Edit tour

Windows Analysis Report
http://www.americanexpress.com/us/pakyc/

Overview

General Information

Sample URL:	http://www.americanexpress.com/us/pakyc/
Analysis ID:	1426764
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML body with high number of embedded images detected

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 3720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.americanexpress.com/us/pakyc/ MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 3788 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2008,i,11165410213512412256,6401227915527638973,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63

Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.0&d_fieldgroup=A&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&mid=10156722043248159620305584607496081974&ts=1713274424642 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://oneforms.americanexpress.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CvVersion%7C5.0.0
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.0.0&d_fieldgroup=A&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&mid=10156722043248159620305584607496081974&ts=1713274424642 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CvVersion%7C5.0.0
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s65150841158414?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&visitorCheck=VisitorAPI%20Present&cm.&ssf=1&.cm&omn.&lob=ser&country=us&language=en&.omn&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=oneforms.americanexpress.com&events=event140&h1=us%7Coneamex%7Cser%7Ciforms%7Copen&c3=en&c4=US&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7CiForms&v27=US&c30=US%7Coneamex%7Cser%7CiForms%7Copen&c31=US&c38=US%7Coneamex%7Cser%7CiForms%7Copen&c43=New%20Visitor&c44=D%3Dv44&v45=prospect&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c50=authenticated&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c75=Launch&v75=10156722043248159620305584607496081974&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=8700
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s65150841158414?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&visitorCheck=VisitorAPI%20Present&cm.&ssf=1&.cm&omn.&lob=ser&country=us&language=en&.omn&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=oneforms.americanexpress.com&events=event140&h1=us%7Coneamex%7Cser%7Ciforms%7Copen&c3=en&c4=US&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7CiForms&v27=US&c30=US%7Coneamex%7Cser%7CiForms%7Copen&c31=US&c38=US%7Coneamex%7Cser%7CiForms%7Copen&c43=New%20Visitor&c44=D%3Dv44&v45=prospect&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c50=authenticated&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c75=Launch&v75=10156722043248159620305584607496081974&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CMCOPTOUT-1713281625s%7CNONE%7CvVersion%7C5.0.0; s_sess=%20s_tp%3D1022%3B%20s_ppv%3Dus%25257Coneamex%25257Cser%25257CiForms%2525
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s66786050574872?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&visitorCheck=VisitorAPI%20Present&omn.&ppvpage=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&ppvtotal=89&ppvinitial=89&lob=ser&country=us&language=en&.omn&cm.&ssf=1&.cm&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=oneforms.americanexpress.com&events=event140&h1=us%7Coneamex%7Cser%7Ciforms%7Copen&c3=en&c4=US&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7CiForms&v27=US&c30=US%7Coneamex%7Cser%7CiForms%7Copen&c31=US&c38=US%7Coneamex%7Cser%7CiForms%7Copen&v41=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c44=D%3Dv44&v45=prospect&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c50=authenticated&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c75=Launch&v75=10156722043248159620305584607496081974&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s62158091623535?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&cm.&ssf=1&.cm&omn.&identifier=iForms&element=On%20page%201%20form%20load&lob=ser&detail=page%201%20visited&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=iForms&v5=us%3E%3EiForms%3E%3Eimpression%3E%3EOn%20page%201%20form%20load%3E%3Epage%201%20visited&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=iForms&c22=us%3E%3EiForms%3E%3Eimpression%3E%3EOn%20page%201%20form%20load%3E%3Epage%201%20visited&v27=US&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&v75=10156722043248159620305584607496081974&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CMCOPTOUT-1713281625s%7CNONE%7CvVersion%7C5.0.0; s_sess=%20s_tp%3D1022%3B%20s_p
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s66786050574872?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&visitorCheck=VisitorAPI%20Present&omn.&ppvpage=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&ppvtotal=89&ppvinitial=89&lob=ser&country=us&language=en&.omn&cm.&ssf=1&.cm&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=oneforms.americanexpress.com&events=event140&h1=us%7Coneamex%7Cser%7Ciforms%7Copen&c3=en&c4=US&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7CiForms&v27=US&c30=US%7Coneamex%7Cser%7CiForms%7Copen&c31=US&c38=US%7Coneamex%7Cser%7CiForms%7Copen&v41=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c44=D%3Dv44&v45=prospect&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c50=authenticated&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c75=Launch&v75=10156722043248159620305584607496081974&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNO
Source: global traffic	HTTP traffic detected: GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s62158091623535?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&cm.&ssf=1&.cm&omn.&identifier=iForms&element=On%20page%201%20form%20load&lob=ser&detail=page%201%20visited&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=iForms&v5=us%3E%3EiForms%3E%3Eimpression%3E%3EOn%20page%201%20form%20load%3E%3Epage%201%20visited&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=iForms&c22=us%3E%3EiForms%3E%3Eimpression%3E%3EOn%20page%201%20form%20load%3E%3Epage%201%20visited&v27=US&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&v75=10156722043248159620305584607496081974&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1Host: omns.americanexpress.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CMCOPTOUT-1713281625s%7CNONE%7CvVersion%7C5.0.0; s_sess=%20s_tp%3D1022%3B%20s_ppv%3Dus%25257Coneamex%25257Cser%25257CiForms%25257Copen%25257CpaKycOptions_en_US%252C89%252C89%252C907%3B%20s_cc%3Dtrue%3B; s_pers=%20s_tslv%3D1713274425317%7C1776346425317%3B%20s_tbm%3Dtrue%7C171327
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=aRAnk+tG2VV4rGs&MD=dvu3AKno HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAZ018joKFt9ONlJduRp0qgN4q0hEVgbtyzwhNOAQGHdiJ/WvF5CgahoZEynXJhIj56iTukhgVUPTic3eRyYR66fmSTdDW3LZw/IwxowvJNO42yNYmggOVq0grbDpD4QdDBVM9tWomORZ6Yhc//Dhybj55G1bMVl6gWid3LX185%2BHPvRzCdiW7tPCZaapPO7gKeTL3oDg104em5KKXTB%2BceyTUab5TPh2hCfSfz3ROVCrQakad6ZQ37pn7Jq55%2B49mfT4CA7pYaH/XGU53tm06AVeElWzPkyU/J4Yr1r8h47zRUwOcxGjC0T6BxpX7IwaaJwfyVT2Tevj23PMjumVtDYDZgAACJApzEW9bdlTqAHCfce4H//0LkQQF0iYmZWxtt1dWvSzGNKs6NAaiIu4m%2BImJYSHXcOmZtDwUL0%2BUymlprTmxloTHEuQDijkcU5PqlrdEYhHSlVnLrvUTCnDR1vmk543DEPCdFtnaUl609OaNAQkb/e7nPcl%2B67G5Dc29nT/V8B5U9lchFW7xWqPHkQuCZA50rluvxrcN4wb18tGScFXkYUxmkRTxh93rRO8rLxlvdYWNZq5kqFskFA1QjSBfNkY3jOMCqKAaeYCUVvq2O2DG8Vic09hMubc3IxZABXSl1PjuWzKnxEYxtVO8td1XElRuZE3fMhWvRHVZ1MY3aEAtAlxR/5N3EK7zTjPwWNXdFtFPokX/X%2BIfUv4QiqoLEgN1b71FA0Gp50%2BF1wsch2c1SV4l/9L%2BGgkJjGLe5ANJP9Ov1A5bIwE7mZo0/wK3xjUQicZVES9SX1weCg1fPypsz%2ByLcBGVnr32oxtbCUtGaDIx6GQ4i1VArCR24r76ss4R%2BHjWm2FgtfEERi/x8MHiXiD9JZNn7Fg1z79isM6w2qo6CKvtYyMrM1lO7HMfUI0IcyK2AE%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1713274460User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: F16DF180308E4A4591A546EFF0544AB2X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=aRAnk+tG2VV4rGs&MD=dvu3AKno HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown

DNS traffic detected: queries for: www.americanexpress.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.17:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.17:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.9:443 -> 192.168.2.17:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.9:443 -> 192.168.2.17:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.17:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49806 version: TLS 1.2

Source: chromecache_144.1.dr, chromecache_151.1.dr	String found in binary or memory: http://feross.org
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-4454a9ef97c1c8cd89
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-bea3c9697c62409967
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-c5299abd23ef05bd6d
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-f424e4c1e880782914
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/333b39a46679/launch-df6a13efe609-staging.min.js
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/launch-77374eae9c9b-staging.min.js
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/66bfa1f1c370/launch-a84bcfcd9f88-staging.min.js
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/6ea2f89ca33d/launch-25c1ded7854b-staging.min.js
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/6ea2f89ca33d/launch-ffeccfbfebd3.min.js
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/8e98299b4e37/launch-186af9da7404-staging.min.js
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/8e98299b4e37/launch-f60a62d583bd.min.js
Source: chromecache_128.1.dr	String found in binary or memory: https://assets.adobedtm.com/dcb19cbd6cbf/8fe231718838/launch-5a77dcd96b5f-staging.min.js
Source: chromecache_128.1.dr	String found in binary or memory: https://cdaas-dev.americanexpress.com/cdaas/api/axpi/omniture/launch/1.4.9/launch-688f678fbf27-stagi
Source: chromecache_144.1.dr, chromecache_151.1.dr	String found in binary or memory: https://feross.org/opensource
Source: chromecache_131.1.dr	String found in binary or memory: https://github.com/facebook/regenerator/blob/main/LICENSE
Source: chromecache_118.1.dr, chromecache_138.1.dr, chromecache_107.1.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_144.1.dr	String found in binary or memory: https://hertzen.com
Source: chromecache_144.1.dr	String found in binary or memory: https://html2canvas.hertzen.com
Source: chromecache_134.1.dr, chromecache_123.1.dr	String found in binary or memory: https://oneforms.americanexpress.com/iForms/at-secure/paKycLanding_en_US
Source: chromecache_134.1.dr, chromecache_123.1.dr	String found in binary or memory: https://oneforms.americanexpress.com/iForms/open/paSelfKyc2_en_US
Source: chromecache_128.1.dr	String found in binary or memory: https://qwww.aexp-static.com/cdaas/api/axpi/omniture/adobe/launch/intranet/1.4.1/launch-80e343e58fb8
Source: chromecache_128.1.dr	String found in binary or memory: https://qwww.aexp-static.com/cdaas/api/axpi/omniture/launch/1.4.9/launch-688f678fbf27-staging.min.js
Source: chromecache_131.1.dr	String found in binary or memory: https://ucmapi.americanexpress.com/api/consent/ext/record/
Source: chromecache_131.1.dr	String found in binary or memory: https://ucmapi.americanexpress.com/api/consent/management/
Source: chromecache_131.1.dr	String found in binary or memory: https://ucmapi.americanexpress.com/api/v1/geo_location/check
Source: chromecache_128.1.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/api/axpi/omniture/adobe/launch/intranet/1.4.1/launch-355955701c68.
Source: chromecache_148.1.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/api/axpi/omniture/launch/1.4.9/dcb19cbd6cbf/b4385da1798a/74e098123
Source: chromecache_128.1.dr, chromecache_155.1.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/api/axpi/omniture/launch/1.4.9/launch-b363d6c28b7c.min.js
Source: chromecache_120.1.dr, chromecache_139.1.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/dxt-vendor-shared-scripts/adobe-wrapper/1.6.6/adobe-wrapper.js
Source: chromecache_146.1.dr, chromecache_132.1.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one-tag/tagging/entrypoints/v1.43.0/entrypoint-15983.js
Source: chromecache_122.1.dr, chromecache_125.1.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/one-identity-session/1.38.3/timeout.js
Source: chromecache_156.1.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/qualtrics/1.71.0/
Source: chromecache_154.1.dr, chromecache_145.1.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/one/qualtrics/1.71.0/qualtricsIntercept.js
Source: chromecache_110.1.dr, chromecache_102.1.dr	String found in binary or memory: https://www.aexp-static.com/cdaas/user-consent-management/ucm/v1.13.0/UCM.js
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/be/fr/legal/politique-cookie.html?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/be/nl/legal/cookiebeleid.html?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/content/dam/amex/us/company/Privacy/California_Privacy_Notice.pdf
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/cz-cz/spolecnost/pravni/centrum-ochrany-osobnich-udaju/o-souborech-c
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/da-dk/selskab/legal/privatlivspolitik/angaende-cookies?showoverlay=f
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/de-at/firma/legal/datenschutz-center/cookie-informationen?showoverla
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/en-ca/company/legal/privacy-centre/about-cookies/?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/en-ca/company/legal/privacy-centre/privacy-statement/?showoverlay=fa
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/en-cz/company/legal/privacy-centre/about-cookies/?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/en-hu/company/legal/privacy-centre/about-cookies/?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/en-pl/company/legal/privacy-centre/about-cookies/?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/es/legal/informacion-sobre-los-cookies.html?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/fi/legal/yksityisyys/cookies/index.html?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/fr-ca/societes/legale/centre-de-confidentialite/a-propos-des-cookies
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/fr-ca/societes/legale/centre-de-confidentialite/declaration-de-confi
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/fr/legal/about-cookies.html?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/germany/legal/about_cookies.shtml?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/hu-hu/ceg/jogi/adatvedelem/a-sutikrol/index.html?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/icc/cookies.html?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/italy/legal/about_cookies.shtml?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/nl/about-cookies.html?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/no/legal/personvern/cookies/index.html?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/pl-pl/firma/prawny/centrum-prywatnosci/o-ciasteczkach/?showoverlay=f
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/se/legal/sekretess/cookies/index.html?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/uk/legal/about-cookies.shtml?showoverlay=false
Source: chromecache_131.1.dr	String found in binary or memory: https://www.americanexpress.com/us/privacy-center/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.americanexpress.com/us/pakyc/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2008,i,11165410213512412256,6401227915527638973,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2008,i,11165410213512412256,6401227915527638973,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
d2pz9khpjpljz2.cloudfront.net	108.138.85.124	true	false	high
www.google.com	142.250.9.105	true	false	high
americanexpress.com.ssl.d2.sc.omtrdc.net	63.140.38.132	true	false	unknown
omns.americanexpress.com	unknown	unknown	false	high
functions.americanexpress.com	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
iformservice.americanexpress.com	unknown	unknown	false	high
siteintercept.qualtrics.com	unknown	unknown	false	high
www.americanexpress.com	unknown	unknown	false	high
icm.aexp-static.com	unknown	unknown	false	high
lptag.liveperson.net	unknown	unknown	false	high
www.aexp-static.com	unknown	unknown	false	high
nexus.ensighten.com	unknown	unknown	false	high
oneforms.americanexpress.com	unknown	unknown	false	high

Name	Source	Malicious	Reputation
https://assets.adobedtm.com/dcb19cbd6cbf/8e98299b4e37/launch-f60a62d583bd.min.js	chromecache_128.1.dr	false	high
https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-c5299abd23ef05bd6d	chromecache_128.1.dr	false	high
https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-4454a9ef97c1c8cd89	chromecache_128.1.dr	false	high
https://feross.org/opensource	chromecache_144.1.dr, chromecache_151.1.dr	false	high
https://assets.adobedtm.com/dcb19cbd6cbf/8e98299b4e37/launch-186af9da7404-staging.min.js	chromecache_128.1.dr	false	high
https://html2canvas.hertzen.com	chromecache_144.1.dr	false	high
https://github.com/js-cookie/js-cookie	chromecache_118.1.dr, chromecache_138.1.dr, chromecache_107.1.dr	false	high
https://assets.adobedtm.com/dcb19cbd6cbf/8fe231718838/launch-5a77dcd96b5f-staging.min.js	chromecache_128.1.dr	false	high
https://assets.adobedtm.com/dcb19cbd6cbf/66bfa1f1c370/launch-a84bcfcd9f88-staging.min.js	chromecache_128.1.dr	false	high
https://assets.adobedtm.com/dcb19cbd6cbf/6ea2f89ca33d/launch-ffeccfbfebd3.min.js	chromecache_128.1.dr	false	high
http://feross.org	chromecache_144.1.dr, chromecache_151.1.dr	false	high
https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-bea3c9697c62409967	chromecache_128.1.dr	false	high
https://assets.adobedtm.com/dcb19cbd6cbf/61650f53735f/launch-77374eae9c9b-staging.min.js	chromecache_128.1.dr	false	high
https://assets.adobedtm.com/dcb19cbd6cbf/6ea2f89ca33d/launch-25c1ded7854b-staging.min.js	chromecache_128.1.dr	false	high
https://hertzen.com	chromecache_144.1.dr	false	high
https://github.com/facebook/regenerator/blob/main/LICENSE	chromecache_131.1.dr	false	high
https://assets.adobedtm.com/dcb19cbd6cbf/333b39a46679/launch-df6a13efe609-staging.min.js	chromecache_128.1.dr	false	high
https://assets.adobedtm.com/98caf8fccc463fd7e47088b35e73b27720bb5cc1/satelliteLib-f424e4c1e880782914	chromecache_128.1.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.9.105	www.google.com	United States	15169	GOOGLEUS	false
63.140.38.132	americanexpress.com.ssl.d2.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
63.140.39.35	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1426764
Start date and time:	2024-04-16 15:33:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://www.americanexpress.com/us/pakyc/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@15/110@36/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 12:33:40 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985315262749755
Encrypted:	false
SSDEEP:	48:8jjndaT37p6bEH7idAKZdA1JehwiZUklqehay+3:8jjoEUZy
MD5:	1747FBE3D1783CE289764D8335F930C3
SHA1:	38B8E346AE7258B3CA8F127091BAFCCEE6E3FF05
SHA-256:	C4C5565A03D38017A745E96E6886205003F33EEE19B4FE74034F724CB04E1A70
SHA-512:	52028B8F8CAB588640868E56F8ABB5C72AF145431107C439B08229D1D40AD7059FEE353985AD3032FC7F623C1338694F22F0F2F883A505C863CB8B8DEC78AEEE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,..............y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X-l....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X3l....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X3l....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X3l...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X5l...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 12:33:40 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.0030408470348835
Encrypted:	false
SSDEEP:	48:8wzjndaT37p6bEH7idAKZdA10eh/iZUkAQkqehJy+2:8qjoE29QYy
MD5:	FBBF9210BD9E81AF508F67F576E51D31
SHA1:	EE48587CA7CBC577B3355DE8B78E0DDF9F5FB62B
SHA-256:	BB316B51996E0CDF6DD8CA691CCD572ECD86CEFE1BE4F44044113E552C862B98
SHA-512:	F52AAABD8E7D9F637E037494A84F4ADB6FC9AF10ADE89ACD2780FC351F92D75AD1A4CBE3E3BA9CC3799C9419865ED6E0AA3BA62B89EDEA90BC922FDA2B31D367
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....\|.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X-l....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X3l....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X3l....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X3l...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X5l...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0112663977203376
Encrypted:	false
SSDEEP:	48:8endaT37p6jH7idAKZdA14tIeh7sFiZUkmgqeh7sfy+BX:8eoE3nFy
MD5:	930F1110D58F6EDA5202B746571C5143
SHA1:	34F709206D3DB156A31BF9AD7C1F3DD94F9640E2
SHA-256:	E93A1C8E1792C8BF7897C8F31F25ECC4A400F5A7A761DE1E8FAF4D28E4A64F98
SHA-512:	ABE15B1562AF142B3F26664C718D46577BF26EA8FC5EA6D98CD958D295488220446EBE4586E51CBED92A53C98F42014C4003E39CAD851CC6E1311762F4FA2D47
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X-l....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X3l....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X3l....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X3l...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2024 15:33:39.470649958 CEST	59094	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:39.470886946 CEST	56867	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:39.519649982 CEST	58230	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:39.519850016 CEST	52688	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:39.545317888 CEST	53	56578	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:39.600111008 CEST	53	50639	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:40.189774990 CEST	53	60381	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:40.317675114 CEST	64911	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:40.317842960 CEST	55373	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:40.472573042 CEST	53	55373	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:41.426402092 CEST	61032	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:41.426723003 CEST	57792	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.467740059 CEST	54100	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.467740059 CEST	64470	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.468193054 CEST	56139	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.468564034 CEST	58740	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.562879086 CEST	64026	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.563158035 CEST	57704	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.573738098 CEST	53	58740	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:43.645694971 CEST	53	64470	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:43.711093903 CEST	61092	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.711483002 CEST	50748	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.711740971 CEST	59820	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.711886883 CEST	55741	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.712325096 CEST	60716	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.712588072 CEST	53890	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.816534996 CEST	53	50748	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:43.816838026 CEST	53	60716	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:43.816991091 CEST	50366	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.817073107 CEST	53	53890	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:43.817152977 CEST	61367	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.817878962 CEST	53	61092	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:43.817995071 CEST	55078	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.818131924 CEST	55287	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:43.921389103 CEST	53	61367	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:43.922826052 CEST	53	55287	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:44.048696995 CEST	51608	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:44.048865080 CEST	57434	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:44.085732937 CEST	65137	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:44.085892916 CEST	53980	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:44.191356897 CEST	53	53980	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:44.299684048 CEST	59883	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:44.299840927 CEST	50602	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:44.324506998 CEST	52073	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:44.324721098 CEST	62347	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:44.404148102 CEST	53	59883	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:44.404712915 CEST	53	50602	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:46.129865885 CEST	54330	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:46.130000114 CEST	60350	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:46.234899044 CEST	53	60350	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:46.234925985 CEST	53	54330	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:46.719023943 CEST	52422	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:46.719023943 CEST	50917	53	192.168.2.17	1.1.1.1
Apr 16, 2024 15:33:46.874001980 CEST	53	50917	1.1.1.1	192.168.2.17
Apr 16, 2024 15:33:57.109426975 CEST	53	51824	1.1.1.1	192.168.2.17
Apr 16, 2024 15:34:15.803653002 CEST	53	56506	1.1.1.1	192.168.2.17
Apr 16, 2024 15:34:38.322354078 CEST	53	49377	1.1.1.1	192.168.2.17
Apr 16, 2024 15:34:39.545980930 CEST	53	51250	1.1.1.1	192.168.2.17
Apr 16, 2024 15:35:05.286513090 CEST	138	138	192.168.2.17	192.168.2.255
Apr 16, 2024 15:35:06.862341881 CEST	53	49958	1.1.1.1	192.168.2.17

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 16, 2024 15:33:39.576181889 CEST	1.1.1.1	192.168.2.17	0xb01b	No error (0)	www.americanexpress.com	www.americanexpress.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:39.576205969 CEST	1.1.1.1	192.168.2.17	0x46fb	No error (0)	www.americanexpress.com	www.americanexpress.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:39.624996901 CEST	1.1.1.1	192.168.2.17	0xa675	No error (0)	www.americanexpress.com	www.americanexpress.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:39.625637054 CEST	1.1.1.1	192.168.2.17	0xabb9	No error (0)	www.americanexpress.com	www.americanexpress.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:40.446043015 CEST	1.1.1.1	192.168.2.17	0x4304	No error (0)	oneforms.americanexpress.com	oneforms.americanexpress.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:40.472573042 CEST	1.1.1.1	192.168.2.17	0x510a	No error (0)	oneforms.americanexpress.com	oneforms.americanexpress.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:41.531393051 CEST	1.1.1.1	192.168.2.17	0x8ce	No error (0)	www.aexp-static.com	www.aexp-static.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:41.531419039 CEST	1.1.1.1	192.168.2.17	0x2c26	No error (0)	www.aexp-static.com	www.aexp-static.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.572505951 CEST	1.1.1.1	192.168.2.17	0xe4d9	No error (0)	functions.americanexpress.com	functions.americanexpress.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.573738098 CEST	1.1.1.1	192.168.2.17	0x9281	No error (0)	functions.americanexpress.com	functions.americanexpress.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.598892927 CEST	1.1.1.1	192.168.2.17	0x33c9	No error (0)	iformservice.americanexpress.com	iformservice.americanexpress.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.645694971 CEST	1.1.1.1	192.168.2.17	0xe9a1	No error (0)	iformservice.americanexpress.com	iformservice.americanexpress.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.667979956 CEST	1.1.1.1	192.168.2.17	0xb9f0	No error (0)	icm.aexp-static.com	icm.aexp-static.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.668406963 CEST	1.1.1.1	192.168.2.17	0x85f1	No error (0)	icm.aexp-static.com	icm.aexp-static.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.815663099 CEST	1.1.1.1	192.168.2.17	0x1088	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.815917969 CEST	1.1.1.1	192.168.2.17	0x1fb0	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.816534996 CEST	1.1.1.1	192.168.2.17	0xe321	No error (0)	omns.americanexpress.com	americanexpress.com.ssl.d2.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.816838026 CEST	1.1.1.1	192.168.2.17	0x2987	No error (0)	nexus.ensighten.com	d2pz9khpjpljz2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.816838026 CEST	1.1.1.1	192.168.2.17	0x2987	No error (0)	d2pz9khpjpljz2.cloudfront.net		108.138.85.124	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.816838026 CEST	1.1.1.1	192.168.2.17	0x2987	No error (0)	d2pz9khpjpljz2.cloudfront.net		108.138.85.91	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.816838026 CEST	1.1.1.1	192.168.2.17	0x2987	No error (0)	d2pz9khpjpljz2.cloudfront.net		108.138.85.86	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.816838026 CEST	1.1.1.1	192.168.2.17	0x2987	No error (0)	d2pz9khpjpljz2.cloudfront.net		108.138.85.96	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817073107 CEST	1.1.1.1	192.168.2.17	0x2809	No error (0)	nexus.ensighten.com	d2pz9khpjpljz2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	omns.americanexpress.com	americanexpress.com.ssl.d2.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.38.132	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.38.217	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.9	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.93	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.150	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.65	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.38.91	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.38.112	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.82	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.817878962 CEST	1.1.1.1	192.168.2.17	0x39e5	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.224	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:43.921389103 CEST	1.1.1.1	192.168.2.17	0xc2db	No error (0)	siteintercept.qualtrics.com	siteintercept.qprod2.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.921389103 CEST	1.1.1.1	192.168.2.17	0xc2db	No error (0)	siteintercept.qprod2.net	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.922801018 CEST	1.1.1.1	192.168.2.17	0x99b7	No error (0)	siteintercept.qualtrics.com	siteintercept.qprod2.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.922801018 CEST	1.1.1.1	192.168.2.17	0x99b7	No error (0)	siteintercept.qprod2.net	prodlb.siteintercept.qualtrics.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.922826052 CEST	1.1.1.1	192.168.2.17	0x5d16	No error (0)	lptag.liveperson.net	lptag.liveperson.cotcdb.net.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:43.923645973 CEST	1.1.1.1	192.168.2.17	0x9c04	No error (0)	lptag.liveperson.net	lptag.liveperson.cotcdb.net.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:44.153892040 CEST	1.1.1.1	192.168.2.17	0xde89	No error (0)	www.aexp-static.com	www.aexp-static.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:44.154928923 CEST	1.1.1.1	192.168.2.17	0x5485	No error (0)	www.aexp-static.com	www.aexp-static.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:44.189888000 CEST	1.1.1.1	192.168.2.17	0x9d9e	No error (0)	functions.americanexpress.com	functions.americanexpress.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:44.191356897 CEST	1.1.1.1	192.168.2.17	0xb828	No error (0)	functions.americanexpress.com	functions.americanexpress.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:44.404148102 CEST	1.1.1.1	192.168.2.17	0xaebe	No error (0)	www.google.com		142.250.9.105	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:44.404148102 CEST	1.1.1.1	192.168.2.17	0xaebe	No error (0)	www.google.com		142.250.9.106	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:44.404148102 CEST	1.1.1.1	192.168.2.17	0xaebe	No error (0)	www.google.com		142.250.9.147	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:44.404148102 CEST	1.1.1.1	192.168.2.17	0xaebe	No error (0)	www.google.com		142.250.9.104	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:44.404148102 CEST	1.1.1.1	192.168.2.17	0xaebe	No error (0)	www.google.com		142.250.9.99	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:44.404148102 CEST	1.1.1.1	192.168.2.17	0xaebe	No error (0)	www.google.com		142.250.9.103	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:44.404712915 CEST	1.1.1.1	192.168.2.17	0x637	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 16, 2024 15:33:44.428993940 CEST	1.1.1.1	192.168.2.17	0x2fac	No error (0)	icm.aexp-static.com	icm.aexp-static.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:44.429578066 CEST	1.1.1.1	192.168.2.17	0x84ac	No error (0)	icm.aexp-static.com	icm.aexp-static.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234899044 CEST	1.1.1.1	192.168.2.17	0xe7be	No error (0)	omns.americanexpress.com	americanexpress.com.ssl.d2.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	omns.americanexpress.com	americanexpress.com.ssl.d2.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.35	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.72	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.38.111	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.22	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.130	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.248	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.38.91	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.224	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.38.210	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:46.234925985 CEST	1.1.1.1	192.168.2.17	0xb85a	No error (0)	americanexpress.com.ssl.d2.sc.omtrdc.net		63.140.39.240	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:33:46.874001980 CEST	1.1.1.1	192.168.2.17	0x7aa0	No error (0)	iformservice.americanexpress.com	iformservice.americanexpress.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 15:33:46.887459040 CEST	1.1.1.1	192.168.2.17	0x96cc	No error (0)	iformservice.americanexpress.com	iformservice.americanexpress.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:33:45 UTC	1811	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=A&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&mid=10156722043248159620305584607496081974&ts=1713274424642 HTTP/1.1 Host: omns.americanexpress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://oneforms.americanexpress.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CvVersion%7C5.0.0
2024-04-16 13:33:46 UTC	701	IN	HTTP/1.1 200 OK access-control-allow-origin: https://oneforms.americanexpress.com access-control-allow-credentials: true date: Tue, 16 Apr 2024 13:33:46 GMT p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C10156722043248159620305584607496081974; Path=/; Domain=americanexpress.com; Max-Age=63072000; Expires=Thu, 16 Apr 2026 13:33:33 GMT; SameSite=None; Secure vary: Origin content-type: application/x-javascript;charset=utf-8 content-length: 48 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-04-16 13:33:46 UTC	48	IN	Data Raw: 7b 22 6d 69 64 22 3a 22 31 30 31 35 36 37 32 32 30 34 33 32 34 38 31 35 39 36 32 30 33 30 35 35 38 34 36 30 37 34 39 36 30 38 31 39 37 34 22 7d Data Ascii: {"mid":"10156722043248159620305584607496081974"}

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:33:46 UTC	1651	OUT	GET /id?d_visid_ver=5.0.0&d_fieldgroup=A&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&mid=10156722043248159620305584607496081974&ts=1713274424642 HTTP/1.1 Host: omns.americanexpress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CvVersion%7C5.0.0
2024-04-16 13:33:46 UTC	626	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Tue, 16 Apr 2024 13:33:46 GMT p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C10156722043248159620305584607496081974; Path=/; Domain=americanexpress.com; Max-Age=63072000; Expires=Thu, 16 Apr 2026 13:33:33 GMT; SameSite=None; Secure vary: Origin content-type: application/x-javascript;charset=utf-8 content-length: 48 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-04-16 13:33:46 UTC	48	IN	Data Raw: 7b 22 6d 69 64 22 3a 22 31 30 31 35 36 37 32 32 30 34 33 32 34 38 31 35 39 36 32 30 33 30 35 35 38 34 36 30 37 34 39 36 30 38 31 39 37 34 22 7d Data Ascii: {"mid":"10156722043248159620305584607496081974"}

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:33:46 UTC	3460	OUT	GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s65150841158414?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&visitorCheck=VisitorAPI%20Present&cm.&ssf=1&.cm&omn.&lob=ser&country=us&language=en&.omn&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=oneforms.americanexpress.com&events=event140&h1=us%7Coneamex%7Cser%7Ciforms%7Copen&c3=en&c4=US&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7CiForms&v27=US&c30=US%7Coneamex%7Cser%7CiForms%7Copen&c31=US&c38=US%7Coneamex%7Cser%7CiForms%7Copen&c43=New%20Visitor&c44=D%3Dv44&v45=prospect&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c50=authenticated&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c75=Launch&v75=10156722043248159620305584607496081974&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1 Host: omns.americanexpress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CMCOPTOUT-1713281625s%7CNONE%7CvVersion%7C5.0.0; s_sess=%20s_tp%3D1022%3B%20s_ppv%3Dus%25257Coneamex%25257Cser%25257CiForms%25257Copen%25257CpaKycOptions_en_US%252C89%252C89%252C907%3B%20s_cc%3Dtrue%3B; s_pers=%20s_tslv%3D1713274425317%7C1776346425317%3B%20s_tbm%3Dtrue%7C1713276225424%3B%20gpv_v41%3Dus%257Coneamex%257Cser%257CiForms%257Copen%257CpaKycOptions_en_US%7C1713276225436%3B
2024-04-16 13:33:46 UTC	757	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Tue, 16 Apr 2024 13:33:46 GMT expires: Mon, 15 Apr 2024 13:33:46 GMT last-modified: Wed, 17 Apr 2024 13:33:46 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C10156722043248159620305584607496081974; Path=/; Domain=americanexpress.com; Max-Age=34128000; Expires=Fri, 16 May 2025 13:33:33 GMT; SameSite=None; Secure etag: 3679228815467315200-4618519184159726857 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-04-16 13:33:46 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:33:47 UTC	3261	OUT	GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s65150841158414?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&visitorCheck=VisitorAPI%20Present&cm.&ssf=1&.cm&omn.&lob=ser&country=us&language=en&.omn&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=oneforms.americanexpress.com&events=event140&h1=us%7Coneamex%7Cser%7Ciforms%7Copen&c3=en&c4=US&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7CiForms&v27=US&c30=US%7Coneamex%7Cser%7CiForms%7Copen&c31=US&c38=US%7Coneamex%7Cser%7CiForms%7Copen&c43=New%20Visitor&c44=D%3Dv44&v45=prospect&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c50=authenticated&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c75=Launch&v75=10156722043248159620305584607496081974&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1 Host: omns.americanexpress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CMCOPTOUT-1713281625s%7CNONE%7CvVersion%7C5.0.0; s_sess=%20s_tp%3D1022%3B%20s_ppv%3Dus%25257Coneamex%25257Cser%25257CiForms%25257Copen%25257CpaKycOptions_en_US%252C89%252C89%252C907%3B%20s_cc%3Dtrue%3B; s_pers=%20s_tslv%3D1713274425317%7C1776346425317%3B%20s_tbm%3Dtrue%7C1713276225424%3B%20gpv_v41%3Dus%257Coneamex%257Cser%257CiForms%257Copen%257CpaKycOptions_en_US%7C1713276225436%3B
2024-04-16 13:33:47 UTC	757	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Tue, 16 Apr 2024 13:33:47 GMT expires: Mon, 15 Apr 2024 13:33:47 GMT last-modified: Wed, 17 Apr 2024 13:33:47 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C10156722043248159620305584607496081974; Path=/; Domain=americanexpress.com; Max-Age=34128000; Expires=Fri, 16 May 2025 13:33:33 GMT; SameSite=None; Secure etag: 3679228817612800000-4618638713648942262 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-04-16 13:33:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:33:47 UTC	3592	OUT	GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s66786050574872?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&visitorCheck=VisitorAPI%20Present&omn.&ppvpage=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&ppvtotal=89&ppvinitial=89&lob=ser&country=us&language=en&.omn&cm.&ssf=1&.cm&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=oneforms.americanexpress.com&events=event140&h1=us%7Coneamex%7Cser%7Ciforms%7Copen&c3=en&c4=US&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7CiForms&v27=US&c30=US%7Coneamex%7Cser%7CiForms%7Copen&c31=US&c38=US%7Coneamex%7Cser%7CiForms%7Copen&v41=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c44=D%3Dv44&v45=prospect&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c50=authenticated&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c75=Launch&v75=10156722043248159620305584607496081974&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1 Host: omns.americanexpress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CMCOPTOUT-1713281625s%7CNONE%7CvVersion%7C5.0.0; s_sess=%20s_tp%3D1022%3B%20s_ppv%3Dus%25257Coneamex%25257Cser%25257CiForms%25257Copen%25257CpaKycOptions_en_US%252C89%252C89%252C907%3B%20s_cc%3Dtrue%3B; s_pers=%20s_tslv%3D1713274425317%7C1776346425317%3B%20s_tbm%3Dtrue%7C1713276225424%3B%20gpv_v41%3Dus%257Coneamex%257Cser%257CiForms%257Copen%257CpaKycOptions_en_US%7C1713276225436%3B
2024-04-16 13:33:47 UTC	757	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Tue, 16 Apr 2024 13:33:47 GMT expires: Mon, 15 Apr 2024 13:33:47 GMT last-modified: Wed, 17 Apr 2024 13:33:47 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C10156722043248159620305584607496081974; Path=/; Domain=americanexpress.com; Max-Age=34128000; Expires=Fri, 16 May 2025 13:33:33 GMT; SameSite=None; Secure etag: 3679228817521180672-4618263934254334616 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-04-16 13:33:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:33:47 UTC	3310	OUT	GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s62158091623535?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&cm.&ssf=1&.cm&omn.&identifier=iForms&element=On%20page%201%20form%20load&lob=ser&detail=page%201%20visited&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=iForms&v5=us%3E%3EiForms%3E%3Eimpression%3E%3EOn%20page%201%20form%20load%3E%3Epage%201%20visited&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=iForms&c22=us%3E%3EiForms%3E%3Eimpression%3E%3EOn%20page%201%20form%20load%3E%3Epage%201%20visited&v27=US&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&v75=10156722043248159620305584607496081974&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1 Host: omns.americanexpress.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CMCOPTOUT-1713281625s%7CNONE%7CvVersion%7C5.0.0; s_sess=%20s_tp%3D1022%3B%20s_ppv%3Dus%25257Coneamex%25257Cser%25257CiForms%25257Copen%25257CpaKycOptions_en_US%252C89%252C89%252C907%3B%20s_cc%3Dtrue%3B; s_pers=%20s_tslv%3D1713274425317%7C1776346425317%3B%20s_tbm%3Dtrue%7C1713276225424%3B%20gpv_v41%3Dus%257Coneamex%257Cser%257CiForms%257Copen%257CpaKycOptions_en_US%7C1713276225436%3B
2024-04-16 13:33:47 UTC	757	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Tue, 16 Apr 2024 13:33:47 GMT expires: Mon, 15 Apr 2024 13:33:47 GMT last-modified: Wed, 17 Apr 2024 13:33:47 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C10156722043248159620305584607496081974; Path=/; Domain=americanexpress.com; Max-Age=34128000; Expires=Fri, 16 May 2025 13:33:33 GMT; SameSite=None; Secure etag: 3679228817085693952-4618409961666219253 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-04-16 13:33:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:33:47 UTC	3393	OUT	GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s66786050574872?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&visitorCheck=VisitorAPI%20Present&omn.&ppvpage=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&ppvtotal=89&ppvinitial=89&lob=ser&country=us&language=en&.omn&cm.&ssf=1&.cm&.c&h.&architecture=x86&bitness=64&platformVersion=10.0.0&.h&cc=USD&server=oneforms.americanexpress.com&events=event140&h1=us%7Coneamex%7Cser%7Ciforms%7Copen&c3=en&c4=US&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c19=US%7Coneamex%7Cser&c24=US%7Coneamex%7Cser%7CiForms&v27=US&c30=US%7Coneamex%7Cser%7CiForms%7Copen&c31=US&c38=US%7Coneamex%7Cser%7CiForms%7Copen&v41=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c44=D%3Dv44&v45=prospect&c46=DLS%20Navigation&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c50=authenticated&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&c75=Launch&v75=10156722043248159620305584607496081974&v94=D%3Dagent-id&v140=UCM%3A%20en-US%7C%20docEle%3A%20en-US%7C&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1 Host: omns.americanexpress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CMCOPTOUT-1713281625s%7CNONE%7CvVersion%7C5.0.0; s_sess=%20s_tp%3D1022%3B%20s_ppv%3Dus%25257Coneamex%25257Cser%25257CiForms%25257Copen%25257CpaKycOptions_en_US%252C89%252C89%252C907%3B%20s_cc%3Dtrue%3B; s_pers=%20s_tslv%3D1713274425317%7C1776346425317%3B%20s_tbm%3Dtrue%7C1713276225424%3B%20gpv_v41%3Dus%257Coneamex%257Cser%257CiForms%257Copen%257CpaKycOptions_en_US%7C1713276225436%3B
2024-04-16 13:33:47 UTC	757	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Tue, 16 Apr 2024 13:33:47 GMT expires: Mon, 15 Apr 2024 13:33:47 GMT last-modified: Wed, 17 Apr 2024 13:33:47 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C10156722043248159620305584607496081974; Path=/; Domain=americanexpress.com; Max-Age=34128000; Expires=Fri, 16 May 2025 13:33:33 GMT; SameSite=None; Secure etag: 3679228816684220416-4618434322595358830 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-04-16 13:33:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:33:48 UTC	3111	OUT	GET /b/ss/amexpressenterpriseprod/1/JS-2.23.0-LDQM/s62158091623535?AQB=1&ndh=1&pf=1&t=16%2F3%2F2024%2015%3A33%3A45%202%20-120&mid=10156722043248159620305584607496081974&ce=UTF-8&cl=34128000&pageName=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&g=https%3A%2F%2Foneforms.americanexpress.com%2FiForms%2Fopen%2FpaKycOptions_en_US%3Fpage%3D1&c.&cm.&ssf=1&.cm&omn.&identifier=iForms&element=On%20page%201%20form%20load&lob=ser&detail=page%201%20visited&.omn&.c&cc=USD&events=event141&c3=en&c4=US&v4=iForms&v5=us%3E%3EiForms%3E%3Eimpression%3E%3EOn%20page%201%20form%20load%3E%3Epage%201%20visited&c6=D%3Dv6&c10=prospect&c12=D%3Dv12&c14=D%3Dv14&c15=D%3Dv15&c16=D%3Dv16&c21=iForms&c22=us%3E%3EiForms%3E%3Eimpression%3E%3EOn%20page%201%20form%20load%3E%3Epage%201%20visited&v27=US&c44=D%3Dv44&c49=Launch-OneAmex%3Av1.4.9-AM%3A2.23.0-VISID%3A5.0.0-DIL%3ANA-SS%3AY-msuite%3Atrue-PD%3A2024-04-03&c56=oneamex&c64=D%3Dv64&c65=D%3Dv65&c67=D%3Dv67&c69=D%3Dv69&v74=us%7Coneamex%7Cser%7CiForms%7Copen%7CpaKycOptions_en_US&v75=10156722043248159620305584607496081974&pe=lnk_o&pev2=Dynamic%20Page%20Action&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=5C36123F5245AF470A490D45%40AdobeOrg&AQE=1 HTTP/1.1 Host: omns.americanexpress.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: agent-id=37788017-6d8c-40c0-b907-7d0c51c59294; _abck=CD668B8AC8490496902A17437D90DE0B~-1~YAAQUGgBF+U+8dWOAQAAIfwc5wskFUJ9IC78PnrJsuJwpjstryDKWUoiCPDRakQWEz1chgoKthBmk9WPVpZZgjVUAywhEeF5r0VKHro7V8uL1eJY++H9hoRD7QkkHdgZeSI9TESMFQkR8bdY0Fcik3jjbD2e6oIicLGFjB3UpEi1RTGwOJSHoIoXuBfmO7eVzfWnI5uhTj7vCq/DeFAIFOZ95w/rE5i25uO/DF1wksONEhc33QJtOkIA7yyVOn4RJFAqLavNiRJMEfHTlcMzXzZFpMyQVSy5feYf1ejuzsHLb5TbftUnOxZIp17YhPpZdjRrFdERF9uw5DuY/H2SDo1m/P9A9PAYgT/b/m/M3IqoQRr6HaospK2Oe88ChgUjg8uc9Ys=~-1~-1~-1; bm_sz=C650B8EA0335EA14B32869312432139B~YAAQUGgBF+Y+8dWOAQAAIfwc5xe7DcAr8t3oxIUU12i438zDrgbcv9XBGUAg9DYij95YlkOPMVIoaAZAk+WAdBw5TS2WIbDQBRmVXPPuOs1yx8/C4nLhtD9V9JXaItuOOCQzcLi4VhuvyLQu6PZTsv/FS8vAlM84f6WL2jJkXqws7sC+mcLz8HDMaxxtYop21iYTHEUtU01k5M4vOsM4Db2jRuw2HQWz/YnSB3ePwzc2776r3vRp3QpJkT+cUlxq4z/uFSz6QWATpmAR5ftfQkEc9FGUa3Y1naf2UHAD3vEoH1Zkp8qd016eTMxr327aRmYz7TFsNig+1u9FRwku4Qb68f7Yu2sLFsH0Gn/DqIWCMX2/qMGht8jDcYfg+CTElEJuuMtjsMvePiiJ~3294516~4602160; axplocale=en-US; s_ecid=MCMID%7C10156722043248159620305584607496081974; AMCVS_5C36123F5245AF470A490D45%40AdobeOrg=1; AMCV_5C36123F5245AF470A490D45%40AdobeOrg=870038026%7CMCMID%7C10156722043248159620305584607496081974%7CMCAID%7CNONE%7CMCOPTOUT-1713281625s%7CNONE%7CvVersion%7C5.0.0; s_sess=%20s_tp%3D1022%3B%20s_ppv%3Dus%25257Coneamex%25257Cser%25257CiForms%25257Copen%25257CpaKycOptions_en_US%252C89%252C89%252C907%3B%20s_cc%3Dtrue%3B; s_pers=%20s_tslv%3D1713274425317%7C1776346425317%3B%20s_tbm%3Dtrue%7C1713276225424%3B%20gpv_v41%3Dus%257Coneamex%257Cser%257CiForms%257Copen%257CpaKycOptions_en_US%7C1713276225436%3B
2024-04-16 13:33:48 UTC	757	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Tue, 16 Apr 2024 13:33:48 GMT expires: Mon, 15 Apr 2024 13:33:48 GMT last-modified: Wed, 17 Apr 2024 13:33:48 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag set-cookie: s_ecid=MCMID%7C10156722043248159620305584607496081974; Path=/; Domain=americanexpress.com; Max-Age=34128000; Expires=Fri, 16 May 2025 13:33:33 GMT; SameSite=None; Secure etag: 3679228820237778944-4618593206442839138 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-04-16 13:33:48 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.americanexpress.com/us/pakyc/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Windows Analysis Report
http://www.americanexpress.com/us/pakyc/

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:33:54 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=aRAnk+tG2VV4rGs&MD=dvu3AKno HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-16 13:33:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f7590499-adf7-48fe-aca3-88530d8049ba MS-RequestId: 8ebc49d6-15d8-4f59-888c-ee1938272b5f MS-CV: txIrPX3mfESB3+oa.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 16 Apr 2024 13:33:53 GMT Connection: close Content-Length: 24490
2024-04-16 13:33:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-16 13:33:54 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:34:06 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-16 13:34:06 UTC	436	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (dcd/7D15) X-CID: 11 Cache-Control: public, max-age=149301 Date: Tue, 16 Apr 2024 13:34:06 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:34:06 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-16 13:34:07 UTC	456	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (dcd/7D15) X-CID: 11 Cache-Control: public, max-age=149301 Date: Tue, 16 Apr 2024 13:34:06 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-16 13:34:07 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:34:23 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-16 13:34:23 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-16 13:34:23 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 16 Apr 2024 13:33:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 6d05bdb5-db10-4a7d-875f-a55c3b5f2d2e PPServer: PPV: 30 H: SN1PEPF0002F17C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 16 Apr 2024 13:34:22 GMT Connection: close Content-Length: 11390
2024-04-16 13:34:23 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:34:24 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-16 13:34:24 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-16 13:34:24 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 16 Apr 2024 13:33:24 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 22308014-3fde-4b70-8075-f38122eeea4a PPServer: PPV: 30 H: SN1PEPF0002F1B6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 16 Apr 2024 13:34:24 GMT Connection: close Content-Length: 11390
2024-04-16 13:34:24 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:34:24 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-04-16 13:34:24 UTC	438	IN	HTTP/1.1 200 OK Content-Length: 7285 Content-Type: application/json; charset=utf-8 ETag: -824013040_-1440397599 Strict-Transport-Security: max-age=2592000 X-Content-Type-Options: nosniff X-ExP-TrackingId: 85a020f2-87d6-460e-bb3b-120787a4ab43 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 016B85B5FB064FDF812C356A58DBF3DE Ref B: ATL331000102039 Ref C: 2024-04-16T13:34:24Z Date: Tue, 16 Apr 2024 13:34:24 GMT Connection: close
2024-04-16 13:34:24 UTC	1024	IN	Data Raw: 7b 22 46 65 61 74 75 72 65 73 22 3a 5b 22 68 69 67 68 71 75 61 6c 69 74 79 63 61 70 74 75 72 65 63 22 2c 22 79 6f 61 6c 77 39 38 30 31 63 66 22 2c 22 79 6f 63 33 37 32 31 22 2c 22 61 61 74 65 73 31 32 31 22 2c 22 79 6f 63 61 6c 38 33 30 22 2c 22 65 6d 70 72 6f 37 30 32 22 2c 22 79 6f 6e 6f 6e 32 34 38 22 2c 22 63 6f 6e 74 61 63 74 73 76 32 73 79 6e 63 6f 6e 6c 79 22 2c 22 79 6f 79 70 70 31 31 37 22 2c 22 79 6f 79 70 70 35 36 31 22 2c 22 79 6f 70 68 6f 31 35 36 22 2c 22 79 70 72 6f 6d 65 6c 65 73 73 22 2c 22 79 6f 72 65 6d 37 38 32 22 2c 22 79 6f 72 65 6d 33 32 35 22 2c 22 79 6f 72 6f 6d 39 33 39 22 2c 22 79 6f 79 70 70 36 33 38 22 2c 22 79 6f 61 61 6f 77 63 34 36 63 66 22 2c 22 79 6f 35 35 36 22 2c 22 79 6f 61 61 6f 32 36 37 22 2c 22 79 6f 70 72 69 32 35 Data Ascii: {"Features":["highqualitycapturec","yoalw9801cf","yoc3721","aates121","yocal830","empro702","yonon248","contactsv2synconly","yoypp117","yoypp561","yopho156","ypromeless","yorem782","yorem325","yorom939","yoypp638","yoaaowc46cf","yo556","yoaao267","yopri25
2024-04-16 13:34:24 UTC	1024	IN	Data Raw: 2c 22 31 34 67 36 22 3a 22 61 61 74 65 73 31 32 31 22 2c 22 31 38 66 7a 22 3a 22 79 6f 63 61 6c 38 33 30 22 2c 22 31 68 6a 65 22 3a 22 65 6d 70 72 6f 37 30 32 22 2c 22 31 71 61 38 22 3a 22 79 6f 6e 6f 6e 32 34 38 22 2c 22 31 77 6d 74 22 3a 22 63 6f 6e 74 61 63 74 73 76 32 73 79 6e 63 6f 6e 6c 79 22 2c 22 32 69 77 6a 22 3a 22 79 6f 79 70 70 31 31 37 22 2c 22 32 6a 36 61 22 3a 22 79 6f 79 70 70 35 36 31 22 2c 22 32 6b 71 32 22 3a 22 79 6f 70 68 6f 31 35 36 22 2c 22 32 6c 61 64 22 3a 22 79 70 72 6f 6d 65 6c 65 73 73 22 2c 22 32 6f 63 64 22 3a 22 79 6f 72 65 6d 37 38 32 22 2c 22 32 72 65 6b 22 3a 22 79 6f 72 65 6d 33 32 35 22 2c 22 32 73 63 78 22 3a 22 79 6f 72 6f 6d 39 33 39 22 2c 22 32 74 70 33 22 3a 22 79 6f 79 70 70 36 33 38 22 2c 22 33 30 62 38 22 3a 22 Data Ascii: ,"14g6":"aates121","18fz":"yocal830","1hje":"empro702","1qa8":"yonon248","1wmt":"contactsv2synconly","2iwj":"yoypp117","2j6a":"yoypp561","2kq2":"yopho156","2lad":"ypromeless","2ocd":"yorem782","2rek":"yorem325","2scx":"yorom939","2tp3":"yoypp638","30b8":"
2024-04-16 13:34:24 UTC	1024	IN	Data Raw: 32 36 34 22 2c 22 35 39 30 71 22 3a 22 34 61 33 30 64 34 35 35 22 2c 22 35 39 67 67 22 3a 22 32 69 32 68 65 31 31 38 22 2c 22 35 39 67 6a 22 3a 22 34 64 65 35 67 35 34 32 22 2c 22 35 39 76 7a 22 3a 22 62 65 63 34 34 37 35 37 22 2c 22 35 61 39 73 22 3a 22 39 38 34 65 39 37 37 34 22 2c 22 35 61 74 6b 22 3a 22 35 35 35 64 37 39 37 38 22 2c 22 35 62 61 74 22 3a 22 65 6a 66 34 36 37 39 35 22 2c 22 35 63 70 66 22 3a 22 34 39 62 34 67 31 33 33 22 2c 22 35 63 72 73 22 3a 22 33 62 66 39 67 38 35 35 22 2c 22 35 64 77 37 22 3a 22 69 34 37 62 65 31 37 38 22 2c 22 35 65 74 36 22 3a 22 32 34 38 66 61 31 38 36 22 2c 22 35 66 6c 32 22 3a 22 68 35 31 66 30 33 34 32 22 2c 22 35 66 79 6f 22 3a 22 68 64 65 31 67 32 36 37 22 2c 22 35 66 79 71 22 3a 22 34 6a 6a 66 62 37 36 38 Data Ascii: 264","590q":"4a30d455","59gg":"2i2he118","59gj":"4de5g542","59vz":"bec44757","5a9s":"984e9774","5atk":"555d7978","5bat":"ejf46795","5cpf":"49b4g133","5crs":"3bf9g855","5dw7":"i47be178","5et6":"248fa186","5fl2":"h51f0342","5fyo":"hde1g267","5fyq":"4jjfb768
2024-04-16 13:34:24 UTC	1024	IN	Data Raw: 7d 7d 2c 7b 22 49 64 22 3a 22 59 6f 75 72 50 68 6f 6e 65 22 2c 22 50 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 41 41 4f 57 43 34 36 22 3a 36 34 30 30 2c 22 41 41 4f 57 43 34 37 22 3a 37 34 30 30 2c 22 41 41 4f 57 43 36 31 22 3a 31 36 30 30 2c 22 41 41 4f 57 43 36 32 22 3a 32 36 30 30 2c 22 41 41 4f 57 43 36 33 22 3a 33 36 30 30 2c 22 41 69 72 70 6c 61 6e 65 4d 6f 64 65 53 74 61 74 75 73 22 3a 74 72 75 65 2c 22 41 75 74 6f 48 79 64 72 61 74 65 64 49 6d 61 67 65 73 43 6f 75 6e 74 22 3a 30 2c 22 43 61 6c 6c 69 6e 67 41 6c 74 42 6c 75 65 74 6f 6f 74 68 50 61 69 72 69 6e 67 45 76 65 6e 74 22 3a 74 72 75 65 2c 22 43 61 6c 6c 69 6e 67 45 78 69 74 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 43 61 6c 6c 69 6e 67 4f 53 53 65 72 76 69 63 69 6e 67 46 69 Data Ascii: }},{"Id":"YourPhone","Parameters":{"AAOWC46":6400,"AAOWC47":7400,"AAOWC61":1600,"AAOWC62":2600,"AAOWC63":3600,"AirplaneModeStatus":true,"AutoHydratedImagesCount":0,"CallingAltBluetoothPairingEvent":true,"CallingExitConfirmation":true,"CallingOSServicingFi
2024-04-16 13:34:24 UTC	1024	IN	Data Raw: 3a 74 72 75 65 2c 22 49 73 41 75 74 68 56 32 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 4d 65 64 69 61 50 61 63 6b 43 68 65 63 6b 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 68 61 74 46 69 6c 74 65 72 54 6f 67 67 6c 65 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 6f 6e 73 65 6e 74 56 32 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 6f 6e 76 65 72 73 61 74 69 6f 6e 56 69 65 77 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 48 69 64 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 4d 75 74 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 50 69 6e 6e 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 53 65 61 72 63 68 22 3a 74 72 75 65 2c 22 Data Ascii: :true,"IsAuthV2Enabled":true,"MediaPackCheck":true,"MessagingChatFilterToggle":true,"MessagingConsentV2":true,"MessagingConversationView":true,"MessagingEnableHiding":true,"MessagingEnableMuting":true,"MessagingEnablePinning":true,"MessagingSearch":true,"
2024-04-16 13:34:24 UTC	1024	IN	Data Raw: 69 6e 67 54 6f 70 30 31 31 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 32 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 35 22 3a 74 72 75 65 2c 22 52 6f 6d 65 44 69 73 61 62 6c 65 64 22 3a 34 34 31 35 30 33 2c 22 53 65 63 75 72 65 43 6f 6e 74 65 6e 74 22 3a 74 72 75 65 2c 22 53 68 65 6c 6c 45 78 74 65 6e 64 65 64 4c 65 66 74 50 61 6e 65 22 3a 74 72 75 65 2c 22 54 65 73 74 46 65 61 74 75 72 65 32 22 3a 66 61 6c 73 65 2c 22 55 6e 69 76 65 72 73 61 6c 42 6c 75 65 74 6f 6f 74 68 50 61 69 72 69 6e 67 22 3a 74 72 75 65 2c 22 57 68 61 74 73 4e 65 77 43 4e 22 3a 74 72 75 65 2c 22 59 50 50 43 61 74 61 73 74 72 6f 70 68 69 63 45 72 72 6f 72 41 75 74 6f 52 65 73 65 74 22 3a 74 72 75 65 2c 22 59 50 50 43 6f 6e 73 65 63 75 74 69 76 Data Ascii: ingTop011":true,"RemotingTop012":true,"RemotingTop015":true,"RomeDisabled":441503,"SecureContent":true,"ShellExtendedLeftPane":true,"TestFeature2":false,"UniversalBluetoothPairing":true,"WhatsNewCN":true,"YPPCatastrophicErrorAutoReset":true,"YPPConsecutiv
2024-04-16 13:34:24 UTC	1024	IN	Data Raw: 79 6f 35 35 36 3a 33 30 39 38 36 35 35 36 3b 79 6f 61 61 6f 32 36 37 3a 33 30 34 33 34 36 37 32 3b 79 6f 70 72 69 32 35 37 3a 33 30 34 36 34 34 33 33 3b 79 6f 31 37 39 3a 33 30 34 34 35 33 31 30 3b 79 6f 69 73 61 38 36 31 3a 33 30 35 32 35 38 36 38 3b 79 6f 72 65 6d 31 34 31 3a 33 30 34 38 36 33 35 33 3b 79 6f 79 70 70 36 35 32 3a 33 30 35 31 35 34 38 33 3b 79 6f 35 32 35 3a 33 30 35 35 33 39 38 35 3b 79 6f 36 30 36 3a 33 30 35 32 37 38 35 30 3b 79 6f 6e 6f 74 36 33 33 3a 33 30 36 32 36 30 37 38 3b 79 6f 79 70 70 38 35 39 3a 33 30 36 38 37 38 35 39 3b 79 6f 69 6e 64 36 36 35 3a 33 30 35 39 35 31 36 33 3b 79 6f 64 63 67 38 33 30 3a 33 30 37 31 32 39 34 39 3b 6f 6e 6c 79 5f 74 6f 61 73 74 63 6f 6e 74 65 78 74 6d 65 6e 75 3a 33 30 36 34 38 30 38 31 3b 61 6a Data Ascii: yo556:30986556;yoaao267:30434672;yopri257:30464433;yo179:30445310;yoisa861:30525868;yorem141:30486353;yoypp652:30515483;yo525:30553985;yo606:30527850;yonot633:30626078;yoypp859:30687859;yoind665:30595163;yodcg830:30712949;only_toastcontextmenu:30648081;aj
2024-04-16 13:34:24 UTC	117	IN	Data Raw: 38 33 38 35 30 33 3b 35 30 63 37 39 31 30 36 3a 33 30 38 33 38 36 31 39 3b 6a 61 35 63 34 32 34 39 3a 33 31 30 30 36 32 34 34 3b 68 33 65 64 34 31 36 31 3a 33 30 38 39 31 37 38 34 3b 61 62 69 30 67 38 31 37 3a 33 30 39 35 32 38 37 35 3b 61 35 34 66 61 35 37 34 3a 33 30 39 39 33 33 34 39 3b 64 69 66 32 32 32 31 39 3a 33 30 39 36 30 34 30 32 3b 22 7d Data Ascii: 838503;50c79106:30838619;ja5c4249:31006244;h3ed4161:30891784;abi0g817:30952875;a54fa574:30993349;dif22219:30960402;"}

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:34:25 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-16 13:34:25 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-16 13:34:25 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 16 Apr 2024 13:33:25 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: ccd82dfb-496d-48f5-93ee-4b19d3b3b4ce PPServer: PPV: 30 H: SN1PEPF0002F05F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 16 Apr 2024 13:34:24 GMT Connection: close Content-Length: 11370
2024-04-16 13:34:25 UTC	11370	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:34:26 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4788 Host: login.live.com
2024-04-16 13:34:26 UTC	4788	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-16 13:34:26 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 16 Apr 2024 13:33:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 31e4d855-4a44-4269-b3f0-2a6eeaed12e6 PPServer: PPV: 30 H: SN1PEPF0002F1AA V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 16 Apr 2024 13:34:25 GMT Connection: close Content-Length: 11153
2024-04-16 13:34:26 UTC	11153	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:34:26 UTC	2562	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: 120 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAZ018joKFt9ONlJduRp0qgN4q0hEVgbtyzwhNOAQGHdiJ/WvF5CgahoZEynXJhIj56iTukhgVUPTic3eRyYR66fmSTdDW3LZw/IwxowvJNO42yNYmggOVq0grbDpD4QdDBVM9tWomORZ6Yhc//Dhybj55G1bMVl6gWid3LX185%2BHPvRzCdiW7tPCZaapPO7gKeTL3oDg104em5KKXTB%2BceyTUab5TPh2hCfSfz3ROVCrQakad6ZQ37pn7Jq55%2B49mfT4CA7pYaH/XGU53tm06AVeElWzPkyU/J4Yr1r8h47zRUwOcxGjC0T6BxpX7IwaaJwfyVT2Tevj23PMjumVtDYDZgAACJApzEW9bdlTqAHCfce4H//0LkQQF0iYmZWxtt1dWvSzGNKs6NAaiIu4m%2BImJYSHXcOmZtDwUL0%2BUymlprTmxloTHEuQDijkcU5PqlrdEYhHSlVnLrvUTCnDR1vmk543DEPCdFtnaUl609OaNAQkb/e7nPcl%2B67G5Dc29nT/V8B5U9lchFW7xWqPHkQuCZA50rluvxrcN4wb18tGScFXkYUxmkRTxh93rRO8rLxlvdYWNZq5kqFskFA1QjSBfNkY3jOMCqKAaeYCUVvq2O2DG8Vic09hMubc3IxZABXSl1PjuWzKnxEYxtVO8td1XElRuZE3fMhWvRHVZ1MY3aEAtAlxR/5N3EK7zTjPwWNXdFtFPokX/X%2BIfUv4QiqoLEgN1b71FA0Gp50%2BF1wsch2c1SV4l/9L%2BGgkJjGLe5ANJP9Ov1A5bIwE7mZo0/wK3xjUQicZVES9SX1weCg1fPypsz%2ByLcBGVnr32oxtbCUtGaDIx6GQ4i1VArCR24r76ss4R%2BHjWm2FgtfEERi/x8MHiXiD9JZNn7Fg1z79isM6w2qo6CKvtYyMrM1lO7HMfUI0IcyK2AE%3D%26p%3D X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1713274460 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: F16DF180308E4A4591A546EFF0544AB2 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-04-16 13:34:27 UTC	1463	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2215 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: _EDGE_S=SID=1FE498DDD33D65991C988CBED22A640C&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: MUIDB=4590362BB5CF472B95BBEDB3112D4B7B; expires=Sun, 11-May-2025 13:34:27 GMT; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Sun, 11-May-2025 13:34:27 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=1FE498DDD33D65991C988CBED22A640C; domain=.bing.com; path=/; secure; SameSite=None X-EventID: 661e7e63b486437082db78a28e97dce6 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 973EF47EDB914331B9595114ABB6DB4F Ref B: ATL331000104029 Ref C: 2024-04-16T13:34:27Z Date: Tue, 16 Apr 2024 13:34:26 GMT Connection: close
2024-04-16 13:34:27 UTC	790	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value
2024-04-16 13:34:27 UTC	1425	IN	Data Raw: 6c 61 74 65 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 52 65 6d 69 6e 64 65 72 43 61 6c 65 6e 64 61 72 55 70 64 61 74 65 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 55 73 65 43 6c 6f 75 64 52 75 6c 65 46 6f 72 4c 6f 63 61 74 69 6f 6e 73 57 69 74 68 45 6e 74 69 74 79 49 64 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 43 6f 72 74 61 6e 61 48 6f 6d 65 55 73 65 72 41 63 74 69 76 69 74 79 45 6e 61 62 6c 65 64 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 58 44 65 76 69 63 65 4e 6f 74 69 66 69 63 61 74 69 6f 6e 41 63 74 69 6f 6e 73 45 6e 61 62 6c 65 64 22 3a 7b 22 Data Ascii: late":{"value":false,"feature":""},"ReminderCalendarUpdate":{"value":true,"feature":""},"UseCloudRuleForLocationsWithEntityId":{"value":false,"feature":""},"CortanaHomeUserActivityEnabled":{"value":true,"feature":""},"XDeviceNotificationActionsEnabled":{"

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:34:31 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=aRAnk+tG2VV4rGs&MD=dvu3AKno HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-16 13:34:32 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 7c7fb103-50d8-48cb-8e99-c72e0097c8b1 MS-RequestId: e2f27f43-833a-4659-97aa-63dd43f2e8d9 MS-CV: 2va6aScLNEyPeg9d.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 16 Apr 2024 13:34:31 GMT Connection: close Content-Length: 25457
2024-04-16 13:34:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-16 13:34:32 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq