.198.53.1	true	false	unknown
tag.clearbitscripts.com	18.245.46.23	true	false	unknown
vc-live-cf.hotjar.io	18.66.112.15	true	false	unknown
static.cloudflareinsights.com	104.16.80.73	true	false	unknown
trackcmp.net	172.64.153.42	true	false	unknown
active-campaign.files.svdcdn.com	143.244.50.89	true	false	unknown
www.hockeystack.com	188.114.96.3	true	false	unknown
o185886.ingest.sentry.io	34.120.195.249	true	false	unknown
eps.6sc.co	99.83.231.3	true	false	unknown
postmarkapp.com	18.190.105.62	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
adobetarget.data.adobedc.net	66.235.152.221	true	false	unknown
scontent.xx.fbcdn.net	157.240.253.1	true	false	unknown
script.hotjar.com	13.32.27.107	true	false	unknown
global-v4.clearbit.com	3.127.196.46	true	false	unknown
click.pstmrk.it	52.215.14.176	true	false	unknown
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	34.255.228.90	true	false	unknown
s3-us-west-2.amazonaws.com	52.92.188.96	true	false	unknown
client.prod.mplat-ppcprotect.com	52.222.236.71	true	false	unknown
solve-ui.pages.dev	188.114.96.3	true	false	unknown
cloudflareinsights.com	104.16.79.73	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
idx.cph.liveintent.com	44.193.142.207	true	false	unknown
assets-useast2.postmarkapp.com	18.245.46.21	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
domains.rewardful.com	161.35.235.194	true	false	unknown
sp.postmarkapp.com	3.33.192.72	true	false	unknown
d3kqhn8e7z5c19.cloudfront.net	18.173.205.96	true	false	unknown
analytics.google.com	142.250.185.110	true	false	unknown
d3tnn7lar6ozas.cloudfront.net	52.222.250.117	true	false	unknown
cookiesync-446990137.us-west-2.elb.amazonaws.com	35.160.112.221	true	false	unknown
click.prod.mplat-ppcprotect.com	18.173.205.92	true	false	unknown
alb.reddit.com	unknown	unknown	false	unknown
static.ads-twitter.com	unknown	unknown	false	unknown
t.clarity.ms	unknown	unknown	false	unknown
solve-widget.forethought.ai	unknown	unknown	false	unknown
cm.everesttech.net	unknown	unknown	false	unknown
static.hotjar.com	unknown	unknown	false	unknown
idx.liadm.com	unknown	unknown	false	unknown
j.6sc.co	unknown	unknown	false	unknown
c.clarity.ms	unknown	unknown	false	unknown
ws.hotjar.com	unknown	unknown	false	unknown
www.redditstatic.com	unknown	unknown	false	unknown
c.6sc.co	unknown	unknown	false	unknown
assets.adobedtm.com	unknown	unknown	false	unknown
api.vector.co	unknown	unknown	false	unknown
b-code.liadm.com	unknown	unknown	false	unknown
connect.facebook.net	unknown	unknown	false	unknown
px.ads.linkedin.com	unknown	unknown	false	unknown
a.usbrowserspeed.com	unknown	unknown	false	unknown
ipv6.6sc.co	unknown	unknown	false	unknown
activecampaign.demdex.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://www.activecampaign.com/wp-content/themes/activecampaign/assets/js/ehawk-talon-6.js	false		unknown
https://pstmrk.it/logo-84e5b0090c83a410b3a5d76108fe4e16.svg	false		unknown
https://www.activecampaign.com/__geo	false		unknown
https://w3-reporting-nel.reddit.com/reports	false	URL Reputation: safe	unknown
https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=226C267C61E92BD40A495E08%40AdobeOrg&d_nsid=0&ts=1727787550564	false		unknown
https://cdn.cookielaw.org/scripttemplates/202306.2.0/assets/otCommonStyles.css	false		unknown
https://postmarkapp.com/images/illustrations/vehicle-streams.svg	false		unknown
https://cdn.jsdelivr.net/npm/hockeystack@latest/hockeystack-6sense.min.js	false		unknown
https://pixel-config.reddit.com/pixels/t2_5do1o/config	false		unknown
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=9281988c-e2c1-459a-9b5a-19ef09323aa5&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=85193b09-561b-4994-b43b-2d1d25eec8a5&tw_document_href=https%3A%2F%2Fwww.activecampaign.com%2F%3Futm_source%3Dpostmark%26utm_medium%3Dreferral%26utm_campaign%3Dpstmrk_it&tw_iframe_status=0&txn_id=nw9aw&type=javascript&version=2.3.30	false		unknown
https://solve-widget.forethought.ai/static/js/217.fc2caf0a.chunk.js	false		unknown
https://postmarkapp.com/dist/12c6db9796334728e9e0.png	false		unknown
https://postmarkapp.com/dist/30c8ea12425640486856.woff2	false		unknown
https://alb.reddit.com/rp.gif?ts=1727787609063&id=t2_5do1o&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=5f37d9d1-b2de-4b13-858b-3240f0d67a1b&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1280&sw=1024&v=rdt_5afed25b&dpm=&dpcc=&dprc=	false		unknown
https://a.omappapi.com/app/js/11.1a0a4426.min.js	false		unknown
https://pstmrk.it/	false		unknown
https://postmarkapp.com/dist/ef5463774cfcdb391482.png	false		unknown
https://api.vector.co/pixel/li	false		unknown
https://www.activecampaign.com/dist/assets/Animation-Ct0rvTsX.js	false		unknown
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=cecdc2af-2698-44db-ad3a-c3fa3a278553&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=951c80be-86e7-45c2-b82a-d2a5af714c6a&tw_document_href=https%3A%2F%2Fwww.activecampaign.com%2Fpricing&tw_iframe_status=0&txn_id=nw9aw&type=javascript&version=2.3.30	false		unknown
https://a.omappapi.com/app/js/27.9134cb4f.min.js	false		unknown
https://postmarkapp.com/images/illustrations/great-support.svg	false		unknown
https://a.omappapi.com/app/js/api.min.js	false		unknown
https://a.omappapi.com/app/js/20.cf2651f1.min.js	false		unknown
https://3.212.39.155/is	false		unknown
https://a.omappapi.com/app/js/4.2e7510a1.min.js	false		unknown
https://a.trstplse.com/app/js/api.min.js	false		unknown
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	false	URL Reputation: safe	unknown
https://static.zdassets.com/web_widget/messenger/latest/web-widget-9961-611804a.js	false		unknown
https://postmarkapp.com/dist/632271f48e1e9bf96655.png	false		unknown
https://www.activecampaign.com/cdn-cgi/challenge-platform/scripts/jsd/main.js	false		unknown
https://craft-assets.postmarkapp.com/customers/_400x400_crop_center-center_10_none/Kieran.jpg	false		unknown
https://rp.liadm.com/j?dtstmp=1727787617433&se=e30&duid=ab38aa111f6c--01j942nhxbdy7zkt1cckk1jbej&tv=v3.1.2&pu=https%3A%2F%2Fwww.activecampaign.com%2Fpricing&wpn=lc-bundle&wpv=v3.1.2&cd=.activecampaign.com	false		unknown
https://rwd.postmarkapp.com/rw.js	false		unknown
https://js.sentry-cdn.com/b822c481a6c34679af9122e5576d7311.min.js	false		unknown
https://pro.ip-api.com/json/?key=82LH3HgJ6w0DP7N	false		unknown
https://postmarkapp.com/support/article/1059-what-is-pstmrk-it	false		unknown
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZvvyIwAAAG7btQOV	false		unknown
https://activecampaign.demdex.net/dest5.html?d_nsid=0	false		unknown
https://pclick.prod.mplat-ppcprotect.com/recv?lpn=n&plat=&data=eyJjbGllbnRfZGF0YSI6eyJocmVmIjoiaHR0cHM6Ly93d3cuYWN0aXZlY2FtcGFpZ24uY29tLz91dG1fc291cmNlPXBvc3RtYXJrJnV0bV9tZWRpdW09cmVmZXJyYWwmdXRtX2NhbXBhaWduPXBzdG1ya19pdCIsInRva2VuIjoiZXlKMGVYQWlPaUpLVjFRaUxDSmhiR2NpT2lKSVV6STFOaUo5LmV5SmhZMk52ZFc1MFgybGtJam94TnpFek1uMC56YTYzMnMzQ2hMdk9xdHlGQ3owMVVzWnpidExlbVRDMW1iWnE3UEhwbjhzIn19	false		unknown
https://www.activecampaign.com/dist/assets/MediaQueries-DBzfAk4g.js	false		unknown
https://s3-us-west-2.amazonaws.com/b2bjsstore/b/DNXY8HK85XO0/reb2b.js.gz	true		unknown
https://a.omappapi.com/app/js/16.693703a5.min.js	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.activecampaign.com/platform/marketing-automation	chromecache_715.2.dr	false		unknown
https://active-campaign.transforms.svdcdn.com/production/general/Pricing_split-media.png?w=1440&	chromecache_699.2.dr	false		unknown
https://www.activecampaign.com/about	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_735.2.dr, chromecache_488.2.dr, chromecache_501.2.dr	false	URL Reputation: safe	unknown
https://solve-api.forethought.ai/	chromecache_580.2.dr	false		unknown
https://active-campaign.transforms.svdcdn.com/production/general/Barcelona-Spain-Street.jpg?w=1600&a	chromecache_715.2.dr	false		unknown
https://px.ads.linkedin.com/collect?	chromecache_482.2.dr	false	URL Reputation: safe	unknown
https://active-campaign.files.svdcdn.com/production/logos/integrations/mark/color/typeform-mark.svg?	chromecache_473.2.dr	false		unknown
https://postmarkapp.com/migration-guides/mailgun	chromecache_552.2.dr	false		unknown
https://www.activecampaign.com/solutions/smb	chromecache_715.2.dr	false		unknown
https://active-campaign.transforms.svdcdn.com/production/general/Pit-Boss.png?w=990&h=660&q=	chromecache_715.2.dr	false		unknown
https://www.activecampaign.com/br	chromecache_715.2.dr	false		unknown
https://active-campaign.transforms.svdcdn.com/production/general/Woman-working-on-laptop.png?w=300&a	chromecache_699.2.dr, chromecache_715.2.dr	false		unknown
https://static.cloudflareinsights.com	chromecache_580.2.dr	false		unknown
https://www.activecampaign.com/solutions/enterprise	chromecache_715.2.dr	false		unknown
https://assets.adobedtm.com/fccae223403d/b9ca3c9bef1d/launch-dab30381be28.js	chromecache_600.2.dr, chromecache_359.2.dr	false		unknown
https://postmarkapp.com/developer/api/email-api	chromecache_469.2.dr	false		unknown
https://postmarkapp.com/message-streams	chromecache_650.2.dr	false		unknown
https://www.activecampaign.com/apps/CallRail-integration	chromecache_473.2.dr	false		unknown
https://postmarkapp.com/support	chromecache_650.2.dr	false		unknown
https://status.postmarkapp.com	chromecache_552.2.dr, chromecache_650.2.dr	false		unknown
https://www.activecampaign.com/platform/forms	chromecache_715.2.dr	false		unknown
https://github.com/microsoft/clarity	chromecache_511.2.dr, chromecache_667.2.dr	false		unknown
https://www.activecampaign.com/platform/landing-pages	chromecache_715.2.dr	false		unknown
https://www.activecampaign.com/platform/segmentation	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://www.activecampaign.com/apps/google-ads-integration	chromecache_699.2.dr, chromecache_715.2.dr	false		unknown
https://www.activecampaign.com/about/newsroom	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://www.activecampaign.com/industry/creators-and-influencers	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://postmarkapp.com/customers	chromecache_552.2.dr, chromecache_650.2.dr	false		unknown
https://px.ads.linkedin.com/collect/?pid=	chromecache_633.2.dr, chromecache_727.2.dr	false		unknown
https://active-campaign.transforms.svdcdn.com/production/general/Pricing_split-media.png?w=768&h	chromecache_699.2.dr	false		unknown
https://postmarkapp.com/support/article/803-how-do-i-enable-open-tracking	chromecache_650.2.dr	false		unknown
https://active-campaign.files.svdcdn.com/production/logos/integrations/mark/color/zendesk-mark.svg?d	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://active-campaign.transforms.svdcdn.com/production/general/Artivive.png?w=990&h=660&q=	chromecache_715.2.dr	false		unknown
https://www.activecampaign.com/platform/artificial-intelligence	chromecache_715.2.dr	false		unknown
https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=158208907873	chromecache_370.2.dr, chromecache_549.2.dr, chromecache_658.2.dr, chromecache_339.2.dr	false		unknown
https://twitter.com/postmarkapp	chromecache_552.2.dr, chromecache_650.2.dr	false		unknown
https://www.activecampaign.com/platform/content-creation	chromecache_715.2.dr	false		unknown
https://active-campaign.files.svdcdn.com/production/logos/integrations/mark/color/salesforce-mark.sv	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://active-campaign.transforms.svdcdn.com/production/general/Pricing_split-media.png?w=300&h	chromecache_699.2.dr	false		unknown
https://www.activecampaign.com/ecommerce	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://postmarkapp.com/developer/integration/official-libraries	chromecache_552.2.dr	false		unknown
https://twitter.com/kieranmasterton/status/1473349870417235975	chromecache_552.2.dr	false		unknown
https://www.activecampaign.com/apps/salesforce-integration	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://postmarkapp.com/developer/integration/official-libraries#dot-net	chromecache_552.2.dr	false		unknown
https://account.postmarkapp.com/sign_up	chromecache_650.2.dr	false		unknown
https://postmarkapp.com/rebound	chromecache_552.2.dr, chromecache_650.2.dr	false		unknown
https://active-campaign.files.svdcdn.com/production/logos/integrations/mark/color/square-mark.svg?dm	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://active-campaign.files.svdcdn.com/production/logos/integrations/mark/color/googleads-mark.svg	chromecache_699.2.dr, chromecache_715.2.dr	false		unknown
https://td.doubleclick.net/td/update?ig_name=4s184104488.1727787575	chromecache_654.2.dr, chromecache_573.2.dr, chromecache_626.2.dr	false		unknown
http://tt.epicplay.com	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://postmarkapp.com/email-analytics	chromecache_650.2.dr	false		unknown
https://www.activecampaign.com/es	chromecache_715.2.dr	false		unknown
https://cdn.cookielaw.org/vendorlist/googleData.json	chromecache_383.2.dr, chromecache_531.2.dr	false	URL Reputation: safe	unknown
https://www.activecampaign.com/partner/agency	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown
https://www.activecampaign.com/platform	chromecache_715.2.dr	false		unknown
http://loading.retry.widdit.com/	chromecache_699.2.dr, chromecache_473.2.dr, chromecache_715.2.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	unknown	United States	15169	GOOGLEUS	false
18.66.102.11	unknown	United States	3	MIT-GATEWAYSUS	false
52.89.99.220	px.mountain.com	United States	16509	AMAZON-02US	false
13.32.27.54	unknown	United States	7018	ATT-INTERNET4US	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
35.160.112.221	cookiesync-446990137.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
18.173.205.96	d3kqhn8e7z5c19.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.18.34.214	unknown	United States	13335	CLOUDFLARENETUS	false
169.150.247.38	unknown	United States	2711	SPIRITTEL-ASUS	false
35.190.88.7	sessions.bugsnag.com	United States	15169	GOOGLEUS	false
18.173.205.92	click.prod.mplat-ppcprotect.com	United States	3	MIT-GATEWAYSUS	false
169.150.247.36	trustpulse.b-cdn.net	United States	2711	SPIRITTEL-ASUS	false
104.16.80.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
169.150.247.37	unknown	United States	2711	SPIRITTEL-ASUS	false
66.235.152.221	adobetarget.data.adobedc.net	United States	15224	OMNITUREUS	false
151.101.65.140	reddit.map.fastly.net	United States	54113	FASTLYUS	false
104.18.72.113	unknown	United States	13335	CLOUDFLARENETUS	false
52.218.179.88	unknown	United States	16509	AMAZON-02US	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
151.101.66.217	unknown	United States	54113	FASTLYUS	false
44.193.142.207	idx.cph.liveintent.com	United States	14618	AMAZON-AESUS	false
18.244.18.94	unknown	United States	16509	AMAZON-02US	false
104.18.42.227	vector-static-assets.nyc3.cdn.digitaloceanspaces.com	United States	13335	CLOUDFLARENETUS	false
18.244.18.79	pclick.prod.mplat-ppcprotect.com	United States	16509	AMAZON-02US	false
172.66.43.175	api.trstplse.com	United States	13335	CLOUDFLARENETUS	false
169.150.247.40	active-campaign.transforms.svdcdn.com	United States	2711	SPIRITTEL-ASUS	false
104.18.30.176	unknown	United States	13335	CLOUDFLARENETUS	false
35.81.173.170	unknown	United States	237	MERIT-AS-14US	false
142.250.185.110	analytics.google.com	United States	15169	GOOGLEUS	false
3.132.44.151	unknown	United States	16509	AMAZON-02US	false
52.19.134.193	unknown	United States	16509	AMAZON-02US	false
104.20.40.213	assets.apollo.io	United States	13335	CLOUDFLARENETUS	false
143.244.50.89	active-campaign.files.svdcdn.com	United States	174	COGENT-174US	false
52.215.101.83	unknown	United States	16509	AMAZON-02US	false
18.173.205.16	unknown	United States	3	MIT-GATEWAYSUS	false
169.150.236.104	omapp.b-cdn.net	United States	2711	SPIRITTEL-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.70.113	static.zdassets.com	United States	13335	CLOUDFLARENETUS	false
3.127.196.46	global-v4.clearbit.com	United States	16509	AMAZON-02US	false
99.83.231.3	eps.6sc.co	United States	16509	AMAZON-02US	false
34.107.133.146	aplo-evnt.com	United States	15169	GOOGLEUS	false
143.204.98.27	unknown	United States	16509	AMAZON-02US	false
104.20.0.15	www.activecampaign.com	United States	13335	CLOUDFLARENETUS	false
52.222.236.16	unknown	United States	16509	AMAZON-02US	false
52.222.250.34	unknown	United States	16509	AMAZON-02US	false
35.171.253.74	unknown	United States	14618	AMAZON-AESUS	false
54.156.2.105	unknown	United States	14618	AMAZON-AESUS	false
216.58.206.34	td.doubleclick.net	United States	15169	GOOGLEUS	false
18.66.102.106	unknown	United States	3	MIT-GATEWAYSUS	false
54.73.193.221	pacman-content-live.live.eks.hotjar.com	United States	16509	AMAZON-02US	false
104.18.128.216	unknown	United States	13335	CLOUDFLARENETUS	false
52.222.250.117	d3tnn7lar6ozas.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.181.238	google.com	United States	15169	GOOGLEUS	false
172.66.0.96	goldfish-app-jqrqw.ondigitalocean.app	United States	13335	CLOUDFLARENETUS	false
172.67.2.155	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
161.35.235.194	domains.rewardful.com	United States	14061	DIGITALOCEAN-ASNUS	false
52.12.117.226	gs.mountain.com	United States	16509	AMAZON-02US	false
104.16.79.73	cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
13.32.27.107	script.hotjar.com	United States	7018	ATT-INTERNET4US	false
54.204.8.154	billing-product-catalog.cluster.app-us1.com	United States	14618	AMAZON-AESUS	false
34.255.228.90	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
13.32.27.21	unknown	United States	7018	ATT-INTERNET4US	false
52.215.14.176	click.pstmrk.it	United States	16509	AMAZON-02US	false
151.101.1.140	unknown	United States	54113	FASTLYUS	false
89.187.169.39	unknown	Czech Republic	60068	CDN77GB	false
151.101.2.217	js.sentry-cdn.com	United States	54113	FASTLYUS	false
157.240.253.1	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
52.37.46.54	unknown	United States	16509	AMAZON-02US	false
188.114.96.3	www.hockeystack.com	European Union	13335	CLOUDFLARENETUS	false
143.204.98.115	d26da0dx1ebj70.cloudfront.net	United States	16509	AMAZON-02US	false
151.101.129.140	dualstack.reddit.map.fastly.net	United States	54113	FASTLYUS	false
172.66.0.227	t.co	United States	13335	CLOUDFLARENETUS	false
34.120.195.249	o185886.ingest.sentry.io	United States	15169	GOOGLEUS	false
52.17.61.231	wsky-live.live.eks.hotjar.com	United States	16509	AMAZON-02US	false
75.2.108.141	unknown	United States	16509	AMAZON-02US	false
18.66.112.15	vc-live-cf.hotjar.io	United States	3	MIT-GATEWAYSUS	false
172.64.153.42	trackcmp.net	United States	13335	CLOUDFLARENETUS	false
18.244.18.49	detgh1asa1dg4.cloudfront.net	United States	16509	AMAZON-02US	false
18.158.205.16	app.clearbit.com	United States	16509	AMAZON-02US	false
52.7.151.245	unknown	United States	14618	AMAZON-AESUS	false
66.102.1.157	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.66.40.81	unknown	United States	13335	CLOUDFLARENETUS	false
51.77.64.70	unknown	France	16276	OVHFR	false
3.212.39.155	unknown	United States	14618	AMAZON-AESUS	false
142.250.184.226	unknown	United States	15169	GOOGLEUS	false
52.92.188.96	s3-us-west-2.amazonaws.com	United States	16509	AMAZON-02US	false
162.159.140.229	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
216.239.32.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
52.207.180.96	livepixel-production.bln.liveintent.com	United States	14618	AMAZON-AESUS	false
104.17.255.3	solve-api.forethought.ai	United States	13335	CLOUDFLARENETUS	false
104.244.42.131	unknown	United States	13414	TWITTERUS	false
44.209.137.118	dx.mountain.com	United States	14618	AMAZON-AESUS	false
104.17.1.4	unknown	United States	13335	CLOUDFLARENETUS	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
199.232.188.157	platform.twitter.map.fastly.net	United States	54113	FASTLYUS	false
104.18.31.176	tracking.g2crowd.com	United States	13335	CLOUDFLARENETUS	false
18.66.102.51	static-cdn.hotjar.com	United States	3	MIT-GATEWAYSUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523385
Start date and time:	2024-10-01 14:57:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://click.pstmrk.it
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus22.phis.win@26/635@364/100
Cookbook Comments:	Browse: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it Browse: https://postmarkapp.com/support/article/1059-what-is-pstmrk-it Browse: http://postmarkapp.com/ Browse: https://postmarkapp.com/ Browse: https://www.activecampaign.com/pricing

Input	Output
URL: https://pstmrk.it/ Model: jbxai	{ "brand":["Postmark"], "contains_trigger_text":true, "trigger_text":"Postmark uses the p st mrk. it domain to deliver a variety of analytics to the users of our email service.", "prominent_button_name":"Learn more about Postmark", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it Model: jbxai	{ "brand":["ActiveCampaign", "Wonsulting", "Roland", "CODECAMP", "byrider", "BODY FX", "museum of science+industry", "ARTIVIVE", "soundsnap", "billetto.", "WHOF30", "iconosquare", "DUCKS UNLIMITED", "serato"], "contains_trigger_text":true, "trigger_text":"Free 14-day trial with email sign-up", "prominent_button_name":"Get started", "text_input_field_labels":["Email address"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it Model: jbxai	{ "brand":["ActiveCampaign", "Wonsulting", "Roland", "CODECAMP", "byrider", "BODY FX", "miss am of science+industry", "1999", "ART IV/IVF", "bill etto.", "WHO IF 90", "iconos au are", "serato", "DUCKS UNLIMITED"], "contains_trigger_text":true, "trigger_text":"Free 14-day trial with email sign-up", "prominent_button_name":"Get started", "text_input_field_labels":["Email address"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it Model: jbxai	{ "brand":["ActiveCampaign", "Wconsulting", "Roland", "CODECAMP", "byrider", "BODY FX", "museum of science+industry", "ARTIVIVF", "billetto.", "WHOFQ", "iconosquare", "DUCKS UNLIMITED", "serato"], "contains_trigger_text":true, "trigger_text":"Free 14-day trial with email sign-up", "prominent_button_name":"Get started", "text_input_field_labels":["Email address"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://postmarkapp.com/support/article/1059-what-is-pstmrk-it Model: jbxai	{ "brand":["Postmark"], "contains_trigger_text":true, "trigger_text":"Open & Link Tracking", "prominent_button_name":"Start free trial", "text_input_field_labels":["How does open tracking work?", "How do I enable open tracking?", "Open Tracking and Apple Mail (Mail Privacy Protection)"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it Model: jbxai	{ "brand":["Roland", "CodeCamp", "byrider", "BODYX", "museum of science+industry", "soundsnap", "billetto.", "WHOLE30", "iconosquare", "DUCKS UNLIMITED", "serato", "STK STEAKHOUSE", "sundance institute", "VisitDenmark"], "contains_trigger_text":true, "trigger_text":"Free 14-day trial with email sign-up", "prominent_button_name":"Get started", "text_input_field_labels":["Email address"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it Model: jbxai	{ "brand":["ActiveCampaign", "Wonsulting", "Roland", "CodeCamp", "byrider", "BODY FX", "museum of science+industry chicago", "ART I VIVE", "soundsnap", "billet to.", "WHOLE 3 O", "icon o square", "se rato", "STK STEAKHOUSE", "sundance", "VisitDenmark"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Get started", "text_input_field_labels":["Email address"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.activecampaign.com/?utm_source=postmark&utm_medium=referral&utm_campaign=pstmrk_it Model: jbxai	{ "phishing_score":8, "brands":"Roland", "legit_domain":"roland.com", "classification":"wellknown", "reasons":["The brand 'Roland' is a well-known manufacturer of electronic musical instruments.", "The URL 'www.activecampaign.com' does not match the legitimate domain 'roland.com'.", "ActiveCampaign is a known marketing automation platform, which is not directly associated with Roland.", "The presence of an email address input field on a domain not associated with Roland is suspicious."], "brand_matches":[false], "url_match":true, "brand_input":"Roland", "input_fields":"Email address"}

URL: https://postmarkapp.com/ Model: jbxai	{ "brand":["Postmark"], "contains_trigger_text":true, "trigger_text":"The email delivery service that people actually like", "prominent_button_name":"Start free trial", "text_input_field_labels":["API documentation"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://postmarkapp.com/ Model: jbxai	{ "brand":["Postmark"], "contains_trigger_text":true, "trigger_text":"The email delivery service that people actually like", "prominent_button_name":"Start free trial", "text_input_field_labels":["API documentation"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://postmarkapp.com/ Model: jbxai	{ "brand":["Postmark"], "contains_trigger_text":true, "trigger_text":"The email delivery service that people actually like", "prominent_button_name":"Start free trial", "text_input_field_labels":["API documentation"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://postmarkapp.com/ Model: jbxai	{ "brand":["Postmark"], "contains_trigger_text":true, "trigger_text":"The email delivery service that people actually like", "prominent_button_name":"Start free trial", "text_input_field_labels":["API documentation"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://postmarkapp.com/ Model: jbxai	{ "brand":["Postmark"], "contains_trigger_text":true, "trigger_text":"The email delivery service that people actually like", "prominent_button_name":"Start free trial", "text_input_field_labels":["API documentation"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://postmarkapp.com/ Model: jbxai	{ "brand":["Postmark"], "contains_trigger_text":true, "trigger_text":"The email delivery service that people actually like", "prominent_button_name":"Start free trial", "text_input_field_labels":["API documentation"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.activecampaign.com/pricing Model: jbxai	{ "brand":["ActiveCampaign"], "contains_trigger_text":true, "trigger_text":"Start growing your business today", "prominent_button_name":"Buy Now", "text_input_field_labels":["Key features", "All features"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://postmarkapp.com/ Model: jbxai	{ "brand":["Postmark"], "contains_trigger_text":true, "trigger_text":"The email delivery service that people actually like", "prominent_button_name":"Start free trial", "text_input_field_labels":["API documentation"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://postmarkapp.com/ Model: jbxai	{ "brand":["Postmark"], "contains_trigger_text":true, "trigger_text":"The email delivery service that people actually like", "prominent_button_name":"Start free trial", "text_input_field_labels":["API documentation"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.activecampaign.com/pricing Model: jbxai	{ "brand":["ActiveCampaign"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Buy Now", "text_input_field_labels":["How many contacts do you have?", "Compare & find the right plan for you"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.activecampaign.com/pricing Model: jbxai	{ "brand":["ActiveCampaign"], "contains_trigger_text":true, "trigger_text":"Start growing your business today", "prominent_button_name":"Accept", "text_input_field_labels":["How many contacts do you have?", "Run campaigns at scale with enterprise-level support.", "Unlock full omnichannel marketing automation.", "Go further with automation and powerful customer insights.", "Get started with personalized marketing campaigns."], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 11:58:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.968117203520603
Encrypted:	false
SSDEEP:	48:80dbTDPoHjidAKZdA19ehwiZUklqehVy+3:8gPk2y
MD5:	17E2404470DFA2A0392FA8554201614E
SHA1:	E4E6A32AF1A944D5874C7F975354B2F6D06496D9
SHA-256:	3116AC552DDA7B5F4E85EA502E37A12895DD5C9E0DC3F74BD5D0168688E52C0B
SHA-512:	9542971E55D933ED74266D2B64176069FC09F5FA69A7D0C53F535031DF5304691137F1E37530AFBC89FE5BFDA6696BE1313FE934100E78E3AB42716D3855E2BE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IAYWg....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAYWg....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAYWg....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAYWg..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY\g...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............@z......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://click.pstmrk.it

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 330

Chrome Cache Entry: 331

Chrome Cache Entry: 332

Chrome Cache Entry: 333

Chrome Cache Entry: 334

Chrome Cache Entry: 335

Chrome Cache Entry: 336

Chrome Cache Entry: 337

Chrome Cache Entry: 338

Chrome Cache Entry: 339

Chrome Cache Entry: 340

Chrome Cache Entry: 341

Chrome Cache Entry: 342

Chrome Cache Entry: 343

Chrome Cache Entry: 344

Chrome Cache Entry: 345

Chrome Cache Entry: 346

Chrome Cache Entry: 347

Chrome Cache Entry: 348

Chrome Cache Entry: 349

Chrome Cache Entry: 350

Windows Analysis Report
http://click.pstmrk.it

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 14:58:55.232717991 CEST	430	OUT	GET / HTTP/1.1 Host: click.pstmrk.it Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 14:58:55.857511044 CEST	191	IN	HTTP/1.1 302 Found Server: awselb/2.0 Date: Tue, 01 Oct 2024 12:58:55 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: keep-alive Location: https://pstmrk.it
Oct 1, 2024 14:59:40.858242035 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 14:59:42.102969885 CEST	981	OUT	GET / HTTP/1.1 Host: postmarkapp.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _gcl_au=1.1.184104488.1727787575; _gid=GA1.2.1064311475.1727787576; _gat_UA-507677-30=1; _gat_UA-507677-40=1; _ga_EGGETJXCC9=GS1.1.1727787577.1.0.1727787577.0.0.0; _ga=GA1.1.2038735085.1727787576; _sp_ses.eca8=*; _sp_id.eca8=b47ae76e-8f76-485a-9d71-b9723dc9d2a3.1727787578.1.1727787578.1727787578.0a2c25e4-f4c0-4896-b8d0-be15e864e9a3; _clck=1vya0lg%7C2%7Cfpn%7C0%7C1735; _ga_EE5NRK3ZQM=GS1.2.1727787579.1.0.1727787579.0.0.0; _ga_85SFTJ6CT5=GS1.2.1727787579.1.0.1727787579.0.0.0; _clsk=1xov3ma%7C1727787579494%7C1%7C1%7Ct.clarity.ms%2Fcollect
Oct 1, 2024 14:59:42.591114044 CEST	335	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Tue, 01 Oct 2024 12:59:42 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://postmarkapp.com:443/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>
Oct 1, 2024 15:00:27.591914892 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-10-01 12:58:56 UTC	652	OUT	GET / HTTP/1.1 Host: pstmrk.it Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 12:58:56 UTC	319	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 12:58:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2247 Connection: close Server: nginx/1.25.4 Last-Modified: Thu, 14 Mar 2024 05:58:30 GMT ETag: "65f29206-8c7" Accept-Ranges: bytes X-Kong-Upstream-Latency: 0 X-Kong-Proxy-Latency: 0 Via: kong/3.2.2
2024-10-01 12:58:56 UTC	2247	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 50 6f 73 74 6d 61 72 6b 20 68 65 6c 70 73 20 73 6d 61 6c 6c 20 61 6e 64 20 6c 61 72 67 65 20 77 65 62 20 61 70 70 6c 69 63 61 74 69 6f 6e 73 20 64 65 6c 69 76 65 72 20 61 6e 64 20 74 72 61 63 6b 20 74 72 61 6e 73 61 63 74 69 6f 6e 61 6c 20 65 6d 61 69 6c 2e 20 53 74 6f Data Ascii: <!doctype html><html lang="en"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="description" content="Postmark helps small and large web applications deliver and track transactional email. Sto

Timestamp	Bytes transferred	Direction	Data
2024-10-01 12:58:57 UTC	559	OUT	GET /style-75a55d6ad22d9bfb3f40dc9d91cc7d36.css HTTP/1.1 Host: pstmrk.it Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://pstmrk.it/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 12:58:57 UTC	305	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 12:58:57 GMT Content-Type: text/css Content-Length: 45285 Connection: close Server: nginx/1.25.4 Last-Modified: Thu, 14 Mar 2024 05:58:30 GMT ETag: "65f29206-b0e5" Accept-Ranges: bytes X-Kong-Upstream-Latency: 1 X-Kong-Proxy-Latency: 0 Via: kong/3.2.2
2024-10-01 12:58:57 UTC	16074	IN	Data Raw: 2e 6c 2d 6d 69 6e 69 6d 61 6c 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 61 66 39 66 37 7d 2e 6c 2d 6d 69 6e 69 6d 61 6c 5f 77 72 61 70 7b 77 69 64 74 68 3a 31 30 30 25 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 31 35 70 78 29 7b 2e 6c 2d 6d 69 6e 69 6d 61 6c 5f 77 72 61 70 7b 77 69 64 74 68 3a 36 31 35 70 78 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 37 35 30 70 78 29 7b 2e 6c 2d 6d 69 6e 69 6d 61 6c 5f 77 72 61 70 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 30 70 78 7d 7d Data Ascii: .l-minimal{display:flex;justify-content:center;padding:0;background-color:#faf9f7}.l-minimal_wrap{width:100%}@media only screen and (min-width: 615px){.l-minimal_wrap{width:615px}}@media only screen and (min-width: 750px){.l-minimal_wrap{margin-top:30px}}
2024-10-01 12:58:57 UTC	16384	IN	Data Raw: 54 59 75 4f 54 6b 33 49 44 45 75 4e 54 41 7a 54 44 45 32 4c 6a 55 67 4e 7a 6c 73 4c 54 45 75 4e 54 41 7a 4c 54 59 75 4f 54 6b 33 54 44 67 67 4e 7a 41 75 4e 57 77 32 4c 6a 6b 35 4e 79 30 78 4c 6a 55 77 4d 30 77 78 4e 69 34 31 49 44 59 79 65 69 49 67 5a 6d 6c 73 62 44 30 69 49 30 5a 47 52 45 55 77 4d 43 49 76 50 6a 78 77 59 58 52 6f 49 47 51 39 49 6b 30 32 49 44 55 32 62 44 45 75 4e 6a 6b 33 49 44 51 75 4d 7a 41 7a 54 44 45 79 49 44 59 79 62 43 30 30 4c 6a 4d 77 4d 79 41 78 4c 6a 59 35 4e 30 77 32 49 44 59 34 62 43 30 78 4c 6a 59 35 4e 79 30 30 4c 6a 4d 77 4d 30 77 77 49 44 59 79 62 44 51 75 4d 7a 41 7a 4c 54 45 75 4e 6a 6b 33 54 44 59 67 4e 54 5a 36 49 69 42 6d 61 57 78 73 50 53 49 6a 52 6b 59 33 4e 54 63 31 49 69 38 2b 50 48 42 68 64 47 67 67 5a 44 30 69 Data Ascii: TYuOTk3IDEuNTAzTDE2LjUgNzlsLTEuNTAzLTYuOTk3TDggNzAuNWw2Ljk5Ny0xLjUwM0wxNi41IDYyeiIgZmlsbD0iI0ZGREUwMCIvPjxwYXRoIGQ9Ik02IDU2bDEuNjk3IDQuMzAzTDEyIDYybC00LjMwMyAxLjY5N0w2IDY4bC0xLjY5Ny00LjMwM0wwIDYybDQuMzAzLTEuNjk3TDYgNTZ6IiBmaWxsPSIjRkY3NTc1Ii8+PHBhdGggZD0i
2024-10-01 12:58:57 UTC	12827	IN	Data Raw: 61 74 2d 78 73 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 20 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 31 35 70 78 29 7b 2e 75 2d 66 62 2d 61 6c 69 67 6e 2d 62 6f 74 74 6f 6d 2d 61 74 2d 73 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 20 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 37 35 30 70 78 29 7b 2e 75 2d 66 62 2d 61 6c 69 67 6e 2d 62 6f 74 74 6f 6d 2d 61 74 2d 6d 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 20 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e Data Ascii: at-xs{align-items:flex-end !important}}@media only screen and (min-width: 615px){.u-fb-align-bottom-at-s{align-items:flex-end !important}}@media only screen and (min-width: 750px){.u-fb-align-bottom-at-m{align-items:flex-end !important}}@media only screen

Timestamp	Bytes transferred	Direction	Data
2024-10-01 12:58:57 UTC	604	OUT	GET /logo-84e5b0090c83a410b3a5d76108fe4e16.svg HTTP/1.1 Host: pstmrk.it Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pstmrk.it/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 12:58:57 UTC	310	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 12:58:57 GMT Content-Type: image/svg+xml Content-Length: 10139 Connection: close Server: nginx/1.25.4 Last-Modified: Thu, 14 Mar 2024 05:58:30 GMT ETag: "65f29206-279b" Accept-Ranges: bytes X-Kong-Upstream-Latency: 0 X-Kong-Proxy-Latency: 1 Via: kong/3.2.2
2024-10-01 12:58:57 UTC	10139	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 34 39 30 22 20 68 65 69 67 68 74 3d 22 31 30 37 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 66 69 6c 6c 3d 22 23 30 30 30 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 35 39 2e 33 37 38 20 34 32 2e 39 38 38 63 2d 38 2e 35 33 31 20 38 2e 31 34 33 2d 32 34 2e 39 31 35 20 31 33 2e 36 37 2d 34 33 2e 38 31 39 20 31 33 2e 36 37 2d 31 34 2e 30 35 37 20 30 2d 32 36 2e 37 35 37 2d 33 2e 31 30 33 2d 33 35 2e 38 37 2d 38 2e 30 34 37 2d 31 30 2e 34 37 2d 35 2e 37 32 2d 32 Data Ascii: <svg width="490" height="107" fill="none" xmlns="http://www.w3.org/2000/svg"><g opacity=".2" fill-rule="evenodd" clip-rule="evenodd" fill="#000"><path d="M159.378 42.988c-8.531 8.143-24.915 13.67-43.819 13.67-14.057 0-26.757-3.103-35.87-8.047-10.47-5.72-2

Timestamp	Bytes transferred	Direction	Data
2024-10-01 12:58:58 UTC	374	OUT	GET /logo-84e5b0090c83a410b3a5d76108fe4e16.svg HTTP/1.1 Host: pstmrk.it Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 12:58:58 UTC	310	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 12:58:58 GMT Content-Type: image/svg+xml Content-Length: 10139 Connection: close Server: nginx/1.25.4 Last-Modified: Thu, 14 Mar 2024 05:58:30 GMT ETag: "65f29206-279b" Accept-Ranges: bytes X-Kong-Upstream-Latency: 1 X-Kong-Proxy-Latency: 0 Via: kong/3.2.2
2024-10-01 12:58:58 UTC	10139	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 34 39 30 22 20 68 65 69 67 68 74 3d 22 31 30 37 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 66 69 6c 6c 3d 22 23 30 30 30 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 35 39 2e 33 37 38 20 34 32 2e 39 38 38 63 2d 38 2e 35 33 31 20 38 2e 31 34 33 2d 32 34 2e 39 31 35 20 31 33 2e 36 37 2d 34 33 2e 38 31 39 20 31 33 2e 36 37 2d 31 34 2e 30 35 37 20 30 2d 32 36 2e 37 35 37 2d 33 2e 31 30 33 2d 33 35 2e 38 37 2d 38 2e 30 34 37 2d 31 30 2e 34 37 2d 35 2e 37 32 2d 32 Data Ascii: <svg width="490" height="107" fill="none" xmlns="http://www.w3.org/2000/svg"><g opacity=".2" fill-rule="evenodd" clip-rule="evenodd" fill="#000"><path d="M159.378 42.988c-8.531 8.143-24.915 13.67-43.819 13.67-14.057 0-26.757-3.103-35.87-8.047-10.47-5.72-2

Timestamp	Bytes transferred	Direction	Data
2024-10-01 12:58:58 UTC	607	OUT	GET /favicon-1749edb6e78c15abfaf33535c978e911.ico HTTP/1.1 Host: pstmrk.it Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pstmrk.it/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 12:58:58 UTC	309	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 12:58:58 GMT Content-Type: image/x-icon Content-Length: 4286 Connection: close Server: nginx/1.25.4 Last-Modified: Thu, 14 Mar 2024 05:58:30 GMT ETag: "65f29206-10be" Accept-Ranges: bytes X-Kong-Upstream-Latency: 13 X-Kong-Proxy-Latency: 0 Via: kong/3.2.2
2024-10-01 12:58:58 UTC	4286	IN	Data Raw: 00 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 de ff ff 00 Data Ascii: ( @

Timestamp	Bytes transferred	Direction	Data
2024-10-01 12:58:58 UTC	660	OUT	GET /logo-ac-blue-white-64a0e5808244187aba14b4377ba210b1.svg HTTP/1.1 Host: pstmrk.it Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pstmrk.it/style-75a55d6ad22d9bfb3f40dc9d91cc7d36.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 12:58:58 UTC	310	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 12:58:58 GMT Content-Type: image/svg+xml Content-Length: 5696 Connection: close Server: nginx/1.25.4 Last-Modified: Thu, 14 Mar 2024 05:58:30 GMT ETag: "65f29206-1640" Accept-Ranges: bytes X-Kong-Upstream-Latency: 13 X-Kong-Proxy-Latency: 0 Via: kong/3.2.2
2024-10-01 12:58:58 UTC	5696	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 32 39 22 20 68 65 69 67 68 74 3d 22 31 33 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 64 3d 22 4d 39 36 2e 30 34 36 2e 31 32 35 68 2d 2e 38 37 76 2e 38 37 63 30 20 2e 32 32 33 2e 31 2e 34 39 37 2e 35 34 37 2e 34 39 37 68 2e 38 37 76 2d 2e 38 37 63 30 2d 2e 32 2d 2e 30 37 35 2d 2e 34 39 37 2d 2e 35 34 37 2d 2e 34 39 37 5a 4d 39 35 2e 39 37 31 20 32 2e 39 33 33 68 2d 2e 36 39 36 76 37 2e 31 38 34 61 2e 35 2e 35 20 30 20 30 20 30 20 2e 34 37 33 2e 35 32 32 76 2e 30 32 35 68 2e 37 39 35 56 33 2e 34 35 35 63 2d 2e 30 32 35 2d 2e 33 32 33 2d 2e 31 39 39 2d 2e 35 32 32 2d 2e 35 37 32 2d 2e 35 32 32 5a 4d Data Ascii: <svg width="129" height="13" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M96.046.125h-.87v.87c0 .223.1.497.547.497h.87v-.87c0-.2-.075-.497-.547-.497ZM95.971 2.933h-.696v7.184a.5.5 0 0 0 .473.522v.025h.795V3.455c-.025-.323-.199-.522-.572-.522ZM

Timestamp	Bytes transferred	Direction	Data
2024-10-01 12:58:59 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 12:58:59 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=186411 Date: Tue, 01 Oct 2024 12:58:59 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-01 12:59:00 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 12:59:01 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=186354 Date: Tue, 01 Oct 2024 12:59:00 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-01 12:59:01 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}